Commit Graph

61 Commits

Author SHA1 Message Date
Rob Crittenden
0c28978a8d Ensure that dnaMaxValue is higher than dnaNextValue at install time
Resolves 522179
2009-09-09 22:05:24 -04:00
Martin Nagy
b519b87ea4 Add forgotten chunks from commit 4e5a68397a
I accidentally pushed the older patch that didn't contain bits for
ipa-replica-install.
2009-09-08 22:48:34 +02:00
Jason Gerard DeRose
391b1f2b88 Fixed dns_forwarders not being defined when options.setup_dns is False 2009-09-08 13:09:05 +02:00
Martin Nagy
205a41205b Add A and PTR records of ourselves during installation
If the DNS zones already exist but don't contain our own records, add
them. This patch introduces the ipalib.api into the installers. For now,
the code is still little messy. Later patches will abandon the way we
create zones now and use ipalib.api exclusively.
2009-09-02 22:04:25 +02:00
Martin Nagy
b07d1b54f9 Remove old --setup-bind option
Since we are changing the behaviour of the --setup-dns option
substantially, we might as well remove the old --setup-bind option.
2009-09-02 22:04:25 +02:00
Martin Nagy
fbda06269d Setup bind only after restarting kdc and dirsrv
BIND starting before we apply LDAP updates and restart kdc and directory
server causes trouble. We resolve this for now by postponing BIND setup
to the end of installation. Another reason is that we will be using
xml-rpc during the setup in the future.
2009-09-02 22:04:25 +02:00
Martin Nagy
4e5a68397a Use DNS forwarders in /etc/named.conf
This patch adds options --forwarder and --no-forwarders. At least one of
them must be used if you are doing a setup with DNS server. They are
also mutually exclusive. The --forwarder option can be used more than
once to specify more servers. If the installer runs in interactive mode,
it will prompt the user if none of these option was given at the command
line.
2009-09-02 19:09:28 +02:00
Rob Crittenden
aafdb755a3 Install the ldapi ldif file 2009-08-28 08:46:54 -04:00
Rob Crittenden
559c76f761 Add option to the installer for uid/gid starting numbers.
This also adds a new option to the template system. If you include
eval(string) in a file that goes through the templater then the
string in the eval will be evaluated by the Python interpreter. This is
used so one can do $UIDSTART+1. If any errors occur during the evaluation
the original string is is returned, eval() and all so it is up to the
developer to make sure the evaluation passes.

The default value for uid and gid is now a random value between
1,000,000 and (2^31 - 1,000,000)
2009-08-27 14:15:26 -04:00
Rob Crittenden
cab5525076 Enable ldapi connections in the management framework.
If you don't want to use ldapi then you can remove the ldap_uri setting
in /etc/ipa/default.conf. The default for the framework is to use
ldap://localhost:389/
2009-08-27 13:36:58 -04:00
Rob Crittenden
08fc563212 Generate CRLs and make them available from the IPA web server 2009-08-26 09:51:19 -04:00
Rob Crittenden
c781e8a57d Add a new objectclass, ipaObject, that will add a UUID to many IPA objects
ipaObject is defined as an auxiliary objectclass so it is up to the
plugin author to ensure that the objectclass is included an a UUID generated.
ipaUniqueId is a MUST attribute so if you include the objectclass you must
ensure that the uuid is generated.

This also fixes up some unrelated unit test failures.
2009-08-10 16:38:42 -06:00
Rob Crittenden
dbeb409ebd Include schema for key escrow management
https://fedoraproject.org/wiki/Disk_encryption_key_escrow_in_IPA
2009-08-10 16:38:18 -06:00
Martin Nagy
de53d0a26e Make --setup-dns work on replica installation
The ipa-replica-install script will setup the DNS if user specifies the
--setup-dns option. It will only add the zone into LDAP if the
cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add
the records.
2009-07-22 18:02:22 +02:00
Martin Nagy
a09d2c3498 Add a reverse zone with server's PTR record
Also, small cosmetic change in dns.ldif.
2009-07-22 18:02:22 +02:00
Martin Nagy
296ffe6c61 Add --setup-dns option. It will replace --setup-bind 2009-07-22 18:02:22 +02:00
Rob Crittenden
8d164569d0 Allow replicas of an IPA server using an internal dogtag server as the CA
This involves creating a new CA instance on the replica and using pkisilent
to create a clone of the master CA.

Also generally fixes IPA to work with the latest dogtag SVN tip. A lot of
changes to ports and configuration have been done recently.
2009-07-15 09:00:01 -04:00
Martin Nagy
017f236d6a Use uppercase boolean values in dns.ldif
The newest 389 server implements syntax checking and causes problems if
the boolean attribute is set to "True". The correct value should be
"TRUE".
2009-07-15 07:34:28 +02:00
Rob Crittenden
c21e003cdf Let anonymous users browse the VLV index
This is needed for automount support on Solaris

http://docs.sun.com/app/docs/doc/819-5201/6n7a588i7?l=en&a=view
2009-07-10 16:45:45 -04:00
Rob Crittenden
e31d5fb1cf Implement support for non-LDAP-based actions that use the LDAP ACI subsystem.
There are some operations, like those for the certificate system, that
don't need to write to the directory server. So instead we have an entry
that we test against to determine whether the operation is allowed or not.

This is done by attempting a write on the entry. If it would succeed then
permission is granted. If not then denied. The write we attempt is actually
invalid so the write itself will fail but the attempt will fail first if
access is not permitted, so we can distinguish between the two without
polluting the entry.
2009-07-10 16:41:05 -04:00
Martin Nagy
5149803873 Configure BIND LDAP driver to use SASL authentication
We use /etc/named.keytab generated by ipa-server-install to authenticate
against the LDAP server. Also tidy up /etc/named.conf since we're there.
2009-07-10 09:55:29 -04:00
Simo Sorce
9fe707a3f2 Basic changes to get a default principal for DNS
Also moves delagation layout installation in dsinstance.
This is needed to allow us to set default membership in
other modules like bindinstance.

Signed-off-by: Martin Nagy <mnagy@redhat.com>
2009-07-10 09:42:22 -04:00
Pavel Zuna
94181d54fe Make object classes of automatically created entries lowercase.
This makes them more consistent with entries created by plugins.
It's a cosmetic thing, not that useful.
2009-07-10 08:58:44 -04:00
Martin Nagy
8345e8e1f1 Use root.$HOST.$DOMAIN. instead of root.$DOMAIN. 2009-06-02 12:32:06 +02:00
Martin Nagy
1bc786e379 Use LDAP instead of flat file for zone storage 2009-06-02 12:32:01 +02:00
Martin Nagy
1893a802c7 Change DNS LDAP attributes
Removes two unneeded attributes and adds one attribute for specifying
DNS update policy. Additionally, use different namespace for them: 5.x
for attribute types and 6.x for object classes.
2009-06-02 12:30:59 +02:00
Rob Crittenden
e396cc26bf Add memberOf as a MAY to ipaHost
499731
2009-05-26 14:26:49 -04:00
Rob Crittenden
7da22cf8c7 Enable the portmap or rpcbind service if the NIS service is enabled 2009-05-21 14:51:04 -06:00
Rob Crittenden
86472a94ee Fix quoting to work with new csv handler in ldapupdate 2009-05-19 11:50:39 -06:00
Rob Crittenden
e5bec4ae39 Schema change so the nisnetgroup triples work properly.
If we use cn for hostname there is no easy way to distinguish between
a host and a hostgroup. So adding a fqdn attribute to be used to store
the hostname instead.
2009-05-19 09:54:17 -04:00
Rob Crittenden
2d0624cff5 Add schema-compat translation from our netgroup schema to nisNetgroup triples 2009-05-19 09:53:40 -04:00
Rob Crittenden
4376ad0b10 Add taskgroup and ACI for writing host principal keys (so ipa-getkeytab works) 2009-05-19 09:52:21 -04:00
Rob Crittenden
de88954b91 New tool to enable/disable DS plugin to act as NIS server 2009-05-13 14:09:56 -04:00
Rob Crittenden
064240def3 Fix replica installation for self-signed CA (no dogtag) 2009-05-04 17:42:03 -04:00
Rob Crittenden
dfe9db5548 Add signing profile to CA installation so we can sign the firefox jar file.
Use the requestId we get back from the CA when requesting the RA agent cert
and use that to issue the certificate rather than hardcoding 7.

This also adds some clean-up of file permissions and leaking fds
2009-05-04 16:54:42 -04:00
Rob Crittenden
bbbac4b24f Fix bind zone installer 2009-04-27 15:44:26 -04:00
Pavel Zuna
7d0bd4b895 Rename errors2.py to errors.py. Modify all affected files. 2009-04-23 10:29:14 -04:00
Rob Crittenden
9182c10b03 Issue DS and Apache server certs during CA installation.
Notes:
- will create a CA instance (pki-ca) if it doesn't exist
- maintains support for a self-signed CA
- A signing cert is still not created so Firefox autoconfig still won't work
2009-04-20 14:01:00 -04:00
Rob Crittenden
64fa3dd4c3 Finish work replacing the errors module with errors2
Once this is committed we can start the process of renaming errors2 as errors.
I thought that combinig this into one commit would be more difficult to
review.
2009-04-20 13:58:26 -04:00
Rob Crittenden
484eff1016 Implement an installer for the Dogtag certificate system.
The CA is currently not automatically installed. You have to pass in the
--ca flag to install it.

What works:
- installation
- unistallation
- cert/ra plugins can issue and retrieve server certs

What doesn't work:
- self-signed CA is still created and issues Apache and DS certs
- dogtag and python-nss not in rpm requires
- requires that CS be in the "pre" install state from pkicreate
2009-04-03 14:06:09 -04:00
Rob Crittenden
0c63ed3f5e Fill in the ACIs and taskgroups for most of the plugins.
This adds:
group administration
host administration
host group administration
delegation administration
service administration
automount administration
netgroup administration
2009-04-01 10:33:43 -04:00
Rob Crittenden
c00281a9f9 Name update files so they can be easily sorted.
We want to process some updates in a particular order (schema, structural).
Using an init-inspired ordering mechanism.
2009-03-25 11:03:07 -04:00
Rob Crittenden
1445a36026 Modify the taskgroup plugin to use the new group baseclass and add tests 2009-03-20 09:28:12 -04:00
Rob Crittenden
a55c5d6bcd New plugin to handle role groups
Role groups will be part of the ACI system. It will let one create broad
categories of permissions. Things like: helpdesk, user admin, group admin,
whatever.
2009-03-20 09:28:09 -04:00
Rob Crittenden
2f17ebebba Fix build breakage and install rolegroup.update 2009-03-20 08:49:33 -04:00
Rob Crittenden
6fa330662a Add taskgroups plugin
Taskgroups are what we grant permission to with the new ACI system.
2009-03-17 14:52:17 -04:00
Rob Crittenden
588c90d8e6 Fix broken build. dna-conf.ldif was removed. 2009-03-09 08:11:02 -04:00
Rob Crittenden
d9c4ba5a30 Remove our copy of the DNA plugin and use the one that comes with DS.
The DS plugin does config checking when adding new entries online so
we are dropping the Posix subtree.
2009-03-06 17:37:37 -05:00
Rob Crittenden
be0cac932a Update objectclasses for groups, by default not posix groups.
This change depends on DS bugs 487574 and 487725. Groups cannot be
promoted properly without these fixed. It will fail with an
Object Class violation because gidNumber isn't set.
2009-02-27 23:18:19 -05:00
Rob Crittenden
3fdf9abfce Enforce netgroup uniqueness, allow netgroups to be members of netgroups
When adding an entry, convert a constraint violation of "already exists"
into a DuplicateEntry exception so the user gets a useful response
2009-02-27 12:57:21 -05:00