Commit Graph

10954 Commits

Author SHA1 Message Date
Jan Cholasta
0c7ca279c7 config: re-add init_config and config
Re-add `init_config` and `config` to `ipapython.config`, because they are
used by Ipsilon (see https://pagure.io/ipsilon/issue/265).

This partially reverts commit 7b966e8577.

https://pagure.io/freeipa/issue/6707

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-08 16:08:30 +01:00
Christian Heimes
177f07e163 Chain CSR generator file loaders
First try custom location, then csrgen subdir in confdir and finally
fall back to package data.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Ben Lipton <blipton@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-08 15:59:26 +01:00
Christian Heimes
80be181629 Move csrgen templates into ipaclient package
csrgen broke packaging of ipaclient for PyPI. All csrgen related
resources are now package data of ipaclient package. Package data is
accessed with Jinja's PackageLoader() or through pkg_resources.

https://pagure.io/freeipa/issue/6714

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Ben Lipton <blipton@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-08 15:59:26 +01:00
Martin Babinsky
f8d7e37a09 Allow login to WebUI using Kerberos aliases/enterprise principals
The logic of the extraction/validation of principal from the request and
subsequent authentication was simplified and most of the guesswork will
be done by KDC during kinit. This also allows principals from trusted
domains to login via rpcserver.

https://fedorahosted.org/freeipa/ticket/6343

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-08 15:56:11 +01:00
Jan Cholasta
1e912f5b83 dns: fix dnsrecord_add interactive mode
`dnsrecord_add` interactive mode might prompt for value of non-existent
arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This
happens because `dnsrecord_add` extra flags are incorrectly defined as
parts of the respective DNS records.

Remove extra flags from DNS record parts to fix the interactive mode on old
clients talking to new servers. Skip non-existent arguments in the
interactive mode to fix new clients talking to old servers.

https://fedorahosted.org/freeipa/ticket/6457

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-08 15:52:41 +01:00
Martin Basti
25fa2bb6c9 tests: use --setup-kra in tests
This will allow to test --setup-kra option together with
ipa-server-install in install tests

Separate installation using ipa-kra-install is already covered.

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-08 15:50:30 +01:00
Martin Basti
4006cbbc02 KRA: add --setup-kra to ipa-server-install
This patch allows to install KRA on first IPA server in one step using
ipa-server-install

This option improves containers installation where ipa-server can be
installed with KRA using one call without need to call docker exec.

Please note the the original `kra.install()` calls in
ipaserver/install/server/install.py were empty operations as it did
nothing, so it is safe to move them out from CA block

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-08 15:50:30 +01:00
Pavel Vomacka
ad3451067a WebUI: don't change casing of Auth Indicators values
All values were previously converted to lowercase which was not
coresponding with CLI behaviour. Now they stay as they are
inserted. I also have to change the strings to lowercase because
the otp and radius should be inserted as lowercase words.

https://fedorahosted.org/freeipa/ticket/6308

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 15:43:11 +01:00
Pavel Vomacka
0220fc8986 WebUI: Allow disabling lowering text in custom_checkbox_widget
Add new attribute which keeps information whether each text added
using custom_checkbox_widget shoud be transformed to lowercase.

Part of: https://fedorahosted.org/freeipa/ticket/6308

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 15:43:11 +01:00
Petr Vobornik
56a2642af0 webui: fixes normalization of value in attributes widget
Fix is in checkboxes widget but the only affected one is attributes widget.

Reproduction:
 1. Add permission with attribute with uppercase character
   $ ipa permission-add aa_test --type=stageuser --attrs=businessCategory --right=read
 2. Check if it is correctly displayed in Web UI

Actual result:
 - businesscategory is not checked
Expected result:
 - businesscategory is checked

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-08 15:41:16 +01:00
Florence Blanc-Renaud
ea34e17a46 IdM Server: list all Employees with matching Smart Card
Implement a new IPA command allowing to retrieve the list of users matching
the provided certificate.
The command is using SSSD Dbus interface, thus including users from IPA
domain and from trusted domains. This requires sssd-dbus package to be
installed on IPA server.

https://fedorahosted.org/freeipa/ticket/6646

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-08 15:08:41 +01:00
Pavel Vomacka
e1dfc51e48 Add support for custom table pagination size
New customization button opens dialog with field for setting the number of lines
in tables. After saving the new value there is new topic which starts refreshing
current table facet (if shown) and set all other facets expired. Therefore all
tables are immediately regenerated.

https://fedorahosted.org/freeipa/ticket/5742

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 14:54:56 +01:00
Pavel Vomacka
f78cc89326 Make singleton from config module
Also added general setter and getter for attributes of config.

Part of: https://fedorahosted.org/freeipa/ticket/5742

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 14:54:56 +01:00
Pavel Vomacka
7b699105a5 Add javascript integer validator
Javascript integer validator checks whether value entered into field is number
and is not higher than Number.MAX_SAFE_INTEGER constant.

Part of: https://fedorahosted.org/freeipa/ticket/5742

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 14:54:56 +01:00
Martin Basti
6c95f33d37 man: add missing --setup-adtrust option to manpage
ipa-server-install and ipa-replica-install manpages miss --setup-adtrust
options

https://pagure.io/freeipa/issue/6630

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-03-08 12:57:53 +01:00
Pavel Vomacka
19426f32ff
WebUI: Add certmap module
Add facets for certmaprule and certmapconfigure entities.

https://fedorahosted.org/freeipa/ticket/6601

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 10:14:21 +01:00
Pavel Vomacka
d3700275c1
WebUI: Add Custom command multivalued adder dialog
Adder dialog which is used along with custom_command_multivalued_widget.
It behaivor of confirm dialog and adds fields which are necessary.

Part of: https://fedorahosted.org/freeipa/ticket/6601

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 10:14:21 +01:00
Pavel Vomacka
fba318b833
WebUI: Create non editable row widget for mutlivalued widget
Old krb-principal widget is changed to general one. And used also for
ipacertmapdata in user.

This widget make every line non-editable.

Part of: https://fedorahosted.org/freeipa/ticket/6601

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 10:14:21 +01:00
Pavel Vomacka
27027bbc9c
WebUI: Add possibility to set field always writable
If field will have set attribute 'always_writable' to true, then
'no_update' flag will be ingored. Used in command user-{add,remove}-certmap
which needs to be writable in WebUI and also needs to be omitted from
user-mod command.

Part of: https://fedorahosted.org/freeipa/ticket/6601

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-08 10:14:21 +01:00
Simo Sorce
adf8aabf10
Use GSS-SPNEGO if connecting locally
GSS-SPNEGO allows us to negotiate a SASL bind with less roundtrips
therefore use it when possible.

We only enable it for local connections for now because we only
recently fixed Cyrus SASL to do proper GSS-SPNEGO negotiation. This
change means a newer and an older version are not compatible.

Restricting ourselves to the local host prevents issues with
incompatible services, and it is ok for us as we are only really
looking for speedups for the local short-lived connections performed
by the framework. Most other clients have longer lived connections,
so peformance improvements there are not as important.

Ticket: https://pagure.io/freeipa/issue/6656

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-07 20:09:57 +01:00
Florence Blanc-Renaud
f447489707
ipa systemd unit should define Wants=network instead of Requires=network
The file ipa.service defines
    Requires=network.target
which means that ipa stack will be restarted each time the network stack
is restarted. This is not needed, and Wants=network.target will be sufficient.

https://fedorahosted.org/freeipa/ticket/6723

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-07 20:06:35 +01:00
Pavel Vomacka
070bc48dd6
WebUI: Change structure of Identity submenu
Previously there were 'User Groups', 'Host Groups' and 'Netgroups'
separately, now these three items are grouped into one named 'Groups'
which has sidebar with three items mentioned above.

This change allows us to move ID views into Identity submenu.

https://pagure.io/freeipa/issue/6717

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-03-07 20:04:01 +01:00
Pavel Vomacka
aa8530b7af
WebUI: add sizelimit:0 to cert-find
It was not possible to get all arbitrary certificates which were added
using {user|host|service|idview}-add-cert method. Adding sizelimit:0
to this cert-find command fix the issue. It set sizelimit to unlimited.

https://pagure.io/freeipa/issue/6712

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-03-07 19:58:00 +01:00
Tomas Krizek
a06c71b126
Add SHA256 fingerprints for certs
https://fedorahosted.org/freeipa/ticket/6701

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-07 19:52:43 +01:00
Fraser Tweedale
3ba0375c83
rabase.get_certificate: make serial number arg mandatory
In rabase.get_certificate it does not make sense for the
serial_number argument to be optional.  Make it a mandatory
positional argument.

Part of: https://pagure.io/freeipa/issue/3473
Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-07 13:24:16 +01:00
Michal Reznik
83e2c2b65e test_csrgen: adjusted comparison test scripts for CSRGenerator
Commit ada91c2 introduced changes in "csrgen/templates/openssl_base.tmpl"
which broke the following 2 tests:

    test_CSRGenerator.test_userCert_OpenSSL
    test_CSRGenerator.test_caIPAserviceCert_OpenSSL

The tests use files caIPAserviceCert_openssl.sh and userCert_openssl.sh
as expected scripts in order to compare scripts generated by CSRGenerator.
E.g. as other parameter was introduced we are now not checking with
"if [[ $# -ne 2 ]]" but rather with if "[[ $# -lt 2 ]]".

https://pagure.io/freeipa/issue/6724

Reviewed-By: Milan Kubik <mkubik@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-07 13:18:14 +01:00
Stanislav Laznicka
30d7c210a4 We don't offer no quickies
It's not our main priority as developers to offer any forms of quickies
nor guides on how to perform them.

Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-06 13:13:10 +01:00
Stanislav Laznicka
24eeb4d6a3 Fix cookie with Max-Age processing
When cookie has Max-Age set it tries to get expiration by adding
to a timestamp. Without this patch the timestamp would be set to
None and thus the addition of timestamp + max_age fails

https://pagure.io/freeipa/issue/6718

Reviewed-By: Simo Sorce <ssorce@redhat.com>
2017-03-06 10:48:32 +00:00
Christian Heimes
d1c5d92897
Use https to get security domain from Dogtag
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-03 13:33:51 +01:00
Fraser Tweedale
11c9df2577
Extract method to map principal to princpal type
Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-03 12:09:57 +01:00
Fraser Tweedale
2066a80be2
Remove redundant principal_type argument
Minor refactor to remove the redundant 'principal_type' argument
from 'caacl_check' and associated functions.

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-03 12:09:57 +01:00
Tomas Krizek
223a48b6d9
man: update ipa-cacert-manage
Make it clear this command is used to only renew certificate for
the CA and provide guidance on how to renew other certificates.

https://pagure.io/freeipa/issue/6648

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-02 17:02:25 +01:00
Petr Vobornik
5e0ca17ca0
Change README to use Markdown
So that it will be nicely formatted on FreeIPA Pagure landing page.
  https://pagure.io/freeipa

Some links were updated as other projects also moved to Pagure.io.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-02 16:55:57 +01:00
Florence Blanc-Renaud
9e24918c89 Support for Certificate Identity Mapping
See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-02 15:09:42 +01:00
Christian Heimes
22d7492c94 Cleanup certdb
* use with statement to open/close files
* prefer fchmod/fchown when a file descriptor is available
* set permission before data is written to file

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-02 14:45:00 +01:00
Christian Heimes
bc1f60b3ba Default to pkginstall=true without duplicated definitions
automake was complaining about duplicated definitions of pkginstall. It
was defined to true in Makefile.python.am only to be overriden in some
Makefile.am.

Now we assume that pkginstall is implicit true and only skip
installation when pkginstall is explicitly set to false.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
60cfacc541 pylint: ignore pypi placeholders
pylint gets confused by duplicated package names, e.g. ipaplatform and
pypi/ipaplatform.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
ab9f42d6ee Python build: use --build-base everywhere
Some calls to setup.py specified a build base, some did not. This can
lead to issues, e.g. build, clean and install are using different build
directories.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
b4c1bf1c7d Add with_wheels global to install wheel and PyPI packaging dependencies
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
acdd1f5978 Add placeholders for ipaplatform, ipaserver and ipatests
I also renamed the base directory to pypi and added a new build target
pypi_packages.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
e2b9ea2fd5 Add python-wheel as build requirement
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
2e784336b0 Packaging: Add placeholder packages
The ipa and freeipa packages are placeholders to prevent PyPI squashing
attacks and reserve the names for future use. `pip install ipa` installs
ipaclient.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
ed7a03a1af Vault: port key wrapping to python-cryptography
https://fedorahosted.org/freeipa/ticket/6650

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-02 14:22:11 +01:00
Jan Cholasta
ba3c201a03 server install: do not attempt to issue PKINIT cert in CA-less
Require the user to provide the PKINIT cert with --pkinit-cert-file or
disable PKINIT with --no-pkinit in CA-less ipa-server-install,
ipa-replica-prepare and ipa-replica-install.

Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade.

https://pagure.io/freeipa/issue/5678

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-03-02 09:10:22 +00:00
Stanislav Laznicka
a7c8077ce8 Fix CA-less upgrade
In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it
does not make sense to try to create a password file for an NSS
database from it (the NSS database does not exist either).

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-01 15:38:43 +00:00
Christian Heimes
88fd936a76 Remove NSPRError exception from platform tasks
ipalib.x509 no longer raises NSPRError. PyCA cryptography raises
ValueError for invalid certs.

https://fedorahosted.org/freeipa/ticket/5695

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-01 15:58:59 +01:00
Martin Babinsky
612ea7f66e Provide basic integration tests for built-in AD trust installer
A couple of tests were added to server/replica install integration
suite to test AD trust install w/ various combinations of other optional
components.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-01 15:55:45 +01:00
Martin Babinsky
23cebe1356 Update server/replica installer man pages
Since AD trust installer is now a part of composite installers, their
man pages were updated with separate section documenting relevant AD
trust-related option descriptions.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-01 15:55:45 +01:00
Martin Babinsky
f62f0b7485 Fix erroneous short name options in ipa-adtrust-install man page
`--rid-base` and `--secondary-rid-base` had `-U` option assigned
by error in the man page. Remove it as these options have not short
alias.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-01 15:55:45 +01:00
Martin Babinsky
eee319dba1 Merge AD trust configurator into replica installer
`ipa-replica-install` is now able to configure Samba and winbind
services in order to manage Active Directory trusts. `--add-agents`
option is exposed in replica installer, while `--add-sids` now defaults
to `False` since adding a first AD trust controller to an existing
sizeable deployment can result in stuck installation as sidgen tasks can
take a long time to complete. That's why adding SIDs should be a
conscious decision in this case.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-01 15:55:45 +01:00