Commit Graph

632 Commits

Author SHA1 Message Date
Christian Heimes
a48f6511f6 Use namespace-aware meta importer for ipaplatform
Instead of symlinks and build-time configuration the ipaplatform module
is now able to auto-detect platforms on import time. The meta importer
uses the platform 'ID' from /etc/os-releases. It falls back to 'ID_LIKE'
on platforms like CentOS, which has ID=centos and ID_LIKE="rhel fedora".

The meta importer is able to handle namespace packages and the
ipaplatform package has been turned into a namespace package in order to
support external platform specifications.

https://fedorahosted.org/freeipa/ticket/6474

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-15 14:17:24 +01:00
Tomas Krizek
49c77d7781
py3 spec: remove python2 dependencies from server-trust-ad
Use only python3 dependencies when building server-trust-ad for python3.

Fixes: https://pagure.io/freeipa/issue/7208
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-13 17:43:35 +01:00
Tomas Krizek
e203e9f86e
py3 spec: remove python2 dependencies from freeipa-server
When building the package with for python3, use only python3
dependencies. Changed:
  python -> python2 / python3
  python-gssapi -> python2-gssapi / python3-gssapi
  python-ldap -> python-ldap / python3-pyldap
  systemd-python -> python2-systemd / python3-systemd

Fixes: https://pagure.io/freeipa/issue/7208
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-13 17:43:35 +01:00
Tomas Krizek
3c84b0146b
py3 spec: use proper python2 package names
Package names for python2 were updated. Changed:
  dbus-python -> python2-dbus
  python -> python2
  python-devel -> python2-devel
  python-enum34 -> python2-enum34
  python-jwcrypto -> python2-jwcrypto
  python-kdcproxy -> python2-kdcproxy
  python-netifaces -> python2-netifaces
  python-netaddr ->  python2-netaddr
  python-pytest-multihost -> python2-pytest-multihost
  python-pytest-sourceorder -> python2-pytest-sourceorder
  python-setuptools -> python2-setuptools
  python-six -> python2-six
  python-sssdconfig -> python2-sssdconfig
  samba-python -> python2-samba

Part of: https://pagure.io/freeipa/issue/7131
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-13 17:43:35 +01:00
Robbie Harwood
9f8700fcee
ipa-kdb: support KDB DAL version 7.0
krb5-1.16 includes DAL version 7, which changes the signature of
audit_as_req to include local and remote address parameters.

This patch just enables building against the new DAL version and bumps
the minimum in freeipa.spec.in, but doesn't use the new information
for anything.

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-10-26 12:46:44 +02:00
Stanislav Laznicka
d39456a882
ipatests: use python3 if built with python3
Change the default python version for test scripts

https://pagure.io/freeipa/issue/7131

Reviewed-By: Felipe Barreto <fbarreto@redhat.com>
2017-10-26 12:43:47 +02:00
Tomas Krizek
8eb1bd37be
spec: bump 389-ds-base to 1.3.7.6-1
To avoid insidious bug during server installation on Fedora 27,
the dependency of 389-ds-base is bumped.

https://bugzilla.redhat.com/show_bug.cgi?id=1488295

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-10-24 12:01:32 +02:00
Rob Crittenden
acd72cc8f5 Use 389-ds provided method for file limits tuning
Previously IPA would set the LimitNOFILE value to 8192 to increase
the number of concurrent clients. 389-ds-base does this by default
as of 1.3.7.0.

Remove the IPA-specific tuning and rely on the out-of-the-box
389-ds-base tuning.

Bump the required version of 389-ds-base to 1.3.7.0.

Any other tuning added by 389-ds-base will result in a
dirsrv.systemd.rpmsave file which admins will need to merge
in manually, like typical .rpmsave config changes.

https://pagure.io/freeipa/issue/6994

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-17 14:59:06 +02:00
Fraser Tweedale
560ee3c0b5 certmonger: add support for MS V2 template
Update certmonger.resubmit_request() and .modify() to support
specifying the Microsoft V2 certificate template extension.

This feature was introduced in certmonger-0.79.5 so bump the minimum
version in the spec file.

Part of: https://pagure.io/freeipa/issue/6858

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Petr Vobornik
b0184d10ab
browser config: cleanup after removal of Firefox extension
Firefox extension which served for configuring Kerberos auth in Firefox
until version which banned self-signed extensions was removed in commit
6c53765ac1.

Given that configure.jar, even older Firefox config tool, was removed
sometime before that, there is no use for signtool tool. It is good
because it is removed from Fedora 27 anyway. So removing last unused
function which calls it.

The removal of FF extension was not exactly clean so removing also
browserconfig.html which only purpose was to use the extension. Therefore
also related JS files are removed. This removal requires unauthorized.html
to be updated so that it doesn't point to non-existing page. And given that
it now points only to single config page, we can change link in UI login page
to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html.

Btw, commit 6c53765ac1 removed also generation of
krb.js. It had one perk - with that info ssbrowser.html could display real
Kerberos domain instead of only 'example.com'.  I don't have time to revert this
change so removing traces of krb.js as well.

https://pagure.io/freeipa/issue/7135

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-09-21 10:27:14 +02:00
Tomas Krizek
faaba4f1bd
spec: bump python-pyasn1 to 0.3.2-2
The new python-pyasn1 fixes an issue that occurred during ca-less
installation.

Fixes: https://pagure.io/freeipa/issue/7157
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-09-19 11:26:01 +02:00
Rob Crittenden
62e72c2a53 Add exec to /var/lib/ipa/sysrestore for install status inquiries
installutils.is_ipa_configured() previously required root
privileges to see whether there were sysrestore or filestore
files. The directory was mode 0700 so this function always returned
False for non-root users.

Relaxing permissions is is needed to run the tests as the jenkins user.

Backed-up files retain their original FS permissions so this
shouldn't disclose any previously unreadable backed-up configuration.

https://pagure.io/freeipa/issue/7157

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-09-19 08:54:20 +02:00
Martin Basti
8be28145bf py3: set samba dependencies
Set proper python3 dependencies for samba package

https://pagure.io/freeipa/issue/7131

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-14 14:06:09 +02:00
Stanislav Laznicka
f2701f3a0b pylint: make unsupported-assignment-operation check local
unsupported-assignment-operation is useful at times, make it only
local, not global.

https://pagure.io/freeipa/issue/6874

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-08 15:42:07 +02:00
Tomas Krizek
5dcb0e6fc7
dnssec: keep dnssec daemons in Python2
Until DNSSEC is ready for Python3, we should run DNSSEC with Python 2.

Related: https://pagure.io/freeipa/issue/4985

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-09-01 12:35:31 +02:00
Stanislav Laznicka
aa969da461
spec: remove strict options from shebangs
https://pagure.io/freeipa/issue/4985

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-09-01 11:39:16 +02:00
Stanislav Laznicka
263217ff46
spec: have the scripts depend on py3 packages
When building for Fedora, we have with_python3 set to 1 by
default. Therefore, when such build is performed, have the
scripts depend on python3 packages instead of python2 (the
previous state was the scripts depended on both Python versions).

https://pagure.io/freeipa/issue/4985

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-09-01 11:39:16 +02:00
Stanislav Laznicka
3aff58c804
spec: remove python3 workaround
We have had a python3-ipaserver package for quite some time now

https://pagure.io/freeipa/issue/4985

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-09-01 11:39:16 +02:00
Martin Babinsky
a2de6a17c5 Move tmpfiles.d configuration handling back to spec file
Since ipaapi user is now created during RPM install and not in runtime,
we may switch back to shipping tmpfiles.d configuration directly in RPMs
and not create it in runtime, which is a preferred way to handle drop-in
configuration anyway.

This also means that the drop-in config will be shipped in /usr/lib
instead of /etc according to Fedora packaging guidelines.

This partially reverts commit 38c66896de.

https://pagure.io/freeipa/issue/7053

Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
2017-08-30 13:05:23 +02:00
Stanislav Laznicka
170f7a778b certmonger: remove temporary workaround
During recent refactoring, a workaround was added to make it
possible for OpenSSL backend of python-cryptography to read PEM
certificates returned by dogtag-ipa-renew-agent-submit. This was
fixed in latest certmonger version.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-30 12:55:59 +02:00
Stanislav Laznicka
0be9a17211 py3: Fix searching for yubikeys
Bumping the requirements for the python-yubikey package. This is
unfortunately most probably fixed only in Fedora because there was no
upstream release for about a year and a half now. That also means
bumping the version in ipasetup.py.in would be pointless.

https://pagure.io/freeipa/issue/7121

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-08-29 12:59:23 +02:00
Stanislav Laznicka
9869d52bab
Make the IPA server run under Python 3 by default
Set python3-mod_wsgi as a requirement for FreeIPA in the spec file
if with_python3 is specified so that httpd runs IPA server under
Python 3.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-08-21 15:47:33 +02:00
Stanislav Laznicka
5965e27b30
Turn IPA scripts to python3 -bb for testing
This is a commit which expands current scripts being run under
python3 by default. We set the -bb option so that any Bytes/Str
error breaks execution.

This commit shall be reverted before reaching production.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-08-21 15:47:33 +02:00
Stanislav Laznicka
7bf6eb7e19
py3: Depend on newer pyldap for server-upgrade
https://pagure.io/freeipa/issue/4985

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-08-21 11:29:07 +02:00
Christian Heimes
5f03329051
Misc Python 3 fixes for ipaserver.secrets
bytes/str fixes for LDAP data, JSON encoding and temp files.

Require jwcrpyto 0.4.2 with fix for RHBZ #1476150

https://pagure.io/freeipa/issue/4985

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-08-11 13:47:35 +02:00
Stanislav Laznicka
1124eee2ff replica-prepare: run the script in py3 by default
https://pagure.io/freeipa/issue/4985

Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
2017-08-02 16:15:13 +02:00
Stanislav Laznicka
a36f2aed63
Ensure network is online prior to an upgrade
Fedora system upgrades don't necessary require the network to be up.
However, we do, so we have to make sure the network is online before
performing an upgrade.

https://pagure.io/freeipa/issue/7039

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-07-14 09:20:40 +02:00
Martin Basti
aa1c0cf3e8 py3: run already ported scripts under py3 by default
To prevent regressions in py3, all ported scripts should be run by py3
by default.

This is temporary and will be removed once porting to py3 is done

https://pagure.io/freeipa/issue/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-07-12 15:41:04 +02:00
Martin Basti
17103e53cb py3: temporary set dependencies to both py2 and py3 packages
We are slowly migrating python scripts to py3 and setting py3 as default
for them. Thus we need to depend on both py2 and py3 packages until
everything is migrated.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-07-12 15:41:04 +02:00
Jan Cholasta
d5fc0ddd87 install: do not assume /etc/krb5.conf.d exists
Add `includedir /etc/krb5.conf.d` to /etc/krb5.conf only if
/etc/krb5.conf.d exists.

Do not rely on /etc/krb5.conf.d to enable the certauth plugin.

This fixes install on platforms which do not have /etc/krb5.conf.d.

https://pagure.io/freeipa/issue/6589

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2017-06-28 15:44:51 +02:00
Fraser Tweedale
1a35a2e213 Add CommonNameToSANDefault to default cert profile
The CommonNameToSANDefault component was added to Dogtag 10.4.  When
a profile is configured to use it, this profile copies the CN in the
certificate to the Subject Alternative Name extension as a dNSName
(if and only if it does look like a DNS name).

It is desirable that the default service profile use this component.
Add it to the default profile, for new installations only.  For
existing installations, until a proper profile update mechanism is
implemented, administrators who wish to use it must configure it via
the 'certprofile-mod' command.

Fixes: https://pagure.io/freeipa/issue/7007
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-06-27 14:25:58 +00:00
Martin Basti
4eec2f5e57 Build: allow to build only py2 rpms for fedora
This is more or less for testing purposes of py2/py3 compatibility

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-06-20 12:36:29 +02:00
Fraser Tweedale
d7e1ab8438 Add a README to certificate profile templates directory
There have been several instances of people using the profile
configuration template files as actual profile configurations,
resulting in failures and support load.  Add a README to the profile
template directory to explain that these files should not be used
and advise of the recommend procedure.

Fixes: https://pagure.io/freeipa/issue/7014
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-06-15 13:55:09 +02:00
Martin Basti
a2147de6e2 Explicitly ask for py2 dependencies in py2 packages
In future default package names can start to pointing to py3 instead of
py2. We have to explicitly ask for python2-* and python3-* packages.

This commit changes only dependencies that are available in both F25 and
F26

https://pagure.io/freeipa/issue/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-06-09 16:34:15 +02:00
Pavel Vomacka
2485c3377a Bump version of python-gssapi
Complete fixing of the bug requires fix on python-gssapi side.
That fix is included in version 1.2.0-5.

Fixes: https://pagure.io/freeipa/issue/6796
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-06-07 13:58:17 +02:00
Jan Cholasta
92276c1e88 pkinit manage: introduce ipa-pkinit-manage
Add the ipa-pkinit-manage tool to allow enabling / disabling PKINIT after
the initial server install.

https://pagure.io/freeipa/issue/7000

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-06-06 13:27:44 +02:00
Martin Basti
be1415b6cc pylint: explicitly depends on python2-pylint
F26 defaults to python3 with pylint package, we have to explicitly ask
for python2 version of pylint

https://pagure.io/freeipa/issue/6986

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-06-01 09:51:52 +02:00
Martin Basti
71adc8cd3f Add remote_plugins subdirectories to RPM
Subdirectories of remote plugins were forgotten in previous fix
d22ac59828cc4339d509804ddb3e2e1da9cfaa20 .

https://pagure.io/freeipa/issue/6927

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-05-31 10:32:57 +02:00
Martin Basti
a90a113b66 custodia dep: require explictly python2 version
python-custodia matches python3-custodia, but for py2 installations we
need python2-custodia explicitly

https://pagure.io/freeipa/issue/6962

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-05-31 10:28:06 +02:00
Martin Basti
6e67978356 py3: add missing py3 pylint depedencies
https://pagure.io/freeipa/issue/6874
https://pagure.io/freeipa/issue/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-05-29 14:44:29 +02:00
Pavel Vomacka
9149f2d9c6 Change python-cryptography to python2-cryptography
Package name is python2-cryptography and even that it Provides
python-cryptography package, it causes problems during update of IPA
on RHEL - python2-cryptography is not updated. After changing required package
name to python2-cryptography upgrade on RHEL works well.

Fixes: https://pagure.io/freeipa/issue/6749
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-05-24 18:00:28 +02:00
Jan Cholasta
4d36cbf6ad install: introduce generic Kerberos Augeas lens
Introduce new IPAKrb5 lens to handle krb5.conf and kdc.conf changes using
Augeas. The stock Krb5 lens does not work on our krb5.conf and kdc.conf.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-19 12:31:24 +02:00
Jan Cholasta
11b8a34346 client install: fix client PKINIT configuration
Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs
trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`.

Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs
known to IPA.

Make sure both bundles are exported in all installation code paths.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-19 12:31:24 +02:00
Martin Basti
374a58fa49 ipaclient: fix missing RPM ownership
FreeIPA package should own all subdirectories to work properly with
3rd party packages/plugins.

https://pagure.io/freeipa/issue/6927

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-05-16 11:21:48 +02:00
Martin Basti
6c061b6836
tests: add missing dependency iptables
KDC proxy tests are using iptables, but this is optional package in at
least Fedora cloud image, thus we must have it in dependencies

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-05-10 09:23:07 +02:00
Pavel Vomacka
e0b32dac54
Turn on NSSOCSP check in mod_nss conf
Turn on NSSOCSP directive during install/replica install/upgrade.
That check whether the certificate which is used for login is
revoked or not using OSCP.

Marks the server cert in httpd NSS DB as trusted peer ('P,,')
to avoid chicken and egg problem when it is needed to contact
the OCSP responder when httpd is starting.

https://pagure.io/freeipa/issue/6370

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-05-10 09:08:34 +02:00
Tomas Krizek
999706fcdf python2-ipalib: add missing python dependency
Commit dfd560a190 started to use
ssl symbols like ssl.OP_NO_SSLv2 that were introduced in Python 2.7.9.

Related https://pagure.io/freeipa/issue/6920

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-05 18:55:41 +02:00
Oliver Gutierrez
548014f03e Added plugins directory to paclient subpackages
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-05-03 17:42:08 +02:00
Jan Cholasta
0f42670afa spec file: bump krb5 Requires for certauth fixes
Bump krb5-* Requires to the version which includes the final version of
certauth support.

https://pagure.io/freeipa/issue/4905

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-04-27 09:17:41 +02:00
Jan Cholasta
0784e53f7f spec file: bump python-netaddr Requires
Bump python-netaddr Requires to the version which has correct private and
reserved IPv4 address ranges.

This fixes DNS server install failure when 0.0.0.0 is entered as a
forwarder.

https://pagure.io/freeipa/issue/6894

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-26 12:35:06 +02:00
Christian Heimes
3a5b3be8b9 tox testing support for client wheel packages
Add tox infrastructure to test client wheel packages workflow:

* build client packages
* install client packages
* ipa-run-tests --ipaclient-unittests under Python 2 and 3
* pylint of client packages under Python 2 and 3
* placeholder packages work as expected

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-12 16:53:22 +02:00
Christian Heimes
2cd6788c3f Replace hard-coded kdcproxy path with WSGI script
mod_wsgi has no way to import a WSGI module by dotted module name. A new
kdcproxy.wsgi script is used to import kdcproxy from whatever Python
version mod_wsgi is compiled against. This will simplify moving FreeIPA
to Python 3 and solves an import problem on Debian.

Resolves: https://pagure.io/freeipa/issue/6834

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-04-12 13:05:23 +02:00
David Kupka
a726e98f03 Create system users for FreeIPA services during package installation
Previously system users needed by FreeIPA server services was created during
ipa-server-install. This led to problem when DBus policy was configured during
package installation but the user specified in the policy didn't exist yet
(and potentionally similar ones). Now the users will be created in package %pre
section so all users freeipa-server package needs exist before any installation
or configuration begins.
Another possibility would be using systemd-sysusers(8) for this purpose but
given that systemd is not available during container build the traditional
approach is superior.
Also dirsrv and pkiuser users are no longer created by FreeIPA instead it
depends on 389ds and dogtag to create those users.

https://pagure.io/freeipa/issue/6743

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-04-11 17:51:49 +02:00
Christian Heimes
40a60675f3 Don't hard-code with_wheels
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-04-03 13:08:52 +02:00
Christian Heimes
ae1c2086db Add an option to build ipaserver wheels
To create a wheel bundle with ipaserver and its dependencies:

    make wheel_bundle IPA_SERVER_WHEELS=1

To include additional dependencies:

    make wheel_bundle IPA_EXTRA_WHEELS=ipatests[webui]

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-04-03 13:08:52 +02:00
Jan Cholasta
2b33230f66 setup, pylint, spec file: drop python-nss dependency
Remove the unused python-nss dependency.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-31 12:20:35 +02:00
Jan Cholasta
9183cf2a75 certdb: use certutil and match_hostname for cert verification
Use certutil and ssl.match_hostname calls instead of python-nss for
certificate verification.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-31 12:20:35 +02:00
Jan Cholasta
b18ee8b9dd
spec file: bump libsss_nss_idmap-devel BuildRequires
Bump BuildRequires on libsss_nss_idmap-devel to the version which
introduces the sss_nss_getlistbycert function.

This fixes RPM build failure when an older version of
libsss_nss_idmap-devel was installed.

https://pagure.io/freeipa/issue/6828

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-03-29 10:33:25 +02:00
Jan Cholasta
2dda1acf44 spec file: bump krb5-devel BuildRequires for certauth
Bump BuildRequires on krb5-devel to the version which introduces the
certauth pluggable interface.

This fixes RPM build failure when an older version of krb5-devel was
installed.

https://pagure.io/freeipa/issue/4905

Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-28 14:03:54 +00:00
Christian Heimes
f5bf5466ed Use Custodia 0.3.1 features
* Use sd-notify in ipa-custodia.service
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
  default setting for IPA's config file. The new file also makes it
  simpler to run IPA's custodia instance with its own SELinux context.
* ipapython no longer depends on custodia

The patch addresses three issues:

* https://bugzilla.redhat.com/show_bug.cgi?id=1430247
  Forward compatibility with Custodia 0.3 in Fedora rawhide
* https://pagure.io/freeipa/issue/5825
  Use sd-notify
* https://pagure.io/freeipa/issue/6788
  Prepare for separate SELinux context

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-28 15:02:06 +02:00
David Kupka
27d13d90fe spec file: Bump requires to make Certificate Login in WebUI work
gssproxy >= 0.7.0-2 - fixes impersonator checking
mod_lookup_identity >= 0.9.9 - adds support for single certificate assigned to multiple users
mod_nss >= 1.0.14-3 - no longer sets remote user in fixup hook
sssd-dbus >= 1.15.2 - adds FindByNameAndCertificate DBus method

https://pagure.io/freeipa/issue/6823

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-28 14:24:18 +02:00
Stanislav Laznicka
b7ae3363fd Bump samba version for FIPS and priv. separation
With the latest Samba, adding trusts to AD under FIPS should now work
as well as adding trusts as a whole after the privilege separation
rework.

https://pagure.io/freeipa/issue/6671
https://pagure.io/freeipa/issue/6697

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-27 18:51:11 +02:00
Sumit Bose
c4156041fe IPA certauth plugin
This patch add a certauth plugin which allows the IPA server to support
PKINIT for certificates which do not include a special SAN extension
which contains a Kerberos principal but allow other mappings with the
help of SSSD's certmap library.

Related to https://pagure.io/freeipa/issue/4905

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-27 09:52:57 +02:00
Jan Cholasta
990ce9eef3 spec file: always provide python package aliases
Provide python-ipa* aliases for python2-ipa* subpackages when the
python_provide RPM macro is not available.

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 14:35:23 +00:00
Jan Cholasta
417f1926c4 spec file: support client-only build
nspr-devel, nss-devel and openssl-devel are required for client-only build,
move their respective BuildRequires from the server-specific BuildRequires
section to the main BuildRequires section.

Pass --enable-server or --disable-server to ./configure based on the value
of %{ONLY_CLIENT}.

Remove the `make client-check` call from %check, as the client-check target
does not exist anymore. Always call `make check` instead.

Do not package the /usr/share/ipa directory in freeipa-client-common, as it
is not created in client-only build.

https://pagure.io/freeipa/issue/6517

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 13:42:16 +00:00
Jan Cholasta
e42a846506 spec file: support build without ipatests
Build ipatests only if %with_ipatests RPM macro is specified.

By default the macro is specified if ONLY_CLIENT is not specified.

https://pagure.io/freeipa/issue/6517

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-03-15 13:39:47 +00:00
Christian Heimes
f1f63506ca Make pylint and jsl optional
./configure no longer fails when pylint or jsl are not available. The
make targets for pylint and jsl are no longer defined without the tools.

Rational:
pylint and jsl are not required to build FreeIPA. Both are useful
developer tools. It's more user friendly to make both components
optionally with default config arguments. There is no reason to
fail building on a build system without development tools.

It's still possible to enforce dependency checks with --with-jslint and
--enable-pylint.

https://fedorahosted.org/freeipa/ticket/6604

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-03-15 12:42:36 +00:00
Jan Cholasta
7ef4e9eb81 spec file: add unconditional python-setuptools BuildRequires
python-setuptools is required not only for lint, but to make the build
possible at all.

Move the python-setuptools BuildRequires from the lint section to the main
section.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-03-15 07:44:35 +00:00
Martin Basti
f4c7f1dd8a Remove copy-schema-to-ca.py from master branch
This script is used only for IPA <3.1, so it must be compatible with
ipa-3-0 branch, so it should be placed there

https://pagure.io/freeipa/issue/6540

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-14 15:16:20 +01:00
Pavel Vomacka
75c592d3b9 Support certificate login after installation and upgrade
Add necessary steps which set SSSD and set SELinux boolean during
installation or upgrade. Also create new endpoint in apache for
login using certificates.

https://pagure.io/freeipa/issue/6225

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2017-03-14 15:13:43 +01:00
Martin Basti
4514ec1505 pylint: bump dependency to version >= 1.6
Older pylint versions produces false positive errors

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-13 16:05:25 +01:00
David Kupka
c37254e1b1 Bump required version of gssproxy to 0.7.0
https://pagure.io/freeipa/issue/6671
https://pagure.io/freeipa/issue/6698

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-10 14:17:29 +01:00
Christian Heimes
80be181629 Move csrgen templates into ipaclient package
csrgen broke packaging of ipaclient for PyPI. All csrgen related
resources are now package data of ipaclient package. Package data is
accessed with Jinja's PackageLoader() or through pkg_resources.

https://pagure.io/freeipa/issue/6714

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Ben Lipton <blipton@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-08 15:59:26 +01:00
Florence Blanc-Renaud
ea34e17a46 IdM Server: list all Employees with matching Smart Card
Implement a new IPA command allowing to retrieve the list of users matching
the provided certificate.
The command is using SSSD Dbus interface, thus including users from IPA
domain and from trusted domains. This requires sssd-dbus package to be
installed on IPA server.

https://fedorahosted.org/freeipa/ticket/6646

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-03-08 15:08:41 +01:00
Petr Vobornik
5e0ca17ca0
Change README to use Markdown
So that it will be nicely formatted on FreeIPA Pagure landing page.
  https://pagure.io/freeipa

Some links were updated as other projects also moved to Pagure.io.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-02 16:55:57 +01:00
Christian Heimes
b4c1bf1c7d Add with_wheels global to install wheel and PyPI packaging dependencies
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Christian Heimes
e2b9ea2fd5 Add python-wheel as build requirement
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-02 14:43:37 +01:00
Florence Blanc-Renaud
eaa87c75b9 Do not configure PKI ajp redirection to use "::1"
When ipa-server-install configures PKI, it provides a configuration file
with the parameter pki_ajp_host set to ::1. This parameter is used to configure
Tomcat redirection in /etc/pki/pki-tomcat/server.xml:
    <Connector port="8009"
            protocol="AJP/1.3"
            redirectPort="8443"
            address="::1" />
ie all requests to port 8009 are redirected to port 8443 on address ::1.

If the /etc/hosts config file does not define ::1 for localhost, then AJP
redirection fails and replica install is not able to request a certificate
for the replica.

Since PKI has been fixed (see PKI ticket 2570) to configure by default the AJP
redirection with "localhost", FreeIPA does not need any more to override
this setting.
The code now depends on pki 10.3.5-11 which provides the fix in the template
and the upgrade.

https://fedorahosted.org/freeipa/ticket/6575

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-17 14:58:06 +01:00
Alexander Bokovoy
593ea7da9a ipa-kdb: support KDB DAL version 6.1
DAL version 6.0 removed support for a callback to free principal.
This broke KDB drivers which had complex e_data structure within
the principal structure. As result, FreeIPA KDB driver was leaking
memory with DAL version 6.0 (krb5 1.15).

DAL version 6.1 added a special callback for freeing e_data structure.
See details at krb5/krb5#596

Restructure KDB driver code to provide this callback in case
we are built against DAL version that supports it. For DAL version
prior to 6.0 use this callback in the free_principal callback to
tidy the code.

Use explicit KDB version dependency in Fedora 26+ via BuildRequires.

With new DAL version, freeipa package will fail to build and
we'll have to add a support for new DAL version explicitly.

https://fedorahosted.org/freeipa/ticket/6619

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2017-02-15 14:24:05 +01:00
Simo Sorce
d2f5fc304f Configure HTTPD to work via Gss-Proxy
https://fedorahosted.org/freeipa/ticket/4189
https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-15 07:13:37 +01:00
Simo Sorce
38c66896de Generate tmpfiles config at install time
We do not want to generate runtime directories just because the packages
are installed, but only if the server is actually setup and run. Also this
will be needed later because we will create a user at install time and some
tmpfiles will need to be owned by this user.
As we are changing this code also rationalize the directory structure and
move it from the http rundir to the ipa specific rundir.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-15 07:13:37 +01:00
Simo Sorce
c894ebefc5 Change session handling
Stop using memcache, use mod_auth_gssapi filesystem based ccaches.
Remove custom session handling, use mod_auth_gssapi and mod_session to
establish and keep a session cookie.
Add loopback to mod_auth_gssapi to do form absed auth and pass back a
valid session cookie.
And now that we do not remove ccaches files to move them to the
memcache, we can avoid the risk of pollutting the filesystem by keeping
a common ccache file for all instances of the same user.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-15 07:13:37 +01:00
Stanislav Laznicka
5b56952a54 Bump required python-cryptography version
Since we started using 'Certificate.serial_number' instead of
'.serial' from python-cryptography, bump the required version
to the one where the above mentioned transition happened.

https://fedorahosted.org/freeipa/ticket/6631

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-14 16:59:13 +01:00
Tomas Krizek
6cb7bca684 Bump required version of bind-dyndb-ldap to 11.0-2
Fedora release bind-dyndb-ldap 11.0-2 transforms existing named.conf
old style API to the new style API. This package version is required
to enable upgrade of existing IPA installations to new version.

https://fedorahosted.org/freeipa/ticket/6565

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-02-14 15:30:12 +01:00
Tomas Krizek
5de7065fe5 bump required version of BIND, bind-dyndb-ldap
bynd-dyndb-ldap used a custom configuration file format. Since BIND 9.11,
an API was accepted upstream. This caused backward incompatible changes
to the named.conf configuration file used to configure the
bind-dyndb-ldap BIND plugin. Version 11.0 of bind-dyndb-ldap plugin and
BIND 9.11 are required to use with the new config file format.

https://fedorahosted.org/freeipa/ticket/6565

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 16:34:53 +01:00
Martin Basti
bd83fdf516 pki-base: use pki-base-python2 as dependency
pki-base provides pki-base-python2, but we should depend directly on
pki-base-python2 because in future pki-base may provide pki-base-python3
instead.

Source: cheimes@redhat.com

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-07 13:18:27 +01:00
Martin Basti
66fa0585aa pki: add missing depedency pki-base[-python3]
FreeIPA server modules requires pki module

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-07 13:18:27 +01:00
Ben Lipton
10ef594786 csrgen: Add code to generate scripts that generate CSRs
Adds a library that uses jinja2 to format a script that, when run, will
build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses
this library and builds the script for a given principal. The rules are
read from json files in /usr/share/ipa/csr, but the rule provider is a
separate class so that it can be replaced easily.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-01-31 10:20:28 +01:00
Abhijeet Kasurde
c56e02b3c5 Remove deprecated ipa-upgradeconfig command
Fixes https://fedorahosted.org/freeipa/ticket/6620

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-01-24 09:51:39 +01:00
Lukas Slebodnik
b82d285a4a SPEC: Fix build in mock
Neither pylint nor jsl is installed by default because rpm macro with_lint
is not defined in spec file. However, configure script tried to
find pylint/jsl anyway.

  checking for Pylint... /usr/bin/python2: No module named pylint
  configure: error: cannot find pylint for /usr/bin/python2

  RPM build errors:
  error: Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build)
      Bad exit status from /var/tmp/rpm-tmp.2GAFh4 (%build)

Resolves:
https://fedorahosted.org/freeipa/ticket/6604

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-01-18 09:05:56 +01:00
Martin Basti
35ba724de9 Py3: Fix ToASCII method
in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method
returns Py3 default (unicode) string. So only in Py2 we have to decode
str to unicode.

https://fedorahosted.org/freeipa/ticket/5935

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-01-06 12:48:10 +01:00
Jan Cholasta
eb1f05d598 spec file: revert to the previous Release tag
Revert from the current Release tag value `upstream` to the previously used
`0%{?dist}`, because:

* `0` sorts before `1`, which is usually used as the initial release number
  in downstream packages,

* the information provided by `%{?dist}` is useful, as packages built on
  one OS are not always installable on another OS.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-01-02 12:09:25 +01:00
Jan Cholasta
1b85e59cee spec file: do not define with_lint inside a comment
RPM expands macros even inside comments in spec files, so the with_lint
macro is unintentionally always defined.

Escape the percent sign in '%global' in the comment to prevent this.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-12-19 13:39:17 +01:00
Petr Spacek
21a0987601 Build: specify BuildRequires for Python 3 pylint
python3-samba is intentionally ommited because it is not in Fedora repos.
Pylint somehow magically ignores this missing package.
Keep in mind that server will not work until this this solved.

https://fedorahosted.org/freeipa/ticket/157

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-13 14:36:11 +01:00
Petr Spacek
b7d70baee7 Build: makerpms.sh generates Python 2 & 3 packages at the same time
Petr Viktorin recommended me to copy the whole build directory and run
configure twice, with different values for PYTHON variable.

After thinking a bit about that, it seems as cleanest approach.
Building for two versions of Python at the same time should be
temporary state so I decided not to complicate Autotools build system
with conditional spagetti for two versions of Python.

For proper Python2/3 distiction in the two separate builds, I added
find/grep/sed combo which replaces shebangs with system-wide Python
interpreter as necessary. This is workaround for the fact that FreeIPA
does not use setuptools properly. Honza told me that proper use of
setuptools is not trivial so we decided to go with this for now.

https://fedorahosted.org/freeipa/ticket/157

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-13 14:36:11 +01:00
Pavel Vomacka
a8b7dbff8a Add python-pyasn1-modules into dependencies
Python-pyasn1-modules is needed because of this import:
     from pyasn1_modules import rfc2459
in ipalib/x509.py.

Python-pyasn1-modules is required only by python-ldap package, but it would be
good to not rely on another package and rather say explicitely that
this package is necessary.

https://fedorahosted.org/freeipa/ticket/6398

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-12-05 13:57:00 +01:00
Christian Heimes
289982e02f Require python-cryptography >= 1.3.1
python-cryptography versions < 1.3 no longer compile with recent OpenSSL
1.0.2 versions. In order to build wheels, a more recent version of
cryptography is required. 1.3.1 is the oldest well tested version (RHEL
7.3) that is known to work with FreeIPA.

Bump up in freeipa.spec is not required for technical reasons. The
problem only affects PyPI packages. It's policy to keep
requirements in sync.

https://fedorahosted.org/freeipa/ticket/6468

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 17:33:32 +01:00
Christian Heimes
8559791e0d Require python-gssapi >= 1.2.0
The PyPI package for python-gssapi 1.1.x has a packaging bug. It depends on
enum34 for Python 3 although it is only required for 2.7. 1.2.0 is the
oldest version that has been tested at length by QE. It's know to work.

Bump up in freeipa.spec is not required for technical reasons. The
packaging bug only affects PyPI packages. It's policy to keep
requirements in sync.

https://fedorahosted.org/freeipa/ticket/6468

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-30 16:24:41 +01:00
Jan Cholasta
fba6c21da3 certdb: move IPA NSS DB install functions to ipaclient.install
The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform.

Move them to ipaclient.install.client as they are used only from the client
installer and ipa-restore.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-29 14:50:51 +01:00
Jan Cholasta
a1f260d021 ipapython: move dnssec, p11helper and secrets to ipaserver
The dnssec and secrets subpackages and the p11helper module depend on
ipaplatform.

Move them to ipaserver as they are used only on the server.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-29 14:50:51 +01:00