Commit Graph

9960 Commits

Author SHA1 Message Date
Florence Blanc-Renaud
90704df59d Show full error message for selinuxusermap-add-hostgroup
While investigating the issue for selinuxusermap-add-hostgroup,
we discovered that other commands were missing output.
A first patch fixes most of the issues:
freeipa-jcholast-677-frontend-copy-command-arguments-to-output-params-on-.patch

This patch fixes servicedelegation CLI, where
servicedelegation.takes_params was missing
ipaallowedtarget_servicedelegationtarget, ipaallowedtoimpersonate and
memberprincipal

https://fedorahosted.org/freeipa/ticket/6026

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-20 13:13:05 +02:00
Jan Cholasta
cdf8b668e7 frontend: copy command arguments to output params on client
In commit f554078291 we stopped copying
command arguments to output params in order to remove redundancies and
reduce API schema in size. Since then, output params were removed from
API schema completely and are reconstructed on the client.

Not including arguments in output params hides failed members from member
commands' CLI output. To fix this, copy arguments to output params again,
but only on the client side.

https://fedorahosted.org/freeipa/ticket/6026

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2016-07-20 13:12:37 +02:00
Fraser Tweedale
b12db92414 Create server and host certs with DNS altname
Currently server (HTTP / LDAP) certs are created without a Subject
Alternative Name extension during server install, replica prepare
and host enrolment, a potentially problematic violation of RFC 2818.

Add the hostname as a SAN dNSName when these certs are created.

(Certmonger adds an appropriate request extension when renewing the
certificate, so nothing needs to be done for renewal).

Fixes: https://fedorahosted.org/freeipa/ticket/4970
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-07-19 14:18:04 +02:00
Martin Babinsky
b144bf527d Use server API in com.redhat.idm.trust-fetch-domains oddjob helper
https://fedorahosted.org/freeipa/ticket/6082

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-07-19 14:11:39 +02:00
Lenka Doudova
6a072f3c5c Tests: Support of UPN for trusted domains
Basic set of tests to verify support of UPN functionality.

Test cases:
- establish trust
- verify the trust recognizes UPN
- verify AD user with UPN can be resolved
- verify AD user with UPN can authenticate
- remove trust

https://fedorahosted.org/freeipa/ticket/6094

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-19 13:29:51 +02:00
Lenka Doudova
f487233df0 Tests: External trust
Provides basic coverage for external trust feature.
Test cases:
1. verify an external trust with AD subdomain can be established
   - verify only one trustdomain is listed
   - verify subdomain users are resolvable
   - verify trust can be deleted
2. verify non-external trust with AD subdomain cannot be established
3. verify an external trust with AD forest root domain can be established
   - verify that even if AD subdomain is specified, it is not associated with the trust
   - verify trust can be deleted

https://fedorahosted.org/freeipa/ticket/6093

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-19 13:25:29 +02:00
Thierry Bordaz
b04f617803 Heap corruption in ipapwd plugin
ipapwd_encrypt_encode_key allocates 'kset' on the heap but
with num_keys and keys not being initialized.
Then ipa_krb5_generate_key_data initializes them with the
generated keys.
If ipa_krb5_generate_key_data fails (here EINVAL meaning no
principal->realm.data), num_keys and keys are left uninitialized.
Upon failure, ipapwd_keyset_free is called to free 'kset'
that contains random num_keys and keys.

allocates kset with calloc so that kset->num_keys==0 and
kset->keys==NULL

https://fedorahosted.org/freeipa/ticket/6030

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-07-19 13:17:37 +02:00
Martin Basti
72b2c8a54d CI: DNS locations
This test is testing default IPA system records in locations, if
priority and weight were properly set per service, per server, per
location.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-07-18 13:31:18 +02:00
Martin Babinsky
37bfd1fdde DNS install: Ensure that DNS servers container exists
during DNS installation it is assumed that the cn=servers,cn=dns container is
always present in LDAP backend when migrating DNS server info to LDAP.

This may not always be the case (e.g. when a new replica is set up against
older master) so the code must take additional steps to ensure this container
is present.

https://fedorahosted.org/freeipa/ticket/6083

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-07-15 14:13:32 +02:00
Fraser Tweedale
49389ed1e0 spec: require Dogtag >= 10.3.3-3
Required features that were expected to be released in Dogtag 10.3.4
have instead been released for Fedora in 10.3.3-3.  Retract the
minimum required version.

https://fedorahosted.org/freeipa/ticket/5956

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-07-15 14:09:03 +02:00
David Kupka
92dea9b186 schema: Fix subtopic -> topic mapping
https://fedorahosted.org/freeipa/ticket/6069

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-15 14:02:17 +02:00
Lenka Doudova
aab861142d Tests: Authentication indicators integration tests
https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2016-07-15 13:57:18 +02:00
Lenka Doudova
dcdbbb9759 Tests: Authentication indicators xmlrpc tests
https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2016-07-15 13:57:18 +02:00
Lenka Doudova
0f9a5ce6b4 Tests: Tracker class for services
Provides basic service tracker, so far for purposes of [1].
Tracker is not complete, some methods will need to be added in case of service test refactoring.

[1] https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2016-07-15 13:57:18 +02:00
Martin Babinsky
a5c8c9880d messages: specify message type for ResultFormattingError
the ResultFormattingError message class was missing a `type` member which
could cause `otptoken-add` command to crash during QR image rendering using
suboptimal TTY settings

https://fedorahosted.org/freeipa/ticket/6081

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-07-15 13:55:36 +02:00
Martin Babinsky
2f02ffed03 Preserve user principal aliases during rename operation
When a MODRDN is performed on the user entry, the MODRDN plugin resets both
krbPrincipalName and krbCanonicalName to the value constructed from uid. In
doing so, hovewer, any principal aliases added to the krbPrincipalName are
wiped clean. In this patch old aliases are fetched before the MODRDN operation
takes place and inserted back after it is performed.

This also preserves previous user logins which can be used further for
authentication as aliases.

https://fedorahosted.org/freeipa/ticket/6028

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2016-07-15 13:51:03 +02:00
Martin Babinsky
a1a7ecdc7b vault-add: set the default vault type on the client side if none was given
`vault-add` commands does much processing depending on the vault type even
before the request is forwarded to remote server. Since default values for
parameters are now filled only on server side, the client-side logic would
fail if the vault type was not explicitly given. In this case we have to
retrieve and use the default vault type from schema.

https://fedorahosted.org/freeipa/ticket/6047

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-07-13 18:46:31 +02:00
Stanislav Laznicka
6c74bd2bcc Removed unused method parameter from migrate-ds
An extra parameter on client side command override of migrate-ds output
was causing errors.

https://fedorahosted.org/freeipa/ticket/6034

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-13 18:40:22 +02:00
Martin Basti
2874fdbfef host-find: do not show SSH key by default
Only function 'remove_sshpubkey_from_output_list_post' should be used in
postcallbacks of *-find, otherwise only one entry will be cleaned up

https://fedorahosted.org/freeipa/ticket/6043

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-07-13 18:37:15 +02:00
Fraser Tweedale
8cd87d12d5 caacl: expand plugin documentation
Expand the 'caacl' plugin documentation to explain some common
confusions including the fact that CA ACLs apply to the target
subject principal (not necessarily the principal requesting the
cert), and the fact that CA-less CA ACL implies the 'ipa' CA.

Fixes: https://fedorahosted.org/freeipa/ticket/6002
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-07-13 18:34:17 +02:00
Martin Basti
9feeaca9fb Enable vault-* commands on client
Client plugins fot vault commands were disabled by NO_CLI=True,
inherited from vault_add_interal, that is always NO_CLI=True.
Introduced by this commit 8278da6967

Removed NO_CLI=True from client side plugins for vault.

https://fedorahosted.org/freeipa/ticket/6035

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-07-12 16:03:07 +02:00
Sumit Bose
6d6da6b281 kdb: check for local realm in enterprise principals
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
2016-07-12 12:26:28 +02:00
Martin Babinsky
c1d8629b74 ipa-advise: correct handling of plugin namespace iteration
The API object namespace iterators now yield plugin classes themselves
instead of their names as strings. The method enumerating through available
plugins needs to be made aware of this change.

https://fedorahosted.org/freeipa/ticket/6044

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-07-12 11:02:52 +02:00
Martin Babinsky
a5efeb449b ipa-compat-manage: use server API to retrieve plugin status
https://fedorahosted.org/freeipa/ticket/6033

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-07-12 10:59:59 +02:00
Milan Kubík
0277a89825 ipatests: remove ipacertbase option from test CSR configuration
The issue was found during test review. If the cert base contains
spaces, openssl req fails.

https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-07-12 10:55:50 +02:00
Milan Kubík
d88a12f1f5 ipatests: Test Sub CA with CAACL and certificate profile
Test the Sub CA feature by signing a CSR with custom
certificate profile.

The test also covers 'cert-request' fallback behaviour
for missing 'cacn' and 'profile-id' options by reusing
the fixtures from the module.

https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-07-12 10:55:50 +02:00
Milan Kubík
5b37aaad77 ipatests: Extend CAACL suite to cover Sub CA members
https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-07-12 10:55:50 +02:00
Milan Kubík
ea9b15f435 ipatests: Tracker implementation for Sub CA feature
The patch implements Tracker subclass for CA plugin
and the basic CRUD tests for the plugin entries.

https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-07-12 10:55:50 +02:00
Martin Babinsky
c5cc79f1ad ipa-nis-manage: Use server API to retrieve plugin status
https://fedorahosted.org/freeipa/ticket/6027

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2016-07-12 10:53:03 +02:00
Fraser Tweedale
88841a5619 uninstall: untrack lightweight CA certs
Fixes: https://fedorahosted.org/freeipa/ticket/6020
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-12 10:50:52 +02:00
Oleg Fayans
f784532d4e Test for incorrect client domain
https://fedorahosted.org/freeipa/ticket/5976

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-07-01 17:59:27 +02:00
Petr Spacek
dc5b2eaa77 client-install: log exceptions from certmonger.request_cert
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-07-01 13:33:49 +02:00
Martin Babinsky
0ade41abba Fix incorrect check for principal type when evaluating CA ACLs
This error prevented hosts to request certificates for themselves.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-07-01 13:16:23 +02:00
Petr Vobornik
4c1d737656 Become IPA 4.4.0 2016-07-01 11:39:29 +02:00
Martin Basti
3f26702981 IPA 4.4.0 Translations
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-01 11:24:53 +02:00
David Kupka
d2cb9ed327 Allow unexpiring passwords
Treat maxlife=0 in password policy as "never expire". Delete
krbPasswordExpiration in user entry when password should never expire.

https://fedorahosted.org/freeipa/ticket/2795

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2016-07-01 11:22:02 +02:00
Fraser Tweedale
3691e39a62 Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3
ipa-server-upgrade from pre-lightweight CAs version fails when
Dogtag is also being upgraded from pre-lightweight CAs version,
because Dogtag needs to be restarted after adding the lightweight
CAs container, before requesting information about the host
authority.

Move the addition of the Dogtag lightweight CAs container entry a
bit earlier in the upgrade procedure, ensuring restart.

Fixes: https://fedorahosted.org/freeipa/ticket/6011
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-01 11:09:53 +02:00
Petr Spacek
5e78b54d7c Fix internal errors in host-add and other commands caused by DNS resolution
Previously resolver was returning CheckedIPAddress objects. This
internal server error in cases where DNS actually returned reserved IP
addresses.

Now the resolver is returning UnsafeIPAddress objects which do syntactic
checks but do not filter IP addresses.

From now on we can decide if some IP address should be accepted as-is or
if it needs to be contrained to some subset of IP addresses using
CheckedIPAddress class.

This regression was caused by changes for
https://fedorahosted.org/freeipa/ticket/5710

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-07-01 10:35:39 +02:00
Petr Spacek
ce1f9ca51b Remove unused is_local(), interface, and defaultnet from CheckedIPAddress
All these were unused so I'm removing them to keep the code clean and
easier to read. At this point it is clear that only difference between
netaddr.IPAddress and CheckedIPAddress is prefixlen attribute.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-07-01 10:35:39 +02:00
Martin Basti
a635135ba3 Bump SSSD version in requires
This is required by commit aa734da494 for
function sss_nss_getnamebycert()

https://fedorahosted.org/freeipa/ticket/4955

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-07-01 10:20:36 +02:00
David Kupka
cea1f33606 schema: Perform the check for schema update when force_schema_check is True
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-01 10:12:34 +02:00
Fraser Tweedale
4844eaec19 Add --cn option to cert-status
Add the 'cacn' option to the cert-status command.  Right now there
is nothing we need to (or can) do with it, but we add it anyway for
future use.

Fixes: https://fedorahosted.org/freeipa/ticket/5999
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-01 10:05:16 +02:00
Pavel Vomacka
2ec59b7f23 Add widget for kerberos aliases to service page
Also changes the name of option which is send during adding new service from
'krbprincipalname' to 'krbcanonicalname'.

https://fedorahosted.org/freeipa/ticket/5927

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Pavel Vomacka
62c4e15d16 Add widget for kerberos aliases to hosts page
https://fedorahosted.org/freeipa/ticket/5927

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Pavel Vomacka
2da3090a97 Add widget for kerberos aliases to user page
https://fedorahosted.org/freeipa/ticket/5927

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Pavel Vomacka
4bc2e3164f Add widgets for kerberos aliases
Create own custom_command_multivalued_widget for kerberos aliases.

https://fedorahosted.org/freeipa/ticket/5927

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Pavel Vomacka
2232a5bb09 Set default confirmation button label to 'Remove'
Part of: https://fedorahosted.org/freeipa/ticket/5831

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Pavel Vomacka
df56fd3371 Change error handling in custom_command_multivalued_widget
The custom_command_multivalued_widget now handles remove and add commands errors
correctly and shows error message.

Part of: https://fedorahosted.org/freeipa/ticket/5381

add_error

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-07-01 09:39:49 +02:00
Martin Babinsky
acf2234ebc Unify display of principal names/aliases across entities
Since now users, hosts, and service all support assigning multiple principal
aliases to them, the display of kerberos principal names should be consistent
across all these objects. Principal aliases and canonical names will now be
displayed in all add, mod, show, and find operations.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-01 09:37:25 +02:00
Martin Babinsky
e6ff83e361 Provide API for management of host, service, and user principal aliases
New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...])
were added to manage principal aliases.

'add' commands will check the following:
* the correct principal type is supplied as an alias
* the principals have correct realm and the realm/alternative suffix (e.g.
  e-mail) do not overlap with those of trusted AD domains

If the entry does not have canonical principal name, the first returned
principal name will be set as one. This is mostly to smoothly operate on
entries created on older servers.

'remove' commands will check that there is at least one principal alias equal
to the canonical name left on the entry.

See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases

https://fedorahosted.org/freeipa/ticket/1365
https://fedorahosted.org/freeipa/ticket/3961
https://fedorahosted.org/freeipa/ticket/5413

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-01 09:37:25 +02:00