Commit Graph

10496 Commits

Author SHA1 Message Date
Petr Spacek
46b6b9e309 Build: support --enable-silent-rules for Python packages
Setuptools will print only warnings. The option has to be used before
setuptools command specification, otherwise it will not apply to sub-commands.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-16 09:12:07 +01:00
Petr Spacek
27e7a89a62 Build: workaround bug 1005235 related to Python paths in auto-generated Requires
https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-16 09:12:07 +01:00
Florence Blanc-Renaud
198cd5fab3 Fix renewal lock issues on installation
- Make sure that the file /var/run/ipa/renewal.lock is deleted upon
uninstallation, in order to avoid subsequent installation issues.

- Modify certmonger renewal script: restart the http/dirsrv services
only if they were already running

- Cleanup certmonger ra renewal script: no need to restart httpd

- Reorder during http install: request the SSL cert before adding
ipa-service-guard
Rationale: when a CA helper is modified, certmonger launches the helper
with various operations (FETCH_ROOTS, ...) If the CA helper is once again
modified, the on-going helper is killed. This can lead to
ipa-service-guard being killed and not releasing the renew lock.

If the SSL cert is requested with IPA helper before ipa-service-guard is added,
we avoid this locking issue.

Part of the refactoring effort, certificates sub-effort.

https://fedorahosted.org/freeipa/ticket/6433

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-11-16 09:10:01 +01:00
Lenka Doudova
4b3bd54242 Document make_delete_command method in UserTracker
https://fedorahosted.org/freeipa/ticket/6485

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2016-11-15 17:02:13 +01:00
Petr Spacek
5a5373464f Build: document what should be in %install section of SPEC file
https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-15 17:00:32 +01:00
Petr Spacek
1fa0ed954b Build: move web UI file installation from SPEC to Makefile.am
This is next step towards fully functional make install.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-15 17:00:32 +01:00
Petr Spacek
20918579ac Build: move server directory handling from SPEC to Makefile.am
This is next step towards fully functional make install.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-15 17:00:32 +01:00
Petr Spacek
636aaa7dbc Build: move client directory handling from SPEC to Makefile.am
This is next step towards fully functional make install.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-15 17:00:32 +01:00
Lenka Doudova
4df1d9d1a5 Tests: Providing trust tests with tree root domain
https://fedorahosted.org/freeipa/ticket/6347

Reviewed-By: Ganna Kaihorodova <gkaihoro@redhat.com>
2016-11-15 13:34:38 +01:00
Christian Heimes
2dd66c6366 Use correct classifiers to make setup.py files PyPI compatible
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-15 12:07:57 +01:00
Oleg Fayans
232a0391d3 Test for installing rules with service principals
https://fedorahosted.org/freeipa/ticket/6481

Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
2016-11-14 18:29:48 +01:00
Oleg Fayans
91c8911a9e Test: integration tests for certs in idoverrides feature
https://fedorahosted.org/freeipa/ticket/6005

Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
2016-11-14 18:29:48 +01:00
Oleg Fayans
f1c9c56f40 Added interface to certutil
Added generic method to run certutil with arbitrary set of paramenters

Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
2016-11-14 18:29:48 +01:00
Milan Kubík
e54109c167 ipatests: Fix assert_deepequal outside of pytest process
https://fedorahosted.org/freeipa/ticket/6420

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-14 18:19:17 +01:00
Michal Židek
2df7098389 git: Add commit template
In order to use the commit template, run the
following command:
git config commit.template .git-commit-template

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-14 18:15:04 +01:00
Pavel Vomacka
6e475988e1 TESTS: Update group type name
As the group type has been changed from 'normal' to 'nonposix' we need to update
this information also in tests.

https://fedorahosted.org/freeipa/ticket/6334

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-14 18:08:15 +01:00
Tomas Krizek
d6300dca28 cainstance: use correct certificate for replica install check
Incorrect certificate file extension caused DL0 replica install to fail.

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2016-11-14 18:01:04 +01:00
Petr Spacek
623cc428cf Update man page for ipa-adtrust-install by removing --no-msdcs option
https://fedorahosted.org/freeipa/ticket/6480

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2016-11-14 17:33:30 +01:00
Lenka Doudova
414ed0d182 Tests: Verify that validity info is present in cert-show and cert-find command
https://fedorahosted.org/freeipa/ticket/6419

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-14 17:30:47 +01:00
Lenka Doudova
46aa414445 Add file_exists method as a member of transport object
Method file_exists is reported by pylint as not being a member of transport
object, however it is used as such. Adding the method to object to avoid pylint
errors or unnecessary pylint disable.

https://fedorahosted.org/freeipa/ticket/6400

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-14 14:32:10 +01:00
Lenka Doudova
3938698e07 Tests: Provide AD cleanup for legacy client tests
Providing cleanup of trust information from AD machines for legacy client tests.

https://fedorahosted.org/freeipa/ticket/6396

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-14 14:32:10 +01:00
Lenka Doudova
8a177732af Tests: Provide AD cleanup for trust tests
Providing cleanup of trust information from AD machines for trusts tests.

https://fedorahosted.org/freeipa/ticket/6396

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-14 14:32:10 +01:00
Christian Heimes
a22a5dd676 Use api.env.nss_dir instead of paths.IPA_NSSDB_DIR
ipaclient plugins are now using nss_dir from api.env instead of
hard-coded paths.IPA_NSSDB_DIR.

Closes: https://fedorahosted.org/freeipa/ticket/6386
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-14 13:57:26 +01:00
Fraser Tweedale
e1df2e0792 cert-request: accept CSRs with extraneous data
The cert-request command used to accept CSRs that had extra data
surrounding the PEM data, e.g. commentary about the contents of the
CSR.  Recent commits that switch to using python-cryptography for
cert and CSR handling broke this.  Our acceptance tests use such
CSRs, hence the tests are now failing.

To avoid the issue, freshly encode the python-cryptography
CertificateSigningRequest object as PEM.  This avoids re-using the
user-supplied data, in case it has extraneous data.

Fixes: https://fedorahosted.org/freeipa/ticket/6472
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-11-11 15:42:26 +01:00
Tomas Krizek
f183f70e01 dns: check if container exists using ldapi
Previously an adhoc connection was established for checking if
dns(sec) container exists. A simple or external bind was used.
Instead, always connect with ldapi through api.Backend.ldap2.

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 14:55:24 +01:00
Abhijeet Kasurde
28bc54f91d Provide user hint about IP address in IPA install
With this fix, user will be notified about pressing enter
to proceed with IPA installation procedure, if user has
provided valid IP address previously.

Fixes https://fedorahosted.org/freeipa/ticket/5949

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 13:50:51 +01:00
Jan Cholasta
09423acb65 install: migrate client install to the new class hierarchy
Migrate ipa-client-install from the custom script to the new installer
class hierarchy classes.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
714699a81f install: allow specifying verbosity and console log format in CLI
https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
225fae8418 install: migrate server installers to the new class hierarchy
Migrate ipa-server-install and ipa-replica-install from the old installer
classes to the new installer class hierarchy classes.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
a8fdb8de82 install: introduce installer class hierarchy
Add class hierarchy which allows inherting knob definitions between the
various client and server install scripts.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
08a446a6bc install: fix subclassing of knob groups
Add new @group decorator to declare an installer class as a knob group
instead of subclassing Group, so that subclassing the installer does not
create duplicates of the original group.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
269ca6c454 install: make knob base declaration explicit
Declare knob bases explicitly using a keyword argument instead of guessing
if the type argument is a base or a type of the knob.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
043c262ce4 install: declare knob CLI names using the argparse convention
Replace cli_name, cli_short_name and cli_positional knob arguments with a
single cli_names argument, which allows defining one or more CLI names
using the argparse convention ("--option" for long option name, "-o" for
short option name and "argument" for positional argument name).

Also replace cli_aliases with cli_deprecated_names which uses the same
convention.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
a929ac3338 install: use standard Python classes to declare knob types
Use type(None) rather than bool to define knobs which are represented as
command line flags. This allows declaring both "--option" and
"--option={0,1}"-style command line options.

Use enum.Enum subclasses instead of set literals to declare enumerations.

Use typing.List[T] instead of (list, T) to declare lists. (Note that a
minimal reimplementation of typing.List is used instead of the Python 2
backport of the typing module due to non-technical reasons.)

Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP
addresses.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
9fd1981ae8 install: introduce updated knob constructor
Add new knob() knob constructor. Keep the old Knob() constructor for
backward compatibility with old code.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
be0c1afa74 install: simplify CLI option parsing
Let IPAOptionParser handle parsing of its supported types and use an option
callback only for unsupported types.

Instead of parsing positional arguments manually, parse them using a custom
IPAOptionParser instance, reusing the option parsing code.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Jan Cholasta
a641e279ff install: improve CLI positional argument handling
Instead of specifying which knobs should be positional arguments in
cli.install_tool(), do it using a flag in knob definition, where the rest
of CLI configuration is.

As a side effect, the usage string for CLI tools can now be generated
automatically.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-11-11 12:17:25 +01:00
Stanislav Laznicka
8c742b1539 Fix CA replica install on DL1
Dogtag requires Directory Manager password for its installation.
On Domain Level 1 a special password for Directory Manager is
created and used during the installation. However, by importing
the real DM password from remote LDAP, we can no longer use
the temporary password from the replica installation.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
7cd3b1bfa7 installutils: remove 'install_service_keytab' function
This functionality was merged to Service class and is not longer used
anywhere.

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
73fc15556d domain-level agnostic keytab retrieval in httpinstance
apache keytab is now retrieved using the same method in both domain levels.
The difference lies in the authentication scheme used to retrieve service
keytab:

  * in DL0 passed in DM credentials are used
  * in DL1 GSSAPI is used

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
4e97a0171a installers: restart DS after KDC is configured
This is required to enable password extension plugin right away so that
services configured later can use it to request keytabs via ipa-getkeytab.

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
3129b874a2 dsinstance: use keytab retrieval method from parent class
DS replica can now use remote API and ipa-getkeytab to create service
principal and fetch the keytab in both domain levels. There is no need to use
KDC installer to do it.

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
6181844c0c use DM credentials to retrieve service keytab only in DLO
In DL0 directory manager password is bundled in the supplied replica file and
the replica installer can use it to authenticate against master when
retrieving service keytabs.

In DL1, however, DM credentials are generated randomly and used during local
DS instance creation. The proper DM password is imported by custodia much
later to the process. We must not allow the installer to contact the remote
master using this random password since it would fail.

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
4286f3885b Service: common method for service keytab requests
Since creation of service principals and keytab retrieval are common
operations, Service class should provide means to add service entry to LDAP,
retrieve its keytab to designated destination and change the owner to service
user.

https://fedorahosted.org/freeipa/ticket/6405

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
32599987fd Turn Kerberos-related properties to Service class members
The Service class now accepts keytab path and service name part of Kerberos
principal as members. Kerberos principal is turned into a property computed
from service prefix, FQDN and realm. the handling of Kerberos principals and
keytabs in service installers was changed to use class members instead of
copy-pasted constants. This shall aid in the future refactoring of
principal/keytab handling code.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
81bf72dc35 Make service user name a class member of Service
This will aid further refactoring of service installers, since the user will
be defined only once during parent class initialization.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Martin Babinsky
15f282cf2c service installers: clean up the inheritance
Instead of delegating handling of some parameters like fstore to the parent
class, the *Instance installers had the logic copy-pasted in their
constructors. Some other members were also moved to the Service class and the
parent class constructors in children were fixed to modern standards of
initializing parent class in Python.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-11-11 12:17:25 +01:00
Stanislav Laznicka
1e6366bc9f Offer more general way to check domain level in replicainstall
Domain levels 0 and 1 use the same mechanism of checking domain
level correctness. Group them together and make it more general
should there be more domain levels in the future (although lets
hope there won't be).

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-11 12:17:25 +01:00
Stanislav Laznicka
37578cfc2b Use same means of checking replication agreements on both DLs
https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-11 12:17:25 +01:00
Stanislav Laznicka
bc2e3386e7 replicainstall: move common checks to common_check()
install_check() and promote_check() have some common checks that can
be safely moved to common grounds.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-11 12:17:25 +01:00