Commit Graph

8347 Commits

Author SHA1 Message Date
Alexander Bokovoy
47e1de7604 trusts: pass AD DC hostname if specified explicitly
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
03c2d76186 ipa-adtrust-install: add IPA master host principal to adtrust agents
Fixes https://fedorahosted.org/freeipa/ticket/4951

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
785f6593ca add one-way trust support to ipasam
When trust is established, ipasam module creates a number of objects in LDAP
to represent the trust information. Among them, for one-way trust we create
a principal named IPA$@AD where IPA is a NetBIOS (flat) name of the IPA forest
and AD is a realm of the trusted Active Directory forest root domain.

This principal is then used by SSSD on IPA masters to authenticate against
trusted Active Directory domain controllers and retrieve information about
user and group identities.

FreeIPA also uses this principal's credentials to retrieve domain topology.

The access to the keys of the principal should be well-protected. We only
allow to retrieve the keytab for it for members of cn=adtrust agents group.
This group is populated with host/ and cifs/ principals from IPA masters.

Starting with FreeIPA 4.2 the group will also have host/ principals of IPA masters
where no ipa-adtrust-install was run. To add them, run ipa-adtrust-install
on the master which will be configured to be a domain controller (e.g.
run Samba with ipasam), and specify --add-agents option to trigger activation
of the interactive mode to specify which IPA masters to enable.

Fixes https://fedorahosted.org/freeipa/ticket/4962
Part of fixes for https://fedorahosted.org/freeipa/ticket/4546

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
d3ccfefaa4 ipa-kdb: filter out group membership from MS-PAC for exact SID matches too
When incoming SID blacklist contains exact SIDs of users and groups,
attempt to filter them out as well, according to [MS-PAC] 4.1.1.2.

Note that we treat user's SID and primary group RID filtering as violation
of the KDC policy because the resulting MS-PAC will have no user SID or
primary group and thus will be invalid.

For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1
it is OK to have empty group RIDs array as GroupCount SHOULD be
equal to Groups.MembershipCount returned by SamrGetGroupsForUser
[MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty.

Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
88c10dd975 ipa-kdb: use proper memory chunk size when moving sids
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Tomas Babej
e8ff6a3ef6 dcerpc: Raise ACIError correctly
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
David Kupka
6a91893ff5 ipa-replica-prepare: Do not create DNS zone it automatically.
When --ip-address is specified check if relevant DNS zone exists
in IPA managed DNS server, exit with error when not.

https://fedorahosted.org/freeipa/ticket/5014

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 00:37:42 +02:00
Martin Babinsky
ea7f392bb9 add option to skip client API version check
This can be either set in IPA config file or specified as
'ipa --skip-version-check [COMMAND]'.

part of https://fedorahosted.org/freeipa/ticket/4768

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 00:35:05 +02:00
Martin Basti
1d9bdb2409 Fix regression: ipa-dns-install will add CA records if required
https://fedorahosted.org/freeipa/ticket/5101

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 00:32:05 +02:00
Fraser Tweedale
462e0b9eb1 certprofile: add ability to update profile config in Dogtag
Add the `--file=FILENAME' option to `certprofile-mod' which, when
given, will update the profile configuration in Dogtag to the
contents of the file.

Fixes: https://fedorahosted.org/freeipa/ticket/5093
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 00:25:46 +02:00
Fraser Tweedale
bed6f402e2 certprofile: add option to export profile config
Add the `--out=FILENAME' option to `certprofile-show'.  When given,
it exports the profile configuration from Dogtag and writes it to
the named file.

Fixes: https://fedorahosted.org/freeipa/ticket/5091
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 00:25:46 +02:00
Tomas Babej
62e8002bc4 Hide topology and domainlevel features
* Hide topology and domainlevel commands in the CLI
* Hide topology and domainlevel in the WebUI
* Set maximum allowed domain level to 0
* Do not configure and enable the topology plugin

https://fedorahosted.org/freeipa/ticket/5097

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 00:09:09 +02:00
Christian Heimes
25d1afdc54 Improve error handling in ipa-httpd-kdcproxy
The pre start script 'ipa-httpd-kdcproxy' for httpd.service now handles
connection and authentication errors more gracefully. If the script is
not able to conenct to LDAP, it only prints a warning and exits with
status code 0. All other errors are still reported as fatal error and
result in a non-zero exit code.

This fixes a problem with offline RPM updates. A restart of Apache no
longer fails when LDAP is not running.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-07 16:31:04 +02:00
Martin Basti
6fa123447f FIX: Clear SSSD caches when uninstalling the client
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-07-07 16:27:24 +02:00
Tomas Babej
12b053df30 l10n: Update translation strings
* Generate new l10n strings
* Include newly created python implicit files
* Merges already translated strings from Zanata

https://fedorahosted.org/freeipa/ticket/4832

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-07 12:07:15 +02:00
Tomas Babej
c6e6b216e9 l10n: Add configuration file for Zanata
Zanata cliens require the presence of a XML configuration file
inside the git repository of the project.

https://fedorahosted.org/freeipa/ticket/4832

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-07 12:07:15 +02:00
Endi S. Dewata
475ade4bec Added ipaVaultPublicKey attribute.
A new attribute ipaVaultPublicKey has been added to replace the
existing ipaPublicKey used to store the vault public key.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-07 07:44:56 +00:00
Endi S. Dewata
fc5c614950 Added symmetric and asymmetric vaults.
The vault plugin has been modified to support symmetric and asymmetric
vaults to provide additional security over the standard vault by
encrypting the data before it's sent to the server. The encryption
functionality is implemented using the python-cryptography library.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-07 07:44:56 +00:00
Petr Spacek
8ee975b276 DNSSEC: Detect attempt to install & disable master at the same time.
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Petr Spacek
c0271b9c87 DNSSEC: ipa-dns-install: Detect existing master server sooner.
User should get the error before he installs missing packages etc.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Martin Basti
f7c98c650a Allow to run subprocess with suplementary groups
Param suplementary_groups allows to specify list of group names to be
used for subprocess.
suplementary_groups param requires runas param to be specified.

Required for ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Martin Basti
2e4e8d759d DNSSEC: update message
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Martin Basti
e151492560 DNSSEC: allow to disable/replace DNSSEC key master
This commit allows to replace or disable DNSSEC key master

Replacing DNSSEC master requires to copy kasp.db file manually by user

ipa-dns-install:
--disable-dnssec-master  DNSSEC master will be disabled
--dnssec-master --kasp-db=FILE  This configure new DNSSEC master server,  kasp.db from old server is required for sucessful replacement
--force Skip checks

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Petr Vobornik
b258bcee83 webui: add mangedby tab to otptoken
Added managedby_user tab to manage users who can manage the token.

https://fedorahosted.org/freeipa/ticket/5003

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-07 05:51:28 +02:00
Petr Vobornik
2a976334c2 webui: API browser
First part of API browser - displaying metadata in more consumable way.

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-03 10:42:16 +02:00
Petr Vobornik
392809f984 webui: menu and navigation fixes
fixes:

1. When navigation is initiated from clicking and a link with hash, update
of facet state causes that subsequent click on a link with hash will be
ignored. Caused by a code which prevents infinite loop because of facet
state update. Now hash update is done only if it was really changed.

2. registered correct handler for standalone pages

3. fix selection of menu item where the items differ only in args. Chooses
the item with the most similar state to current facet.

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-03 10:42:16 +02:00
Petr Vobornik
8d8aa60dbd webui: fix webui specific metadata
Mark all Web UI specific metadata so they could be filtered out
in the API Browser.

Fix cert name.

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-03 10:42:16 +02:00
Petr Vobornik
114f11fe5a webui: ListViewWidget
A widget for rendering a list of groups of items. Intended to be
used in sidebar. Plan is to serve also as a base for FacetGroupsWidget.

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-03 10:42:16 +02:00
Petr Vobornik
ba0a1c6b33 include more information in metadata
added to commands: doc, proper args, NO_CLI

added to options: default_from, cli_name, cli_short_name and others

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-03 10:42:16 +02:00
Martin Basti
884afb5d38 Server Upgrade: use debug log level for upgrade instead of info
Upgrade contains too many unnecessary info logs.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-03 07:47:59 +00:00
Petr Vobornik
66ea322e7e topology: make cn of new segment consistent with topology plugin
Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-03 08:47:23 +02:00
Petr Vobornik
2b8e1caa7b topologysegment: hide direction and enable options
These options should not be touched by users yet.

https://fedorahosted.org/freeipa/ticket/5061

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-03 08:47:23 +02:00
Petr Vobornik
fa4954c35d ipa-replica-manage del: add timeout to segment removal check
Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-03 08:47:23 +02:00
Petr Vobornik
6be7d41ba1 ipa-replica-manage del: relax segment deletement check if topology is disconnected
https://fedorahosted.org/freeipa/ticket/5072

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-03 08:47:23 +02:00
Martin Babinsky
76eea85701 new commands to manage user/host/service certificates
A new group of commands is introduced that simplifies adding and removing
binary certificates to entries. A general form of the command is

ipa [user/host/service]-[add/remove]-cert [pkey] --certificate=[BASE64 BLOB]

Part of http://www.freeipa.org/page/V4/User_Certificates and
https://fedorahosted.org/freeipa/ticket/4238

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-02 14:43:44 +00:00
Martin Babinsky
53b11b6117 reworked certificate normalization and revocation
Validation of certificate is now handled by `x509.validate_certificate'.

Revocation of the host and service certificates was factored out to a separate
function.

Part of http://www.freeipa.org/page/V4/User_Certificates

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-02 14:43:44 +00:00
Martin Babinsky
93dab56ebf baseldap: add support for API commands managing only a single attribute
This patch extends the API framework with a set of classes which add/remove
 values to a single LDAPObject attribute.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-02 14:43:44 +00:00
Tomas Babej
8d30feb539 winsync_migrate: Generalize membership migration
https://fedorahosted.org/freeipa/ticket/4943

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
e5fe79a0f4 winsync_migrate: Migrate memberships of the winsynced users
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
199358112e man: Add manpage for ipa-winsync-migrate
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
6462530440 idviews: Fallback to AD DC LDAP only if specifically allowed
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
f8d1458fda winsync-migrate: Include the tool parts in Makefile and friends
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
19d62e9aa4 winsync-migrate: Move the tool under ipaserver.install package
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
e9a3b99717 winsync-migrate: Rename to tool to achive consistency with other tools
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
7017d9e8a6 winsync-migrate: Delete winsync agreement prior to migration
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
d584eb7001 winsync-migrate: Require explicit specification of the target server and validate existing agreement
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
bff7a748d6 idviews: Do not abort the find & show commands on conversion errors
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
0e11a87090 winsync-migrate: Require root privileges
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
e6a2a67d7a dcerpc: Add debugging message to failing kinit as http
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00
Tomas Babej
69c6a33216 dcerpc: Change logging level for debug information
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-02 13:23:21 +02:00