IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-12 16:32:01 -05:00
Code Issues Packages Projects Releases Wiki Activity
6,773 Commits 11 Branches 63 Tags
48539b35d78f8872fc2996e045987bcfa6ab7db7
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jan Cholasta 48539b35d7 Use LDAP API to upload CA certificate instead of ldapmodify command. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta 65957b7eff Do not create CA certificate files in CA-less server install. 
The files are created later by ipa-client-install, there's no need to do it
twice.

This also fixes a bug in CA-less, where the CA certificate is not removed from
/etc/pki/nssdb after client uninstall, because it has a different nickname.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta fea7163e87 Move CACERT definition to a single place. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta 4c761108e8 Fix certificate renewal scripts to work with separate CA DS instance. 
https://fedorahosted.org/freeipa/ticket/3805

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta 8e98690409 Log unhandled exceptions in certificate renewal scripts. 
https://fedorahosted.org/freeipa/ticket/4093

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-10 18:41:10 +01:00
Jan Cholasta c0c38ed314 Fix modlist generation code not to generate empty replace mods. 
https://fedorahosted.org/freeipa/ticket/4138
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-03 12:14:09 +01:00
Jan Cholasta 792c3f9c8c Always use real entry DNs for memberOf in ldap2. 
https://fedorahosted.org/freeipa/ticket/4192

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-02-24 14:30:23 +01:00
Jan Cholasta 4e207b4c88 Remove sourcehostcategory from the default HBAC rule. 
https://fedorahosted.org/freeipa/ticket/4158

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-02-06 16:46:24 +01:00
Jan Cholasta c2bd6f365d Convert remaining frontend code to LDAPEntry API. 2014-01-24 20:38:15 +01:00
Jan Cholasta 5737eaf134 Raise an exception when legacy LDAP API is used. 2014-01-24 20:29:32 +01:00
Jan Cholasta 9d863e9a96 Convert remaining test code to LDAPEntry API. 2014-01-24 20:29:31 +01:00
Jan Cholasta 97c1c95f20 Convert remaining update code to LDAPEntry API. 2014-01-24 20:29:31 +01:00
Jan Cholasta 08051f1651 Convert remaining installer code to LDAPEntry API. 2014-01-24 20:29:31 +01:00
Jan Cholasta a5f322cb7b Get original entry state from LDAP in LDAPUpdate. 2014-01-24 20:29:31 +01:00
Jan Cholasta 923e9d8bed Fix ntpd config on clients. 
https://fedorahosted.org/freeipa/ticket/4094
 2014-01-24 13:01:32 +01:00
Jan Cholasta be2c5d22b3 Increase service startup timeout default. 
https://fedorahosted.org/freeipa/ticket/4078
 2014-01-17 10:12:04 +01:00
Jan Cholasta 7ce3320996 Do not start the service in stopped_service if it was not running before. 
This fixes a possible NSS database corruption in renew_ca_cert.
 2014-01-15 17:44:10 +01:00
Jan Cholasta e369e3dcad Fix ipa-client-automount uninstall when fstore is empty. 
https://fedorahosted.org/freeipa/ticket/4091
 2014-01-15 12:10:05 +01:00
Jan Cholasta f7128b9c03 Use raw LDAP data in ldapupdate. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:40 +01:00
Jan Cholasta c86d9f33c9 Do not crash on bad LDAP data when formatting decode error message. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:40 +01:00
Jan Cholasta d6c3d3f57a Store old entry state in dict rather than LDAPEntry. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 4284a8349b Remove legacy LDAPEntry properties data and orig_data. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta aa66cd5f35 Remove unused LDAPClient methods get_syntax and get_single_value. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 61887ac392 Add LDAPEntry method generate_modlist. 
Use LDAPEntry.generate_modlist instead of LDAPClient._generate_modlist and
remove LDAPClient._generate_modlist.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 9d4bcb63de Reduce amount of LDAPEntry.reset_modlist calls in ldapupdate. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 21fab665f4 Use LDAPClient.update_entry for LDAP mods in ldapupdate. 
Remove legacy IPAdmin methods generateModList and updateEntry.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 8d67acc026 Make IPASimpleLDAPObject.get_single_value result overridable. 
Add some default overrides.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta c98cff25ab Move LDAPClient method get_single_value to IPASimpleLDAPObject. 
Refactor IPASimpleLDAPObject methods get_syntax and get_single_value.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 24d85f15ee Use old entry state in LDAPClient.update_entry. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta 7b3d9be388 Rename LDAPEntry method commit to reset_modlist. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:38:29 +01:00
Jan Cholasta 911f5e9eb7 PKI service restart after CA renewal failed 
Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092
 2014-01-08 09:47:23 +01:00
Jan Cholasta 1357eade4c Prevent garbage from readline on standard output of dogtag-ipa-retrieve-agent. 
https://fedorahosted.org/freeipa/ticket/4064
 2013-12-20 14:31:05 +01:00
Jan Cholasta bc3f3381c6 Convert remaining backend code to LDAPEntry API. 2013-12-16 14:44:19 +01:00
Jan Cholasta 36502a6367 Fix internal error in the user-status command. 
https://fedorahosted.org/freeipa/ticket/4066
 2013-12-10 15:34:45 +01:00
Jan Cholasta 5e2f7b68f0 Remove CFLAGS duplication. 
https://fedorahosted.org/freeipa/ticket/3896
 2013-12-06 14:44:41 +01:00
Jan Cholasta 07ddfdd127 Fix compilation error in ipa-cldap. 
https://fedorahosted.org/freeipa/ticket/3896
 2013-12-06 14:44:40 +01:00
Jan Cholasta 8bfa79289a Add stricter default CFLAGS to Makefile. 
https://fedorahosted.org/freeipa/ticket/3896
 2013-12-06 14:44:40 +01:00
Jan Cholasta 75dadc1d8f Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file. 
Remove explicitly specified hardening flags from LDFLAGS in ipa-otpd.

https://fedorahosted.org/freeipa/ticket/3896
 2013-12-06 14:44:40 +01:00
Jan Cholasta f618e35a1a Prefer user CFLAGS/CPPFLAGS over those provided by rpmbuild in the spec file. 
https://fedorahosted.org/freeipa/ticket/3896
 2013-12-06 14:44:40 +01:00
Jan Cholasta db3e450732 Own /usr/share/ipa/ui/js/ in the spec file. 
https://fedorahosted.org/freeipa/ticket/4010
 2013-12-02 12:37:44 +01:00
Jan Cholasta 652c4e6ace Use hardening flags for ipa-optd. 
https://fedorahosted.org/freeipa/ticket/4010
 2013-12-02 12:37:41 +01:00
Jan Cholasta 4050e553c3 Remove unused method get_api of the ldap2 plugin. 
https://fedorahosted.org/freeipa/ticket/3971
 2013-11-27 13:46:42 +01:00
Jan Cholasta 97445b2df3 Refactor indirect membership processing. 
A single LDAP search is now used instead of one search per member.

https://fedorahosted.org/freeipa/ticket/3971
 2013-11-27 13:46:42 +01:00
Jan Cholasta a9bf18ab95 Support searches with paged results control in LDAPClient. 
https://fedorahosted.org/freeipa/ticket/3971
 2013-11-27 13:46:41 +01:00
Jan Cholasta 8013056194 Add wrapper for result3 to IPASimpleLDAPObject. 
https://fedorahosted.org/freeipa/ticket/3971
 2013-11-27 13:46:41 +01:00
Jan Cholasta 73df6150e5 Move IPA specific code from LDAPClient to the ldap2 plugin. 
https://fedorahosted.org/freeipa/ticket/3971
 2013-11-27 13:46:41 +01:00
Jan Cholasta f20577ddc4 Remove mod_ssl port workaround. 
https://fedorahosted.org/freeipa/ticket/4021
 2013-11-26 12:58:17 +01:00
Jan Cholasta df5f4ee81d Turn LDAPEntry.single_value into a dictionary-like property. 
This change makes single_value consistent with the raw property.

https://fedorahosted.org/freeipa/ticket/3521
 2013-11-05 13:56:55 +01:00
Jan Cholasta 941e9686a3 Use encoded values from entry objects directly when adding new entries. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:52 +01:00
Jan Cholasta e60eda3b3d Use encoded values from entry objects directly when generating modlists. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:52 +01:00
Jan Cholasta 78f0ca983b Store encoded attribute values from search results directly in entry objects. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:52 +01:00
Jan Cholasta a7180ed021 Remove legacy toDict and origDataDict methods of LDAPEntry. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta 463407ac6f Make sure attributeTypes updates are done before objectClasses updates. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta 9ecf4b7aac Decode and encode attribute values in LDAPEntry on demand. 
This is achieved by storing both decoded and encoded attribute values in
LDAPEntry and synchronizing changes between them whenever an attribute is
accessed.

Added a new property "raw" to LDAPEntry. It provides a dictionary-like
object which can be used to directly access encoded attribute values.

https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta 5d1d513849 Always use lists for values in LDAPEntry internally. 
Outside of LDAPEntry, it is still possible to use non-lists. Once we enforce
lists for attribute values, this will be removed.

https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta 5aadaa6030 Introduce IPASimpleLDAPObject.decode method for decoding LDAP values. 
This method is intended as a counterpart of IPASimpleLDAPObject.encode and
replaces IPASimpleLDAPObject.convert_value_list.

https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta 4f0814d7c0 Make LDAPEntry a wrapper around dict rather than a dict subclass. 
https://fedorahosted.org/freeipa/ticket/3521
 2013-10-31 18:09:51 +01:00
Jan Cholasta e98abdca9b Track DS certificate with certmonger on replicas. 
https://fedorahosted.org/freeipa/ticket/3975
 2013-10-29 15:31:16 +01:00
Jan Cholasta 194556beb0 Allow PKCS#12 files with empty password in install tools. 
https://fedorahosted.org/freeipa/ticket/3897
 2013-10-04 10:27:23 +02:00
Jan Cholasta c123264ac7 Read passwords from stdin when importing PKCS#12 files with pk12util. 
This works around pk12util refusing to use empty password files, which prevents
the use of PKCS#12 files with empty password.

https://fedorahosted.org/freeipa/ticket/3897
 2013-10-04 10:27:23 +02:00
Jan Cholasta e380acdc1c Fix nsslapdPlugin object class after initial replication. 
This is a workaround for <https://fedorahosted.org/389/ticket/47490>.

https://fedorahosted.org/freeipa/ticket/3915
 2013-09-10 09:49:43 +02:00
Jan Cholasta 7c66912824 Fix service-disable in CA-less install. 
https://fedorahosted.org/freeipa/ticket/3886
 2013-08-29 10:18:32 +02:00
Jan Cholasta 3c9261699a Fix ipa-server-certinstall usage string. 
https://fedorahosted.org/freeipa/ticket/3869
 2013-08-28 10:20:42 +02:00
Jan Cholasta fc8f0ae3ad Add --dirman-password option to ipa-server-certinstall. 
https://fedorahosted.org/freeipa/ticket/3869
 2013-08-28 10:20:41 +02:00
Jan Cholasta 5a8e326aeb Fix nsSaslMapping object class before configuring SASL mappings. 
This is a workaround for <https://fedorahosted.org/389/ticket/47490>.

https://fedorahosted.org/freeipa/ticket/3778
 2013-08-27 18:43:20 +02:00
Jan Cholasta 78cf94a52c Ask for PKCS#12 password interactively in ipa-server-certinstall. 
https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta 02be7acd15 Add --pin option to ipa-server-certinstall. 
Hide the unnecessary --dirsrv_pin and --http_pin options.

https://fedorahosted.org/freeipa/ticket/3869
 2013-08-20 16:18:59 +02:00
Jan Cholasta 1669253238 Untrack old and track new cert with certmonger in ipa-server-certinstall. 
https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta f2c3ae36f9 Replace only the cert instead of the whole NSS DB in ipa-server-certinstall. 
https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta 809123ab02 Ignore empty mod error when updating DS SSL config in ipa-server-certinstall. 
https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta 59c4aba883 Remove unused NSSDatabase and CertDB method find_root_cert_from_pkcs12. 
https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta 2b08168df4 Port ipa-server-certinstall to the admintool framework. 
Change the log file path from /var/log/ipa/default.log to admintool's default
path.

https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta ce711ddad8 Make PKCS#12 handling in ipa-server-certinstall closer to what other tools do. 
In particular, PKCS#12 validation and server certificate selection is now done
the same way as in ipa-server-install and ipa-replica-prepare.

https://fedorahosted.org/freeipa/ticket/3641
 2013-08-20 16:18:59 +02:00
Jan Cholasta 693710784b Print newline after receiving EOF in installutils.read_password. 2013-07-24 10:00:03 +02:00
Jan Cholasta ab2debd1ea Ask for PKCS#12 password interactively in ipa-replica-prepare. 
https://fedorahosted.org/freeipa/ticket/3717
 2013-07-24 10:00:03 +02:00
Jan Cholasta ea544bee4c Ask for PKCS#12 password interactively in ipa-server-install. 
https://fedorahosted.org/freeipa/ticket/3717
 2013-07-24 10:00:02 +02:00
Jan Cholasta b7f10d9fe6 Add new hidden command option to suppress processing of membership attributes. 
https://fedorahosted.org/freeipa/ticket/3706
 2013-07-23 13:13:54 +02:00
Jan Cholasta b5d008ed5a Run gpg-agent explicitly when encrypting/decrypting files. 
Also add an option to ipautil.run to redirect command output to /dev/null.

https://fedorahosted.org/freeipa/ticket/3767
 2013-07-17 16:15:15 +02:00
Jan Cholasta a209bb38aa Add missing equality index for ipaUniqueId. 
https://fedorahosted.org/freeipa/ticket/3743
 2013-07-11 12:39:26 +03:00
Jan Cholasta a10521a1dc Add missing substring indices for attributes managed by the referint plugin. 
The referint plugin does a substring search on these attributes each time an
entry is deleted, which causes a noticable slowdown for large directories if
the attributes are not indexed.

https://fedorahosted.org/freeipa/ticket/3706
 2013-07-11 12:39:26 +03:00
Jan Cholasta 30c06f7573 Use LDAP modify operation directly to add/remove group members. 
This prevents getting full member list from LDAP and putting it back later.

https://fedorahosted.org/freeipa/ticket/3706
 2013-07-11 12:39:26 +03:00
Jan Cholasta 55da832867 Use LDAP search instead of *group_show to check for a group objectclass. 
https://fedorahosted.org/freeipa/ticket/3706
 2013-07-11 12:39:26 +03:00
Jan Cholasta 100f13d95b Use LDAP search instead of *group_show to check if a group exists. 
https://fedorahosted.org/freeipa/ticket/3706
 2013-07-11 12:39:25 +03:00
Jan Cholasta ab96ca7831 Check trust chain length in CA-less install. 
https://fedorahosted.org/freeipa/ticket/3707
 2013-07-11 12:39:25 +03:00
Jan Cholasta ec75348354 Skip cert issuer validation in service and host commands in CA-less install. 
https://fedorahosted.org/freeipa/ticket/3736
 2013-07-09 14:22:57 -04:00
Jan Cholasta ea7db35b62 Enable SASL mapping fallback. 
Assign a default priority of 10 to our SASL mappings.

https://fedorahosted.org/freeipa/ticket/3330
 2013-06-27 17:06:51 +02:00
Jan Cholasta 736dd0fcd6 Do not skip SSSD known hosts in ipa-client-install --ssh-trust-dns. 
https://fedorahosted.org/freeipa/ticket/3705
 2013-06-27 08:48:40 +02:00
Jan Cholasta 76dc2176f9 Fix CA-less check in ipa-replica-install and ipa-ca-install. 
https://fedorahosted.org/freeipa/ticket/3750
 2013-06-26 11:00:20 +02:00
Jan Cholasta e201305743 Do not track DS certificate in CA-less setup. 
https://fedorahosted.org/freeipa/ticket/3675
 2013-06-12 12:59:54 +02:00
Jan Cholasta 5ae8515c20 Do not allow installing CA replicas in CA-less setup. 
https://fedorahosted.org/freeipa/ticket/3673
https://fedorahosted.org/freeipa/ticket/3674
 2013-06-12 12:59:54 +02:00
Jan Cholasta 2ccadf4726 Skip empty lines when parsing pk12util output. 2013-06-12 12:59:54 +02:00
Jan Cholasta 1e772b1845 Handle exceptions gracefully when verifying PKCS#12 files. 
https://fedorahosted.org/freeipa/ticket/3667
 2013-06-12 12:59:54 +02:00
Jan Cholasta 6b55623526 Remove stray error condition in ipa-server-install. 2013-06-12 12:59:54 +02:00
Jan Cholasta cf84376928 Use the correct PKCS#12 file for HTTP server. 
https://fedorahosted.org/freeipa/ticket/3665
 2013-06-12 12:59:54 +02:00
Jan Cholasta 252de46ebf Fix normalization of FQDNs in DNS installer code. 
https://fedorahosted.org/freeipa/ticket/3600
 2013-05-03 18:05:50 +02:00
Jan Cholasta ddd8988f1c Add support for OpenSSH 6.2. 
Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config
on openssh-server update.

https://fedorahosted.org/freeipa/ticket/3571
 2013-04-30 11:05:39 -04:00
Jan Cholasta 63e79a3d86 Add ipa-ca records for existing CA masters when installing DNS for the first time. 
https://fedorahosted.org/freeipa/ticket/3564
 2013-04-24 14:36:28 +02:00
Jan Cholasta 014f296274 Add DNS records for existing masters when installing DNS for the first time. 
https://fedorahosted.org/freeipa/ticket/3564
 2013-04-24 14:36:28 +02:00
Jan Cholasta 692fe7cbf7 Use correct zone when removing DNS records of a master. 
https://fedorahosted.org/freeipa/ticket/3563
 2013-04-18 08:05:17 +02:00
Jan Cholasta fe00788bb4 Delete DNS records in ipa-ca on ipa-csreplica-manage del. 
https://fedorahosted.org/freeipa/ticket/3547
 2013-04-15 21:12:41 +02:00