Commit Graph

404 Commits

Author SHA1 Message Date
Martin Basti
4f25b29605 SPEC: do not run upgrade when ipa server is not installed
Running upgrade when IPA is not installed produces false positive errors

https://fedorahosted.org/freeipa/ticket/5704

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-22 10:28:16 +01:00
Martin Babinsky
aa74995736 spec: require python-cryptography newer than 0.9
When generating keys for custodia service, the key material is stored in
python-cryptography's OpenSSL backend encoded as DER. This only works in
python-cryptography 0.9 and newer so we need to make sure this version pulled
in during RPM build and install.

https://fedorahosted.org/freeipa/ticket/5744

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-21 17:53:25 +01:00
Martin Babinsky
3ab63fa6ba spec: add conflict with bind-chroot to freeipa-server-dns
https://fedorahosted.org/freeipa/ticket/5696

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-18 09:32:47 +01:00
Martin Basti
d6f03da753 spec: Add missing dependencies to python*-ipalib package
Standalone instalation of python*-ipalib packages does not pull all
required packages and results into import errors.

https://fedorahosted.org/freeipa/ticket/5680

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-18 07:16:39 +01:00
Lukas Slebodnik
2a61ddb644 SPEC: Remove unused build dependency on libwbclient
The string "wbclient" is not mentioned anywhere in
source code and there isn't any issue with building
freeipa packages without this package.

Reviewed-By: Sumit Bose <sbose@redhat.com>
2016-03-09 19:03:06 +01:00
Thierry Bordaz
6851e560dd configure DNA plugin shared config entries to allow connection with GSSAPI
https://fedorahosted.org/freeipa/ticket/4026

When a replica needs to extend its DNA range, it selects the remote replica with the
larger available range. If there is no replica agreement to that remote replica,
the shared config entry needs to contain the connection method/protocol.
This fix requires 389-ds
 * https://fedorahosted.org/389/ticket/47779
 * https://fedorahosted.org/389/ticket/48362

That are both fixed in 1.3.4.6

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-02 16:43:17 +01:00
Tomas Babej
271086ebdd spec: Bump required sssd version to 1.13.3-5
https://fedorahosted.org/freeipa/ticket/4403
https://fedorahosted.org/freeipa/ticket/4436

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-03-01 12:40:25 +01:00
Alexander Bokovoy
1353847e49 slapi-nis: update configuration to allow external members of IPA groups
Currently in an environment with trust to AD the compat tree does not
show AD users as members of IPA groups. The reason is that IPA groups
are read directly from the IPA DS tree and external groups are not
handled.

slapi-nis project has added support for it in 0.55, make sure we update
configuration for the group map if it exists and depend on 0.55 version.

https://fedorahosted.org/freeipa/ticket/4403

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-03-01 12:40:25 +01:00
Petr Viktorin
ec95ffaa52 Package python3-ipaclient
Part of the work for https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-29 08:28:50 +01:00
Timo Aaltonen
872d5903d0 Move freeipa certmonger helpers to libexecdir.
The scripts in this directory are simple python scripts, nothing arch-specific
in them. Having them under libexec would simplify the code a bit too, since
there would be no need to worry about lib vs lib64 (which also cause trouble
on Debian).

https://fedorahosted.org/freeipa/ticket/5586

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-26 08:29:44 +01:00
Jan Cholasta
11592dde1b client: stop using /etc/pki/nssdb
Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses
/etc/ipa/nssdb and IPA CA certificates are provided to the system using
p11-kit. Remove leftovers on upgrade.

https://fedorahosted.org/freeipa/ticket/5592

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-24 10:53:28 +01:00
Jan Cholasta
b3411dc985 replica promotion: fix AVC denials in remote connection check
Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob.

https://fedorahosted.org/freeipa/ticket/5550

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-02-11 18:40:39 +01:00
Petr Viktorin
840de9bb48 Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)
Make ipaclient a Python library like ipapython, ipalib, etc.
Use setup.py instead of autotools for installing it.

Move C client tools, Python scripts, and man pages, to client/.

Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS).
Remove /setup-client.py (ipalib/setup.py should be used instead).

Update Makefiles and the spec file accordingly.

https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-27 12:09:02 +01:00
Jan Cholasta
6896035af2 spec file: package python-ipalib as noarch
https://fedorahosted.org/freeipa/ticket/5596

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2016-01-25 12:30:03 +01:00
Fraser Tweedale
fd7ea2c939 Remove workaround for CA running check
A workaround was introduced for ticket #4676 that used wget to
perform an (unauthenticated) https request to check the CA status.
Later, wget was changed to curl (the request remained
unauthenticated).

Remove the workaround and use an http request (no TLS) to check the
CA status.  Also remove the now-unused unauthenticated_http_request
method, and update specfile to remove ipalib dependency on curl.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-21 14:09:44 +01:00
Jan Cholasta
500ee7e2b1 ipapython: port p11helper C code to Python
This replaces the binary _ipap11helper module with cffi-based Python code.

https://fedorahosted.org/freeipa/ticket/5596

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-21 10:21:32 +01:00
Petr Vobornik
3aef54d0c2 spec: do not require arch specific ipalib package from noarch packages
noarch packages should not contain:
  Requires: some-package-{?_isa}

because then they are not the same for each arch - are not noarch

https://fedorahosted.org/freeipa/ticket/5568

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-20 12:16:35 +01:00
Jan Cholasta
7e56b4bbd7 ipapython: remove default_encoding_utf8
Replace the "import default_encoding_utf8" in ipalib/cli.py with equivalent
Python code.

https://fedorahosted.org/freeipa/ticket/5596

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-01-15 13:39:52 +01:00
Martin Basti
34b197afa4 DNSSEC CI: add missing ldns-utils dependency
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-12 10:45:00 +01:00
Martin Babinsky
7cd99e8520 use FFI call to rpmvercmp function for version comparison
Stop using rpm-python to compare package versions since the implicit NSS
initialization upon  the module import breaks NSS handling in IPA code. Call
rpm-libs C-API function via CFFI instead.

Big thanks to Martin Kosek <mkosek@redhat.com> for sharing the code snippet
that spurred this patch.

https://fedorahosted.org/freeipa/ticket/5572

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-01-11 17:54:36 +01:00
Christian Heimes
6ac3553dde Require Dogtag 10.2.6-13 to fix KRA uninstall
The combination of a bug in Dogtag's sslget command and a new feature
in mod_nss causes an incomplete uninstallation of KRA. The bug has been
fixed in Dogtag 10.2.6-13.

https://fedorahosted.org/freeipa/ticket/5469
https://fedorahosted.org/pki/ticket/1704

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-01-06 20:35:52 +01:00
Martin Basti
91913c5ba7 Fix version comparison
Use RPM library to compare vendor versions of IPA for redhat platform

https://fedorahosted.org/freeipa/ticket/5535

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-22 14:08:41 +01:00
Petr Viktorin
53b60546e4 Package ipapython, ipalib, ipaplatform, ipatests for Python 3
Running make with PYTHON=/usr/bin/python3 will build/install the
bits for Python 3.

Executable scripts in ipatests have symlinks Python version suffixes
as per Fedora guidelines. Suffix-less names point to the Python 2 versions.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-17 10:52:57 +01:00
David Kupka
8b1002a18c spec file: Add dbus-python to BuildRequires
Commit 8d7f67e introduced the need for dbus-python during build time.

https://fedorahosted.org/freeipa/ticket/5497
2015-12-14 13:38:52 +01:00
Gabe
5c9b9089b7 Migrate wget references and usage to curl
https://fedorahosted.org/freeipa/ticket/5458

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-11 18:46:10 +01:00
Jan Cholasta
8d7f67e08c replica install: add remote connection check over API
Add server_conncheck command which calls ipa-replica-conncheck --replica
over oddjob.

https://fedorahosted.org/freeipa/ticket/5497

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-11 18:44:13 +01:00
Jan Cholasta
00f591d4e9 build: put oddjob scripts into separate directory
https://fedorahosted.org/freeipa/ticket/5497

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-11 18:44:13 +01:00
Jan Cholasta
e9baafb08f spec file: put Python modules into standalone packages
Make the following changes in packaging:

* freeipa-server - split off python2-ipaserver and freeipa-server-common,
* freeipa-server-dns - build as noarch,
* freeipa-client - split off python2-ipaclient and freeipa-client-common,
* freeipa-admintools - build as noarch,
* freeipa-python - split into python2-ipalib and freeipa-common, provide
  freeipa-python-compat for upgrades,
* freeipa-tests - rename to python2-ipatests and build as noarch.

Bump version to 4.2.91.

https://fedorahosted.org/freeipa/ticket/3197

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-11 15:17:41 +01:00
Jan Cholasta
f50b4647ba spec file: remove config files from freeipa-python
/etc/ipa/dnssec is now owned by freeipa-server. The remaining files are now
owned by freeipa-client.

https://fedorahosted.org/freeipa/ticket/3197

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-11 15:17:41 +01:00
Simo Sorce
f12f56fe8d Support sourcing the IPA server name from config
Use ding-libs to parse /etc/ipa/default.conf to find the IPA server
to contact by default.

Signed-off-by: Simo Sorce <simo@redhat.com>

Ticket: https://fedorahosted.org/freeipa/ticket/2203
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2015-11-27 15:58:51 +01:00
Christian Heimes
b6c893aae6 mod_auth_gssapi: Remove ntlmssp support and restrict mechanism to krb5
By default mod_auth_gssapi allows all locally available mechanisms. If
the gssntlmssp package is installed, it also offers ntlmssp.  This has
the annoying side effect that some browser will pop up a
username/password request dialog if no Krb5 credentials are available.

The patch restricts the mechanism to krb5 and removes ntlmssp and
iakerb support from Apache's ipa.conf.

The new feature was added to mod_auth_gssapi 1.3.0.

https://fedorahosted.org/freeipa/ticket/5114

Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-11-26 15:20:19 +01:00
Lukas Slebodnik
5594205628 SPEC: Run cmocka based unit test in %check phase
This patch also consolidate build dependencies for
c based unit tests

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-18 12:52:20 +01:00
Martin Basti
19044e87ac Drop configure.jar
Configure.jar used to be used with firefox version < 10 which is not
supported anymore, thus this can be removed.

https://fedorahosted.org/freeipa/ticket/5144

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-11-13 14:02:45 +01:00
Tomas Babej
ab58ec0d50 spec: Add Provides directives to alternative package names
https://fedorahosted.org/freeipa/ticket/5408

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-12 09:54:59 +01:00
Lukas Slebodnik
85253b9c40 SPEC: Drop sssd from BuildRequires
Packaging of sssd was changed and more sub-packages are build
from sssd.src.rpm. Especially python bindings and development packages
are already in sub-packages. As a result of this change the meta package
sssd can be removed from BuildRequires without any problem.

FreeIPA spec file contained build requirement for latest version of
sssd even though the latest sssd was not required for building
FreeIPA rpms. In many cases, it was sufficient just to change requirements
for FreeIPA packages instead of build requirements.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-11-05 13:37:47 +01:00
Alexander Bokovoy
abf34d99d9 spec file: depend on Dogtag 10.2.6-12 for tomcat 8 upgrade
Dogtag 10.2.6-12 includes automatic upgrade from Tomcat 7 to Tomcat 8.
Otherwise FreeIPA is broken after upgrades. This affects Fedora 22 to
Fedora 23 upgrades.

https://bugzilla.redhat.com/show_bug.cgi?id=1274915

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-11-02 19:28:54 +01:00
Petr Vobornik
3f0707a199 change pki-core required version for replica promotion
Required PKI changes, namely:
  https://fedorahosted.org/pki/ticket/1414
  https://fedorahosted.org/pki/ticket/1580

Are included in pki-core 10.2.6-5 reps. 10.2.6-10

10.2.7 does not exist yet.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-27 18:03:01 +01:00
Petr Vobornik
fff31ca220 topology: manage ca replication agreements
Configure IPA so that topology plugin will manage also CA replication
agreements.

upgrades if CA is congigured:
- ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX
- ipaReplTopoManagedSuffix: o=ipaca is added to master entry
- binddngroup is added to o=ipaca replica entry

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Simo Sorce
2cd0d20a2a Require a DS version that has working DNA plugin
The DNA plugin needed to be fixed to deal with replica binddn groups.
Version 1.3.4.4 is needed for that.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Simo Sorce
463dda3067 Add ipa-custodia service
Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Gabe
a6d9c40f14 Update FreeIPA package description
https://fedorahosted.org/freeipa/ticket/5284

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-06 18:05:37 +02:00
Jan Cholasta
4c39561261 install: fix kdcproxy user home directory
https://fedorahosted.org/freeipa/ticket/5314

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-23 16:29:49 +02:00
Jan Cholasta
0de8603183 install: create kdcproxy user during server install
This change makes kdcproxy user creation consistent with DS and CA user
creation. Before, the user was created in the spec file, in %pre scriptlet
of freeipa-server.

https://fedorahosted.org/freeipa/ticket/5314

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-22 16:34:51 +02:00
Tomas Babej
cfeea91828 ipa-backup: Add mechanism to store empty directory structure
Certain subcomponents of IPA, such as Dogtag, cannot function if
non-critical directories (such as log directories) have not been
stored in the backup.

This patch implements storage of selected empty directories,
while preserving attributes and SELinux context.

https://fedorahosted.org/freeipa/ticket/5297

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-09-22 13:17:25 +02:00
Jan Cholasta
5137478fb8 install: support KRA update
https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Petr Viktorin
066d08f124 Add python-six to dependencies
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:38:56 +02:00
Rob Crittenden
7ed51586ca Use %license instead of %doc for packaging the license
https://fedorahosted.org/freeipa/ticket/5227

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-31 13:28:54 +02:00
Michael Simacek
aad73fad60 Port from python-krbV to python-gssapi
python-krbV library is deprecated and doesn't work with python 3. Replacing all
it's usages with python-gssapi.

- Removed Backend.krb and KRB5_CCache classes
  They were wrappers around krbV classes that cannot really work without them
- Added few utility functions for querying GSSAPI credentials
  in krb_utils module. They provide replacements for KRB5_CCache.
- Merged two kinit_keytab functions
- Changed ldap plugin connection defaults to match ipaldap
- Unified getting default realm
  Using api.env.realm instead of krbV call

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-08-26 09:41:36 +02:00
Jan Cholasta
aebb72e1fb spec file: Add Requires(post) on selinux-policy
This prevents ipa-server-upgrade failures on SELinux AVCs because of old
selinux-policy version.

https://fedorahosted.org/freeipa/ticket/5256

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-08-26 08:19:32 +02:00
Michael Simacek
584788a91a Bump python-gssapi version to 1.1.2
python-gssapi had a bug in exception handling that caused exceptions to be
shadowed by LookupError. The new version should fix the problem.

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2015-08-24 08:03:10 +02:00