IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
11,247 Commits 11 Branches 63 Tags
5abd9bb99680df45b6cd87de3b08466d612344bb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Basti 6c061b6836 tests: add missing dependency iptables 
KDC proxy tests are using iptables, but this is optional package in at
least Fedora cloud image, thus we must have it in dependencies

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
 2017-05-10 09:23:07 +02:00
Martin Basti 05984f171b ca_status: add HTTP timeout 30 seconds 
CA sometimes "forgot to answer" so we have to add timeout for http
connection and ask again rather than wait for infinity.

https://pagure.io/freeipa/issue/6766

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-05-04 14:09:50 +02:00
Martin Basti 20f7689079 http_request: add timeout option 
httplib.HTTPConnection supports timeout option so _httplib_request can
be updated to allow passing connection keyword arguments to
connection_factory.

We need connection timeout for cases when reply from server is not
received on time to ask again and not to wait for infinity.

https://pagure.io/freeipa/issue/6766

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-05-04 14:09:50 +02:00
Martin Basti 7f4c2fbd97 Use proper SELinux context with http.keytab 
During upgrade keytab is moved to a new location using "move" operation.
This commit replaces move operation with "copy" and "remove" that
ensures a proper selinux context.

https://pagure.io/freeipa/issue/6924

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2017-05-03 17:42:50 +02:00
Martin Basti 2bab2d4963 Store GSSAPI session key in /var/run/ipa 
Runtime data should be stored in /var/run instead of /etc/httpd/alias.
This change is also compatible with selinux policy.

https://pagure.io/freeipa/issue/6880

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-04-27 12:35:46 +02:00
Martin Basti e8f2a415b3 Fix PKCS11 helper 
Slots in HSM are not assigned statically, we have to chose proper
slot from token label.

Softhsm i2.2.0 changed this behavior and now slots can change over
time (it is allowed by pkcs11 standard).

Changelog:
* created method get_slot() that returns slot number from
  used label
* replaces usage of slot in __init__ method of P11_Helper
  with label
* slot is dynamically detected from token label before
  session is opened
* pkcs11-util --init-token now uses '--free' instead '--slot'
  which uses first free slot (we don't care about slot numbers
  anymore)

https://pagure.io/freeipa/issue/6692

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-04-12 09:54:10 +02:00
Martin Basti bad0f608c4 Remove surplus 'the' in output of ipa-adtrust-install 
Fixing the typo

https://pagure.io/freeipa/issue/6864

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-04-11 13:06:13 +02:00
Martin Basti fd597f83ae collect audit.log for easier selinux investigation 
Audit log contains useful information about selinux issues

Reviewed-By: Milan Kubik <mkubik@redhat.com>
 2017-04-06 10:08:54 +02:00
Martin Basti eeaf428b1b Set "KDC:Disable Last Success" by default 
In big deployments enabled recording of the last sucesfull login
this creates a huge changelog on DS side and cause performance
issues even if this is excluded from replication.

Actually this is not used directly by FreeIPA so it is safe to remove
in new installations. User who need this must manually remove
"KDC:Disable Last Success" using `ipa config-mod` command or WebUI.

https://pagure.io/freeipa/issue/5313

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-03-27 18:24:05 +02:00
Martin Basti 9ac62bec44 Set development version to 4.5.90 
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-03-16 10:36:03 +01:00
Martin Basti 474e6a7a71 Update 4.5 translations 
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2017-03-15 17:44:14 +01:00
Martin Basti ca5b53adcc Add copy-schema-to-ca for RHEL6 to contrib/ 
Fixed version that works on RHEL6. Adding it to contrib to avoid loosing it.

https://pagure.io/freeipa/issue/6540

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-03-14 15:16:20 +01:00
Martin Basti f4c7f1dd8a Remove copy-schema-to-ca.py from master branch 
This script is used only for IPA <3.1, so it must be compatible with
ipa-3-0 branch, so it should be placed there

https://pagure.io/freeipa/issue/6540

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-03-14 15:16:20 +01:00
Martin Basti 4514ec1505 pylint: bump dependency to version >= 1.6 
Older pylint versions produces false positive errors

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-03-13 16:05:25 +01:00
Martin Basti 8fb61a55fe backup: backup anonymous keytab 
Freeipa stops working without anon keytab

https://pagure.io/freeipa/issue/5959

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2017-03-09 18:22:34 +01:00
Martin Basti 25fa2bb6c9 tests: use --setup-kra in tests 
This will allow to test --setup-kra option together with
ipa-server-install in install tests

Separate installation using ipa-kra-install is already covered.

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
 2017-03-08 15:50:30 +01:00
Martin Basti 4006cbbc02 KRA: add --setup-kra to ipa-server-install 
This patch allows to install KRA on first IPA server in one step using
ipa-server-install

This option improves containers installation where ipa-server can be
installed with KRA using one call without need to call docker exec.

Please note the the original `kra.install()` calls in
ipaserver/install/server/install.py were empty operations as it did
nothing, so it is safe to move them out from CA block

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
 2017-03-08 15:50:30 +01:00
Martin Basti 6c95f33d37 man: add missing --setup-adtrust option to manpage 
ipa-server-install and ipa-replica-install manpages miss --setup-adtrust
options

https://pagure.io/freeipa/issue/6630

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2017-03-08 12:57:53 +01:00
Martin Basti 53c8e9a53f ipactl restart: log httplib failues as debug 
There are several excerptions ConnectionRefusedError raised
before ipactl is able to connect to dogtag after restart. These
exception should be logged on debug level until timeout is reached.

https://fedorahosted.org/freeipa/ticket/6674

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-02-17 12:11:56 +01:00
Martin Basti 79b3fbf97d Tests: search for disabled users 
Add tests for searching disabled/enabled users.

XFAIL: newly created users has no 'nsaccountlock' attribute set and
user-find doesn't return them as active users. This should be fixed.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-02-17 10:07:46 +01:00
Martin Basti 5bd8217423 Test: DNS nsupdate from dns-update-system-records 
Get nsupdate data from dns-update-system-records, remove system records
and run nsupdate to verify that all system records were updated

https://fedorahosted.org/freeipa/ticket/6585

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-15 12:20:55 +01:00
Martin Basti 7eb2ef6190 DNS: dns-update-system-record can create nsupdate file 
Added option --out <path> creates a file with IPA DNS data in nsupdate
format.

https://fedorahosted.org/freeipa/ticket/6585

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-15 12:20:55 +01:00
Martin Basti dd119f8aad py3: ipa_generate_password: do not compare None and Int 
The one cannot compare None and Int in Py3
"""
unorderable types: NoneType() > int()
"""

Continue when class is disabled with None value

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 69072cb80f py3: change_admin_password: use textual mode 
Convert function to NamedTemporaryFile with textual mode, because
passwords are text. Using `with` and NamedTemporaryFile gives more
security agains leaking password from tempfiles.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 488d01ced7 py3: create DNS zonefile: use textual mode 
Also code was rewritten to use NamedTemporaryFile with context

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 47f912e16b py3: upgradeinstance: use bytes literals with LDIF operations 
python ldif support only bytes as values, literals must be bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 7fd36e4d36 py3: upgradeinstance: decode data before storing them as backup... 
...and vice versa
backup requires string not bytes, but ldap provide bytes thus data must
be decoded and encoded from restore

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti f31d73b79a py3: upgradeinstance: open dse.ldif in textual mode 
ldap ldif parser requires to have input file opened in textual mode

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti d4aa75d105 custodia: kem.set_keys: replace too-broad exception 
Exception is too brod and may hide various issues that show up later. If
the code expects that entry may exist, then ldap.ALREADY_EXISTS
exception should be used

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 8660b9e968 py3: kem.py: user bytes with ldap values 
python ldap requires bytes as values

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti c27a46177c py3: custodia: basedn must be unicode 
basedn in custodia related modules has type bytes, that causes issues in
Py3 when strings were concatenated with bytes

```
malformed RDN string = "cn=custodia,cn=ipa,cn=etc,b'dc=example,dc=com'"
```

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 2674a217ac py3: configparser: use raw keyword 
configparser.get() changed in python3 and `raw` is now a keyword attribute.

Also it must be set to True, otherwise InterpolationSyntaxError is raised

'''
InterpolationSyntaxError: '%' must be followed by '%' or '(', found:
'%2fvar%2frun%2fslapd-EXAMPLE-COM.socket'
'''

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti 88b192a37e py3: modify_s: attribute name must be str not bytes 
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-10 14:03:04 +01:00
Martin Basti b24787a67f py3: ldapupdate: fix logging str(bytes) issue 
bytes as argument of str() gives unexpected result by adding prefix "b"
there.

Also add missing safe_option() call to logging (it will fix another
str(bytes) issue)

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2017-02-08 18:09:49 +01:00
Martin Basti 387a1513bb DNSSEC: forwarders validation improvement 
Some DNS servers behaves oddly and instead sending result without RRSIG records
don't reply at all when DNSSEC flag is enabled (timeout). Instead of
hard error IPA should this handle as DNSSEC error and continue with
installation/adding forwarders.

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
 2017-02-08 15:59:41 +01:00
Martin Basti a5ccdc16cb py3: test_ipaserver: fix BytesWarnings 
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-02-08 15:41:39 +01:00
Martin Basti 6bb5af7bea py3: get_memberofindirect: fix ByteWarnings 
DN must be converted to bytes as other variables adn lists contain bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-02-08 15:41:39 +01:00
Martin Basti d38540acd6 py3: DN: fix BytesWarning 
User repr() instead of str() for bytes, it has the same effect, but it
is proper way how to print bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-02-08 15:41:39 +01:00
Martin Basti ad1a5551d5 Tests: fix wait_for_replication task 
DS changed a format of replication status attribute. Now it is with
prefix "Error (x)" where x is the error code.

Both formats were kept to allow tests run on older and new
versions of DS.

Reviewed-By: Milan Kubik <mkubik@redhat.com>
 2017-02-08 14:15:53 +01:00
Martin Basti 4c84341b8b py3: send Decimal number as string instead of base64 encoded value 
for Decimal only from client to server direction uses __base64__
notation. Server replies with pure string for Decimal data, and also
server is able to parse string and create decimal values where needed.

without this we need ugly py3 code:
-        return {'__base64__': base64.b64encode(str(val))}
+        return {'__base64__': base64.b64encode(
+            str(val).encode('ascii')).decode('ascii')}

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti ab53d80883 py3: ipaldap: properly encode DNSName to bytes 
The encode method of LDAPClient didn't return DNSName as bytes but
string in py3. In py2 it returns non-unicode string so it can be encoded
safely by ascii as to_text() method returns only ascii characters.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti a584758cfb py3: _convert_to_idna: fix bytes/unicode mistmatch 
ToASCII() returns bytes, it must be decoded to unicode

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti 03d0a55e8a py3: DNS: get_record_entry_attrs: do not modify dict during iteration 
In py3 keys() doesn't return list but iterator so it must be transformed
to tuple otherwise iterator will be broken.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti a3d3b0ad25 py3: _ptrrecord_precallaback: use bytes with labels 
DNS labels are bytes so bytes must be used for comparison

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti a93b2bea5c py3: remove_entry_from_group: attribute name must be string 
Do not encode attribute names

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti caa560ca79 py3: base64 encoding/decoding returns always bytes don't mix it 
Using unicode(bytes) call causes undesired side effect that is inserting
`b` character to result. This obviously causes issues with binary base64 data

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-08 08:32:44 +01:00
Martin Basti bd83fdf516 pki-base: use pki-base-python2 as dependency 
pki-base provides pki-base-python2, but we should depend directly on
pki-base-python2 because in future pki-base may provide pki-base-python3
instead.

Source: cheimes@redhat.com

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-07 13:18:27 +01:00
Martin Basti 66fa0585aa pki: add missing depedency pki-base[-python3] 
FreeIPA server modules requires pki module

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-02-07 13:18:27 +01:00
Martin Basti 91ab650ac4 py3: x509.py: return principal as unicode string 
X509 return principal as unicode string

https://fedorahosted.org/freeipa/ticket/4985
https://fedorahosted.org/freeipa/ticket/6640

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-02-07 11:36:38 +01:00
Martin Basti 5de70e3199 py3: tests_xmlrpc: do not call str() on bytes 
Calling str() on bytes causes undesired side effect: it adds prefix "b"
to the result of conversion. The method decode() should be used instead.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-02-02 13:43:16 +01:00
Martin Basti 980c8a5f9e py3: normalize_certificate: support both bytes and unicode 
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti b8d6524d43 py3: strip_header: support both bytes and unicode 
Various method passed various bytes or unicode as parameter

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 47e76e16ef py3: fingerprint_hex_sha256: fix encoding/decoding 
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti d5ab0637fe py3: fix CSR encoding inside framework 
csr must be in string because framework excpects only strings, so we
have to decode it back

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 1023cfebff Principal: validate type of input parameter 
Bytes are unsupported and we should raise a TypeError from Principal
__init__ method otherwise we get hard to debug result

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti deaf9ae247 Use dict comprehension 
Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti b37d18288d py3: can_read: attributelevelrights is already string 
Remove decode() as it causes error in py3 because the attribute is
already string not bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 49333058c8 py3: get_effective_rights: values passed to ldap must be bytes 
Values passed to LDAP must be bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti dd3d9f1ca6 py3: ipaldap: update encode/decode methods 
Update encoding/decoding accordingly to work under Py3

Removing functions that were used only once in code and give no real
improvements

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti aa036e5f33 py3: rpcserver fix undefined variable 
variable 'e' is valid only in except block in py3, so it must be
assigned to different variable for further usage

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti cca9aa43e1 py3: WSGI executioners must return bytes in list 
WSGI prints TypeError into error log when IPA doesn't return bytes in
list as result

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 35e135c4e3 py3: session: fix r/w ccache data 
ccache contains binary data, so it should be read and write in binary
mode

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 7e8eb53375 Py3: Fix undefined variable 
Variable 'e' has only local scope in except block in Py3

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti 9739d0354a py3: rpcserver: decode input because json requires string 
json library parses string so input must be decoded

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti a9fec1de1a py3: session.py decode server name to str 
This fix is temporal because Memcache will be removed soon, so it is
more workaround than fix

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-31 18:33:27 +01:00
Martin Basti f2ec44f270 Use proper logging for error messages 
https://fedorahosted.org/freeipa/ticket/6588r

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-01-31 10:44:42 +01:00
Martin Basti 38fd8b356d wait_for_entry: use only DN as parameter 
Using the whole entry is not needed as parameter because only DN is used
and it prevents easier usage of this function

https://fedorahosted.org/freeipa/ticket/6588

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-01-31 10:44:42 +01:00
Martin Basti 18337bf7f7 py3: decode bytes for json.loads() 
In py 3.5 json.loads requires to have string as input, all bytes must be
decoded.

Note: python 3.6 supports bytes for json.loads()

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 0eb5a0e0ec dogtag.py: fix exception logging of JSON data 
'read_ca' and 'create_ca' have no logging when exception happened and it
masks real reason why it failed.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 1e0f98a146 py3: convert_attribute_members: don't use bytes as parameter for DN 
due perfomance improvement in e4930b3235
we have to decode value before it can be used in DN() constructor.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 746d4ffc58 py3: make_filter_from_attr: use string instead of bytes 
Method escape_filter_chars() requires string as parameter instead of
bytes. 'value_to_utf8' returns bytes thus this code has to be removed.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 4b148c8ca3 py3: __add_acl: use standard ipaldap methods 
Using raw pyldap interface we have to keep vaules as bytes. Is easier to
migrate to ipaldap and use strings without decoding and encoding.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 0a1d7f2e01 py3: add_entry_to_group: attribute name must be string not bytes 
With bytes as attribute name pyldap raises type error

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 51578882fc py3: HTTPResponse has no 'dict' attribute in 'msg' 
There is no 'dict' attribute in 'msg', but 'msg' attribute is dict-like object
in both py2/3, so it can be used instead.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti c0b5c6709d py3: _httplib_request: don't convert string to bytes 
There is no need to encode hostname to bytes. UTF-8 characters must be
encoded in different format in URL anyway and it causes only error in
Py3. String must be unicode to support Py2.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 232ceed5bb py3: cainstance: replace mkstemp with NamedTemporaryFile 
With Python3 files must be opened in textual mode to write text, and
best practise is to use fileobject instead fo os.write() and manual
encodig

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 2547bca8df py3: write CA/KRA config into file opened in text mode 
config parser writes data as text so CA/KRA should be opened in textual
mode otherwise type errors are raised from installer

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 0d4074b4f1 py3: CA/KRA: config parser requires string 
basedn is DN object it has to be converted to string before it can be
used with config parser

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 7ae5e5f669 py3: ipautil: open tempfiles in text mode 
Code in ipautlis works with text, so tempfiles should be open in
textmode otherwise TypeErrors are raised

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti bbe8849a65 py3: ldap modlist must have keys as string, not bytes 
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 63b5d4a859 py3: open temporary ldif file in text mode 
ldif parser uses file in text mode, so we have to open it in text mode
in py3

Also values passed to parser should be bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti e064109277 py3: service.py: replace mkstemp by NamedTemporaryFile 
NamedTemporaryfile can be used in more pythonic way and file can be
opened in textual mode that is required with PY3

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti 23239bccc1 py3: create_cert_db: write to file in a compatible way 
Py3 expect bytes to be writed using os.write. Instead of that using
io module is more pythonic.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-24 13:25:47 +01:00
Martin Basti ccea23138b _resolve_records: fix assert, nameserver_ip can be none 
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2017-01-24 09:58:06 +01:00
Martin Basti 083b4241d2 Remove duplicated step from DS install 
"Adding SASL mappings.." is duplicated step in __common_setup in DS
instance and should be removed.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2017-01-12 11:15:14 +01:00
Martin Basti d648c6a692 py3: enable py3 pylint 
We should run pylint in both python2 and python3 versions

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2017-01-11 13:17:15 +01:00
Martin Basti 35ba724de9 Py3: Fix ToASCII method 
in Py2 to_text method returns Py2 non-unicode string, but in Py3 to_text method
returns Py3 default (unicode) string. So only in Py2 we have to decode
str to unicode.

https://fedorahosted.org/freeipa/ticket/5935

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2017-01-06 12:48:10 +01:00
Martin Basti 0663faf258 fix: regression in API version comparison 
Commint 2cbaf15604 introduced a regression
in API version comparison. In case that newer client is trying to call
older server an error is returned, but it should work. This commit fixes
it.

https://fedorahosted.org/freeipa/ticket/6468

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2016-12-13 13:53:27 +01:00
Martin Basti 15351ab6e7 ipactl: pass api as argument to services 
Commit 6409abf1 removes hard dependency of ipalib in ipalatform to avoid
cyclic dependenies, this commit updates ipactl accordingly

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-12-12 14:19:42 +01:00
Martin Basti a291c6ded9 DNS: URI records: bump python-dns requirements 
Support for DNS URI records has been added in python-dns 1.13

https://fedorahosted.org/freeipa/ticket/6344

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2016-11-29 14:28:42 +01:00
Martin Basti 55b14abcb5 remove Knob function 
`Knob` function is an old implementation which was replcaed by `knob`
function and currently is unused, so it can be removed

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-22 17:38:38 +01:00
Martin Basti 61094a2a20 KRA: don't add KRA container when KRA replica 
This fixes regression caused by c56256e2a2
"""
  [9/11]: add vault container
ipa         : CRITICAL Failed to load vault.ldif: Command
'/usr/bin/ldapmodify -v -f /tmp/tmpxxO9IC -H
ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket -x -D cn=Directory
Manager
-y /tmp/tmpVKinCZ' returned non-zero exit status 68
  [10/11]: apply LDAP updates
"""

and removes unneded steps during installation of KRA replica,
because KRA container must be there since installation of first KRA
instance.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-21 17:58:49 +01:00
Martin Basti ad32bf147e Zanata: exlude testing ipa.pot file 
Exlude testing file "ipatests/test_ipalib/data/ipa.pot" which should not be
uploaded to zanata.

https://fedorahosted.org/freeipa/ticket/6435

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-11-21 14:47:47 +01:00
Martin Basti 847b6eddab client: use correct code for failed uninstall 
Hardcoded value 1 means CLIENT_INSTALL_ERROR, but this part belongs to
uninstallation so it should be CLIENT_UNINSTALL_ERROR

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti 5249eb817e client: use exceptions instead of return states 
Python has builtin exceptions which can be used very well to handling
errors in python instead of returning error states (C style)

Exception will allow better client-server integration in future

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti c38ce49e8d client: move install part to else branch 
https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti b3786730e5 client: move install cleanup from ipa-client-install to module 
Cleanup should be part of installation function

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti bbad08900b client: move clean CCACHE to module 
According 04b8575c52 cleaning CCACHE is
needed after installation. This commit moves this cleanup from
ipa-client-install to client.install() function

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti 8cbbb53591 client: fix script execution 
if __name__ == "__main__" should be first instead of try block. We want
execute it only when file was executed as script

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00
Martin Basti 1f65c07524 client: Remove useless except in ipa-client-install 
SystemExit is raised by sys.exit() so catching and reraising it again is
wasting of resources

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
 2016-11-11 12:13:56 +01:00