Commit Graph

403 Commits

Author SHA1 Message Date
Martin Kosek
6ee9480b7b Handle LDAP search references
LDAP search operation may return a search reference pointing to
an LDAP resource. As the framework does not handle search
references, skip these results to prevent result processing
failures.

Migrate operation crashed when the migrated DS contained search
references. Now, it correctly skips these records and prints the
failed references to user.

https://fedorahosted.org/freeipa/ticket/1209
2011-06-10 08:34:27 +02:00
Martin Kosek
915235859c IPA installation with --no-host-dns fails
--no-host-dns option should allow installing IPA server on a host
without a DNS resolvable name.

Update parse_ip_address and verify_ip_address functions has been
changed not to return None and print error messages in case of
an error, but rather let the Exception be handled by the calling
routine.

https://fedorahosted.org/freeipa/ticket/1246
2011-06-10 08:29:14 +02:00
Rob Crittenden
a26fb5aaca Fix external CA installation
When re-creating the CADS instance it needs to be more fully-populated
so we have enough information to create an SSL certificate and move
the principal to a real entry.

https://fedorahosted.org/freeipa/ticket/1245
2011-06-09 17:41:43 +02:00
Jan Cholasta
db78f36235 Honor netmask in DNS reverse zone setup.
ticket 910
2011-05-30 13:37:03 +02:00
Jan Cholasta
80b4b3d44b Parse netmasks in IP addresses passed to server install.
ticket 1212
2011-05-30 13:36:26 +02:00
Rob Crittenden
868d4e734e Do a lazy retrieval of the LDAP schema rather than at module load.
Attempt to retrieve the schema the first time it is needed rather than
when Apache is started. A global copy is cached for future requests
for performance reasons.

The schema will be retrieved once per Apache child process.

ticket 583
2011-05-30 09:16:30 +02:00
Martin Kosek
17c3f9e84e Fix reverse zone creation in ipa-replica-prepare
When a new reverse zone was created in ipa-replica-prepare (this
may happen when a new replica is from different subnet), the master
DNS address was corrupted by invalid A/AAAA record. This caused
problems for example in installing replica.

https://fedorahosted.org/freeipa/ticket/1223
2011-05-27 18:00:47 +02:00
Rob Crittenden
201ffc07bd Configure Managed Entries on replicas.
The Managed Entries plugin configurations weren't being created on
replica installs. The templates were there but the cn=config
portions were not.

This patch adds them as updates. The template portion will be added
in the initial replication.

ticket 1222
2011-05-25 16:39:27 -04:00
Rob Crittenden
00abd47de4 Enable 389-ds SSL host checking by defauilt
Enforce that the remote hostname matches the remote SSL server certificate
when 389-ds operates as an SSL client.

Also add an update file to turn this off for existing installations.

This also changes the way the ldapupdater modlist is generated to be more
like the framework. Single-value attributes are done as replacements
and there is a list of force-replacement attributes.

ticket 1069
2011-05-20 10:08:11 -04:00
Rob Crittenden
4027b12371 Test for forwarded Kerberos credentials cache in wsgi code.
We should more gracefully handle if the TGT has not been forwarded
than returning a 500 error.

Also catch and display KerberosErrors from ping() in the client better.

ticket 1101
2011-05-18 09:35:04 +02:00
Jr Aquino
756d61724e Return copy of config from ipa_get_config()
It was discovered that using the batch plugin it was possible to
store duplicate data in parts of the ipa_config during iterations.
This was causing a cascading exec failures if any one of the batch
executions failed.

https://fedorahosted.org/freeipa/ticket/1220
2011-05-13 13:09:24 -04:00
Martin Kosek
2cbc6fd6a2 Improve service manipulation in client install
Remove redundant ipa-client-install error message when optional nscd
daemon was not installed. Additionally, use standard IPA functions
for service manipulation and improve logging.

https://fedorahosted.org/freeipa/ticket/1207
2011-05-13 13:24:35 +02:00
Martin Kosek
e2aab9636e Let selinux-policy handle port 7390
Since selinux-policy-3.9.16-5.fc15 is out, the dogtag port 7390 is
handled via selinux-policy and there is no need to manage it in
FreeIPA installer.

https://fedorahosted.org/freeipa/ticket/1205
2011-05-11 17:54:37 -04:00
Simo Sorce
d1fd695467 install-scripts: avoid using --list with chkconfig
This option does not behave properly in F15 as chkconfig does not list services
moved to use systemd service files.

Plus there are more direct ways than parsing its output, which are more
reliable.

Also just testing for the availability of the service calling 'chkconfig name'
is enough.

https://fedorahosted.org/freeipa/ticket/1206
2011-05-06 15:46:41 +02:00
Martin Kosek
af6d3347ba NS records not updated by replica
When replica with DNS is installed, NS records for the managed zone
are not updated with the replica FQDN. The administrator then has
to do it manually to enroll the new DNS server to the zone.

This patch also removes the newly created NS records when the
replica is removed via ipa-replica-manage command.

https://fedorahosted.org/freeipa/ticket/1034
2011-05-03 15:12:07 +02:00
Martin Kosek
ea5efc5dfa LDAP Updater may crash IPA installer
Fix a logging error in ipa-ldap-updater which may cause IPA
installer to crash.

https://fedorahosted.org/freeipa/ticket/1199
2011-05-02 10:45:41 -04:00
Rob Crittenden
1dd7364b7b Handle principal not found errors when converting replication a greements
There are times where one side or the other is missing its peers
krbprincipalname when converting from simple to GSSAPI replication. Ticket
1188 should address the cause of this.

This patch provides better information and handling should either side
be missing.

ticket 1044
2011-04-28 15:10:25 +02:00
Martin Kosek
98eefab5e1 Improve Directory Service open port checker
Wait for DS ports to open after _every_ DS service restart.
Several restarts were missed by the current open port checker
implementation.

https://fedorahosted.org/freeipa/ticket/1182
2011-04-28 09:59:34 +02:00
Jr Aquino
cc0e6680b9 Optimize and dynamically verify group membership
Rather than doing full searches for members read each member individually
to determine if it is direct or indirect.

Also add a fail-safe when calculating indirect membership so removing
a member will log enough information for debugging (ticket 1133).

https://fedorahosted.org/freeipa/ticket/1139
https://fedorahosted.org/freeipa/ticket/1133
2011-04-22 14:15:16 -04:00
Rob Crittenden
46a3411420 Wait for memberof task and DS to start before proceeding in installation.
This was causing a replica DS instance to crash if the task was not
completed when we attempted a shutdown to do a restart.

In replication.py we were restarting the DS instance without waiting
for the ports to become available.

It is unlikely that the dn of the memberof task will change but just in
case I noted it in the two places it is referenced.

ticket 1188
2011-04-22 11:43:50 +02:00
Jan Cholasta
5700920627 Fix uninitialized attributes. 2011-04-21 10:41:29 +02:00
Rob Crittenden
fe67680da5 The default groups we create should have ipaUniqueId set
This adds a new directive to ipa-ldap-updater: addifnew. This will add
a new attribute only if it doesn't exist in the current entry. We can't
compare values because the value we are adding is automatically generated.

ticket 1177
2011-04-15 13:02:17 +02:00
Jan Cholasta
1ac3ed2c27 Fix lint false positives. 2011-04-13 15:58:45 +02:00
Rob Crittenden
d42bf3f530 Fix traceback in ipa-nis-manage.
The root user cannot use ldapi because of the autobind configuration.
Fall back to a standard GSSAPI sasl bind if the external bind fails.
With --ldapi a regular user may be trying this as well, catch that
and report a reasonable error message.

This also gives priority to the DM password if it is passed in.

Also require the user be root to run the ipa-nis-manage command.
We enable/disable and start/stop services which need to be done as root.

Add a new option to ipa-ldap-updater to prompt for the DM password.
Remove restriction to be run as root except when doing an upgrade.

Ticket 1157
2011-04-11 15:33:03 -04:00
Rob Crittenden
b9a2c11d6f Fix ORDERING in some attributetypes and remove other unnecessary elements.
Looking at the schema in 60basev2.ldif there were many attributes that did
not have an ORDERING matching rule specified correctly. There were also a
number of attributeTypes that should have been just SUP
distinguishedName that had a combination of SUP, SYNTAX, ORDERING, etc.

This requires 389-ds-base-1.2.8.0-1+

ticket 1153
2011-04-05 21:46:32 -04:00
Rob Crittenden
e1ef080837 Cache the value of get_ipa_config() in the request context.
There are some operations that fetch the configuration multiple times.
This will return a cached value instead of getting it from LDAP over
and over.

ticket 1023
2011-03-31 13:08:32 -04:00
Jr Aquino
463d7d2fe8 Escape LDAP characters in member and memberof searches
https://fedorahosted.org/freeipa/ticket/1140
2011-03-31 12:52:08 -04:00
Jan Cholasta
b29bd47273 Fix wording of error message.
ticket 1009
2011-03-29 13:47:06 -04:00
Martin Kosek
18542cd165 Wait for Directory Server ports to open
When Directory Server operation is run right after the server restart
the listening ports may not be opened yet. This makes the installation
fail.

This patch fixes this issue by waiting for both secure and insecure
Directory Server ports to open after every restart.

https://fedorahosted.org/freeipa/ticket/1076
2011-03-21 14:31:08 -04:00
Rob Crittenden
ca5332951c Automatically update IPA LDAP on rpm upgrades
Re-enable ldapi code in ipa-ldap-updater and remove the searchbase
restriction when run in --upgrade mode. This allows us to autobind
giving root Directory Manager powers.

This also:
 * corrects the ipa-ldap-updater man page
 * remove automatic --realm, --server, --domain options
 * handle upgrade errors properly
 * saves a copy of dse.ldif before we change it so it can be recovered
 * fixes an error discovered by pylint

ticket 1087
2011-03-21 13:23:53 -04:00
Rob Crittenden
15e213d025 Ensure that the system hostname is lower-case.
ticket 1080
2011-03-18 14:54:01 -04:00
Rob Crittenden
861d1bbdca Fix SELinux errors caused by enabling TLS on dogtag 389-ds instance.
This fixes 2 AVCS:

* One because we are enabling port 7390 because an SSL port must be
  defined to use TLS On 7389.
* We were symlinking to the main IPA 389-ds NSS certificate databsae.
  Instead generate a separate NSS database and certificate and have
  certmonger track it separately

I also noticed some variable inconsistency in cainstance.py. Everywhere
else we use self.fqdn and that was using self.host_name. I found it
confusing so I fixed it.

ticket 1085
2011-03-15 14:09:57 -04:00
Simo Sorce
0b6b2342d0 Domain to Realm
Explicitly use the realm specified on the command line.
Many places were assuming that the domain and realm were the same.

https://bugzilla.redhat.com/show_bug.cgi?id=684690
https://fedorahosted.org/freeipa/ticket/1091
2011-03-14 15:26:07 -04:00
Rob Crittenden
9dfb0f05b0 Use TLS for dogtag replication agreements.
Configure the dogtag 389-ds instance with SSL so we can enable TLS
for the dogtag replication agreements. The NSS database we use is a
symbolic link to the IPA 389-ds instance.

ticket 1060
2011-03-10 09:57:36 -05:00
Martin Kosek
1c741e6278 ipa-dns-install script fails
This patch fixes a typo in class Service, function __get_conn which
causes ipa-dns-install script to fail every time.

https://fedorahosted.org/freeipa/ticket/1065
2011-03-08 10:24:53 -05:00
Pavel Zuna
64575a411b Use ldapi: instead of unsecured ldap: in ipa core tools.
The patch also corrects exception handling in some of the tools.

Fix #874
2011-03-03 14:04:34 -05:00
Rob Crittenden
f476c097d2 Replace only if old and new have nothing in common
Jakub did the initial diagnosis of this, I added a fix for removing
the last entry when removing members and a test case.

ticket 1000
2011-03-03 11:02:02 -05:00
Martin Kosek
f785af4efe Inconsistent sysrestore file handling by IPA server installer
IPA server/replica uninstallation may fail when it tries to restore
a Directory server configuration file in sysrestore directory, which
was already restored before.

The problem is in Directory Server uninstaller which uses and modifies
its own image of sysrestore directory state instead of using the
common uninstaller image.

https://fedorahosted.org/freeipa/ticket/1026
2011-03-03 11:02:02 -05:00
Simo Sorce
54b2627018 Store list of non-master replicas in DIT and provide way to list them
Fixes: https://fedorahosted.org/freeipa/ticket/1007
2011-03-02 09:46:46 -05:00
Rob Crittenden
07ba40f33e Use Sudo rather than SUDO as a label.
ticket 1005
2011-03-01 16:48:35 -05:00
Simo Sorce
b6ca0f210c Fix replica setup using replication admin kerberos credentials
Fixes: https://fedorahosted.org/freeipa/ticket/1022
2011-03-01 11:02:55 -05:00
Simo Sorce
2028695d88 Use wrapper for sasl gssapi binds so it behaves like other binds
By calling directly sasl_interactive_bind_s() we were not calling __lateinit()
This in turn resulted in some variables like dbdir not to be set on the
IPAadmin object.
Keep all bind types in the same place so the same common sbind steps can be
performed in each case.

Related to: https://fedorahosted.org/freeipa/ticket/1022
2011-03-01 11:02:55 -05:00
Simo Sorce
c335eb96e7 Fix winsync agreements setup
Fixes: https://fedorahosted.org/freeipa/ticket/1006
2011-03-01 11:02:55 -05:00
Pavel Zuna
bfca99b420 Send Accept-Language header over XML-RPC and translate on server.
Fix #904
Fix #917
2011-03-01 10:31:37 -05:00
Rob Crittenden
99d6e0883a Set SuiteSpotGroup when setting up our 389-ds instances.
The group is now required because 389-ds has tightened the permissions
on /var/run/dirsrv. We use the same group for both our LDAP instances
and /var/run/dirsrv ends up as root:dirsrv mode 0770.

ticket 1010
2011-02-24 15:23:16 -05:00
Rob Crittenden
af9f905239 Collect memberof information for sudo commands.
We weren't searching the cn=sudo container so all members of a
sudocmdgroup looked indirect.

Add a label for sudo command groups.

Update the tests to include verifying that membership is done
properly.

ticket 1003
2011-02-23 18:44:23 -05:00
Jr Aquino
1770750b8a Create default disabled sudo bind user
Read access is denied to the sudo container for unauthenticated users.
This shared user can be used to provide authenticated access to the
sudo information.

https://fedorahosted.org/freeipa/ticket/998
2011-02-23 15:32:24 -05:00
Rob Crittenden
ac68ea3c6c Add default roles and permissions for HBAC, SUDO and pw policy
Created some default roles as examples. In doing so I realized that
we were completely missing default rules for HBAC, SUDO and password
policy so I added those as well.

I ran into a problem when the updater has a default record and an add
at the same time, it should handle it better now.

ticket 585
2011-02-22 10:02:24 -05:00
Rob Crittenden
2f82112bb3 Add handling for indirect memberof other entries.
This creates a new custom attribute, memberofindirect_[plugin].
Using this you can tell the difference between being an actual memberof
another entry and being a memberof as the result if inheritence. This is
particularly useful when trying to remove members of an entry, you can
only remove direct members.

I had to add a couple of short sleep calls to make things work a little
better. The memberof plugin runs as a postop and we have no way of knowing
when it has done its work. If we don't pause we may show some stale
data that memberof hasn't updated yet. .3 seconds is an arbitrary choice.

ticket 966
2011-02-21 11:21:23 -05:00
Jakub Hrozek
bc8d33307a Use unicode parameters in the host plugin
https://fedorahosted.org/freeipa/ticket/977
2011-02-18 10:31:23 -05:00