Commit Graph

8394 Commits

Author SHA1 Message Date
Petr Vobornik
9d69ad2428 do not import memcache on client
Fixes regression caused by cd3ca94ff2.

Which caused:
* client installation failure (missing memcache)
* invalid warning in CLI on server

https://fedorahosted.org/freeipa/ticket/5133

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-16 11:23:40 +02:00
Jan Cholasta
d6e701a793 spec file: Update minimum required version of krb5
Automatically require the krb5 version used at build time.

https://fedorahosted.org/freeipa/ticket/5132

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-15 11:02:32 +00:00
Jan Cholasta
ba31b41569 spec file: Move /etc/ipa/kdcproxy to the server subpackage
The directory was in the python subpackage, but that broke client-only
build. We don't want the directory to be installed on clients anyway,
since it is part of a server-side feature.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2015-07-15 10:46:18 +00:00
Martin Basti
8bc0e9693b copy-schema-to-ca: allow to overwrite schema files
If content of source and target file differs, the script will ask user
for permission to overwrite target file.

https://fedorahosted.org/freeipa/ticket/5034

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-15 07:11:21 +00:00
Martin Basti
c144ea6fef Stageusedr-activate: show username instead of DN
If activate user already exists, show name of this user in error message
instead of user DN.
Error message reworder to keep the same format as stageuser-add,
user-add.

https://fedorahosted.org/freeipa/ticket/5038

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-15 07:08:02 +00:00
Christian Heimes
18d417e981 Replace file() with open()
The open() function is the recommended way to open a file. In Python 3
the file type is gone, but open() still works the same.

The patch is related to https://fedorahosted.org/freeipa/ticket/5127

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-14 13:59:31 +02:00
Christian Heimes
35e219f996 Remove tuple unpacking from except clause ipaserver/dcerpc.py
Python 3 doesn't support tuple unpacking in except clauses. All implicit
tuple unpackings have been replaced with explicit unpacking of e.args.

https://fedorahosted.org/freeipa/ticket/5120

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-14 13:43:50 +02:00
Christian Heimes
4677ea29be Remove tuple unpacking from except clause ipalib/plugins/hbactest.py
Python 3 doesn't support tuple unpacking in except clauses. All implicit
tuple unpackings have been replaced with explicit unpacking of e.args.

https://fedorahosted.org/freeipa/ticket/5120

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-14 13:43:50 +02:00
Christian Heimes
feb8891dd0 Remove tuple unpacking from except clause ipa-client/ipaclient/ipachangeconf.py
Python 3 doesn't support tuple unpacking in except clauses. All implicit
tuple unpackings have been replaced with explicit unpacking of e.args.

https://fedorahosted.org/freeipa/ticket/5120

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-14 13:43:50 +02:00
Christian Heimes
334be8c9cc Remove tuple unpacking from except clause contrib/RHEL4/ipachangeconf.py
Python 3 doesn't support tuple unpacking in except clauses. All implicit
tuple unpackings have been replaced with explicit unpacking of e.args.

https://fedorahosted.org/freeipa/ticket/5120

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-14 13:43:50 +02:00
Milan Kubík
3459607410 spec file: update the python package names for libipa_hbac and libsss_nss_idmap
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-14 10:57:36 +00:00
Simo Sorce
ca6947da6f Fix DNS records installation for replicas
Ticket: https:/fedorahosted.org/freeipa/ticket/5116

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-14 10:50:36 +00:00
Christian Heimes
c701ab612d Start dirsrv for kdcproxy upgrade
The kdcproxy upgrade step in ipa-server-upgrade needs a running dirsrv
instance. Under some circumstances the dirsrv isn't running. The patch
rearranges some upgrade steps and starts DS before enable_kdcproxy().

https://fedorahosted.org/freeipa/ticket/5113

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-14 10:37:43 +00:00
Tomas Babej
5106421961 Revert "Hide topology and domainlevel features"
This reverts commit 62e8002bc4.

Hiding of the topology and domainlevel features was necessary
for the 4.2 branch only.

Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-07-10 15:26:50 +02:00
Milan Kubík
61f41df949 ipalib: pass api instance into textui in doctest snippets
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-10 15:05:19 +02:00
Tomas Babej
8a4e79c9e6 ipalib: Fix missing format for InvalidDomainLevelError
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-10 15:01:22 +02:00
Martin Basti
67b2b34085 Prevent to rename certprofile profile id
https://fedorahosted.org/freeipa/ticket/5074

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-10 09:01:05 +00:00
Petr Vobornik
0569910fea Bump 4.3 development version to 4.2.90
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-09 13:07:35 +02:00
Petr Vobornik
218de5bff7 Become IPA 4.2.0 2015-07-09 12:11:56 +02:00
Petr Vobornik
f0e88e9b13 fix error message when certificate CN is invalid
The error message was probably copied from mail address check below.

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-09 11:58:30 +02:00
Petr Vobornik
0b943f3ce9 webui: remove cert manipulation actions from host and service
Remove
* cert_view
* cert_get
* cert_revoke
* cert_restore

These actions require serial number which is not provided to Web UI if
multiple certificates are present.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-09 10:58:40 +02:00
Petr Vobornik
cf8b56cc75 webui: show multiple cert
New certificate widget which replaced certificate status widget.

It can display multiple certs. Drawback is that it cannot display
if the certificate was revoked. Web UI does not have the information.

part of: https://fedorahosted.org/freeipa/ticket/5045

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-09 10:58:40 +02:00
Petr Vobornik
7c481b1e90 webui: cert-request improvements
Certificate request action and dialog now supports 'profile_id',
'add' and 'principal' options. 'add' and 'principal' are disaplayed
only if certificate is added from certificate search facet.

Certificate search facet allows to add a certificate.

User details facet allows to add a certificate.

part of
https://fedorahosted.org/freeipa/ticket/5046

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-09 10:58:40 +02:00
Petr Vobornik
cd3ca94ff2 move session_logout command to ipalib/plugins directory
API refactoring caused that session_logout command was not registered.

Commands in ipalib/plugins directory are automatically registered.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 17:16:54 +02:00
Tomas Babej
9c5df3cf76 upgrade: Enable and start oddjobd if adtrust is available
If ipa-adtrust-install has already been run on the system,
enable and start the oddjobd service.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-08 17:14:56 +02:00
Tomas Babej
675aada2e1 adtrustinstance: Enable and start oddjobd
Enable and start the oddjobd service as part of the
ipa-adtrust-install for the new IPA installations.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-08 17:14:56 +02:00
Fraser Tweedale
ec7e5e0cac cert-request: enforce caacl for principals in SAN
cert-request currently does not enforce caacls for principals
included in the subjectAltName requestExtension.  Enforce for any
dNSName values recognised as hosts/services known to FreeIPA.

Fixes: https://fedorahosted.org/freeipa/ticket/5096
Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-08 17:13:25 +02:00
Fraser Tweedale
e3c225317b caacl: fix incorrect construction of HbacRequest for hosts
The _acl_make_request function is using the 'host/' prefix itself
instead of the hostname after it.  Use split_any_principal to do the
splitting correctly, also taking realm into account.

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-08 17:13:25 +02:00
Petr Vobornik
f13cce2d9c webui: hide facet tab in certificate details facet
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 17:12:29 +02:00
Petr Vobornik
927391125c webui: caacl
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 17:12:29 +02:00
Petr Vobornik
a3727387ee webui: certificate profiles
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 17:12:29 +02:00
Martin Basti
e51bb1bc66 Fix logging in API
Setup log in API before first usage

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 17:11:23 +02:00
Jan Cholasta
7c0e7f7e3c spec file: Update minimal versions of required packages
https://fedorahosted.org/freeipa/ticket/5103

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-08 16:08:06 +02:00
Martin Basti
21b04769b9 Upgrade: Do not show upgrade failed message when IPA is not installed
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-08 12:58:50 +00:00
Jan Cholasta
232458a222 ipalib: Fix skip_version_check option
This reverts commit ea7f392bb9.

The option can be either set in IPA config file or specified as
'ipa -e skip_version_check=1 [COMMAND]'.

https://fedorahosted.org/freeipa/ticket/4768

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-07-08 12:36:19 +00:00
Endi S. Dewata
bf6df3df9b Added vault access control.
New LDAP ACIs have been added to allow vault owners to manage the
vaults and to allow members to access the vaults. New CLIs have
been added to manage the owner and member list. The LDAP schema
has been updated as well.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-08 06:30:23 +00:00
Sumit Bose
5017726eba ipa-kdb: add unit_tests for string_to_sid() and dom_sid_string()
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Sumit Bose
3f7481a220 ipa-kdb: make string_to_sid() and dom_sid_string() more robust
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Sumit Bose
7a1b4dcafc ipa-kdb: add unit-test for filter_logon_info()
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Sumit Bose
9d026ba824 ipa-kdb: convert test to cmocka
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Sumit Bose
7b524e7835 extdom: add unit-test for get_user_grouplist()
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
2dd5b46d25 trust: support retrieving POSIX IDs with one-way trust during trust-add
With one-way trust we cannot rely on cross-realm TGT as there will be none.
Thus, if we have AD administrator credentials we should reuse them.
Additionally, such use should be done over Kerberos.

Fixes:
 https://fedorahosted.org/freeipa/ticket/4960
 https://fedorahosted.org/freeipa/ticket/4959

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
5025204175 trusts: add ACIs to allow AD trust agents to fetch cross-realm keytabs
Part of https://fedorahosted.org/freeipa/ticket/4959

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
a9570e8ea3 ipa-pwd-extop: expand error message to tell what user is not allowed to fetch keytab
When retrieving keytab, it is useful to know what user was attempting
to fetch the keyts and failed. This is useful to debug one-way trust
where SSSD forks out a process of ipa-getkeytab and it might be using
a wrong credentials cache for authentication purposes.

Part of https://fedorahosted.org/freeipa/ticket/4959

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
d5aa1ee04e trusts: add support for one-way trust and switch to it by default
One-way trust is the default now, use 'trust add --two-way ' to
force bidirectional trust

https://fedorahosted.org/freeipa/ticket/4959

In case of one-way trust we cannot authenticate using cross-realm TGT
against an AD DC. We have to use trusted domain object from within AD
domain and access to this object is limited to avoid compromising the whole
trust configuration.

Instead, IPA framework can call out to oddjob daemon and ask it to
run the script which can have access to the TDO object. This script
(com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal
to retrieve TDO object credentials from IPA LDAP if needed and then
authenticate against AD DCs using the TDO object credentials.

The script pulls the trust topology out of AD DCs and updates IPA LDAP
store. Then IPA framework can pick the updated data from the IPA LDAP
under normal access conditions.

Part of https://fedorahosted.org/freeipa/ticket/4546

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
14992a07fc ipa-adtrust-install: allow configuring of trust agents
Trust agents are IPA master without Samba which can serve
information about users from trusted forests. Such IPA masters
cannot be used to configure trust but they can resolve AD users and groups
for IPA clients enrolled to them.

Since support from both FreeIPA and SSSD is needed to enable
trust agent support, we currently only consider those IPA masters
which have been upgraded to FreeIPA 4.2 or later.

Part of https://fedorahosted.org/freeipa/ticket/4951

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
aa21600822 ipa-sidgen: reduce log level to normal if domain SID is not available
To support AD trust agents, we need to run sidgen and extdom plugins
on every IPA master. Lack of working configuration, thus, is not a
failure so reduce log level to normal as sidgen plugin will not
be active if domain SID is missing but it can certainly be kept
enabled.

Part of https://fedorahosted.org/freeipa/ticket/4951

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
47e1de7604 trusts: pass AD DC hostname if specified explicitly
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
03c2d76186 ipa-adtrust-install: add IPA master host principal to adtrust agents
Fixes https://fedorahosted.org/freeipa/ticket/4951

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00
Alexander Bokovoy
785f6593ca add one-way trust support to ipasam
When trust is established, ipasam module creates a number of objects in LDAP
to represent the trust information. Among them, for one-way trust we create
a principal named IPA$@AD where IPA is a NetBIOS (flat) name of the IPA forest
and AD is a realm of the trusted Active Directory forest root domain.

This principal is then used by SSSD on IPA masters to authenticate against
trusted Active Directory domain controllers and retrieve information about
user and group identities.

FreeIPA also uses this principal's credentials to retrieve domain topology.

The access to the keys of the principal should be well-protected. We only
allow to retrieve the keytab for it for members of cn=adtrust agents group.
This group is populated with host/ and cifs/ principals from IPA masters.

Starting with FreeIPA 4.2 the group will also have host/ principals of IPA masters
where no ipa-adtrust-install was run. To add them, run ipa-adtrust-install
on the master which will be configured to be a domain controller (e.g.
run Samba with ipasam), and specify --add-agents option to trigger activation
of the interactive mode to specify which IPA masters to enable.

Fixes https://fedorahosted.org/freeipa/ticket/4962
Part of fixes for https://fedorahosted.org/freeipa/ticket/4546

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-08 01:56:52 +02:00