Commit Graph

509 Commits

Author SHA1 Message Date
Ana Krivokapic
a70b08e9ae Do not crash if DS is down during server uninstall
DS is contacted during server uninstallation, in order to obtain information
about replication agreements. If DS is unavailable, warn and continue with
uninstallation.

https://fedorahosted.org/freeipa/ticket/3867
2013-09-09 17:24:04 +02:00
Petr Vobornik
f312d72510 Fix RUV search scope in ipa-replica-manage
The search had an incorrect scope and therefore it didn't find any RUV.

This issue prevented removing of replica.

https://fedorahosted.org/freeipa/ticket/3876
2013-09-04 12:46:29 +02:00
Ana Krivokapic
7959f3ee1e Add warning when uninstalling active replica
Add a warning when trying to uninstall a replica that has active replication
agreements.

https://fedorahosted.org/freeipa/ticket/3867
2013-09-04 11:07:32 +02:00
Ana Krivokapic
de7b1f86dc Create DS user and group during ipa-restore
ipa-restore would fail if DS user did not exist. Check for presence of DS
user and group and create them if needed.

https://fedorahosted.org/freeipa/ticket/3856
2013-09-02 16:28:37 +02:00
Jan Cholasta
fc8f0ae3ad Add --dirman-password option to ipa-server-certinstall.
https://fedorahosted.org/freeipa/ticket/3869
2013-08-28 10:20:41 +02:00
Tomas Babej
ab6a6e27d8 Make CS.cfg edits with CA instance stopped
This patch makes sure that all edits to CS.cfg configuration file
are performed while pki-tomcatd service is stopped.

Introduces a new contextmanager stopped_service for handling
a general problem of performing a task that needs certain service
being stopped.

https://fedorahosted.org/freeipa/ticket/3804
2013-08-26 16:21:36 +02:00
Ana Krivokapic
c318213250 Fix broken replica installation
Make sure the subject base parameter is correctly passed and used during the
creation of the DS instance on a replica.

https://fedorahosted.org/freeipa/ticket/3868
2013-08-20 16:36:13 +02:00
Jan Cholasta
02be7acd15 Add --pin option to ipa-server-certinstall.
Hide the unnecessary --dirsrv_pin and --http_pin options.

https://fedorahosted.org/freeipa/ticket/3869
2013-08-20 16:18:59 +02:00
Jan Cholasta
2b08168df4 Port ipa-server-certinstall to the admintool framework.
Change the log file path from /var/log/ipa/default.log to admintool's default
path.

https://fedorahosted.org/freeipa/ticket/3641
2013-08-20 16:18:59 +02:00
Jan Cholasta
ce711ddad8 Make PKCS#12 handling in ipa-server-certinstall closer to what other tools do.
In particular, PKCS#12 validation and server certificate selection is now done
the same way as in ipa-server-install and ipa-replica-prepare.

https://fedorahosted.org/freeipa/ticket/3641
2013-08-20 16:18:59 +02:00
Nathaniel McCallum
fb95f379f0 Bypass ipa-replica-conncheck ssh tests when ssh is not installed
https://fedorahosted.org/freeipa/ticket/3777
2013-08-15 20:06:18 +02:00
Tomas Babej
69394bab5a Remove support for IPA deployments with no persistent search
Drops the code from ipa-server-install, ipa-dns-install and the
BindInstance itself. Also changed ipa-upgradeconfig script so
that it does not set zone_refresh to 0 on upgrades, as the option
is deprecated.

https://fedorahosted.org/freeipa/ticket/3632
2013-08-09 12:14:42 +02:00
Ana Krivokapic
da2605c942 Handle --subject option in ipa-server-install
Properly handle --subject option of ipa-server-install, making sure this
value gets passed to certmap.conf. Introduce a new template variable
$SUBJECT_BASE for this purpose.

Also make sure that this value is preserved on upgrades.

https://fedorahosted.org/freeipa/ticket/3783
2013-08-08 16:52:48 +02:00
Martin Kosek
6a0aabede5 Free NSS objects in --external-ca scenario
In external CA installation, ipa-server-install leaked NSS objects
which caused an installation crash later when a subsequent call of
NSSConnection tried to free them.

Properly freeing the NSS objects avoid this crash.

https://fedorahosted.org/freeipa/ticket/3773
2013-07-26 12:51:10 +02:00
Jan Cholasta
693710784b Print newline after receiving EOF in installutils.read_password. 2013-07-24 10:00:03 +02:00
Jan Cholasta
ea544bee4c Ask for PKCS#12 password interactively in ipa-server-install.
https://fedorahosted.org/freeipa/ticket/3717
2013-07-24 10:00:02 +02:00
Alexander Bokovoy
e95a7b1b8d ipa-adtrust-install: configure compatibility tree to serve trusted domain users
Enables  support  for  trusted  domains  users  for old clients through Schema
Compatibility plugin.  SSSD supports trusted domains natively starting with
version 1.9 platform. For platforms that lack SSSD or run older SSSD version
one needs  to  use  this  option.  When  enabled, slapi-nis  package  needs  to
be  installed  and schema-compat-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server. These users and
groups will be available under  cn=users,cn=compat,$SUFFIX  and
cn=groups,cn=compat,$SUFFIX trees.  SSSD will normalize names of users and
groups to lower case.

In  addition  to  providing  these users and groups through the compat tree,
this option enables authentication over LDAP for trusted domain users with DN
under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.

This authentication  is related to  PAM  stack  using  'system-auth' PAM
service. If you have disabled HBAC rule 'allow_all', then make sure there is
special service called 'system-auth' created and HBAC rule to allow access to
anyone to this rule on IPA masters is added. Please note that system-auth PAM
service is  not used directly by any other application, therefore it is safe to
create one specifically to support trusted domain users via compatibility path.

https://fedorahosted.org/freeipa/ticket/3567
2013-07-18 17:56:30 +02:00
Ana Krivokapic
595de183a7 Add 'ipa_server_mode' option to SSSD configuration
https://fedorahosted.org/freeipa/ticket/3652
2013-07-18 17:49:23 +02:00
Tomas Babej
c81849712f Provide ipa-advise tool
Provides a pluggable framework for generating configuration
scriptlets and instructions for various machine setups and use
cases.

Creates a new ipa-advise command, available to root user
on the IPA server.

Also provides an example configuration plugin,
config-fedora-authconfig.

https://fedorahosted.org/freeipa/ticket/3670
2013-07-17 13:49:59 +02:00
Tomas Babej
7a105604e2 Change group ownership of CRL publish directory
Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no
longer owned by created with package installation. The directory
is rather created/removed with the CA instance itself.

This ensures proper creation/removeal, group ownership
and SELinux context.

https://fedorahosted.org/freeipa/ticket/3727
2013-07-16 12:17:40 +02:00
Petr Vobornik
f5bc155f56 Create Firefox configuration extension on CA-less install
Create:
* kerberosauth.xpi
* krb.js

even when --http_pkcs12 option is used.

https://fedorahosted.org/freeipa/ticket/3747
2013-06-27 16:01:52 +02:00
Martin Kosek
77ae4da706 Remove entitlement support
Entitlements code was not tested nor supported upstream since
version 3.0. Remove the associated code.

https://fedorahosted.org/freeipa/ticket/3739
2013-06-26 14:11:42 +02:00
Jan Cholasta
76dc2176f9 Fix CA-less check in ipa-replica-install and ipa-ca-install.
https://fedorahosted.org/freeipa/ticket/3750
2013-06-26 11:00:20 +02:00
Jan Cholasta
5ae8515c20 Do not allow installing CA replicas in CA-less setup.
https://fedorahosted.org/freeipa/ticket/3673
https://fedorahosted.org/freeipa/ticket/3674
2013-06-12 12:59:54 +02:00
Jan Cholasta
6b55623526 Remove stray error condition in ipa-server-install. 2013-06-12 12:59:54 +02:00
Jan Cholasta
cf84376928 Use the correct PKCS#12 file for HTTP server.
https://fedorahosted.org/freeipa/ticket/3665
2013-06-12 12:59:54 +02:00
Tomas Babej
b2c378dcc8 Manage ipa-otpd.socket by IPA
Adds a new simple service called OtpdInstance, that manages
ipa-otpd.socket service. Added to server/replica installer
and ipa-upgradeconfig script.

https://fedorahosted.org/freeipa/ticket/3680
2013-06-06 18:16:59 +02:00
Tomas Babej
6f51f92138 Use private ccache in ipa install tools
All installers that handle Kerberos auth, have been altered to use
private ccache, that is ipa-server-install, ipa-dns-install,
ipa-replica-install, ipa-ca-install.

https://fedorahosted.org/freeipa/ticket/3666
2013-06-05 12:27:45 +02:00
Petr Viktorin
34ba1b7060 Remove code to install Dogtag 9
Since we depend on Dogtag 10 now, there is no need to keep code
that installs a Dogtag 9 CA.

Support for upgraded Dogtag-9-style instances is left in.

https://fedorahosted.org/freeipa/ticket/3529
2013-05-31 10:26:07 +02:00
Martin Kosek
ba89635679 Set KRB5CCNAME so that dirsrv can work with newer krb5-server
The DIR ccache format is now the default in krb5-server 1.11.2-4
but /run/user/<uid> isn't created for Apache by anything so it
has no ccache (and it doesn't have SELinux permissions to write here
either).

Use KRB5CCNAME to set a file path instead in /etc/sysconfig/dirsrv.

https://fedorahosted.org/freeipa/ticket/3628
2013-05-14 17:01:03 -04:00
Rob Crittenden
13cef6cac4 Set KRB5CCNAME so httpd s4u2proxy can with with newer krb5-server
The DIR ccache format is now the default in krb5-server 1.11.2-4
but /run/user/<uid> isn't created for Apache by anything so it
has no ccache (and it doesn't have SELinux permissions to write here
either).

Use KRB5CCNAME to set a file path instead in /etc/sysconfig/httpd.

https://fedorahosted.org/freeipa/ticket/3607
2013-05-09 09:15:47 +02:00
Petr Vobornik
c72d0f5075 Generate plugin index dynamically
https://fedorahosted.org/freeipa/ticket/3235
2013-05-06 16:22:30 +02:00
Petr Vobornik
74b6099fb0 Web UI plugin loader
https://fedorahosted.org/freeipa/ticket/3235
2013-05-06 16:22:20 +02:00
Tomas Babej
66b1d435c3 Handle connection timeout in ipa-replica-manage
When connecting to replica, ipa-replica-manage could fail with
unknown error due to connection time out. This patch properly
handles the situation

Fixed in conjunction with https://fedorahosted.org/freeipa/ticket/3524
2013-05-02 10:55:54 -04:00
Tomas Babej
6839483d29 Enforce host existence only where needed in ipa-replica-manage
In ipa-replica-manage commands, we enforce that hostnames we work
with are resolvable. However, this caused errors while deleting
or disconnecting a ipa / winsync replica, if that replica was down
and authoritative server for itself.

Also adds an --no-lookup flag to disable host existence checks.

https://fedorahosted.org/freeipa/ticket/3524
2013-05-02 10:53:15 -04:00
Ana Krivokapic
dfcdd9c403 Always stop dirsrv in 'ipactl stop'
Ensure that 'ipactl stop' stops the dirsrv instance, even when no other
services are running.

https://fedorahosted.org/freeipa/ticket/3574
2013-04-29 09:38:30 -04:00
Petr Viktorin
d4a0fa34af Fix syntax errors in schema files
- add missing closing parenthesis in idnsRecord declaration
- remove extra dollar sign from ipaSudoRule declaration
- handle missing/extraneous X-ORIGIN lines in 10-selinuxusermap.update

This does not use the schema updater because the syntax needs to be
fixed in the files themselves, otherwise 389 1.3.2+ will fail
to start.
Older DS versions transparently fix the syntax errors.

The existing ldap-updater directive for ipaSudoRule is fixed
(ldap-updater runs after upgradeconfig).

https://fedorahosted.org/freeipa/ticket/3578
2013-04-26 11:15:16 -04:00
Ana Krivokapic
6d2176322c Do not display an interactive mode message in unattended mode
https://fedorahosted.org/freeipa/ticket/3576
2013-04-24 13:33:49 -04:00
Tomas Babej
fe3ba33d26 Update only selected attributes for winsync agreement
Trying to insert nsDS5ReplicatedAttributeListTotal and
nsds5ReplicaStripAttrs to winsync agreements caused upgrade errors.
With this patch, these attributes are skipped for winsync agreements.

Made find_ipa_replication_agreements() in replication.py more
corresponding to find_replication_agreements. It returns list of
entries instead of unicode strings now.

https://fedorahosted.org/freeipa/ticket/3522
2013-04-16 10:05:43 -04:00
Petr Viktorin
e736e75ce9 Drop --selfsign server functionality
Design: http://freeipa.org/page/V3/Drop_selfsign_functionality
Ticket: https://fedorahosted.org/freeipa/ticket/3494
2013-04-15 16:56:12 -04:00
Petr Viktorin
006ab23c6d Remove obsolete self-sign references from man pages, docstrings, comments
Part of the work for https://fedorahosted.org/freeipa/ticket/3494
2013-04-15 16:56:06 -04:00
Petr Viktorin
4e3c1051d0 Uninstall selfsign CA on upgrade
This will convert a master with a selfsign CA to a CA-less one in
ipa-upgradeconfig.
The relevant files are left in place and can be used to manage certs
manually.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3494
2013-04-15 16:55:27 -04:00
Jan Cholasta
fe00788bb4 Delete DNS records in ipa-ca on ipa-csreplica-manage del.
https://fedorahosted.org/freeipa/ticket/3547
2013-04-15 21:12:41 +02:00
Jan Cholasta
f684c6d6f8 Use A/AAAA records instead of CNAME records in ipa-ca.
https://fedorahosted.org/freeipa/ticket/3547
2013-04-15 21:12:36 +02:00
Petr Viktorin
b36380fff8 ipa-server-install: correct help text for --external_{cert,ca}_file
The options take PEM certificates, not PKCS#10.
This corrects both the --help output and the man page.

https://fedorahosted.org/freeipa/ticket/3523
2013-04-15 13:32:58 +02:00
Rob Crittenden
c8694cb19f Full system backup and restore
This will allow one to backup and restore the IPA files and data. This
does not cover individual entry restoration.

http://freeipa.org/page/V3/Backup_and_Restore

https://fedorahosted.org/freeipa/ticket/3128
2013-04-12 09:59:17 -04:00
Tomas Babej
ff01a08ffc Properly handle ipa-replica-install when its zone is not managed by IPA
The ipa-replica-install script tries to add replica's A and PTR
records to the master DNS, if master does manage DNS. However,
master need not manage replica's zone. Properly handle this use
case.

https://fedorahosted.org/freeipa/ticket/3496
2013-04-02 09:44:48 -04:00
Petr Viktorin
1bc892c02d Load the CA cert into server NSS databases
The CA cert was not loaded, so if it was missing from the PKCS#12 file,
installation would fail.
Pass the cert filename to the server installers and include it in
the NSS DB.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3363
2013-04-02 15:28:50 +02:00
Petr Viktorin
03a2c66eda Support installing with custom SSL certs, without a CA
Design: http://freeipa.org/page/V3/CA-less_install
https://fedorahosted.org/freeipa/ticket/3363
2013-04-02 15:28:50 +02:00
Petr Viktorin
34aa490141 ipa-server-install: Remove the --selfsign option
Instead, certificates in pkcs12 files can be given to set up
IPA with no CA at all.
Use a flag, setup_ca, to signal if a CA is being installed.

Design: http://freeipa.org/page/V3/Drop_selfsign
Part of the work for: https://fedorahosted.org/freeipa/ticket/3494
2013-04-02 15:28:50 +02:00