Commit Graph

333 Commits

Author SHA1 Message Date
Fraser Tweedale
4cf2bfcaa6 Add profile_id parameter to 'request_certificate'
Add the profile_id parameter to the 'request_certificate' function
and update call sites.

Also remove multiple occurrences of the default profile ID
'caIPAserviceCert'.

Part of: https://fedorahosted.org/freeipa/ticket/57

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Fraser Tweedale
b24fe0eb73 Import included profiles during install or upgrade
Add a default service profile template as part of FreeIPA and format
and import it as part of installation or upgrade process.

Also remove the code that modifies the old (file-based)
`caIPAserviceCert' profile.

Fixes https://fedorahosted.org/freeipa/ticket/4002

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Fraser Tweedale
300b74fc7f Add certprofile plugin
Add the 'certprofile' plugin which defines the commands for managing
certificate profiles and associated permissions.

Also update Dogtag network code in 'ipapython.dogtag' to support
headers and arbitrary request bodies, to facilitate use of the
Dogtag profiles REST API.

Part of: https://fedorahosted.org/freeipa/ticket/57

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Jan Cholasta
454e8691cf client-install: Fix kinits with non-default Kerberos config file
https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-05-21 07:42:24 +00:00
Petr Vobornik
7d10547ae3 allow to call ldap2.destroy_connection multiple times
A regression fix.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2015-05-07 18:13:57 +02:00
Martin Babinsky
a1f91247cc point the users to PKI-related logs when CA configuration fails
This patch adds an error handler which prints out the paths to logs related to
configuration and installation of Dogtag/CA in the case of failure.

https://fedorahosted.org/freeipa/ticket/4900

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-29 05:19:29 +00:00
David Kupka
9b706e74d5 Make lint work on Fedora 22.
pylint added 'confidence' parameter to 'add_message' method of PyLinter.
To be compatible with both, pre- and post- 1.4  IPALinter must accept
the parameter but not pass it over.
Also python3 checker was added and enabled by default. FreeIPA is still
not ready for python3.
Additionally few false-positives was marked.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-27 11:02:57 +02:00
Petr Vobornik
4364ac08c5 speed up indirect member processing
the old implementation tried to get all entries which are member of group.
That means also user. User can't have any members therefore this costly
processing was unnecessary.

New implementation reduces the search only to entries which have members.

Also page size was removed to avoid paging by small pages(default size: 100)
which is very slow for many members.

https://fedorahosted.org/freeipa/ticket/4947

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-27 05:55:04 +00:00
Petr Viktorin
2cafb47ed7 Remove Editable DN and DN component classes
Make all DNs, RDNs and AVAs immutable.
Immutability makes reasoning about DN-handling code easier,
as value objects can't be changed once created.
Instead of mutable DNs, one can use a list (or even a generator)
of RDNs that's converted to a DN on output.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-23 11:34:39 +00:00
Martin Babinsky
415a5ff372 ipautil: new functions kinit_keytab and kinit_password
kinit_keytab replaces kinit_hostprincipal and performs Kerberos auth using
keytab file. Function is also able to repeat authentication multiple times
before giving up and raising Krb5Error.

kinit_password wraps kinit auth using password and also supports FAST
authentication using httpd armor ccache.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-20 08:27:35 +00:00
Jan Cholasta
b48cfe05e9 ldap: Remove IPASimpleLDAPObject
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
e2b0981d60 ldap: Use SimpleLDAPObject instead of IPASimpleLDAPObject in LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
db88498c95 ldap: Move schema handling from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
cbb112dd57 ldap: Use LDAPClient instead of IPASimpleLDAPObject in LDAPEntry
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
955885d8d9 ldap: Move value encoding from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
232e04d861 ldap: Use LDAPClient bind and unbind methods in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
c904dea06a ldap: Add bind and unbind methods to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
45d9b82f40 ldap: Use LDAPClient connection management in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
02e1ebe07c ldap: Add connection management to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
a849bca53f ldap: Remove unused IPAdmin methods
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
b106450dbf ldap: Drop python-ldap tuple compatibility
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Thierry Bordaz
c20009123f User life cycle: allows MODRDN from ldap2
enhance update_entry_rdn so that is allows
to move an entry a new superior

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 06:50:16 +00:00
Petr Vobornik
11bd9d96f1 performance: faster DN implementation
DN code was optimized to be faster if DNs are created from string. This is
the major use case, since most DNs come from LDAP.

With this patch, DN creation is almost 8-10x faster (with 30K-100K DNs).

Second mojor use case - deepcopy in LDAPEntry is about 20x faster - done by
custom __deepcopy__ function.

The major change is that DN is no longer internally composed  of RDNs and
AVAs but it rather keeps the data in open ldap format - the same as output
of str2dn function. Therefore, for immutable DNs, no other transformations
are required on instantiation.

The format is:

DN: [RDN, RDN,...]
RDN: [AVA, AVA,...]
AVA: ['utf-8 encoded str - attr', 'utf-8 encode str -value', FLAG]
FLAG: int

Further indexing of DN object constructs an RDN which is just an encapsulation
of the RDN part of open ldap representation. Indexing of RDN constructs AVA in
the same fashion.

Obtained EditableAVA, EditableRDN from EditableDN shares the respected lists
of the open ldap repr. so that the change of value or attr is reflected in
parent object.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-14 19:31:54 +02:00
David Kupka
082c55fb9c Always reload StateFile before getting or modifying the stored values.
This change does not solve using multiple instances of StateFile concurently
because there is no use for it in near future. Instead this solves an issue of loosing
records when more instances of StateFile are interleaved in sequential code.

https://fedorahosted.org/freeipa/ticket/4901

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-18 12:42:16 +01:00
Nathan Kinder
a58b77ca9c Timeout when performing time sync during client install
We use ntpd now to sync time before fetching a TGT during client
install.  Unfortuantely, ntpd will hang forever if it is unable to
reach the NTP server.

This patch adds the ability for commands run via ipautil.run() to
have an optional timeout.  This capability is used by the NTP sync
code that is run during ipa-client-install.

Ticket: https://fedorahosted.org/freeipa/ticket/4842
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-03-16 15:55:26 +01:00
Martin Basti
6af49259c2 Fix dead code in ipap11helper module
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-11 14:32:20 +01:00
Petr Spacek
459f0a8401 p11helper: clarify error message
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Petr Spacek
5635d1bf43 p11helper: use sizeof() instead of magic constants
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Petr Spacek
4b33f2b515 p11helper: standardize indentation and other visual aspects of the code
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Martin Basti
93c384fd13 Remove unused method from ipap11pkcs helper module
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Martin Basti
46a631138f Fix memory leaks in ipap11helper
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Martin Basti
a178f586bd DNSSEC add support for CKM_RSA_PKCS_OAEP mechanism
Ticket: https://fedorahosted.org/freeipa/ticket/4657#comment:13
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Simo Sorce
d762f61d25 Add a clear OpenSSL exception.
We are linking with OpenSSL in 2 files, so make it clear we intentionally
add a GPLv3 exception to allow that linking by third parties.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2015-02-23 16:25:54 +01:00
Martin Basti
d5035c0ed9 Prevent install scripts fail silently if timeout exceeded
socket.timeout() exceptions need description, otherwise no error message
is printed on console.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-02-12 17:10:10 +01:00
Martin Basti
e6a575d6d7 Fix reference counting in pkcs11 extension
* removed unneeded reference increment
* added increment of Py_None

Part of ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-02-10 15:30:38 +00:00
Tomas Babej
f30865c5f0 ipapython: Fix incorrect python shebangs
Make sure shebangs explicitly reference python2.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-01-26 13:03:24 +01:00
Martin Basti
46c12159e6 DNSSEC: fix root zone dns name conversion
Root zone was represented as '@', which was incorrect. ksmutil did not
accept it.
Now root zone is represented as '.'

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-01-23 09:26:55 +00:00
Tomas Babej
e11e8235ac baseldap: Handle missing parent objects properly in *-find commands
The find_entries function in ipaldap does not differentiate between
a LDAP search that returns error code 32 (No such object) and LDAP
search returning error code 0 (Success), but returning no results.

In both cases errors.NotFound is raised. In turn, LDAPSearch
commands interpret NotFound exception as no results.

To differentiate between the cases, a new error EmptyResult
was added, which inherits from NotFound to preserve the compatibility
with the new code.

This error is raised by ipaldap.find_entries in case it is performing
a search with and the target dn does not exist.

https://fedorahosted.org/freeipa/ticket/4659

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-01-13 16:16:14 +00:00
Martin Basti
337faf5064 Using wget to get status of CA
This is just workaround

Ticket: https://fedorahosted.org/freeipa/ticket/4676
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-12-10 16:59:56 +00:00
Jan Cholasta
968e1bbcf8 Unload P11_Helper object's library when it is finalized in ipap11helper
https://fedorahosted.org/freeipa/ticket/4713

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-25 08:23:24 +00:00
Rob Crittenden
5c0ad221e8 Use NSS protocol range API to set available TLS protocols
Protocols are configured as an inclusive range from SSLv3 through
TLSv1.2. The allowed values in the range are ssl3, tls1.0,
tls1.1 and tls1.2.

This is overridable per client by setting tls_version_min and/or
tls_version_max.

https://fedorahosted.org/freeipa/ticket/4653

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-24 13:09:44 +00:00
Martin Basti
58737c7791 Fix pk11helper module compiler warnings
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-20 16:46:30 +01:00
Martin Basti
c80a59eff4 Raise right exception if domain name is not valid
Because of dnspython implementation, in some cases UnicodeError is
raised instead of DNS SyntaxError

Ticket: https://fedorahosted.org/freeipa/ticket/4734
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-20 14:41:36 +00:00
Endi S. Dewata
80a8df3f19 Modififed NSSConnection not to shutdown existing database.
The NSSConnection class has been modified not to shutdown the
existing NSS database if the database is already opened to
establish an SSL connection, or is already opened by another
code that uses an NSS database without establishing an SSL
connection such as vault CLIs.

https://fedorahosted.org/freeipa/ticket/4638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:09:19 +01:00
Jan Cholasta
4589ef133c Fix various bugs in ipap11helper
Fixes a memory leak, a library handle leak and a double free.

Also remove some redundant NULL checks before free to prevent false positives
in static code analysis.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00
Gabe
7eca640ffa Remove trivial path constants from modules
https://fedorahosted.org/freeipa/ticket/4399

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-04 12:57:01 +01:00
Petr Spacek
ac500003fd Fix zone name to directory name conversion in BINDMgr.
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-10-29 15:02:08 +01:00
Petr Spacek
276e69de87 DNSSEC: add ipa dnssec daemons
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Martin Basti
9101cfa60f DNSSEC: opendnssec services
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Martin Basti
eb54814741 DNSSEC: DNS key synchronization daemon
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00