IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-12 16:32:01 -05:00
Code Issues Packages Projects Releases Wiki Activity
8,515 Commits 11 Branches 63 Tags
b93137c1964690cc6c20ad5e187aa70cc414554c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Basti fb98e77104 Add user-stage command 
This patch replaces 'stageuser-add --from-delete' with new command
user-stage.

Original way always required  to specify first and last name, and
overall combination of options was hard to manage. The new command
requires only login of deleted user (user-del --preserve).

https://fedorahosted.org/freeipa/ticket/5041

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-21 12:29:03 +02:00
Martin Basti 556e97bf23 Server Upgrade: Start DS before CA is started. 
https://fedorahosted.org/freeipa/ticket/5232

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-19 11:55:21 +02:00
Martin Basti 9fe67dcf2b Add dependency to SSSD 1.13.1 
SSSD 1.13.1 has required functionality tu support duslstack and
multihomed

https://fedorahosted.org/freeipa/ticket/4249

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-08-19 11:03:58 +02:00
Martin Basti d7be2fd1bd Fix upgrade of sidgen and extdom plugins 
If configuration entries already exist, upgrade will not add them
again.

https://fedorahosted.org/freeipa/ticket/5151

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-08-10 15:03:54 +02:00
Martin Basti cea52ce186 ULC: Fix stageused-add --from-delete command 
Nonexistent method was used to move deleted user to staged area.
Minor fixes added:
 * handle not found error
 * return new DN

https://fedorahosted.org/freeipa/ticket/5145

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-29 17:06:54 +02:00
Martin Basti 45c709112d Use 'mv -Z' in specfile to restore SELinux context 
There might be AVC denial between moving file and restoring context.
Using 'mv -Z' will solve this issue.

https://fedorahosted.org/freeipa/ticket/4923

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-29 16:44:13 +02:00
Martin Basti 2427b2c242 Remove ico files from Makefile 
Icons were removed in a4be844809 but still
persist in Makefile. This patch fixes Makefile.

https://fedorahosted.org/freeipa/ticket/823

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-27 16:19:49 +02:00
Martin Basti 92828d3cf5 DNS: check if DNS package is installed 
Instead of separate checking of DNS required packages, we need just
check if IPA DNS package is installed.

https://fedorahosted.org/freeipa/ticket/4058

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-21 17:30:10 +02:00
Martin Basti 5ea41abe98 DNS: Consolidate DNS RR types in API and schema 
* Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API:
    These records never worked, they dont have attributes in schema.
    TSIG and TKEY are meta-RR should not be in LDAP
    TA is not supported by BIND
    NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be
    in LDAP.
    *! SIG, NSEC are already defined in schema, must stay in API.

* Add HINFO, MINFO, MD, NXT records to API as unsupported records
    These records are already defined in LDAP schema

* Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records
    These records were defined in IPA API as unsupported, but schema definition was
    missing. This causes that ACI cannot be created for these records
    and dnszone-find failed. (#5055)

https://fedorahosted.org/freeipa/ticket/4934
https://fedorahosted.org/freeipa/ticket/5055

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-21 17:18:29 +02:00
Martin Basti c6c84faecf Py3: replace tab with space 
python3 does not allow to mix spaces and tabs

Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2015-07-17 17:19:51 +02:00
Martin Basti 82aaa1e6d0 Allow value 'no' for replica-certify-all attr in abort-clean-ruv subcommand 
--force option set replica-certify-all to 'no' during abort-clean-ruv
subcommand

https://fedorahosted.org/freeipa/ticket/4988

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-07-17 16:47:18 +02:00
Martin Basti 9f70128353 sysrestore: copy files instead of moving them to avoind SELinux issues 
Copying files restores SELinux context.

https://fedorahosted.org/freeipa/ticket/4923

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-17 13:46:23 +02:00
Martin Basti a619a1e211 Validate adding privilege to a permission 
Adding priviledge to a permission via webUI allowed to avoid check and to add permission
with improper type.

https://fedorahosted.org/freeipa/ticket/5075

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-17 04:57:54 +00:00
Martin Basti a0ce9e6b09 fix selinuxusermap search for non-admin users 
Remove nonexistent attribute 'hostmembergroup' that is not in ACI nor schema.

Related to https://fedorahosted.org/freeipa/ticket/5130

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-07-16 15:38:47 +02:00
Martin Basti 8bc0e9693b copy-schema-to-ca: allow to overwrite schema files 
If content of source and target file differs, the script will ask user
for permission to overwrite target file.

https://fedorahosted.org/freeipa/ticket/5034

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-15 07:11:21 +00:00
Martin Basti c144ea6fef Stageusedr-activate: show username instead of DN 
If activate user already exists, show name of this user in error message
instead of user DN.
Error message reworder to keep the same format as stageuser-add,
user-add.

https://fedorahosted.org/freeipa/ticket/5038

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-15 07:08:02 +00:00
Martin Basti 67b2b34085 Prevent to rename certprofile profile id 
https://fedorahosted.org/freeipa/ticket/5074

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-10 09:01:05 +00:00
Martin Basti e51bb1bc66 Fix logging in API 
Setup log in API before first usage

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 17:11:23 +02:00
Martin Basti 21b04769b9 Upgrade: Do not show upgrade failed message when IPA is not installed 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-08 12:58:50 +00:00
Martin Basti 1d9bdb2409 Fix regression: ipa-dns-install will add CA records if required 
https://fedorahosted.org/freeipa/ticket/5101

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 00:32:05 +02:00
Martin Basti 6fa123447f FIX: Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-07-07 16:27:24 +02:00
Martin Basti f7c98c650a Allow to run subprocess with suplementary groups 
Param suplementary_groups allows to specify list of group names to be
used for subprocess.
suplementary_groups param requires runas param to be specified.

Required for ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti 2e4e8d759d DNSSEC: update message 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti e151492560 DNSSEC: allow to disable/replace DNSSEC key master 
This commit allows to replace or disable DNSSEC key master

Replacing DNSSEC master requires to copy kasp.db file manually by user

ipa-dns-install:
--disable-dnssec-master  DNSSEC master will be disabled
--dnssec-master --kasp-db=FILE  This configure new DNSSEC master server,  kasp.db from old server is required for sucessful replacement
--force Skip checks

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-07-07 08:37:15 +02:00
Martin Basti 884afb5d38 Server Upgrade: use debug log level for upgrade instead of info 
Upgrade contains too many unnecessary info logs.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-03 07:47:59 +00:00
Martin Basti 2e329ecdc7 KRA Install: check replica file if contains req. certificates 
https://fedorahosted.org/freeipa/ticket/5059

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-02 10:59:53 +00:00
Martin Basti 96c23659fc DNS: Do not traceback if DNS is not installed 
Instead of internal error show 'DNS is not configured' message, when a
dns* command is executed.

https://fedorahosted.org/freeipa/ticket/5017

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-01 20:19:01 +02:00
Martin Basti b2f0a018b6 Sanitize CA replica install 
Check if cafile exist first.

https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-06-30 13:41:00 +02:00
Martin Basti 16f47ed452 Fix indicies ntUserDomainId, ntUniqueId 
ntUserDomainId and ntUniqueId  contained "eq,pres" index value, which is
not valid.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-29 13:40:29 +02:00
Martin Basti 20ffd4b614 Server Upgrade: create default config for NIS Server plugin 
Plugin is disabled by default.

This commit prevents false positive upgrade errors.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-18 17:48:36 +02:00
Martin Basti d2d13826c6 ipa-ca-install fix: reconnect ldap2 after DS restart 
https://fedorahosted.org/freeipa/ticket/5064

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-18 17:46:52 +02:00
Martin Basti 3ababb763b DNS: add UnknownRecord to schema 
defintion of UnknownRecord attributetype

https://fedorahosted.org/freeipa/ticket/4939

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-18 14:37:28 +02:00
Martin Basti c1d484afde Server Upgrade: disconnect ldap2 connection before DS restart 
Without this patch, the invalid api.Backend.ldap2 connection
was used to communicate with DS and it raises network error
after DS restart.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-15 09:54:04 +02:00
Martin Basti f763b137ee DNSSEC: fix traceback during shutdown phase 
ipa-dnskeysyncd causes traceback when receive SIGTERM, SIGINT

Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-15 09:43:51 +02:00
Martin Basti 6a92b32bf2 Revert 389-DS BuildRequires version to 1.3.3.9 
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
 2015-06-11 13:21:27 +02:00
Martin Basti f8c8c360f1 DNSSEC: validate forward zone forwarders 
Show warning messages if DNSSEC validation is failing for particular FW
zone or if the specified forwarders do not work

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-11 13:12:31 +02:00
Martin Basti 9aa6124b39 DNSSEC: Improve global forwarders validation 
Validation now provides more detailed information and less false
positives failures.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-11 13:12:31 +02:00
Martin Basti b6924c00ab Fix: regression in host and service plugin 
Test failures:
 * wrong error message
 * mod operation always delete usercertificates

https://fedorahosted.org/freeipa/ticket/4238

Reviewed-By: Milan Kubik <mkubik@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-06-03 17:52:30 +00:00
Martin Basti 943c539122 ULC: fix: upgrade for stage Stage User Admins failed 
Upgrade failed because entry 'dn: cn=Stage User
Administrators,cn=privileges,cn=pbac,$SUFFIX' doesnt exist.

Now upgrade will create the privilege if it does not exist.

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-06-02 13:50:19 +00:00
Martin Basti af8f44c86a Installers fix: remove temporal ccache 
Environ variable may be changed outside, so store path into global
variable.

https://fedorahosted.org/freeipa/ticket/5042

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-06-02 10:35:22 +00:00
Martin Basti 9eedffdfa6 Server Upgrade: fix remove statement 
If value does not exists then do not update entry. Otherwise, together with
nonexistent entry, the LDAP decode error will be raised.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-26 11:33:07 +00:00
Martin Basti f903c2d5bf Fix: use DS socket check only for upgrade 
To detect if DS server is running, use the slapd socket for upgrade, and the LDAP port
for installation.

Without enabled LDAPi socket checking doesnt work.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-26 11:30:15 +00:00
Martin Basti 027515230a Server Upgrade: Move code from ipa-upgradeconfig to separate module 
This also prevent the script ipa-upgradeconfig execute upgrading.
Upgrade of services is called from ipa-server-upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-25 16:34:44 +00:00
Martin Basti c43c5d1e43 Server Upgrade: Fix: execute schema update 
Accidentaly schema upgrade has not been executed.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-22 15:56:33 +02:00
Martin Basti 3d17bf8e63 Server Upgrade: wait until DS is ready 
During server upgrade we should wait until DS is ready after restart, otherwise
connection error is raised.

Instead of 389 port, the DS socket is checked.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-05-22 15:51:05 +02:00
Martin Basti 98e4c6d6de Uid uniqueness: fix: exclude compat tree from uniqueness 
Without this commit it is not possible to move user to staged area.

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2015-05-22 15:41:41 +02:00
Martin Basti ab69a0b1a7 Pylint: fix false positive warning for domain 
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-05-19 19:14:58 +02:00
Martin Basti ae9c3e2dce DNS install: extract DNS installer into one module 
This is required modification to be able move to new installers.

DNS subsystem will be installed by functions in this module in each of
ipa-server-install, ipa-dns-install, ipa-replica-install install
scripts.

https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-19 14:21:31 +00:00
Martin Basti 96f6d6ca09 DNSSEC: update OpenDNSSEC KASP configuration 
* remove unneeded parts
* increase KSK key length to 3072
* increase KSK key lifetime to 2 years (see NIST SP 800-81-2 section 11.2)

Update is not required, as template contains just recommended values
which should by reviewed by administrators.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-05-19 12:50:56 +00:00
Martin Basti ebd9146113 DNSSEC: FIX Do not re-create kasp.db if already exists 
Kasp should not be replaced by DNS reinstallation with new file.

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-05-19 12:47:59 +00:00
Martin Basti fbdfd688b9 Server Upgrade: Fix uniqueness plugins 
Due previous changes (in master branch only) the uniqueness plugins
became misconfigured.

After this patch:
* whole $SUFFIX will be checked by unique plugins
* just staged users are exluded from check

This reverts some changes in commit
52b7101c11

Since 389-ds-base 1.3.4.a1 new attribute 'uniqueness-exclude-subtrees'
can be used.

https://fedorahosted.org/freeipa/ticket/4921

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-19 12:45:41 +00:00
Martin Basti 99c0b918a7 Server Upgrade: ipa-ldap-updater will not do overall upgrade 
ipa-ldap-updater is now just util which applies changes specified in update
files or schema files.

ipa-ldap-updater will not do overall server upgrade anymore, use
ipa-server-upgrade instead.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 78baeeb77c Server Upgrade: handle errors better 
* Prevent to continue with upgrade if a fatal error happened
* Use exceptions to handle failures

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti f6e3088b87 Server Upgrade: do not allow to run upgradeinstace alone 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 6c438fff33 Server Upgrade: raise RuntimeError instead exit() 
Ldapupdater should not call sys.exit() in the middle of execution and
should fail gracefully

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 7660f40e2b Server Upgrade: Do not start DS if it was stopped before upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-19 12:43:04 +00:00
Martin Basti 3c86b0ef3e Dont use the proxy to check CA status 
Checking status of the CA via proxy cause issues when httpd instance is
down.

To check status of CA we do not need proxy.

https://fedorahosted.org/freeipa/ticket/4994

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-15 10:22:28 +00:00
Martin Basti 57fba7a56f Server Upgrade: fix memberUid index 
https://fedorahosted.org/freeipa/ticket/5007

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-12 12:50:47 +02:00
Martin Basti 520bbd001b Server Upgrade: Allow base64 encoded values 
This patch allows to use base64 encoded values in update files.

Double colon ('::') must be used as separator between attribute name
and base64 encoded value.

add:attr::<base64-value>
replace:attr::<old-base64-value>::<new-base64-value>

https://fedorahosted.org/freeipa/ticket/4984

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-11 16:08:01 +00:00
Martin Basti 5783d0c832 Server Upgrade: remove CSV from upgrade files 
CSV values are not supported in upgrade files anymore

Instead of

   add:attribute: 'first, part', second

please use

  add:attribute: firts, part
  add:attribute: second

Required for ticket: https://fedorahosted.org/freeipa/ticket/4984

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-05-11 16:08:01 +00:00
Martin Basti 5db962d167 Server Upgrade: enable DS global lock during upgrade 
https://fedorahosted.org/freeipa/ticket/4925

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 882ce85ad5 Server Upgrade: use LDIF parser to modify DSE.ldif 
Ticket: https://fedorahosted.org/freeipa/ticket/4925
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 522cbb23f1 move realm_to_serverid to installutils module 
To avoid cyclic imports realm_to_serverid function had to be moved to
installutils from dsinstance.

Required for: https://fedorahosted.org/freeipa/ticket/4925

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 81df7b501e Server Upgrade: fix a comment in ldapupdater 
DN sorting was removed in previous patches

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-05 11:47:49 +02:00
Martin Basti 3debc7b2b5 Server Upgrade: use ipa-server-upgrade in RPM upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00
Martin Basti 9f049ca144 Server Upgrade: Verify version and platform 
Verify version and platform before upgrade or ipactl start|restart

Upgrade:
* do not allow upgrade on different platforms
* do not allow upgrade data with higher version than build has

Start:
* do not start services if platform mismatch
* do not start services if upgrade is needed
* do not start services if data with higher version than build has

New ipactl options:
--skip-version-check: do not validate IPA version
--ignore-service-failures (was --force): ignore if a service start fail
      and continue with starting other services
--force: combine --skip-version-check and --ignore-service-failures

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00
Martin Basti 3942696606 Server Upgrade: ipa-server-upgrade command 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00
Martin Basti 2c8c4b8c88 ipa client: use NTP servers specified by user 
NTP servers specified by user should be used to synchronize time.

https://fedorahosted.org/freeipa/ticket/4983

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:39:08 +02:00
Martin Basti e55d8ee5d4 ipa client: use NTP servers detected from SRV 
Detected NTP servers from SRV records should be used in NTP client
configuration.

https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Basti e395bdb911 ipa client: make --ntp-server option multivalued 
There can be more ntp servers in ntp.conf

Required for ticket: https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Basti 0a1a3d7312 DNSSEC CI tests 
Tests:
* install master, replica, then instal DNSSEC on master
  * test if zone is signed (added on master)
  * test if zone is signed (added on replica)

* install master with DNSSEC, then install replica
  * test if root zone is signed
  * add zone, verify signatures using our root zone

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Milan Kubik <mkubik@redhat.com>
 2015-04-14 19:29:36 +02:00
Martin Basti b9c5744031 Server Upgrade: only root can run updates 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti d09706a8c8 Server Upgrade: restart DS using ipaplatfom service 
Removes extra class DSRestart which do the same thing

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b605ccc94b Server Upgrade: use ldap2 connection in fix_replica_agreements 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 4aec9d2280 Server Upgrade: Handle connection better in updates_from_dict 
Connection should be closed if update is done

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 0e752aab29 Server Upgrade: plugins should use ldapupdater API instance 
This is required to have proper LDAP connection in plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti f24f614396 Server Upgrade: specify order of plugins in update files 
* add 'plugin' directive
* specify plugins order in update files
* remove 'run plugins' options
* use ldapupdater API instance in plugins
* add update files representing former PreUpdate and PostUpdate order of plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti cc19b5a76a Server Upgrade: Apply plugin updates immediately 
Preparation to moving plugins executin into update files.
* remove apply_now flag
* plugins will return only (restart, modifications)

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b4ca5c57d2 Server Upgrade: remove unused code in upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 13c4631813 Server Upgrade: use only LDAPI connection 
Use only ldapi connection to execute upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b92136cba2 Fix ldap2 shared connection 
Since API is not singleton anymore, ldap2 connections should not be
shared by default.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-02 12:26:04 +00:00
Martin Basti 1216da8b9f DNSSEC: Do not log into files 
We want to log DNSSEC daemons only into console (journald)

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-04-02 08:45:08 +00:00
Martin Basti b5e941d49b Server Upgrade: Fix comments 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-02 08:42:43 +00:00
Martin Basti c3d441ae03 Server Upgrade: remove --test option 
As --test option is not used for developing, and it is not recommended
to test if upgrade will pass, this path removes it copmletely.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:48:41 +01:00
Martin Basti c95c4849ae Server Upgrade: respect --test option in plugins 
Several plugins do the LDAP data modification directly.
In test mode these plugis should not be executed.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:40:24 +01:00
Martin Basti a42fcfc18b Server Upgrade: order update files by default 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 0c7274ead8 Server Upgrade: Update entries in order specified in file 
Dictionary replaced with list. Particular upgrades are
executed in the same order as they are specified in update
a file.

Different updates for the smae cn, are not merged into one upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 144bc6c1eb Server Upgrade: Set modified to false, before each update 
Variable self.modified should be set to false before each run of update

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 10bc6bd0bf Server Upgrade: Upgrade one file per time 
* Files are sorted alphabetically, no numbering required anymore
* One file updated per time

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti bb1d7a741c Server Upgrade: do not sort updates by DN 
Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti d3f5d5d1ff Server Upgrade: Remove unused PRE_SCHEMA_UPDATE 
This is not used anymore.

Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:33:22 +01:00
Martin Basti 6af49259c2 Fix dead code in ipap11helper module 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-11 14:32:20 +01:00
Martin Basti f26220b9b3 DNS: remove NSEC3PARAM from records 
NSEC3PARAM is configurable only from zone commands. This patch removes
this record type from DNS records.

Ticket: https://fedorahosted.org/freeipa/ticket/4930
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-09 15:21:04 +01:00
Martin Basti 63c497a1fb DNS fix: do not show part options for unsupported records 
Do not show parts options in help output, if record is marked as unsupported.

Ticket: https://fedorahosted.org/freeipa/ticket/4930
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-09 15:21:04 +01:00
Martin Basti 0c3bf595f3 DNS fix: do not traceback if unsupported records are in LDAP 
Show records which are unsupported, if they are in LDAP.
Those records are not editable, and web UI doesnt show them.

Fixes traceback caused by --structured option

Ticket: https://fedorahosted.org/freeipa/ticket/4930
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-09 15:21:04 +01:00
Martin Basti a695f33989 Remove unused disable-betxn.ldif file 
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-09 14:45:16 +01:00
Martin Basti 93c384fd13 Remove unused method from ipap11pkcs helper module 
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-06 10:54:21 +01:00
Martin Basti 46a631138f Fix memory leaks in ipap11helper 
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-06 10:54:21 +01:00
Martin Basti a178f586bd DNSSEC add support for CKM_RSA_PKCS_OAEP mechanism 
Ticket: https://fedorahosted.org/freeipa/ticket/4657#comment:13
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-03-06 10:54:21 +01:00
Martin Basti 52b7101c11 Fix uniqueness plugins 
* add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users
will not be forced to have unique uid

* remove unneded update plugins -> update was moved to .update file

* add uniqueness-across-all-subtrees required by user lifecycle
management

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00