IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-12 16:32:01 -05:00
Code Issues Packages Projects Releases Wiki Activity
8,541 Commits 11 Branches 63 Tags
c7408f67f6cff7bd3ac14b7661472898f8e7dd73
Commit Graph
57 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David Kupka 59cc54b6dc ipactl: Do not start/stop/restart single service multiple times 
In case multiple services are provided by single system daemon
it is not needed to start/stop/restart it mutiple time.

https://fedorahosted.org/freeipa/ticket/5248

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-08-26 17:43:03 +02:00
David Kupka 02ab34c60b vault: Limit size of data stored in vault 
https://fedorahosted.org/freeipa/ticket/5231

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-08-26 16:11:42 +02:00
David Kupka db88985c0d Backup/resore authentication control configuration 
https://fedorahosted.org/freeipa/ticket/5071

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-08-19 14:13:00 +02:00
David Kupka f160aa3d0a client: Add description of --ip-address and --all-ip-addresses to man page 
https://fedorahosted.org/freeipa/ticket/4249

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-08-19 13:11:22 +02:00
David Kupka 8ba1392a39 client: Add support for multiple IP addresses during installation. 
https://fedorahosted.org/freeipa/ticket/4249

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-08-18 22:50:18 +02:00
David Kupka 65b8c62207 user-undel: Fix error messages. 
https://fedorahosted.org/freeipa/ticket/5207

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-08-18 19:27:01 +02:00
David Kupka fe91c375d0 dbus: Create empty dbus.Array with specified signature 
Python DBus binding could fail to guess the type signature from empty list.
This issue was seen but we don't have a reproducer. There is no harm in making
sure that it will not happen.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-08-14 12:48:45 +02:00
David Kupka e384aad729 ipa-client-install: Do not (re)start certmonger and DBus daemons. 
When DBus is present in the system it is always running.

Starting of certmomger is handled in ipapython/certmonger.py module if
necessary. Restarting is no longer needed since freeipa is not changing
certmonger's files.

https://fedorahosted.org/freeipa/ticket/5095

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-20 14:28:09 +00:00
David Kupka 2defc486ab cermonger: Use private unix socket when DBus SystemBus is not available. 
https://fedorahosted.org/freeipa/ticket/5095

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-20 14:28:09 +00:00
David Kupka e5d179b5b9 migration: Use api.env variables. 
Use api.env.basedn instead of anonymously accessing LDAP to get base DN.
Use api.env.basedn instead of searching filesystem for ldapi socket.

https://fedorahosted.org/freeipa/ticket/4953

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-17 10:30:42 +02:00
David Kupka 6a91893ff5 ipa-replica-prepare: Do not create DNS zone it automatically. 
When --ip-address is specified check if relevant DNS zone exists
in IPA managed DNS server, exit with error when not.

https://fedorahosted.org/freeipa/ticket/5014

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-07-08 00:37:42 +02:00
David Kupka e3d3938f44 upgrade: Raise error when certmonger is not running. 
Certmonger should be running (should be started on system boot).
Either user decided to stop it or it crashed. We should just error out and
let user check & fix it.

https://fedorahosted.org/freeipa/ticket/5080

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-06-29 13:46:47 +02:00
David Kupka 4d05b5d18d Use 389-ds centralized scripts. 
Directory server is deprecating use of tools in instance specific paths. Instead
tools in bin/sbin path should be used.

https://fedorahosted.org/freeipa/ticket/4051

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-11 13:16:06 +02:00
David Kupka 2acedb2d5d Move CA installation code into single module. 
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-06-08 06:22:54 +00:00
David Kupka 0167919ba8 Do not store state if CA is enabled 
IPA creates own instance of CA, so there is no need to check if previous
instance was enabled, because there could not be any.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-05-19 12:53:58 +00:00
David Kupka f19f3e5741 Lint: Fix error on pylint-1.3.1 introduced by fix for pylint-1.4.1. 
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-27 11:02:57 +02:00
David Kupka 9b706e74d5 Make lint work on Fedora 22. 
pylint added 'confidence' parameter to 'add_message' method of PyLinter.
To be compatible with both, pre- and post- 1.4  IPALinter must accept
the parameter but not pass it over.
Also python3 checker was added and enabled by default. FreeIPA is still
not ready for python3.
Additionally few false-positives was marked.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-27 11:02:57 +02:00
David Kupka 4a5f5b14c3 Lint: Skip checking of functions stolen by python-nose. 
python-nose modifies namespaces in a way that confuses pylint. To skip
these PyCheckers' visit_callfunc method must be extended.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-24 15:57:45 +02:00
David Kupka b9657975b7 Bump ipa.conf version to 17. 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-03-30 13:06:12 +00:00
David Kupka 5a03462bfc Use mod_auth_gssapi instead of mod_auth_kerb. 
https://fedorahosted.org/freeipa/ticket/4190

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-03-30 13:06:12 +00:00
David Kupka 8c72e2efad Remove unused part of ipa.conf. 
Separate configuration of '/var/www/cgi-bin' is no longer needed legacy from
IPA 1.0.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-03-30 13:06:12 +00:00
David Kupka 082c55fb9c Always reload StateFile before getting or modifying the stored values. 
This change does not solve using multiple instances of StateFile concurently
because there is no use for it in near future. Instead this solves an issue of loosing
records when more instances of StateFile are interleaved in sequential code.

https://fedorahosted.org/freeipa/ticket/4901

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:42:16 +01:00
David Kupka 4a20115ce8 Restore default.conf and use it to build API. 
When restoring ipa after uninstallation we need to extract and load
configuration of the restored environment.

https://fedorahosted.org/freeipa/ticket/4896

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-03-05 12:17:23 +00:00
David Kupka aa745b31d3 Use IPA CA certificate when available and ignore NO_TLS_LDAP when not. 
ipa-client-automount is run after ipa-client-install so the CA certificate
should be available. If the certificate is not available and ipadiscovery.ipacheckldap
returns NO_TLS_LDAP warn user and try to continue.

https://fedorahosted.org/freeipa/ticket/4902

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2015-03-05 10:59:01 +01:00
David Kupka 3b87302f5a idviews: Allow setting ssh public key on ipauseroverride-add 
https://fedorahosted.org/freeipa/ticket/4868

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-27 16:03:13 +00:00
David Kupka b6c58ff238 Abort backup restoration on not matching host. 
When restoring backup on master other than it was created there is high risk
of unexpected and hard-to-debug behavior. Refuse such restore.

https://fedorahosted.org/freeipa/ticket/4823

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-13 15:01:31 +00:00
David Kupka b0f412177f Remove ipanttrustauthincoming/ipanttrustauthoutgoing from ipa trust-add output. 
https://fedorahosted.org/freeipa/ticket/4787

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-01-13 15:33:55 +01:00
David Kupka 3c69435c1b Always add /etc/hosts record when DNS is being configured. 
This was done previosly but accidentally removed when later with patch for
ticket #3575.

https://fedorahosted.org/freeipa/ticket/4817

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-18 13:09:58 +01:00
David Kupka 3a6d714bb2 Use singular in help metavars + update man pages. 
https://fedorahosted.org/freeipa/ticket/4695

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-11-26 14:33:23 +01:00
David Kupka 56ca47d535 Fix error message for nonexistent members and add tests. 
https://fedorahosted.org/freeipa/ticket/4643

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-11-24 16:04:57 +01:00
David Kupka 373bbee4e3 ipa-restore: Check if directory is provided + better errors. 
https://fedorahosted.org/freeipa/ticket/4683

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-11-21 15:19:56 +01:00
David Kupka 35dad9684b Fix --{user,group}-ignore-attribute in migration plugin. 
Ignore case in attribute names.

https://fedorahosted.org/freeipa/ticket/4620

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-11-20 16:49:13 +01:00
David Kupka b032debd23 Produce better error in group-add command. 
https://fedorahosted.org/freeipa/ticket/4611

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-13 13:07:22 +00:00
David Kupka e28eb13907 Remove service file even if it isn't link. 
(Link to) service file from /etc/systemd/system/ must be removed before masking
systemd service.

https://fedorahosted.org/freeipa/ticket/4658

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-13 13:53:23 +01:00
David Kupka 82c3c2b242 Remove unneeded internal methods. Move code to public methods. 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-11 09:18:30 +01:00
David Kupka 9335552418 Stop dirsrv last in ipactl stop. 
Other services may depend on directory server.

https://fedorahosted.org/freeipa/ticket/4632

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-06 10:43:11 +01:00
David Kupka 364d466fd7 Respect UID and GID soft static allocation. 
https://fedoraproject.org/wiki/Packaging:UsersAndGroups?rd=Packaging/UsersAndGroups#Soft_static_allocation

https://fedorahosted.org/freeipa/ticket/4585

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-11-05 15:22:51 +01:00
David Kupka 3f9d1a71f1 Fix typo causing certmonger is provided with wrong path to ipa-submit. 
Using strip() instead split() caused that only first character of path was specified.
Also using shlex for more robust parsing.

https://fedorahosted.org/freeipa/ticket/4624

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-10-16 09:49:46 +02:00
David Kupka 47731f4584 Fix printing of reverse zones in ipa-dns-install. 
This was forgotten in patch for ticket
https://fedorahosted.org/freeipa/ticket/3575

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-10-16 08:02:02 +02:00
David Kupka c44f4dcbea Stop dogtag when updating its configuration in ipa-upgradeconfig. 
Modifying CS.cfg when dogtag is running may (and does) result in corrupting
this file.

https://fedorahosted.org/freeipa/ticket/4569

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-10-15 09:12:11 +02:00
David Kupka c8f7cb0163 Set IPA CA for freeipa certificates. 
In previous versions (before moving certmonger.py to DBus) it was set and some
tools and modules depends on it. For example: ipa-getcert uses this to filter
freeipa certificates.

https://fedorahosted.org/freeipa/ticket/4618

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-10-14 10:55:29 +02:00
David Kupka 35c7bd05af Check that port 8443 is available when installing PKI. 
https://fedorahosted.org/freeipa/ticket/4564

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-10 11:57:44 +02:00
David Kupka f36794e811 Fix example usage in ipa man page. 
https://fedorahosted.org/freeipa/ticket/4587

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-10-08 09:52:08 +02:00
David Kupka cd9a4cca1f Do not require description in UI. 
Description attribute is not required in LDAP schema so there is no reason to
require it in UI. Modified tests to reflect this change.

https://fedorahosted.org/freeipa/ticket/4387

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-29 12:53:43 +02:00
David Kupka 947c7398ed Detect and configure all usable IP addresses. 
Find, verify and configure all IP addresses that can be used to reach the server
FreeIPA is being installed on. Ignore some IP address only if user specifies
subset of detected addresses using --ip-address option.
This change simplyfies FreeIPA installation on multihomed and dual-stacked servers.

https://fedorahosted.org/freeipa/ticket/3575

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-09-26 17:54:18 +02:00
David Kupka 89c4f12425 Add 'host' setting into default.conf configuration file on client. Fix description in man page. 
'host' setting specifies local hostname not the hostname of IPA server.

https://fedorahosted.org/freeipa/ticket/4481

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:38:57 +02:00
David Kupka cba9dcfe0d Fix typo causing ipa-upgradeconfig to fail. 
Replace 'post-certsave-command' by 'cert-postsave-command'.

https://fedorahosted.org/freeipa/ticket/4529

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-11 13:27:04 +02:00
David Kupka dc4bdd327f Allow user to force Kerberos realm during installation. 
User can set realm not matching one resolved from DNS. This is useful especially
when DNS is missconfigured.

https://fedorahosted.org/freeipa/ticket/4444

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 14:50:36 +02:00
David Kupka 4484d4d58b Do not restart apache server when not necessary. 
https://fedorahosted.org/freeipa/ticket/4352

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 13:15:46 +02:00
David Kupka 6d94cdf250 Use certmonger D-Bus API instead of messing with its files. 
FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.

>=certmonger-0.75.13 is needed for this to work.

https://fedorahosted.org/freeipa/ticket/4280

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 10:51:42 +02:00
David Kupka 8aa01e24a1 Add record(s) to /etc/host when IPA is configured as DNS server. 
This is to avoid chicken-egg problem when directory server fails to start
without resolvable hostname and named fails to provide hostname without
directory server.

https://fedorahosted.org/freeipa/ticket/4220

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-03 16:03:31 +02:00
David Kupka 724391a71b Verify otptoken timespan is valid 
When creating or modifying otptoken check that token validity start is not after
validity end.

https://fedorahosted.org/freeipa/ticket/4244

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-29 17:09:29 +02:00
David Kupka f7e00b9ad6 test group: remove group from protected group. 
Related to https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-29 17:07:11 +02:00
David Kupka 6119c21441 Fix group-remove-member crash when group is removed from a protected group 
https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-29 13:10:51 +02:00
David Kupka 603842867c Improve password validity check. 
Allow use of characters that no longer cause troubles. Check for
leading and trailing characters in case of 389 Direcory Manager password.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-24 14:22:40 +02:00
David Kupka 41b057e387 Always record that pkicreate has been executed. 
Record that pkicreate/pkispawn has been executed to allow cleanup even if the
installation did not finish correctly.

https://fedorahosted.org/freeipa/ticket/2796

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-22 09:03:56 +02:00
David Kupka 2ff14607b1 Fix ipa-client-install --uninstall crash 
Fix ipa-client-install crash when chronyd service fails to start.

https://fedorahosted.org/freeipa/ticket/4273

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-08 10:29:13 +02:00