IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-10-31 17:17:48 -05:00
Code Issues Packages Projects Releases Wiki Activity
7,547 Commits 11 Branches 63 Tags
d03b09beb4855f6ceea505221bf39a0f1369fa73
Commit Graph
7547 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tomas Babej d03b09beb4 idviews: Support specifying object names instead of raw anchors only 
Improve usability of the ID overrides by allowing user to specify the common name of
the object he wishes to override. This is subsequently converted to the ipaOverrideAnchor,
which serves as a stable reference for the object.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 6a798f144f trusts: Add conversion from SID to object name 
Since SID is often used as a unique identifier for AD objects, we need to convert
a SID to actual object name in the AD.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 186c161ef5 idviews: Extend idview-show command to display assigned idoverrides and hosts 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej f3576bd94b idviews: Add ipa idview-apply and idview-unapply commands 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 6e94d23a92 hostgroup: Selected PEP8 fixes for the hostgroup plugin 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej ce42bf282f hostgroup: Remove redundant and star imports 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 936eaada89 hostgroup: Add helper that returns all members of a hostgroup 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 377ab0c4a6 idvies: Add managed permissions for idview and idoverride objects 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej b65b74890b idviews: Create basic idview plugin structure 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej f48a7bb730 ipalib: PEP8 fixes for host plugin 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 3e2e5a4d28 ipalib: Remove redundant and star imports from host plugin 
Also fixes incorrect error catching for UnicodeDecodeError.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej be36525dc5 idviews: Add ipaAssignedIDVIew reference to the host object 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 6b14030e90 idviews: Create container for ID views under cn=accounts 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 16f3786d25 idviews: Add necessary schema for the ID views 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Jan Cholasta 98c5788c37 Add missing imports to ipapython.certdb 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-30 10:18:08 +02:00
Jan Cholasta b1fe42df16 Do not crash in CAInstance.__init__ when default argument values are used 
https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-30 10:06:48 +02:00
Jan Cholasta da24d8a6e7 Fix certmonger search for the CA cert in ipa-certupdate and ipa-cacert-manage 
The search criteria did not include the CA agent name.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 05e66264a9 Fix certmonger.wait_for_request 
https://fedorahosted.org/freeipa/ticket/4558

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 734afdf936 Remove ipa-ca.crt from systemwide CA store on client uninstall and cert update 
The file was used by previous versions of IPA to provide the IPA CA certificate
to p11-kit and has since been obsoleted by ipa.p11-kit, a file which contains
all the CA certificates and associated trust policy from the LDAP certificate
store.

Since p11-kit is hooked into /etc/httpd/alias, ipa-ca.crt must be removed to
prevent certificate import failures in installer code.

Also add ipa.p11-kit to the files owned by the freeipa-python package.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 4e68046751 Get server hostname from jsonrpc_uri in ipa-certupdate 
https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 9ab402c495 Check if IPA client is configured in ipa-certupdate 
https://fedorahosted.org/freeipa/ticket/4460

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta f40a0ad325 Use /etc/ipa/nssdb to get nicknames of IPA certs installed in /etc/pki/nssdb 
Previously a list of nicknames was kept in /etc/pki/nssdb/ipa.txt. The file
is removed now.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta bbf962299d Use NSSDatabase instead of direct certutil calls in client code 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta b764e9d3e6 Add NSSDatabase.has_nickname for checking nickname presence in a NSS DB 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 86c534df7d Move NSSDatabase from ipaserver.certs to ipapython.certdb 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 231f57cedb Introduce NSS database /etc/ipa/nssdb 
This is the new default NSS database for IPA.

/etc/pki/nssdb is still maintained for backward compatibility.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Martin Kosek 2421b13a9b Fix ImportError in ipa-ca-install 
Patch 3aa0731f was not merged correctly and import for a function
that no longer exists. This patch fixes the import.

https://fedorahosted.org/freeipa/ticket/4480
 2014-09-30 09:35:28 +02:00
Jan Cholasta 83cbfa8eae Do stricter validation of CA certificates 
Every CA certificate must have non-empty subject and basic constraints
extension with the CA flag set.

https://fedorahosted.org/freeipa/ticket/4477

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-30 08:50:47 +02:00
Jan Cholasta 3cde7e9cfd Allow choosing CA-less server certificates by name 
Added new --*-cert-name options to ipa-server-install and ipa-replica-prepare
and --cert-name option to ipa-server-certinstall. The options allows choosing
a particular certificate and private key from PKCS#12 files by its friendly
name.

https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-30 08:50:47 +02:00
Jan Cholasta 88083887c9 CA-less installer options usability fixes 
The --*_pkcs12 options of ipa-server-install and ipa-replica-prepare have
been replaced by --*-cert-file options which accept multiple files.
ipa-server-certinstall now accepts multiple files as well. The files are
accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and
raw private key and PKCS#12 formats.

The --root-ca-file option of ipa-server-install has been replaced by
--ca-cert-file option which accepts multiple files. The files are
accepted in PEM and DER certificate and PKCS#7 certificate chain formats.

The --*_pin options of ipa-server-install and ipa-replica-prepare have been
renamed to --*-pin.

https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-30 08:50:47 +02:00
Jan Cholasta 3aa0731fc6 External CA installer options usability fixes 
The --external_cert_file and --external_ca_file options of ipa-server-install
and ipa-ca-install have been replaced by --external-cert-file option which
accepts multiple files. The files are accepted in PEM and DER certificate and
PKCS#7 certificate chain formats.

https://fedorahosted.org/freeipa/ticket/4480

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-30 08:50:47 +02:00
Jan Cholasta 60ecba77cd Add NSSDatabase.import_files method for importing files in various formats 
The files are accepted in PEM and DER certificate, PKCS#7 certificate chain,
PKCS#8 and raw private key and PKCS#12 formats.

https://fedorahosted.org/freeipa/ticket/4480
https://fedorahosted.org/freeipa/ticket/4489

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-30 08:50:47 +02:00
Sumit Bose 3c75b9171e extdom: add support for new version 
Currently the extdom plugin is basically used to translate SIDs of AD
users and groups to names and POSIX IDs.

With this patch a new version is added which will return the full member
list for groups and the full list of group memberships for a user.
Additionally the gecos field, the home directory and the login shell of a
user are returned and an optional list of key-value pairs which
currently will contain the SID of the requested object if available.

https://fedorahosted.org/freeipa/ticket/4031

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
 2014-09-30 08:29:59 +02:00
Nathaniel McCallum 35ec0f7e3d Use stack allocation when writing values during otp auth 
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2014-09-30 08:27:47 +02:00
Petr Vobornik fcce15d0bd webui: do not offer ipa-ad-winsync and ipa-ipa-trust range types 
They are not supported by API.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-29 16:43:02 +02:00
Tomas Babej d83af7d38d baseldap: Properly handle the case of renaming object to the same name 
When renaming a object to the same name, errors.EmptyModList is raised.
This is not properly handled, and can cause other modifications in the
LDAPUpdate command to be ignored.

https://fedorahosted.org/freeipa/ticket/4548

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-29 15:24:58 +02:00
Jan Cholasta f8f3d58688 Allow specifying signing algorithm of the IPA CA cert in ipa-server-install. 
This is especially useful for external CA install, as the algorithm is also
used for the CSR signature.

https://fedorahosted.org/freeipa/ticket/4447

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-29 13:40:57 +02:00
David Kupka cd9a4cca1f Do not require description in UI. 
Description attribute is not required in LDAP schema so there is no reason to
require it in UI. Modified tests to reflect this change.

https://fedorahosted.org/freeipa/ticket/4387

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-29 12:53:43 +02:00
David Kupka 947c7398ed Detect and configure all usable IP addresses. 
Find, verify and configure all IP addresses that can be used to reach the server
FreeIPA is being installed on. Ignore some IP address only if user specifies
subset of detected addresses using --ip-address option.
This change simplyfies FreeIPA installation on multihomed and dual-stacked servers.

https://fedorahosted.org/freeipa/ticket/3575

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-09-26 17:54:18 +02:00
Petr Viktorin f866186239 ipaserver.install.service: Don't show error message on SystemExit(0) 
Additional fix for: https://fedorahosted.org/freeipa/ticket/4499

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-26 16:55:54 +02:00
David Kupka 89c4f12425 Add 'host' setting into default.conf configuration file on client. Fix description in man page. 
'host' setting specifies local hostname not the hostname of IPA server.

https://fedorahosted.org/freeipa/ticket/4481

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:38:57 +02:00
Martin Basti 66ce71f17a LDAP disable service 
This patch allows to disable service in LDAP (ipactl will not start it)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:36:04 +02:00
Martin Basti 29ba9d9d26 Refactoring of autobind, object_exists 
Required to prevent code duplications

ipaldap.IPAdmin now has method do_bind, which tries several bind methods
ipaldap.IPAClient now has method object_exists(dn)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:21:15 +02:00
Petr Viktorin dea825fd9c ipa-restore: Set SELinux booleans when restoring 
https://fedorahosted.org/freeipa/ticket/4157

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2014-09-26 12:12:59 +02:00
Petr Viktorin c7d6fea06f Move setting SELinux booleans to platform code 
Create a platform task for setting SELinux booleans.

Use an exception for the case when the booleans could not be set
(since this is an error if not handled).
Since ipaplatform should not depend on ipalib, create a new
errors module in ipapython for SetseboolError.

Handle uninstallation with the same task, which means
the booleans are now restored with a single call to
setsebool.

Preparation for: https://fedorahosted.org/freeipa/ticket/4157

Fixes: https://fedorahosted.org/freeipa/ticket/2934
Fixes: https://fedorahosted.org/freeipa/ticket/2519
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2014-09-26 12:12:59 +02:00
Sumit Bose 757272a3f8 ipa-kdb: fix unit tests 
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
 2014-09-26 11:28:26 +02:00
Martin Basti 3f8cfdab26 Remove --ip-address, --name-server otpions from DNS help 
Ticket: https://fedorahosted.org/freeipa/ticket/4149
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-26 10:26:52 +02:00
Martin Basti bc2eaa1456 DNS tests: tests update to due to change in options 
Affected options --name-server, --ip-address

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-09-25 16:38:02 +02:00
Martin Basti 23620a4025 WebUI: DNS: Remove ip-address, admin-email options 
Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-09-25 16:38:02 +02:00
Martin Basti 239adf9de4 DNS: autofill admin email 
Admins email (SOA RNAME) is autofilled with value 'hostmaster'. Bind
will automaticaly append zone part.

Part of ticket: https://fedorahosted.org/freeipa/ticket/4149

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-09-25 16:38:02 +02:00