Commit Graph

618 Commits

Author SHA1 Message Date
David Kupka
8d19da49c4 dns: Check if domain already exists.
Raise an error when the domain already exists. This can be overriden using
--force or --allow-zone-overlap options.

https://fedorahosted.org/freeipa/ticket/3681

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-12-14 18:53:53 +01:00
David Kupka
6c107d819c dns: do not add (forward)zone if it is already resolvable.
Check if the zone user wants to add is already resolvable and refuse to
create it if yes. --skip-overlap-check and --force options suppress this check.

https://fedorahosted.org/freeipa/ticket/5087

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-12-14 18:53:53 +01:00
Jan Cholasta
f49cdfe392 ipautil: allow redirecting command output to standard output in run()
https://fedorahosted.org/freeipa/ticket/5527

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-14 14:46:45 +01:00
Petr Viktorin
099cf98307 Refactor ipautil.run
The ipautil.run function now returns an object with returncode and
output are accessible as attributes.

The stdout and stderr of all commands are logged (unless skip_output is given).

The stdout/stderr contents must be explicitly requested with a keyword
argument, otherwise they are None.
This is because in Python 3, the output needs to be decoded, and that can
fail if it's not decodable (human-readable) text.

The raw (bytes) output is always available from the result object,
as is "leniently" decoded output suitable for logging.

All calls are changed to reflect this.

A use of Popen in cainstance is changed to ipautil.run.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-14 10:54:23 +01:00
David Kupka
2c5a662fd8 install: Run all validators at once.
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-08 08:12:22 +01:00
Jan Cholasta
01ddf51df7 custodia: do not modify memberPrincipal on key update
https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-12-07 08:14:13 +01:00
Jan Cholasta
662158b781 ipautil: use file in a temporary dir as ccache in private_ccache
python-gssapi chokes on empty ccache files, so instead of creating an empty
temporary ccache file in private_ccache, create a temporary directory and
use a non-existent file in that directory as the ccache.

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-12-07 08:14:13 +01:00
Stanislav Laznicka
498471e4ae Removed duplicate domain name validating function
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-02 17:26:56 +01:00
Petr Spacek
fa62480c73 ipa-client-install: add support for Ed25519 SSH keys (RFC 7479)
https://fedorahosted.org/freeipa/ticket/5471

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-01 09:41:52 +01:00
Martin Basti
2a1a3c498a Upgrade: increase time limit for upgrades
Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-01 08:51:44 +01:00
Martin Basti
800c702324 Use absolute domain in detection of A/AAAA records
Python dns resolver append configured domain to queries which may lead
to false positive answer.

Exmaple: resolving "ipa.example.com" may return records for
"ipa.example.com.example.com" if domain is configured as "example.com"

https://fedorahosted.org/freeipa/ticket/5421

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-25 14:13:26 +01:00
Tomas Babej
1904d7cc3a private_ccache: Harden the removal of KRB5CCNAME env variable
If the code within the private_ccache contextmanager does not
set/removes the KRB5CCNAME, the pop method will raise KeyError, which
will cause unnecessary termination of the code flow.

Make sure the KRB5CCNAME is popped out of os.environ only if present.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-25 13:51:10 +01:00
Jan Cholasta
aeffe2da42 install: drop support for Dogtag 9
Dogtag 9 CA and CA DS install and uninstall code was removed. Existing
Dogtag 9 CA and CA DS instances are disabled on upgrade.

Creating a replica of a Dogtag 9 IPA master is still supported.

https://fedorahosted.org/freeipa/ticket/5197

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-11-25 09:12:25 +01:00
Fraser Tweedale
6fe0a89807 Do not erroneously reinit NSS in Dogtag interface
The Dogtag interface always attempts to (re)init NSS, which can fail
with SEC_ERROR_BUSY.  Do not reinitialise NSS when it has already
been initialised with the given dbdir.

Part of: https://fedorahosted.org/freeipa/ticket/5459

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-24 10:12:24 +01:00
Fraser Tweedale
2be8d2d068 TLS and Dogtag HTTPS request logging improvements
Pretty printing the TLS peer certificate to logs on every request
introduces a lot of noise; do not log it (subject name, key usage
and validity are still logged).

Fix and tidy up some HTTP logging messages for Dogtag requests.

Part of: https://fedorahosted.org/freeipa/ticket/5269

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-23 11:05:49 +01:00
Lukas Slebodnik
2d39acf626 BUILD: provide check target in custom Makefiles
The automake generated makefiles have already a target check.
We need to provide this target also to non-generated
Makefiles so we can recursively call make check from
top level Makefile

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-18 12:53:26 +01:00
Niranjan MR
0152d16820 enable pem=True in export_pem_cert function
export_pem_cert should export the certificate
in pem format but instead exports the cert in der
format as it doesn't enable pem=True.
This patch specifies pem=True for export_pem_cert function

Signed-off-by: Niranjan MR <mrniranjan@fedoraproject.org>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-11-11 15:02:56 +01:00
Martin Babinsky
b6a2a1cfd2 fix error reporting when installer option is supplied with invalid choice
https://fedorahosted.org/freeipa/ticket/5433

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-11 10:43:52 +01:00
Jan Cholasta
6a55174bb6 install: fix command line option validation
The code which calls the validators was accidentally removed, re-add it.

https://fedorahosted.org/freeipa/ticket/5386
https://fedorahosted.org/freeipa/ticket/5391
https://fedorahosted.org/freeipa/ticket/5392

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-05 10:33:01 +01:00
Gabe
9ffb388253 interactive installer does not ignore leading/trailing whitespace
https://fedorahosted.org/freeipa/ticket/5355

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-29 18:02:01 +01:00
Petr Viktorin
acf519f5c5 ipapython.secrets: Port to Python 3
StringIO was renamed in Python 3. The import was was unused,
so remove it.

Files need to be opened in binary mode if bytes are written to them.
(For Python 2: on Linux, there's no practical difference between
text and binary mode)

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
6811b4be6a ipapython.nsslib: Remove NSSHTTPS
This workaround is unused in Python 2.7+.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
4ddd1821b6 ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and below
IPA hasn't supported these pythons for a while now.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
8a2b65a357 Fix more bytes/unicode issues
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
eab334dde8 Handle binascii.Error from base64.b64decode()
In Python 3, the base64.b64decode function raises binascii.Error (a ValueError
subclass) when it finds incorrect padding. In Python 2 it raises TypeError.

Callers should usually handle ValueError; unless they are specifically
concerned with handling base64 padding issues).

In some cases, callers should handle ValueError:
- ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should
  handle ValueError
- ipalib.x509 (load_certificate*, get_*): callers should handle ValueError

In other cases ValueError is handled:
- ipalib.parameters
- ipapython.ssh
- ipalib.rpc (json_decode_binary - callers already expect ValueError)
- ipaserver.install.ldapupdate

Elsewhere no error handling is done, because values come from trusted
sources, or are pre-validated:
- vault plugin
- ipaserver.install.cainstance
- ipaserver.install.certs
- ipaserver.install.ipa_otptoken_import

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Simo Sorce
86240938b5 Add function to extract CA certs for install
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Simo Sorce
d03619fff3 Implement replica promotion functionality
This patch implements a new flag --promote for the ipa-replica-install command
that allows an administrative user to 'promote' an already joined client to
become a full ipa server.

The only credentials used are that of an administrator. This code relies on
ipa-custodia being available on the peer master as well as a number of other
patches to allow a computer account to request certificates for its services.

Therefore this feature is marked to work only with domain level 1 and above
servers.

Ticket: https://fedorahosted.org/freeipa/ticket/2888

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Simo Sorce
463dda3067 Add ipa-custodia service
Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
David Kupka
5aa118d149 admintool: Add error message with path to log on failure.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-15 13:32:13 +02:00
Petr Viktorin
88fc27da52 ipaldap: Remove extraneous long (included in six.int_types)
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
f67155486b Alias long to int under Python 3
In py3, the two types are unified under the name "int".

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
dd0bfefae8 ipapython.ssh: Port to Python 3
Sort out the accepted types.
Handle Python 3's stricter separation between bytes and unicode.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
e3c05fcb73 Remove uses of the types module
In Python 3, the types module no longer provide alternate names for
built-in types, e.g. `types.StringType` can just be spelled `str`.

NoneType is also removed; it needs to be replaced with type(None)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
026b1b5307 Use six.moves.http_client instead of httplib
The module was renamed in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
187efdfe42 Use six.moves.configparser instead of ConfigParser
The module name was lowercased in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ad2bc94725 Use six.moves.xmlrpc.client instead of xmlrpclib
The module is renamed to xmlrpc.client in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
70b37a956c Use six.moves.urllib instead of urllib/urllib2/urlparse
In Python 3, these modules are reorganized.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
7f1204a42c Use sys.maxsize instead of sys.maxint
In Python 3, integers don't have a maximum. The number called
"sys.maxint" is now "sys.maxsize" (defined as larger than the
largest possible list/string index).

The new spelling is also available in Python 2.7.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ed96f8d9ba ipapython.dn: Use rich comparisons
__cmp__ and cmp were removed from Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
f4e62be667 ipap11helper: Port to Python 3
- Use PyLong instead of PyInt on Python 3
- Use PyBytes instead of PyString for binary strings
- Use Py_TYPE(o) instead of o->py_type, and PyVarObject_HEAD_INIT
  instead of PyObject_HEAD_INIT
- Use a helper function instead of Py_BuildValue("s#"), so that
  bytes are returned on Python 3
- Use new style module initialization on Python 3
- Use PyModule_AddIntConstant and PyModule_AddIntMacro for adding constants

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Robert Kuska
01da4a8de3 Replace StandardError with Exception
StandardError was removed in Python3 and instead
Exception should be used.

Signed-off-by: Robert Kuska <rkuska@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-30 10:51:36 +02:00
Tomas Babej
a758f16abe winsync-migrate: Convert entity names to posix friendly strings
During the migration from winsync replicated users to their
trusted identities, memberships are being preserved. However,
trusted users are external and as such cannot be added as
direct members to the IPA entities. External groups which
encapsulate the migrated users are added as members to those
entities instead.

The name of the external group is generated from the type
of the entity and its name. However, the entity's name can
contain characters which are invalid for use in the group
name.

Adds a helper function to convert a given string to a string
which would be valid for such use and leverages it in the
winsync-migrate tool.

https://fedorahosted.org/freeipa/ticket/5319

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-23 17:05:47 +02:00
Jan Cholasta
86edd6abeb install: Move unattended option to the general help section
https://fedorahosted.org/freeipa/ticket/4517

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-22 12:09:22 +02:00
Jan Cholasta
39f6f637a7 install: Support overriding knobs in subclasses
https://fedorahosted.org/freeipa/ticket/4517

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-22 12:09:22 +02:00
Jan Cholasta
ba5201979d Use bytes instead of str where appropriate
Under Python 2, "str" and "bytes" are synonyms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
23507e6124 Alias "unicode" to "str" under Python 3
The six way of doing this is to replace all occurences of "unicode"
with "six.text_type". However, "unicode" is non-ambiguous and
(arguably) easier to read. Also, using it makes the patches smaller,
which should help with backporting.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
cc53526fd2 Decode script arguments using file system encoding
This mimics Python 3's behavior, where sys.argv is automatically decoded
using file system encoding, as returned by sys.getfilesystemencoding(). This
includes reimplementation of os.fsdecode() from Python 3.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-07 08:00:11 +02:00
Jan Cholasta
cf9bf9dcaf Use six.python_2_unicode_compatible
Rename __unicode__ to __str__ in classes which define it and use the
six.python_2_unicode_compatible decorator on them to make them compatible with
both Python 2 and 3.

Additional changes were required for the ipapython.dnsutil.DNSName class,
because it defined both __str__ and __unicode__.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-07 08:00:11 +02:00
Jan Cholasta
ebdfa4380b Use six.with_metaclass to specify metaclasses
Metaclass specification is incompatible between Python 2 and 3. Use the
six.with_metaclass helper to specify metaclasses.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-07 08:00:11 +02:00
Jan Cholasta
198908ec78 ldap: Make ldap2 connection management thread-safe again
This fixes the connection code in LDAPClient to not store the LDAP connection
in an attribute of the object, which in combination with ldap2's per-thread
connections lead to race conditions resulting in connection failures. ldap2
code was updated accordingly.

https://fedorahosted.org/freeipa/ticket/5268

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-09-04 13:31:46 +02:00
Petr Spacek
025a9b16c8 DNSSEC: Fix HSM synchronization in ipa-dnskeysyncd when running on DNSSEC key master
https://fedorahosted.org/freeipa/ticket/5273

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Oleg Fayans <ofayans@redhat.com>
2015-09-03 18:20:36 +02:00
Petr Viktorin
5178e9a597 Modernize use of range()
In Python 3, range() behaves like the old xrange().
The difference between range() and xrange() is usually not significant,
especially if the whole result is iterated over.

Convert xrange() usage to range() for small ranges.
Use modern idioms in a few other uses of range().

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
9e917cae39 Use six.reraise
The three-argument raise is going away in Python 3. Use the six.reraise
helper instead.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
8de13bd7dd Use the print function
In Python 3, `print` is no longer a statement. Call it as a function
everywhere, and include the future import to remove the statement
in Python 2 code as well.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
fb7943dab4 Use next() function on iterators
In Python 3, next() for iterators is a function rather than method.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
fbacc26a6a Use six.integer_types instead of (long, int)
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
c27cb295a5 Use six.moves.input instead of raw_input
In Python 3, raw_input() was renamed to input().
Import the function from six.moves to get the right version.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
5a9141dc40 Replace filter() calls with list comprehensions
In Python 3, filter() returns an iterator.
Use list comprehensions instead.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
3bf91eab25 Use Python3-compatible dict method names
Python 2 has keys()/values()/items(), which return lists,
iterkeys()/itervalues()/iteritems(), which return iterators,
and viewkeys()/viewvalues()/viewitems() which return views.

Python 3 has only keys()/values()/items(), which return views.
To get iterators, one can use iter() or a for loop/comprehension;
for lists there's the list() constructor.

When iterating through the entire dict, without modifying the dict,
 the difference between Python 2's items() and iteritems() is
negligible, especially on small dicts (the main overhead is
extra memory, not CPU time). In the interest of simpler code,
this patch changes many instances of iteritems() to items(),
iterkeys() to keys() etc.

In other cases, helpers like six.itervalues are used.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
dd16cc98b0 Use six.string_types instead of "basestring"
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Michael Simacek
aad73fad60 Port from python-krbV to python-gssapi
python-krbV library is deprecated and doesn't work with python 3. Replacing all
it's usages with python-gssapi.

- Removed Backend.krb and KRB5_CCache classes
  They were wrappers around krbV classes that cannot really work without them
- Added few utility functions for querying GSSAPI credentials
  in krb_utils module. They provide replacements for KRB5_CCache.
- Merged two kinit_keytab functions
- Changed ldap plugin connection defaults to match ipaldap
- Unified getting default realm
  Using api.env.realm instead of krbV call

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-08-26 09:41:36 +02:00
Abhijeet Kasurde
7c48621bb8 Added try/except block for user_input in ipautil
Added error handling for function user_input in order to
handle EOFError in ipautil.py

https://fedorahosted.org/freeipa/ticket/3406

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-19 15:41:57 +02:00
Fraser Tweedale
27988f1b83 Prohibit deletion of predefined profiles
Deletion of predefined profiles, including the default profile,
should not be allowed.  Detect this case and raise an error.

Also update the predefined profiles collection to use namedtuple,
making it easier to access the various components.

Fixes: https://fedorahosted.org/freeipa/ticket/5198
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-08-18 19:44:43 +02:00
Petr Viktorin
5435a8a32a Use absolute imports
In Python 3, implicit relative imports will not be supported.
Use fully-qualified imports everywhere.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-08-12 18:17:23 +02:00
Petr Viktorin
6a741b51da Replace dict.has_key with the 'in' operator
The deprecated has_key method will be removed from dicts in Python 3.

For custom dict-like classes, has_key() is kept on Python 2,
but disabled for Python 3.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-08-12 18:17:23 +02:00
Petr Viktorin
27dabb4528 Modernize 'except' clauses
The 'as' syntax works from Python 2 on, and Python 3 will
drop the "comma" syntax.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-08-12 18:17:23 +02:00
Fraser Tweedale
812ab600a3 Add profile for DNP3 / IEC 62351-8 certificates
The DNP3 smart-grid standard uses certificate with the IEC 62351-8
IECUserRoles extension.  Add a profile for DNP3 certificates which
copies the IECUserRoles extension from the CSR, if present.

Also update cert-request to accept CSRs containing this extension.

Fixes: https://fedorahosted.org/freeipa/ticket/4752
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-08-11 14:57:41 +02:00
Michael Simacek
f0b4c4487e Port from python-kerberos to python-gssapi
kerberos library doesn't support Python 3 and probably never will.
python-gssapi library is Python 3 compatible.

https://fedorahosted.org/freeipa/ticket/5147

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-08-05 08:08:00 +02:00
Petr Viktorin
b8c46f2a32 Modernize number literals
Use Python-3 compatible syntax, without breaking compatibility with py 2.7

- Octals literals start with 0o to prevent confusion
- The "L" at the end of large int literals is not required as they use
  long on Python 2 automatically.
- Using 'int' instead of 'long' for small numbers is OK in all cases except
  strict type checking checking, e.g. type(0).

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-31 15:22:19 +02:00
Niranjan Mallapadi
7d28230405 Use Exception class instead of StandardError
In except clause, use of "," is not recommended (PEP 3110)

Signed-off-by: Niranjan Mallapadi <mrniranjan@fedoraproject.org>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-07-27 18:01:34 +02:00
David Kupka
2defc486ab cermonger: Use private unix socket when DBus SystemBus is not available.
https://fedorahosted.org/freeipa/ticket/5095

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-20 14:28:09 +00:00
Martin Basti
c6c84faecf Py3: replace tab with space
python3 does not allow to mix spaces and tabs

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2015-07-17 17:19:51 +02:00
Martin Basti
9f70128353 sysrestore: copy files instead of moving them to avoind SELinux issues
Copying files restores SELinux context.

https://fedorahosted.org/freeipa/ticket/4923

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-07-17 13:46:23 +02:00
Christian Heimes
18d417e981 Replace file() with open()
The open() function is the recommended way to open a file. In Python 3
the file type is gone, but open() still works the same.

The patch is related to https://fedorahosted.org/freeipa/ticket/5127

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-14 13:59:31 +02:00
Martin Basti
f7c98c650a Allow to run subprocess with suplementary groups
Param suplementary_groups allows to specify list of group names to be
used for subprocess.
suplementary_groups param requires runas param to be specified.

Required for ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-07-07 08:37:15 +02:00
Petr Vobornik
6be7d41ba1 ipa-replica-manage del: relax segment deletement check if topology is disconnected
https://fedorahosted.org/freeipa/ticket/5072

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-07-03 08:47:23 +02:00
Jan Cholasta
fe2accf776 ipalib: Load ipaserver plugins when api.env.in_server is True
https://fedorahosted.org/freeipa/ticket/3090
https://fedorahosted.org/freeipa/ticket/5073

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-07-01 13:05:30 +00:00
Petr Vobornik
659b88b820 topology: check topology in ipa-replica-manage del
ipa-replica-manage del now:
- checks the whole current topology(before deletion), reports issues
- simulates deletion of server and checks the topology again, reports issues

Asks admin if he wants to continue with the deletion if any errors are found.

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-06-29 17:11:08 +02:00
Jan Cholasta
bae80b00a6 install: Fix logging setup in server and replica install
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-12 05:46:31 +00:00
Petr Spacek
40680fd2a9 Update PKCS#11 mechanism constants for AES key wrapping to PKCS#11 v2.40.
SoftHSM 2.0.0rc1 was updates to these new constants to avoid collision with
Blowfish mechanisms.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-11 13:19:17 +02:00
Jan Cholasta
6f1ae05d8d install: Allow setting usage in CLI tools
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-06-10 07:29:58 +00:00
Jan Cholasta
eb0251c56b install: Add support for positional arguments in CLI tools
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-06-10 07:29:58 +00:00
Jan Cholasta
1bf383e0cf install: Handle Knob cli_name and cli_aliases values consistently
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-06-10 07:29:58 +00:00
Jan Cholasta
9e9c01fba2 install: Introduce installer framework ipapython.install
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-08 15:34:11 +00:00
Jan Cholasta
08229a0c54 install: Move private_ccache from ipaserver to ipapython
https://fedorahosted.org/freeipa/ticket/4468

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-08 15:33:36 +00:00
Fraser Tweedale
4cf2bfcaa6 Add profile_id parameter to 'request_certificate'
Add the profile_id parameter to the 'request_certificate' function
and update call sites.

Also remove multiple occurrences of the default profile ID
'caIPAserviceCert'.

Part of: https://fedorahosted.org/freeipa/ticket/57

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Fraser Tweedale
b24fe0eb73 Import included profiles during install or upgrade
Add a default service profile template as part of FreeIPA and format
and import it as part of installation or upgrade process.

Also remove the code that modifies the old (file-based)
`caIPAserviceCert' profile.

Fixes https://fedorahosted.org/freeipa/ticket/4002

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Fraser Tweedale
300b74fc7f Add certprofile plugin
Add the 'certprofile' plugin which defines the commands for managing
certificate profiles and associated permissions.

Also update Dogtag network code in 'ipapython.dogtag' to support
headers and arbitrary request bodies, to facilitate use of the
Dogtag profiles REST API.

Part of: https://fedorahosted.org/freeipa/ticket/57

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-04 08:27:33 +00:00
Jan Cholasta
454e8691cf client-install: Fix kinits with non-default Kerberos config file
https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-05-21 07:42:24 +00:00
Petr Vobornik
7d10547ae3 allow to call ldap2.destroy_connection multiple times
A regression fix.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2015-05-07 18:13:57 +02:00
Martin Babinsky
a1f91247cc point the users to PKI-related logs when CA configuration fails
This patch adds an error handler which prints out the paths to logs related to
configuration and installation of Dogtag/CA in the case of failure.

https://fedorahosted.org/freeipa/ticket/4900

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-29 05:19:29 +00:00
David Kupka
9b706e74d5 Make lint work on Fedora 22.
pylint added 'confidence' parameter to 'add_message' method of PyLinter.
To be compatible with both, pre- and post- 1.4  IPALinter must accept
the parameter but not pass it over.
Also python3 checker was added and enabled by default. FreeIPA is still
not ready for python3.
Additionally few false-positives was marked.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-27 11:02:57 +02:00
Petr Vobornik
4364ac08c5 speed up indirect member processing
the old implementation tried to get all entries which are member of group.
That means also user. User can't have any members therefore this costly
processing was unnecessary.

New implementation reduces the search only to entries which have members.

Also page size was removed to avoid paging by small pages(default size: 100)
which is very slow for many members.

https://fedorahosted.org/freeipa/ticket/4947

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-27 05:55:04 +00:00
Petr Viktorin
2cafb47ed7 Remove Editable DN and DN component classes
Make all DNs, RDNs and AVAs immutable.
Immutability makes reasoning about DN-handling code easier,
as value objects can't be changed once created.
Instead of mutable DNs, one can use a list (or even a generator)
of RDNs that's converted to a DN on output.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-23 11:34:39 +00:00
Martin Babinsky
415a5ff372 ipautil: new functions kinit_keytab and kinit_password
kinit_keytab replaces kinit_hostprincipal and performs Kerberos auth using
keytab file. Function is also able to repeat authentication multiple times
before giving up and raising Krb5Error.

kinit_password wraps kinit auth using password and also supports FAST
authentication using httpd armor ccache.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-20 08:27:35 +00:00
Jan Cholasta
b48cfe05e9 ldap: Remove IPASimpleLDAPObject
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
e2b0981d60 ldap: Use SimpleLDAPObject instead of IPASimpleLDAPObject in LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
db88498c95 ldap: Move schema handling from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
cbb112dd57 ldap: Use LDAPClient instead of IPASimpleLDAPObject in LDAPEntry
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
955885d8d9 ldap: Move value encoding from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
232e04d861 ldap: Use LDAPClient bind and unbind methods in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
c904dea06a ldap: Add bind and unbind methods to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
45d9b82f40 ldap: Use LDAPClient connection management in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
02e1ebe07c ldap: Add connection management to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
a849bca53f ldap: Remove unused IPAdmin methods
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
b106450dbf ldap: Drop python-ldap tuple compatibility
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Thierry Bordaz
c20009123f User life cycle: allows MODRDN from ldap2
enhance update_entry_rdn so that is allows
to move an entry a new superior

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 06:50:16 +00:00
Petr Vobornik
11bd9d96f1 performance: faster DN implementation
DN code was optimized to be faster if DNs are created from string. This is
the major use case, since most DNs come from LDAP.

With this patch, DN creation is almost 8-10x faster (with 30K-100K DNs).

Second mojor use case - deepcopy in LDAPEntry is about 20x faster - done by
custom __deepcopy__ function.

The major change is that DN is no longer internally composed  of RDNs and
AVAs but it rather keeps the data in open ldap format - the same as output
of str2dn function. Therefore, for immutable DNs, no other transformations
are required on instantiation.

The format is:

DN: [RDN, RDN,...]
RDN: [AVA, AVA,...]
AVA: ['utf-8 encoded str - attr', 'utf-8 encode str -value', FLAG]
FLAG: int

Further indexing of DN object constructs an RDN which is just an encapsulation
of the RDN part of open ldap representation. Indexing of RDN constructs AVA in
the same fashion.

Obtained EditableAVA, EditableRDN from EditableDN shares the respected lists
of the open ldap repr. so that the change of value or attr is reflected in
parent object.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-14 19:31:54 +02:00
David Kupka
082c55fb9c Always reload StateFile before getting or modifying the stored values.
This change does not solve using multiple instances of StateFile concurently
because there is no use for it in near future. Instead this solves an issue of loosing
records when more instances of StateFile are interleaved in sequential code.

https://fedorahosted.org/freeipa/ticket/4901

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-18 12:42:16 +01:00
Nathan Kinder
a58b77ca9c Timeout when performing time sync during client install
We use ntpd now to sync time before fetching a TGT during client
install.  Unfortuantely, ntpd will hang forever if it is unable to
reach the NTP server.

This patch adds the ability for commands run via ipautil.run() to
have an optional timeout.  This capability is used by the NTP sync
code that is run during ipa-client-install.

Ticket: https://fedorahosted.org/freeipa/ticket/4842
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-03-16 15:55:26 +01:00
Martin Basti
6af49259c2 Fix dead code in ipap11helper module
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-11 14:32:20 +01:00
Petr Spacek
459f0a8401 p11helper: clarify error message
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Petr Spacek
5635d1bf43 p11helper: use sizeof() instead of magic constants
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Petr Spacek
4b33f2b515 p11helper: standardize indentation and other visual aspects of the code
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-06 10:58:10 +01:00
Martin Basti
93c384fd13 Remove unused method from ipap11pkcs helper module
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Martin Basti
46a631138f Fix memory leaks in ipap11helper
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Martin Basti
a178f586bd DNSSEC add support for CKM_RSA_PKCS_OAEP mechanism
Ticket: https://fedorahosted.org/freeipa/ticket/4657#comment:13
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-03-06 10:54:21 +01:00
Simo Sorce
d762f61d25 Add a clear OpenSSL exception.
We are linking with OpenSSL in 2 files, so make it clear we intentionally
add a GPLv3 exception to allow that linking by third parties.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2015-02-23 16:25:54 +01:00
Martin Basti
d5035c0ed9 Prevent install scripts fail silently if timeout exceeded
socket.timeout() exceptions need description, otherwise no error message
is printed on console.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-02-12 17:10:10 +01:00
Martin Basti
e6a575d6d7 Fix reference counting in pkcs11 extension
* removed unneeded reference increment
* added increment of Py_None

Part of ticket: https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-02-10 15:30:38 +00:00
Tomas Babej
f30865c5f0 ipapython: Fix incorrect python shebangs
Make sure shebangs explicitly reference python2.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-01-26 13:03:24 +01:00
Martin Basti
46c12159e6 DNSSEC: fix root zone dns name conversion
Root zone was represented as '@', which was incorrect. ksmutil did not
accept it.
Now root zone is represented as '.'

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-01-23 09:26:55 +00:00
Tomas Babej
e11e8235ac baseldap: Handle missing parent objects properly in *-find commands
The find_entries function in ipaldap does not differentiate between
a LDAP search that returns error code 32 (No such object) and LDAP
search returning error code 0 (Success), but returning no results.

In both cases errors.NotFound is raised. In turn, LDAPSearch
commands interpret NotFound exception as no results.

To differentiate between the cases, a new error EmptyResult
was added, which inherits from NotFound to preserve the compatibility
with the new code.

This error is raised by ipaldap.find_entries in case it is performing
a search with and the target dn does not exist.

https://fedorahosted.org/freeipa/ticket/4659

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-01-13 16:16:14 +00:00
Martin Basti
337faf5064 Using wget to get status of CA
This is just workaround

Ticket: https://fedorahosted.org/freeipa/ticket/4676
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-12-10 16:59:56 +00:00
Jan Cholasta
968e1bbcf8 Unload P11_Helper object's library when it is finalized in ipap11helper
https://fedorahosted.org/freeipa/ticket/4713

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-25 08:23:24 +00:00
Rob Crittenden
5c0ad221e8 Use NSS protocol range API to set available TLS protocols
Protocols are configured as an inclusive range from SSLv3 through
TLSv1.2. The allowed values in the range are ssl3, tls1.0,
tls1.1 and tls1.2.

This is overridable per client by setting tls_version_min and/or
tls_version_max.

https://fedorahosted.org/freeipa/ticket/4653

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-24 13:09:44 +00:00
Martin Basti
58737c7791 Fix pk11helper module compiler warnings
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-20 16:46:30 +01:00
Martin Basti
c80a59eff4 Raise right exception if domain name is not valid
Because of dnspython implementation, in some cases UnicodeError is
raised instead of DNS SyntaxError

Ticket: https://fedorahosted.org/freeipa/ticket/4734
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-20 14:41:36 +00:00
Endi S. Dewata
80a8df3f19 Modififed NSSConnection not to shutdown existing database.
The NSSConnection class has been modified not to shutdown the
existing NSS database if the database is already opened to
establish an SSL connection, or is already opened by another
code that uses an NSS database without establishing an SSL
connection such as vault CLIs.

https://fedorahosted.org/freeipa/ticket/4638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:09:19 +01:00
Jan Cholasta
4589ef133c Fix various bugs in ipap11helper
Fixes a memory leak, a library handle leak and a double free.

Also remove some redundant NULL checks before free to prevent false positives
in static code analysis.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00
Gabe
7eca640ffa Remove trivial path constants from modules
https://fedorahosted.org/freeipa/ticket/4399

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-04 12:57:01 +01:00
Petr Spacek
ac500003fd Fix zone name to directory name conversion in BINDMgr.
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-10-29 15:02:08 +01:00
Petr Spacek
276e69de87 DNSSEC: add ipa dnssec daemons
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Martin Basti
9101cfa60f DNSSEC: opendnssec services
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Martin Basti
eb54814741 DNSSEC: DNS key synchronization daemon
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Martin Basti
bcce86554f DNSSEC: add ipapk11helper module
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:23:03 +02:00
Jan Cholasta
4333a623da Fix certmonger.request_cert
https://fedorahosted.org/freeipa/ticket/4550

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-10-16 19:11:52 +02:00
Jan Cholasta
fdc70e89e9 Fix CA cert validity check for CA-less and external CA installer options
https://fedorahosted.org/freeipa/ticket/4612

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-16 18:09:49 +02:00
David Kupka
3f9d1a71f1 Fix typo causing certmonger is provided with wrong path to ipa-submit.
Using strip() instead split() caused that only first character of path was specified.
Also using shlex for more robust parsing.

https://fedorahosted.org/freeipa/ticket/4624

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-10-16 09:49:46 +02:00
David Kupka
c8f7cb0163 Set IPA CA for freeipa certificates.
In previous versions (before moving certmonger.py to DBus) it was set and some
tools and modules depends on it. For example: ipa-getcert uses this to filter
freeipa certificates.

https://fedorahosted.org/freeipa/ticket/4618

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-10-14 10:55:29 +02:00
Jan Cholasta
98c5788c37 Add missing imports to ipapython.certdb
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-09-30 10:18:08 +02:00
Jan Cholasta
05e66264a9 Fix certmonger.wait_for_request
https://fedorahosted.org/freeipa/ticket/4558

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-30 10:01:38 +02:00
Jan Cholasta
bbf962299d Use NSSDatabase instead of direct certutil calls in client code
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-30 10:01:38 +02:00
Jan Cholasta
b764e9d3e6 Add NSSDatabase.has_nickname for checking nickname presence in a NSS DB
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-30 10:01:38 +02:00
Jan Cholasta
86c534df7d Move NSSDatabase from ipaserver.certs to ipapython.certdb
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-30 10:01:38 +02:00
Jan Cholasta
231f57cedb Introduce NSS database /etc/ipa/nssdb
This is the new default NSS database for IPA.

/etc/pki/nssdb is still maintained for backward compatibility.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-09-30 10:01:38 +02:00
Martin Basti
29ba9d9d26 Refactoring of autobind, object_exists
Required to prevent code duplications

ipaldap.IPAdmin now has method do_bind, which tries several bind methods
ipaldap.IPAClient now has method object_exists(dn)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-26 13:21:15 +02:00
Petr Viktorin
c7d6fea06f Move setting SELinux booleans to platform code
Create a platform task for setting SELinux booleans.

Use an exception for the case when the booleans could not be set
(since this is an error if not handled).
Since ipaplatform should not depend on ipalib, create a new
errors module in ipapython for SetseboolError.

Handle uninstallation with the same task, which means
the booleans are now restored with a single call to
setsebool.

Preparation for: https://fedorahosted.org/freeipa/ticket/4157

Fixes: https://fedorahosted.org/freeipa/ticket/2934
Fixes: https://fedorahosted.org/freeipa/ticket/2519
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2014-09-26 12:12:59 +02:00
Jan Cholasta
f680a63158 Fix certmonger code causing the ca_renewal_master update plugin to fail
https://fedorahosted.org/freeipa/ticket/4547

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-09-23 16:25:15 +02:00
David Kupka
6d94cdf250 Use certmonger D-Bus API instead of messing with its files.
FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.

>=certmonger-0.75.13 is needed for this to work.

https://fedorahosted.org/freeipa/ticket/4280

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-05 10:51:42 +02:00
Ade Lee
a25fe00c62 Add a KRA to IPA
This patch adds the capability of installing a Dogtag KRA
to an IPA instance.  With this patch,  a KRA is NOT configured
by default when ipa-server-install is run.  Rather, the command
ipa-kra-install must be executed on an instance on which a Dogtag
CA has already been configured.

The KRA shares the same tomcat instance and DS instance as the
Dogtag CA.  Moreover, the same admin user/agent (and agent cert) can
be used for both subsystems.  Certmonger is also confgured to
monitor the new subsystem certificates.

To create a clone KRA, simply execute ipa-kra-install <replica_file>
on a replica on which a Dogtag CA has already been replicated.
ipa-kra-install will use the security domain to detect whether the
system being installed is a replica, and will error out if a needed
replica file is not provided.

The install scripts have been refactored somewhat to minimize
duplication of code.  A new base class dogtagintance.py has
been introduced containing code that is common to KRA and CA
installs.  This will become very useful when we add more PKI
subsystems.

The KRA will install its database as a subtree of o=ipaca,
specifically o=ipakra,o=ipaca.  This means that replication
agreements created to replicate CA data will also replicate KRA
data.  No new replication agreements are required.

Added dogtag plugin for KRA.  This is an initial commit providing
the basic vault functionality needed for vault.  This plugin will
likely be modified as we create the code to call some of these
functions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

The uninstallation option in ipa-kra-install is temporarily disabled.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-22 09:59:31 +02:00
Jan Cholasta
044c5c833a Enable NSS PKIX certificate path discovery and validation for Dogtag.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
2109d6611b Provide additional functions to ipapython.certmonger.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Alexander Bokovoy
a9fe37e066 ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration
When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 08:13:23 +02:00
Martin Kosek
c4b63dc48a Clear NSS session cache when socket is closed
Even when NSS connection is closed, there may be still cached
certificates in the NSS lib. This may cause subsequent NSS
initialization to crash. This problem especially reproduces in the
unit tests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-02 16:31:50 +02:00
Tomas Babej
a5bb758978 ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}
The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-02 16:12:05 +02:00
Martin Basti
9f5e77f686 Fix handle python-dns UnicodeError
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-20 13:28:53 +02:00
Petr Spacek
e821576129 Clarify LDAPClient docstrings about get_entry, get_entries and find_entries
Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-06-20 12:38:58 +02:00
Tomas Babej
3bb9e1bbd5 ipaplatform: Change makefiles to accomodate for new platform package
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:20 +02:00
Tomas Babej
a9a4bc0848 ipaplatform: Remove remnants of the ipapython/platform
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:20 +02:00
Tomas Babej
4d2ef43f28 ipaplatform: Move all filesystem paths to ipaplatform.paths module
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:20 +02:00
Tomas Babej
c7edd7b68c ipaplatform: Remove redundant imports of ipaservices
Also fixes few incorrect imports.

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:20 +02:00
Tomas Babej
926f8647d2 ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasks
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:19 +02:00
Tomas Babej
a7c2327a36 ipaplatform: Move Fedora-specific implementations of tasks to fedora base platform file
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:18 +02:00
Tomas Babej
3edfabb4c4 ipaplatform: Remove legacy redhat platform module
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:18 +02:00
Tomas Babej
5f31f2d35f ipaplatform: Do not require custom Authconfig implementations from platform modules
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:18 +02:00
Tomas Babej
6a4cd8a4e3 ipaplatform: Move restore_context and check_selinux_status implementations to base fedora platform tasks
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:18 +02:00
Tomas Babej
c465eb842f ipaplatform: Moved Fedora 16 service implementations and refactored them as base Fedora module service implementations
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:17 +02:00
Tomas Babej
1d0623ce1c ipaplatform: Move default implementations of tasks from service.py.in
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:17 +02:00
Tomas Babej
0b974007de ipaplatform: Move service base platfrom related functionality to ipaplatform/base/service.py
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-16 19:48:17 +02:00
Petr Viktorin
521df77744 ipalib.config: Don't autoconvert values to float
When api.env is loaded, strings that "look like" floats got
auto-converted to floats.
This is wrong, as the conversion to float can lose precision.
Case in point: the api_version (e.g. '2.88') should never be
interpreted as float.

Do not automatically convert to float.

We have two numeric options: startup_timeout and wait_for_dns.
wait_for_dns is already converted to int when used in the code.
Convert startup_timeout to float explicitly when used, so
configuration that specified it with a decimal point continues
to work.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2014-06-16 13:38:54 +02:00
Gabe
ec282c7e96 ipautil.run args log message is confusing
https://fedorahosted.org/freeipa/ticket/3724

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-09 16:27:41 +02:00
Martin Basti
d0ce6472f7 DNSName conversion in ipaldap
Domain name has to be stored in LDAP in punycoded value

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
9c7b0ad156 DNSName type
Type used to store domain names based on dnspython

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Petr Viktorin
d6a4da30de admin tools: Log IPA version
Add the IPA version, and vendor version if applicable, to the beginning
of admintool logs -- both framework and indivitual tools that don't yet
use the framework.
This will make debugging easier.

https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-27 12:08:55 +02:00
Petr Viktorin
7f465e693c ipalib.version: Add VENDOR_VERSION
This will allow us to make vendors' lives easier by embedding a
vendor tag to installation logs.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-27 12:08:54 +02:00
Tomas Babej
d90eb46cce ipa-client: Set NIS domain name in the installer
Provides two new options for the ipa-client-install:
    --nisdomain: specifies the NIS domain name
    --no_nisdomain: flag to aviod setting the NIS domain name

In case no --nisdomain is specified and --no_nisdomain flag was
not set, the IPA domain is used.

Manual pages updated.

http://fedorahosted.org/freeipa/ticket/3202

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-09 13:57:04 +03:00
Tomas Babej
1df696f543 ipalib: Add DateTime parameter
Adds a parameter that represents a DateTime format using datetime.datetime
object from python's native datetime library.

In the CLI, accepts one of the following formats:
    Accepts LDAP Generalized time without in the following format:
       '%Y%m%d%H%M%SZ'

    Accepts subset of values defined by ISO 8601:
        '%Y-%m-%dT%H:%M:%SZ'
        '%Y-%m-%dT%H:%MZ'
        '%Y-%m-%dZ'

    Also accepts above formats using ' ' (space) as a separator instead of 'T'.

As a simplification, it does not deal with timezone info and ISO 8601
values with timezone info (+-hhmm) are rejected. Values are expected
to be in the UTC timezone.

Values are saved to LDAP as LDAP Generalized time values in the format
'%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid
confusion, in addition to subset of ISO 8601 values, the LDAP generalized
time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the
format user will see on the output).

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-05 18:57:29 +03:00
Jan Cholasta
9814b272af Keep original name when setting attribute in LDAPEntry.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:21 +02:00
Jan Cholasta
b4860d09b4 Replace get_syntax method of IPASimpleObject with new get_type method.
get_type returns the Python type for an LDAP attribute.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
babddaaee8 Use dogtag-ipa-ca-renew-agent to retrieve renewed certificates from LDAP.
Before, this was done by dogtag-ipa-retrieve-agent-submit.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-25 16:54:55 +01:00
Jan Cholasta
c0c38ed314 Fix modlist generation code not to generate empty replace mods.
https://fedorahosted.org/freeipa/ticket/4138
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-03 12:14:09 +01:00
Jan Cholasta
5737eaf134 Raise an exception when legacy LDAP API is used. 2014-01-24 20:29:32 +01:00
Martin Kosek
252ad0b8c1 Add runas option to run function
Run function can now run the specified command as different user by
setting the both real and effective UID and GID for executed process.

Add both the missing run function attribute doc strings as well as
a doc string for the runas attribute.
2014-01-22 10:14:05 +01:00
Jan Cholasta
c86d9f33c9 Do not crash on bad LDAP data when formatting decode error message.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:40 +01:00
Jan Cholasta
d6c3d3f57a Store old entry state in dict rather than LDAPEntry.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
4284a8349b Remove legacy LDAPEntry properties data and orig_data.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
aa66cd5f35 Remove unused LDAPClient methods get_syntax and get_single_value.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
61887ac392 Add LDAPEntry method generate_modlist.
Use LDAPEntry.generate_modlist instead of LDAPClient._generate_modlist and
remove LDAPClient._generate_modlist.

https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
21fab665f4 Use LDAPClient.update_entry for LDAP mods in ldapupdate.
Remove legacy IPAdmin methods generateModList and updateEntry.

https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
8d67acc026 Make IPASimpleLDAPObject.get_single_value result overridable.
Add some default overrides.

https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
c98cff25ab Move LDAPClient method get_single_value to IPASimpleLDAPObject.
Refactor IPASimpleLDAPObject methods get_syntax and get_single_value.

https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
24d85f15ee Use old entry state in LDAPClient.update_entry.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:41:39 +01:00
Jan Cholasta
7b3d9be388 Rename LDAPEntry method commit to reset_modlist.
https://fedorahosted.org/freeipa/ticket/3488
2014-01-10 14:38:29 +01:00
Jan Cholasta
911f5e9eb7 PKI service restart after CA renewal failed
Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092
2014-01-08 09:47:23 +01:00
Xiao-Long Chen
5e96fbc22a Use /usr/bin/python2
Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com
2014-01-03 09:46:05 +01:00
Jan Cholasta
bc3f3381c6 Convert remaining backend code to LDAPEntry API. 2013-12-16 14:44:19 +01:00
Martin Kosek
9677308caa Allow kernel keyring CCACHE when supported
Server and client installer should allow kernel keyring ccache when
supported.

https://fedorahosted.org/freeipa/ticket/4013
2013-12-09 12:21:22 +01:00
Jan Cholasta
a9bf18ab95 Support searches with paged results control in LDAPClient.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Jan Cholasta
8013056194 Add wrapper for result3 to IPASimpleLDAPObject.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Jan Cholasta
73df6150e5 Move IPA specific code from LDAPClient to the ldap2 plugin.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Petr Viktorin
76c7f24919 Improve LDAPEntry.__repr__ for freshly created entries
Creating a LDAPEntry from dict does not set the raw entries,
to display everything we need to combine the underlying data.

https://fedorahosted.org/freeipa/ticket/4015
2013-11-26 13:19:37 +01:00
Tomas Babej
4a0e91449e ipa-client-install: Publish CA certificate to systemwide store
During the installation, copy the CA certificate to the systemwide
store (/etc/pki/ca-trust/source/anchors/ipa-ca.crt) and update the
systemwide CA database.

This allows browsers to access IPA WebUI without warning out of the
box.

https://fedorahosted.org/freeipa/ticket/3504
2013-11-20 13:15:38 +01:00
Tomas Babej
60b472479d platform: Add Fedora 19 platform file
Part of: https://fedorahosted.org/freeipa/ticket/3504
2013-11-20 13:13:38 +01:00
Petr Viktorin
6381d766ce Remove schema special-casing from the LDAP updater
Now that there's a dedicated schema updater, we do not need the code
in ldapupdate.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Petr Viktorin
f52d471aa7 Add schema updater based on IPA schema files
The new updater is run as part of `ipa-ldap-updater --upgrade`
and `ipa-ldap-updater --schema` (--schema is a new option).
The --schema-file option to ipa-ldap-updater may be used (multiple
times) to select a non-default set of schema files to update against.

The updater adds an X-ORIGIN tag with the current IPA version to
all elements it adds or modifies.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Martin Basti
478dc1e828 ipa-client-install: Added options to configure firefox
Option --configure-firefox configures firefox to use Kerberos
credentials within IPA domain
Optional option --firefox-dir=DIR allows to user to specify non-standard
path where firefox install directory is placed.

Part of ticket: https://fedorahosted.org/freeipa/ticket/3821
2013-11-15 13:30:39 +01:00
Petr Viktorin
196379d126 Remove unused utf8_encode_value functions
The utf8_encode_value/_values functions from ipautil are no longer used.
Remove them.
2013-11-08 12:51:53 +01:00
Jan Cholasta
df5f4ee81d Turn LDAPEntry.single_value into a dictionary-like property.
This change makes single_value consistent with the raw property.

https://fedorahosted.org/freeipa/ticket/3521
2013-11-05 13:56:55 +01:00
Jan Cholasta
941e9686a3 Use encoded values from entry objects directly when adding new entries.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:52 +01:00
Jan Cholasta
e60eda3b3d Use encoded values from entry objects directly when generating modlists.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:52 +01:00
Jan Cholasta
78f0ca983b Store encoded attribute values from search results directly in entry objects.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:52 +01:00
Jan Cholasta
a7180ed021 Remove legacy toDict and origDataDict methods of LDAPEntry.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Jan Cholasta
463407ac6f Make sure attributeTypes updates are done before objectClasses updates.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Jan Cholasta
9ecf4b7aac Decode and encode attribute values in LDAPEntry on demand.
This is achieved by storing both decoded and encoded attribute values in
LDAPEntry and synchronizing changes between them whenever an attribute is
accessed.

Added a new property "raw" to LDAPEntry. It provides a dictionary-like
object which can be used to directly access encoded attribute values.

https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Jan Cholasta
5d1d513849 Always use lists for values in LDAPEntry internally.
Outside of LDAPEntry, it is still possible to use non-lists. Once we enforce
lists for attribute values, this will be removed.

https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Jan Cholasta
5aadaa6030 Introduce IPASimpleLDAPObject.decode method for decoding LDAP values.
This method is intended as a counterpart of IPASimpleLDAPObject.encode and
replaces IPASimpleLDAPObject.convert_value_list.

https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Jan Cholasta
4f0814d7c0 Make LDAPEntry a wrapper around dict rather than a dict subclass.
https://fedorahosted.org/freeipa/ticket/3521
2013-10-31 18:09:51 +01:00
Martin Kosek
dd3295ac32 Installer should always wait until CA starts up
Patch for ticket 3964 changed the installer so that it does not
always wait for CA if the proxy is not configured. However,
it was found out that it may freeze an installation when
a step subsequent after CA restart call the CA and receives no
reply.

Change the wait so that it always waits for CA to start up. If
HTTP proxy is already configured, it should wait on port 443.
If not, it should wait on local PKI port 8443.

https://fedorahosted.org/freeipa/ticket/3973
2013-10-17 12:07:52 +02:00
Martin Kosek
dbfa7157cc PKI installation on replica failing due to missing proxy conf
Proxy configuration was not detected correctly. Both
ipa-pki-proxy.conf and ipa.conf need to be in place and httpd
restarted to be able to check it's status.

https://fedorahosted.org/freeipa/ticket/3964
2013-10-11 09:50:44 +02:00
Petr Viktorin
80886a50e6 ipapython.nsslib: Name arguments to NSPRError
Previously NSPRError was given arguments in the wrong order.
Fix this by naming the arguments.
2013-10-04 15:49:19 +02:00
Petr Viktorin
a93fc02af6 Raise an error when updating CIDict with duplicate keys
Updating a CIDict with data like {'A': 1, 'a': 2} would lead to data
loss since only one of the items would get to the CIDict.
This can result in non-obvious bugs similar to this one in python-ldap:
https://bugzilla.redhat.com/show_bug.cgi?id=1007820

Raise an error in this case; any resolution must be done by the caller.
2013-09-25 10:13:56 +02:00
Petr Viktorin
0226064bac Add missing dict methods to CIDict
Make the CIDict interface match standard dict (except view* methods).

Add __contains__, __iter__, clear.
Add keyword and iterable support for __init__, update.
Also add values() and itervalues(). Previously the dict versions were
used; the new ones guarantee that the order matches keys().
Mark view* methods as not implemented.
CIDict.copy() now returns a CIDict.

Test the above additions, and fromkeys() which worked but wasn't tested.
2013-09-25 10:13:56 +02:00
Petr Viktorin
3e505fe532 Move tests to test directories
Nose doesn't pick up directories that don't begin with 'test'.
Rename ipatests/test_ipaserver/install to test_install so that it's run.

Also, merge test_ipautil.py from ipapython/test into tests/test_ipapython,
so the whole test suite is in one place.
2013-09-25 10:13:56 +02:00
Timo Aaltonen
397986d19a Don't search platform path
Don't use Python.h from the platform specific path
2013-09-16 17:35:22 +02:00
Tomas Babej
6961cf2e77 Perform dirsrv tuning at platform level
When configuring the 389 Directory Server instance, we tune it
so that number of file descriptors available to the DS is increased
from the default 1024 to 8192.

There are platform specific steps that need to be conducted
differently on systemd compatible platforms and sysV compatible
platforms.

systemd: set LimitNOFILE to 8192 in /etc/sysconfig/dirsrv.systemd
sysV: set ulimit -n 8192 in /etc/sysconfig/dirsrv
      set ulimit - nofile 8192 in /etc/security/limits.conf

https://fedorahosted.org/freeipa/ticket/3823
2013-08-26 13:07:17 +02:00
Martin Kosek
b9ec4d1a67 Prevent *.pyo and *.pyc multilib problems
Differences in the python byte code fails in a build validation
(rpmdiff) done on difference architecture of the same package.

This patch:
 1) Ensures that timestamps of generated *.pyo and *.pyc files match
 2) Python integer literals greater or equal 2^32 and lower than 2^64
    are converted to long right away to prevent different type of
    the integer on architectures with different size of int

https://fedorahosted.org/freeipa/ticket/3858
2013-08-13 15:31:46 +02:00
Tomas Babej
22681013b2 Skip referrals when converting LDAP result to LDAPEntry
When converting the result obtained by python-ldap library,
we need to skip unresolved referral entries, since they cannot
be converted.

https://fedorahosted.org/freeipa/ticket/3814
2013-07-26 13:38:37 +02:00
Petr Viktorin
15e83befaf Correct default value of LDAPClient.get_entries scope argument 2013-07-25 12:41:16 +02:00
Jan Cholasta
b5d008ed5a Run gpg-agent explicitly when encrypting/decrypting files.
Also add an option to ipautil.run to redirect command output to /dev/null.

https://fedorahosted.org/freeipa/ticket/3767
2013-07-17 16:15:15 +02:00
Ana Krivokapic
af7807aacc Use --ignore-dependencies only when necessary
Using the --ignore-dependencies switch was causing the ipactl stop command
not to stop all instances of dirsrv and dogtag. Make sure the switch is used
only when necessary, i.e. to prevent ipa-otpd.socket from getting stuck during
the shutdown transaction.

https://fedorahosted.org/freeipa/ticket/3730
https://fedorahosted.org/freeipa/ticket/3729
2013-07-11 18:04:55 +03:00
Ana Krivokapic
fb166e8f5c Avoid systemd service deadlock during shutdown
https://fedorahosted.org/freeipa/ticket/3729
2013-07-11 12:39:28 +03:00
Ana Krivokapic
3b93df4e4e Use correct DS instance in ipactl status
Make sure ipactl status check for correct DS instance. It should check for
'dirsrv@IPA-REALM' and not 'dirsrv.target'.

https://fedorahosted.org/freeipa/ticket/3730
2013-07-11 12:39:28 +03:00
Petr Viktorin
780961a643 Add Nose plugin for BeakerLib integration
The plugin hooks into the Nose runner and IPA's logging infrastructure
and calls the appropriate BeakerLib functions (rl*).

IPA's log_manager is extended to accept custom Handler classes.

The ipa-run-tests helper now loads the plugin.

Patr of the work for: https://fedorahosted.org/freeipa/ticket/3621
2013-06-17 19:23:04 +02:00
Tomas Babej
b2c378dcc8 Manage ipa-otpd.socket by IPA
Adds a new simple service called OtpdInstance, that manages
ipa-otpd.socket service. Added to server/replica installer
and ipa-upgradeconfig script.

https://fedorahosted.org/freeipa/ticket/3680
2013-06-06 18:16:59 +02:00
Petr Viktorin
34ba1b7060 Remove code to install Dogtag 9
Since we depend on Dogtag 10 now, there is no need to keep code
that installs a Dogtag 9 CA.

Support for upgraded Dogtag-9-style instances is left in.

https://fedorahosted.org/freeipa/ticket/3529
2013-05-31 10:26:07 +02:00
Petr Viktorin
8897b51814 Remove leading zero from IPA_NUM_VERSION
The numeric IPA_NUM_VERSION contained a leading zero, so it was treated
as octal value in Python code instead of decimal.

https://fedorahosted.org/freeipa/ticket/3622
2013-05-14 18:49:05 +02:00
Petr Viktorin
5fd68e3f9d Remove unused ipapython.certdb.CertDB class 2013-04-02 15:28:50 +02:00
Alexander Bokovoy
41031fe121 Process exceptions when talking to Dogtag
The problem is the ca_status() uses an HTTP GET operation to check Dogtag's
status. Under some circumstances Dogtag may take a long time to respond, so the
HTTP GET may time out much earlier than 2 minutes. And since the above code
doesn't catch the exception, the whole loop fails immediately, so it doesn't
wait for a full 2 minutes as expected.

https://fedorahosted.org/freeipa/ticket/3492
2013-03-21 17:14:55 +01:00
Rob Crittenden
9005b9bc8a Extend ipa-replica-manage to be able to manage DNA ranges.
Attempt to automatically save DNA ranges when a master is removed.
This is done by trying to find a master that does not yet define
a DNA on-deck range. If one can be found then the range on the deleted
master is added.

If one cannot be found then it is reported as an error.

Some validation of the ranges are done to ensure that they do overlap
an IPA local range and do not overlap existing DNA ranges configured
on other masters.

http://freeipa.org/page/V3/Recover_DNA_Ranges

https://fedorahosted.org/freeipa/ticket/3321
2013-03-13 10:32:36 -04:00
Petr Viktorin
664248d5b8 Use IPAdmin rather than raw python-ldap in migration.py and ipadiscovery.py
These used ipautil.get_ipa_basedn. Convert that to use the new wrappers.

Beef up the error handling in ipaldap to accomodate the errors we catch
in the server discovery.
Add a DatabaseTimeout exception to errors.py.

These were the last uses of ipautil.convert_ldap_error, remove that.

https://fedorahosted.org/freeipa/ticket/3487
https://fedorahosted.org/freeipa/ticket/3446
2013-03-13 12:36:33 +01:00
Petr Viktorin
a0242334fe Use IPAdmin rather than raw python-ldap in ipa-client-install
Part of the work for: https://fedorahosted.org/freeipa/ticket/3487
2013-03-13 12:36:33 +01:00
Petr Viktorin
4e6a2a916d Move ipaldap to ipapython
Part of the work for: https://fedorahosted.org/freeipa/ticket/3446
2013-03-13 12:36:33 +01:00
Petr Viktorin
7e1495b404 Derive Entity class from Entry, and move it to ldapupdate
The two classes were nearly identical, and the updater is
the only code that uses Entity.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
2013-03-01 16:59:42 +01:00
Petr Viktorin
83f99070d6 Remove unused methods from Entry, Entity, and IPAdmin
These classes are deprecated, there's no use keeping unused methods around.

Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
2013-03-01 16:59:42 +01:00
Jan Cholasta
ef1cd6e247 Add custom mapping object for LDAP entry data. 2013-03-01 16:59:42 +01:00
Petr Viktorin
9b7930b93d Make ipapython.dogtag log requests at debug level, not info 2013-02-01 13:45:03 -05:00
Petr Viktorin
26c498736e Port ipa-replica-prepare to the admintool framework
Break the script into several smaller methods.

Use modern idioms: os.path.join instead of string addition; the with statement
for closing files.

Add --quiet, --verbose, and --log-file options. Use logging instead of print
statements. (http://freeipa.org/page/V3/Logging_and_output)

Part of: https://fedorahosted.org/freeipa/ticket/2652
Fixes: https://fedorahosted.org/freeipa/ticket/3285
2013-02-01 13:44:59 -05:00
Petr Viktorin
55cfd06e3a Better logging for AdminTool and ipa-ldap-updater
- Automatically add a "Logging and output options" group with the --quiet,
    --verbose, --log-file options.
- Set up logging based on these options; details are in the setup_logging
    docstring and in the design document.
- Don't bind log methods as individual methods of the class. This means one
    less linter exception.
- Make the help for command line options consistent with optparse's --help and
    --version options.

Design document: http://freeipa.org/page/V3/Logging_and_output
2013-02-01 13:44:55 -05:00
Jan Cholasta
86dde3a38e Add support for RFC 6594 SSHFP DNS records.
https://fedorahosted.org/freeipa/ticket/2642
2013-02-01 09:16:09 -05:00