Commit Graph

3445 Commits

Author SHA1 Message Date
Rishabh Dave
d65297311d
ipa-ca-install: mention REPLICA_FILE as optional in help
As man page already does it, update the help text to show REPLICA_FILE
as optional.

Fixes https://pagure.io/freeipa/issue/7223

Signed-off-by: Rishabh Dave <rishabhddave@gmail.com>
Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-30 10:49:13 +01:00
Fraser Tweedale
aa5ad3e2d3
Add missing space in ipa-replica-conncheck error
Fixes: https://pagure.io/freeipa/issue/7224
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-10-30 10:35:01 +01:00
Florence Blanc-Renaud
7b149b3c7f
Fix ipa-replica-conncheck when called with --principal
ipa-replica-conncheck can be called with --principal / --password or
with an existing Kerberos credential cache in order to supply the
authorized identity logging in to the master machine (in
auto-master-check mode).

In domain-level 0, the tool is called with --principal and password
and tries to obtain a TGT by performing kinit, but does not set the
env var KRB5CCNAME. Subsequent calls to IPA API do not use the
credential cache and fail. In this case, ipa-replica-conncheck falls
back to using SSH to check master connectivity instead of IPA API,
and the ssh check is less robust.

The code should set the KRB5CCNAME env var for IPA API to use the
credential cache.

Fixes:
https://pagure.io/freeipa/issue/7221

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-26 15:06:49 +02:00
Tomas Krizek
624b34ab2b
ldap: limit the retro changelog to dns subtree
The content synchronization plugin can be limited to the dns subtree in
Directory Server. This increases performance and helps to prevent some
potential issues.

Fixes: https://pagure.io/freeipa/issue/6515
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-26 12:40:28 +02:00
Thorsten Scherf
28802b396f Add debug option to ipa-replica-manage and remove references to api_env var.
https://pagure.io/freeipa/issue/7187

Reviewed-By: Felipe Barreto <fbarreto@redhat.com>
2017-10-25 14:34:07 -02:00
Christian Heimes
b29db07c3b Use os.path.isfile() and isdir()
Replace custom file_exists() and dir_exists() functions with proper
functions from Python's stdlib.

The change also gets rid of pylint's invalid bad-python3-import error,
https://github.com/PyCQA/pylint/issues/1565

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-10-20 12:27:19 +02:00
Alexander Bokovoy
620f9653ba ipa-replica-manage: implicitly ignore initial time skew in force-sync
When performing force synchronization, implicitly ignore initial
time skew (if any) and restore it afterwards.

This also changes semantics of force-sync by waiting until the end of
the initial replication.

Fixes https://pagure.io/freeipa/issue/7211

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-19 17:48:58 +03:00
Alexander Bokovoy
051786ce37 ds: ignore time skew during initial replication step
Initial replica creation can go with ignoring time skew checks.
We should, however, force time skew checks during normal operation.

Fixes https://pagure.io/freeipa/issue/7211

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-19 17:48:58 +03:00
Florence Blanc-Renaud
49cf5ec64b
ipa-cacert-manage renew: switch from ext-signed CA to self-signed
The scenario switching from externally signed CA to self-signed CA is
currently failing because the certmonger helper goes through the wrong
code path when the cert is not self-signed.

When the cert is not self-signed but the admin wants to switch to self-signed
a new cert needs to be requested, not retrieved from LDAP.

https://pagure.io/freeipa/issue/7173

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-10-18 12:34:03 +02:00
Christian Heimes
dea059d158
Block PyOpenSSL to prevent SELinux execmem in wsgi
Some dependencies like Dogtag's pki.client library and custodia use
python-requsts to make HTTPS connection. python-requests prefers
PyOpenSSL over Python's stdlib ssl module. PyOpenSSL is build on top
of python-cryptography which trigger a execmem SELinux violation
in the context of Apache HTTPD (httpd_execmem).

When requests is imported, it always tries to import pyopenssl glue
code from urllib3's contrib directory. The import of PyOpenSSL is
enough to trigger the SELinux denial.

Block any import of PyOpenSSL's SSL module in wsgi by raising an
ImportError. The block is compatible with new python-requests with
unbundled urllib3, too.

Fixes: https://pagure.io/freeipa/issue/5442
Fixes: RHBZ#1491508
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-10-18 12:09:57 +02:00
Fraser Tweedale
29f4ec865b ipa-cacert-manage: support MS V2 template extension
Update ipa-cacert-manage to support the MS V2 certificate template
extension.

Part of: https://pagure.io/freeipa/issue/6858

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Fraser Tweedale
fc7c684b12 ipa-ca-install: add --external-ca-profile option
Fixes: https://pagure.io/freeipa/issue/6858
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Fraser Tweedale
b4365e3a7f install: allow specifying external CA template
Allow the MS/AD-CS target certificate template to be specified by
name or OID, via the new option --external-ca-profile.

Part of: https://pagure.io/freeipa/issue/6858

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Fraser Tweedale
1699cff350 Remove duplicate references to external CA type
Part of: https://pagure.io/freeipa/issue/6858

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Petr Vobornik
b0184d10ab
browser config: cleanup after removal of Firefox extension
Firefox extension which served for configuring Kerberos auth in Firefox
until version which banned self-signed extensions was removed in commit
6c53765ac1.

Given that configure.jar, even older Firefox config tool, was removed
sometime before that, there is no use for signtool tool. It is good
because it is removed from Fedora 27 anyway. So removing last unused
function which calls it.

The removal of FF extension was not exactly clean so removing also
browserconfig.html which only purpose was to use the extension. Therefore
also related JS files are removed. This removal requires unauthorized.html
to be updated so that it doesn't point to non-existing page. And given that
it now points only to single config page, we can change link in UI login page
to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html.

Btw, commit 6c53765ac1 removed also generation of
krb.js. It had one perk - with that info ssbrowser.html could display real
Kerberos domain instead of only 'example.com'.  I don't have time to revert this
change so removing traces of krb.js as well.

https://pagure.io/freeipa/issue/7135

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-09-21 10:27:14 +02:00
Fraser Tweedale
09f746f568 ipa-pki-retrieve-key: ensure we do not crash
If ipa-pki-retrieve-key fails for some reason (which may be a
"legitimate" reason, e.g. the server it is attempting to contact
being offline), the program terminates with an uncaught exception,
resulting in crash report.

Catch all exceptions; if an exception gets raised, report the
traceback and exit with nonzero status.

Fixes: https://pagure.io/freeipa/issue/7115
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-09-13 13:56:59 +02:00
Stanislav Laznicka
a765746e95 pylint: fix not-context-manager false positives
threading.Lock() in ipa-replica-conncheck is an alias to
thread.allocate_lock() which creates a LockType object.
This object is an actual context manager but the alias
seems to confuse pylint a bit.

https://pagure.io/freeipa/issue/6874

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-08 15:42:07 +02:00
Pavel Vomacka
a7ab63b84c WebUI: Fix calling undefined method during reset passwords
When calling reset password the whoami command is not called in batch
command, therefore the result is different then in calling
during reset password operation. That needs to be handled to properly
set entity_show method which needs to be called after to gather
data about logged in entity.

https://pagure.io/freeipa/issue/7143

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-07 08:08:17 +02:00
Pavel Vomacka
755a50044c WebUI: remove unused parameter from get_whoami_command
The batch param is not used anywhere therefore we can remove it.

https://pagure.io/freeipa/issue/7143

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-07 08:08:17 +02:00
Pavel Vomacka
45bd31b436
Adds whoami DS plugin in case that plugin is missing
When first installation of IPA has been done when whoami
plugin was not enabled in DS by default and then IPA was
upgraded to newer versions, then after upgrade to IPA 4.5
WebUI stops working. This is caused by new requirement on
whoami DS plugin which is used to obtain information about
logged in entity.

This fix adds the whoami plugin during update in case that the plugin
is not enabled.

https://pagure.io/freeipa/issue/7126

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
2017-09-05 14:07:02 +02:00
Fraser Tweedale
504c303ec4
Fix external renewal for CA with non-default subject DN
When running ``ipa-cacert-manage renew --external-ca`` with an IPA
CA having a subject DN that does not correspond to ``CN=Certificate
Authority, {subject-base}``, the CSR for submission to the external
CA does not generated.  dogtag-ipa-ca-renew-agent-submit is wrongly
assuming the default form of the CA subject DN.

Update dogtag-ipa-ca-renew-agent-submit to look up the actual
subject DN.

Fixes: https://pagure.io/freeipa/issue/7123
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-09-01 11:46:49 +02:00
Pavel Vomacka
76f217b289
Fixes bug in actions creating for search facet
In case that there are no actions specified in spec object, the concatenation
of arrays causes that 'undefined' item is added into the array.

https://pagure.io/freeipa/issue/7052

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-09-01 11:43:52 +02:00
Pavel Vomacka
d5ef1a7fd0
WebUI: fix showing required asterisk '*'
There was a bug that when user switch between two facets where is
required field and in one of them is writable and in second one
is not writable, then the asterisk which marks required field is
not shown. i.e. admin vs. user details page or global_passwd_policy
vs. other_passwd_policy details page.

That was caused by incorrect evaluation of required state of field.
Evaluation works that way: evaluate old required state, then evaluate
current required state and if states has changed then emit change event.
The evaluation depends on writable and read_only state of field.
Those two states are set before evaluation of required state, but
their old values (for evaluating previous required stated) were
not stored anywhere.

This commit adds two attributes which stores old writable
and read_only states. The required asterisk is then shown correctly.

https://pagure.io/freeipa/issue/6849

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-09-01 11:42:08 +02:00
Pavel Vomacka
8c2dbece59 WebUI: Update unit test README
Update link to our FreeIPA wiki page where unit tests are described.
The description of how to run those test was also updated.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
6b70b91de4 Fixes details_test.js
Adds missing import which extends jquery's element with alert method.
Also fixes setting of breadcrumb and tabs in details spec - the code changes
behavior.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
bb5582d52b Fixes for widget_tests.js
Link widget creates only one <label> and one <a> element not more as before.
Test changed accordingly.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
63f7575cb3 Fixes for aci_tests.js
Aci_widget doesn't use table elements anymore. Whole widget is created from
list element. Change in tests needed.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
11e19cd5d5 Fixes for entity_tests.js
Register also details module to provide all objects from that module.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
4fb52371f2 Fixes for ipa_test.js
Basically add API version into the API request. The API version was not
required before.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
9e0db0759a Add up to date JSON files
All files are up to date and there are only files which are needed for unit tests.

https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
46fba2128f Add loader.js into requirements of all HTML unit test files
https://pagure.io/freeipa/issue/6974

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-31 10:35:03 +02:00
Pavel Vomacka
0ee7db75e4 WebUI: Remove plugins symlink as it is unused
The plugins symlink points to non-existing directory and is currently
not used. It also causes errors in freeipa-pr-ci during creating
tarball.

https://pagure.io/freeipa/issue/6447

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-30 16:15:57 +02:00
Pavel Vomacka
41a18bbbc8 Remove all old JSON files
JSON files were used as source of information for offline WebUI.

https://pagure.io/freeipa/issue/6447

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-30 16:15:57 +02:00
Pavel Vomacka
6ad92d3a4f Revert "Web UI: Remove offline version of Web UI"
This reverts commit 24525fd086.
The reverted commit removed symlinks which allowed unit tests to
access FreeIPA code.

https://pagure.io/freeipa/issues/6447

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2017-08-30 16:15:57 +02:00
Martin Babinsky
a2de6a17c5 Move tmpfiles.d configuration handling back to spec file
Since ipaapi user is now created during RPM install and not in runtime,
we may switch back to shipping tmpfiles.d configuration directly in RPMs
and not create it in runtime, which is a preferred way to handle drop-in
configuration anyway.

This also means that the drop-in config will be shipped in /usr/lib
instead of /etc according to Fedora packaging guidelines.

This partially reverts commit 38c66896de.

https://pagure.io/freeipa/issue/7053

Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
2017-08-30 13:05:23 +02:00
Florence Blanc-Renaud
ee5345ac05 Fix Certificate renewal (with ext ca)
Fix certificate renewal scripts that use IPACertificate object:
- renew_ca_cert adds the C flag to the trust flags and needs to
be adapted to IPACertificate object
- ipa-cacert-manage: fix python3 encoding issue

https://pagure.io/freeipa/issue/7106

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-08-30 12:58:58 +02:00
Stanislav Laznicka
170f7a778b certmonger: remove temporary workaround
During recent refactoring, a workaround was added to make it
possible for OpenSSL backend of python-cryptography to read PEM
certificates returned by dogtag-ipa-renew-agent-submit. This was
fixed in latest certmonger version.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-30 12:55:59 +02:00
Florence Blanc-Renaud
69bda6b440 Fix ipa-server-upgrade: This entry already exists
ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin
finds all CA certificates in /etc/httpd/alias and uploads them in LDAP
below cn=certificates,cn=ipa,cn=etc,$BASEDN.
The issue happens because there is already an entry in LDAP for IPA CA, but
with a different DN. The nickname in /etc/httpd/alias can differ from
$DOMAIN IPA CA.

To avoid the issue:
1/ during upgrade, run a new plugin that removes duplicates and restarts ldap
(to make sure that uniqueness attr plugin is working after the new plugin)
2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of
cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA.

https://pagure.io/freeipa/issue/7125

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-30 12:47:53 +02:00
Stanislav Laznicka
e6a9de8a2e py3: remove Exception.message appearances
Exception.message is removed in Python3

https://pagure.io/freeipa/issue/4985
https://pagure.io/freeipa/issue/6874

Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-08-29 12:55:25 +02:00
Stanislav Laznicka
7ef6de931b python3: port certmonger requests script
This commit fixes requesting certificates via certmonger in Python 3.
This includes dogtag-ipa-ca-renew-agent-submit script and scripts
used during the scripts restarting.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-22 10:53:39 +02:00
Stanislav Laznicka
a3c11b01af crtmgr: fix bug if CERTMONGER_CERTIFICATE not set
If CERTMONGER_CERTIFICATE is not set in certain scenario, the
code would fail since None cannot be passed to loading certificates.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-22 10:53:39 +02:00
Stanislav Laznicka
0412625a2b certmonger: finish refactoring for request script
The recent certificate refactoring assures that ipaldap operations
are able to work with IPACertificate values when communication with
the LDAP server. Use these capabilities and prevent possible bugs.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-22 10:53:39 +02:00
Stanislav Laznicka
32be3ef622 certmonger: fix storing retrieved certificates
This was a forgotten part from previous certificate refactoring which
would cause issues since the second part of results throughout the
dogtag-ipa-ca-renew-agent-submit is expected to be a string.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-22 10:53:39 +02:00
Pavel Vomacka
ed7de96648 WebUI: fix incorrectly shown links in association tables
Previously all columns was shown as links, that was caused by setting
link attribute of each column to true. This true value was there because
of possibility to turn off links in whole table on self-service pages.

Now only column which is primary key is set to be shown as link.

https://pagure.io/freeipa/issue/7066

Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
2017-08-17 10:10:21 +02:00
Stanislav Laznicka
31a5cf588e conncheck: fix progression on failure
traceback.format_exc() does not take exception object as an argument.
This made Python 3 get stuck amid ipa-replica-conncheck, probably
because it was waiting for a thread to finish.

https://pagure.io/freeipa/issue/4985

Reviewed-By: Felipe Volpone <fbarreto@redhat.com>
2017-08-17 09:56:01 +02:00
Fraser Tweedale
7995518921 Restore old version of caIPAserviceCert for upgrade only
The latest version of caIPAserviceCert profile includes a feature
that is not available before Dogtag 10.4, and this version of the
profile is intended for new installs only (otherwise, problems will
arise in topologies containing CA replicas at an earlier version).
But IPA versions before v4.2 did not use LDAP-based profiles, so the
new version of the profile gets imported when upgrading from
pre-v4.2 to v4.5 or later.

We do not yet have a proper version- and topology-aware profile
update mechanism, so to resolve this issue, ship the older version
of the profile alongside the newer version, and make sure we use the
older version when importing the profile in an upgrade context.

https://pagure.io/freeipa/issue/7097

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-14 19:25:59 +02:00
Petr Vobornik
cc72db67e2
control logging of host_port_open from caller
host_port_open copied logging behavior of ipa-replica-conncheck utility
which doesn't make it much reusable.

Now log level can be controlled from caller so other callers might use
other logging level without host_port_open guessing what was the
intention.

https://pagure.io/freeipa/issue/7083

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-08-11 13:40:38 +02:00
Stanislav Laznicka
06fbf4b312 replica-conncheck: log when failed to RPC connect
It's nearly impossible to find out what happened when doing
replica connection check and it fails during the RPC phase.
The error is now logged.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-07-27 10:33:58 +02:00
Tomas Krizek
fc7e2565bd ipactl: log check_version exception
When version is mismatched and ipa-server-upgrade is required,
log the version mismatch properly in journal.

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-07-27 10:32:07 +02:00
Stanislav Laznicka
e1f88c844e Fixup of not-so-good PEM certs
certmonger returns PEM certificates with an additional newline
after the base64 encoded cert, remove it

https://pagure.io/freeipa/issue/4985

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-07-27 10:28:58 +02:00