IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
9,555 Commits 11 Branches 60 Tags
d70e52b61b35f42ca2d34ef05310fd2c18c882ce
Commit Graph

9555 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Basti
d70e52b61b DNS Locations: dnsserver: remove config when replica is removed 
Configuration of DNS server should be removed together with any other
information about replica

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
08265f1e92 DNS Locations: dnsserver: use the newer config way in installer 
Store some parts of DNS configuration in LDAP tree instead of named.conf

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
52590d6fa5 DNS Locations: dnsserver: put server_id option into named.conf 
The option server_id is required for DNS location feature, otherwise it
will not work.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
2157ea0e6d DNS Locations: dnsserver-* commands 
New commands for manipulation with DNS server configuration were added:
 * dnsserver-show
 * dnsserver-mod
 * dnsserver-find

https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP
https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
88a0952f26 DNS Locations: dnsservers: add required objectclasses 
Objectclass: idnsServerConfigObject - stores configuration values for
DNS servers

Attributetype: idnsServerId - identifier of dns server (server hostname)

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
4076e8e4e5 DNS Locations: server-mod: add automatic records update 
For any location or server weight change is required to update records

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
a7e463948d DNS Locations: use automatic records update in ipa-adtrust-install 
DNS records for adtrust is added by call dns_update_system_records

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
a5a6ceafcd DNS Locations: adtrustinstance simplify dns management 
The path how to get IPA domain in code was somehow obfuscated, this
patch simplifies and make clear what happened there with domain name.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
45a9326574 DNS Locations: use dns_update_service_records in installers 
use the dns_update_system_records command to set proper DNS records

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
e23159596e DNS Locations: command dns-update-system-records 
command dns-update-system-records updates/fixes DNS records for IPA
services:
* updating A, AAAA records for CA
* updating SRV records for LDAP, kerberos and AD trust
* updating TXT record in _kerberos with proper realm
* updating dns locations if used

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
cf634a4ff8 DNS Locations: add ACI for template attribute 
DNS Servers and DNS Administrators must have access to
'idnsTemplateAttribute' to be able set/read template
for generating CNAME records pointing to proper location records.

Also user must be able to add objectclass for idnsTemplateAttribute

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
394b094fc2 DNS Locations: permission: allow to read status of services 
New permission was added: "System: Read Status of Services on IPA Servers"
This permission is needed for detection which records should be created
on which servers.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
87c23ba029 DNS Locations: DNS data management 
Adding module that allows to work with IPA DNS system records:
* getting system records
* updating system records
* work with DNS locations

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
745a2e6471 DNS Locations: add idnsTemplateObject objectclass 
The objectclass and its related is used for generating cname records
inside bind-dyndb-ldap, see design for more details
https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/RecordGenerator

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
d7671ee667 DNS Locations: fix location-del 
The wrong option was used

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Martin Basti
0f5cca0e45 DNS Locations: add index for ipalocation attribute 
For performace ipalocation should be indexed because it is used by
referint plugin

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-17 15:22:24 +02:00
Petr Spacek
85d083c366 Require 389-ds-base >= 1.3.5.6 
Old DS handles LDAP filters incorrectly and breaks bind-dyndb-ldap.
See https://www.redhat.com/archives/freeipa-devel/2016-June/msg00477.html

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2016-06-16 15:02:15 +02:00
Abhijeet Kasurde
6873ac5b03 Added missing translation to automount.py method 
Fixes: https://fedorahosted.org/freeipa/ticket/5920

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2016-06-16 08:57:55 +02:00
Yuri Chornoivan
dd6645afa9 Fix minor typos 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2016-06-16 08:47:20 +02:00
Stanislav Laznicka
8e3b7b24c1 Increase nsslapd-db-locks to 50000 
Sometimes the lock table would run out of available locks. This should
improve the lock table default configuration.

https://fedorahosted.org/freeipa/ticket/5914

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
 2016-06-15 18:14:02 +02:00
Stanislav Laznicka
fb4e19713d Fixes CA always being presented as running 
Even after manually stopping the pki-tomcatd service instance the
service's is_running() method would still return True.

https://fedorahosted.org/freeipa/ticket/5898

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-15 18:11:28 +02:00
Fraser Tweedale
01795fca83 upgrade: do not try to start CA if not configured 
The upgrade script always attempts to start the CA, even on
instances where the CA is not configured.  Add guards.

Fixes: https://fedorahosted.org/freeipa/ticket/5958
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2016-06-15 17:17:22 +02:00
Jan Cholasta
d26e42ffb0 schema: fix client-side dynamic defaults 
Call command_defaults with properly typed arguments.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
a64aba36a4 schema: exclude local commands 
Commands inherited from Local can't be executed remotely, so exclude them
from API schema.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
f7240c6df8 frontend: call execute rather than forward in Local 
This allows properly subclassing from both Local and other Command classes.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
448af06234 dns, passwd: fix outputs of dns_resolve and passwd commands 
Use proper output type for the `value` output of the commands.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
365d973763 misc: fix empty CLI output of env and plugins commands 
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
e2a8290af1 batch, schema: use Dict instead of Any 
Add new Dict parameter class and use it in the batch and command_defaults
plugins.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
3ac2215ddb schema: generate client-side commands on demand 
Instead of pre-generating all command classes from API schema on API
initialization and using them as plugins, use placeholder objects which
generate the classes on demand.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
4128c565ea plugable: initialize plugins on demand 
Use a new API namespace class which does not initialize plugins until they
are accessed.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Jan Cholasta
bebdce89b6 plugable: allow plugins to be non-classes 
Allow registering any object that is callable and has `name` and `bases`
attributes as a plugin.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
 2016-06-15 14:03:51 +02:00
Martin Babinsky
3e6af238bb Introduce "NTP server" role 
This makes IPA servers that publish their NTP services in LDAP searchable by
`server-role-find` and `server-find` command.

The list of active IPA NTP servers will be displayed in to output of `ipa
config-show` command.

https://fedorahosted.org/freeipa/ticket/5815

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2016-06-15 13:51:48 +02:00
Martin Babinsky
567f00a59c Add NTP to the list of services stored in IPA masters LDAP subtree 
IPA masters can be configured as NTP servers but the status of this service
can not be determined centrally from querying relevant LDAP subtree. This
patch makes IPA master and replica publish the newly configured NTP service in
their service container during installation.

If the master was configured as NTP server, the NTP service entry will be
created upon upgrade.

https://fedorahosted.org/freeipa/ticket/5815
https://fedorahosted.org/freeipa/ticket/5826

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2016-06-15 13:51:48 +02:00
Alexander Bokovoy
905db92e61 adtrust: optimize forest root LDAP filter 
`ipa trust-find' command should only show trusted forest root domains

The child domains should be visible via

   ipa trustdomain-find forest.root

The difference between forest root (or external domain) and child
domains is that root domain gets ipaIDObject class to allow assigning a
POSIX ID to the object. This POSIX ID is used by Samba when an Active
Directory domain controller connects as forest trusted domain object.

Child domains can only talk to IPA via forest root domain, thus they
don't need POSIX ID for their TDOs. This allows us a way to
differentiate objects for the purpose of 'trust-find' /
'trustdomain-find' commands.

Fixes https://fedorahosted.org/freeipa/ticket/5942

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 10:02:33 +02:00
Pavel Vomacka
5e5df4abf0 Extend caacl entity 
There is new checkbox in adding new caacl which can set whether the ACL applies on all
CAs or not. Also there is a new table with CAs on which is current ACL applied. User
can add and remove CAs from this table.

Part of: https://fedorahosted.org/freeipa/ticket/5939

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-15 09:59:50 +02:00
Pavel Vomacka
f4dd2446cd Extend certificate entity page 
Add field for choosing CA when issuing new certificate. Add new item to action menu
on cert details page which allows user to download the certificate as file.

Part of: https://fedorahosted.org/freeipa/ticket/5939

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-15 09:59:50 +02:00
Pavel Vomacka
6e78169e3b Add new webui plugin - ca 
Whole new entity for CAs.

https://fedorahosted.org/freeipa/ticket/5939

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-15 09:59:50 +02:00
Fraser Tweedale
f0915e6198 replica-install: configure key retriever before starting Dogtag 
After installing a replica, Dogtag's Lightweight CA key retrieval
fails until Dogtag is restarted, because the already-running
instance doesn't pick up the changes to CS.cfg.  Configure the key
retriever before the instance is started.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
08e0aa23b0 Add issuer options to cert-show and cert-find 
Add options to cert-show and cert-find for specifying the issuer as
a DN, or a CA name.

Also add the issuer DN to the output of cert-find.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
ae6d5b79fb Update cert-request to allow specifying CA 
Add the '--ca' option to the 'ipa cert-request' command, for
specifying the CA to which to direct the request.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
0b0c07858a Add CA argument to ra.request_certificate 
Add the optional 'ca_id' argument to ra.request_certificate(), for
passing an Authority ID to Dogtag.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
9c93015e78 Update 'caacl' plugin to support lightweight CAs 
For backwards compatibility, an ACL that has no CAs and no CA
category allows access to the IPA CA (host authority) only.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
7d8699580d Add IPA CA entry on install / upgrade 
In addition to user-created lightweight CAs, CA ACLs need to be able
to refer to the "main" CA.  Add an entry for the IPA CA on
installation and upgrade.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Fraser Tweedale
3d4db834ca Add 'ca' plugin 
This commit adds the 'ca' plugin for creating and managing
lightweight CAs.  The initial implementation supports a single level
of sub-CAs underneath the IPA CA.

This commit also:

- adds the container for FreeIPA CA objects

- adds schema for the FreeIPA CA objects

- updates ipa-pki-proxy.conf to allow access to the Dogtag
  lightweight CAs REST API.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2016-06-15 07:13:38 +02:00
Pavel Vomacka
8135651abb Add ability to review cert request dialog 
The request dialog is not closed directly after clicking 'Issue' button, but only
after successful issuing or after clicking 'Close' button. So, the user can check
inputed data.

https://fedorahosted.org/freeipa/ticket/5652

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-14 18:35:31 +02:00
Pavel Vomacka
31faf1c21d Search facet can be without search field 
Add attribute 'disable_search_field' which hides search field on search or
nested_search facet.

Part of: https://fedorahosted.org/freeipa/ticket/5906

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-14 18:27:31 +02:00
Pavel Vomacka
1eb5760018 Add server roles on topology page 
Adds new tab on topology page which shows server roles. Also extends
server details page and server config page (setting of ca renewal server).

https://fedorahosted.org/freeipa/ticket/5906

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-14 18:27:31 +02:00
Pavel Vomacka
72fe7e3294 Extend table facet 
There is new attribute of table facet which allows to set which column of
table will be its primary key. This patch also move some code into separate
method - it will be easier to overide some functionality in child classes.

Part of: https://fedorahosted.org/freeipa/ticket/5906

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-14 18:27:31 +02:00
Pavel Vomacka
95c61c6a0b Association table can be read only 
When it is read only it does not show Add and Delete buttons.

Part of: https://fedorahosted.org/freeipa/ticket/5906

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2016-06-14 18:27:31 +02:00
Martin Basti
5760cc9182 Use python2 for ipa cli 
Switch 'ipa' command to py3 has been done prematurely, this commit sets python2 as interpreter for ipa cli.

https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2016-06-14 13:07:04 +02:00