Commit Graph

10765 Commits

Author SHA1 Message Date
Tomas Krizek
e8a2abd548 named.conf template: update API for bind 9.11
Use the new API for bind 9.11. Removed deprecated "serial_autoincrement"
and updated the rest of configuration to conform to the new format.

This only fixes new IPA installations. For existing installations,
named.conf will be transformed when the new version of bind-dyndb-ldap
is installed.

https://fedorahosted.org/freeipa/ticket/6565

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 16:34:53 +01:00
Tomas Krizek
c26dd805bd Remove obsolete serial_autoincrement from named.conf parsing
Option serial_autoincrement is no longer supported. Remove it from
the named.conf parser and add it to deprecated options to be removed.

https://fedorahosted.org/freeipa/ticket/6565

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 16:34:53 +01:00
Tomas Krizek
36f46a5301 certdb: remove unused valid_months property
Property valid_months is no longer used anywhere in the code. It was
removed when the selfsign funcionality was dropped.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-02-09 15:59:09 +01:00
Tomas Krizek
47565c0fc7 certdb: remove unused keysize property
Keysize property is no longer used anywhere in the code. It was
originally introduced for the request_cert function, which was later
refactored to use a function argument instead.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-02-09 15:59:09 +01:00
Jan Cholasta
e920ae2252 ipaldap: preserve order of values in LDAPEntry._sync()
In Python 2, the order was preserved by accident.

This change makes sure the order is preserved in both Python 2 and 3.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 15:57:48 +01:00
Christian Heimes
b20f6fb294 Print test env information
Print api.env, uname, euid/egid, cwd and Python version when tests are
run with -v (e.g. ipa-run-tests -v).

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 15:57:15 +01:00
Fraser Tweedale
f51869bf52 replica install: relax domain level check for promotion
promote_check currently requires DL == 1.  Relax the check to
require DL >= 1, so that things will work for future DL increases.

Also separate the concerns of retrieving the current domain level,
validating whether the domain level is supported by the IPA version,
and validating whether the current domain level supports the replica
installation method attempted (i.e. replica file versus promotion).

Part of: https://fedorahosted.org/freeipa/ticket/5011

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-09 15:24:48 +01:00
Martin Babinsky
d7cfbb870f Replace exit() calls with exceptions
In order to enable correct handling of hard errors from within the
composite installer code, all calls to `sys.exit` have to be replaced
with raising ScriptError.

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 14:05:22 +01:00
Martin Babinsky
e27f6bfdc3 Remove unused variables in exception handling
https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 14:05:22 +01:00
Martin Babinsky
847be3a8a8 ipa-adtrust-install: format the code for PEP-8 compliance
https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-09 14:05:22 +01:00
Martin Babinsky
91341f4035 Travis CI: Upload the logs from failed jobs to transfer.sh
When a non-lint job fails, all the relevant logs from the test runner
will be gzipped and uploaded to https://transfer.sh file sharing
service. The download link will then be displayed at the very end of the
Travis build log.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-09 13:26:07 +01:00
Martin Basti
b24787a67f py3: ldapupdate: fix logging str(bytes) issue
bytes as argument of str() gives unexpected result by adding prefix "b"
there.

Also add missing safe_option() call to logging (it will fix another
str(bytes) issue)

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-02-08 18:09:49 +01:00
Martin Basti
387a1513bb DNSSEC: forwarders validation improvement
Some DNS servers behaves oddly and instead sending result without RRSIG records
don't reply at all when DNSSEC flag is enabled (timeout). Instead of
hard error IPA should this handle as DNSSEC error and continue with
installation/adding forwarders.

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-02-08 15:59:41 +01:00
Martin Basti
a5ccdc16cb py3: test_ipaserver: fix BytesWarnings
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-08 15:41:39 +01:00
Martin Basti
6bb5af7bea py3: get_memberofindirect: fix ByteWarnings
DN must be converted to bytes as other variables adn lists contain bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-08 15:41:39 +01:00
Martin Basti
d38540acd6 py3: DN: fix BytesWarning
User repr() instead of str() for bytes, it has the same effect, but it
is proper way how to print bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-08 15:41:39 +01:00
Martin Basti
ad1a5551d5 Tests: fix wait_for_replication task
DS changed a format of replication status attribute. Now it is with
prefix "Error (x)" where x is the error code.

Both formats were kept to allow tests run on older and new
versions of DS.

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2017-02-08 14:15:53 +01:00
Martin Basti
4c84341b8b py3: send Decimal number as string instead of base64 encoded value
for Decimal only from client to server direction uses __base64__
notation. Server replies with pure string for Decimal data, and also
server is able to parse string and create decimal values where needed.

without this we need ugly py3 code:
-        return {'__base64__': base64.b64encode(str(val))}
+        return {'__base64__': base64.b64encode(
+            str(val).encode('ascii')).decode('ascii')}

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
ab53d80883 py3: ipaldap: properly encode DNSName to bytes
The encode method of LDAPClient didn't return DNSName as bytes but
string in py3. In py2 it returns non-unicode string so it can be encoded
safely by ascii as to_text() method returns only ascii characters.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
a584758cfb py3: _convert_to_idna: fix bytes/unicode mistmatch
ToASCII() returns bytes, it must be decoded to unicode

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
03d0a55e8a py3: DNS: get_record_entry_attrs: do not modify dict during iteration
In py3 keys() doesn't return list but iterator so it must be transformed
to tuple otherwise iterator will be broken.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
a3d3b0ad25 py3: _ptrrecord_precallaback: use bytes with labels
DNS labels are bytes so bytes must be used for comparison

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
a93b2bea5c py3: remove_entry_from_group: attribute name must be string
Do not encode attribute names

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
Martin Basti
caa560ca79 py3: base64 encoding/decoding returns always bytes don't mix it
Using unicode(bytes) call causes undesired side effect that is inserting
`b` character to result. This obviously causes issues with binary base64 data

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-08 08:32:44 +01:00
David Kupka
8e139d4b55 tests: Add tests for kerberos principal aliases in stageuser
https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
9382efde4f tests: kerberos_principal_aliases: Deduplicate tests
https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
c5c98af99d tests: Stageuser-{add,remove}-cert
https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
7b68cc5b08 tests: add-remove-cert: Use harcoded certificates instead of requesting them
Requesting certificates for test purposes is not necessary as we allow to
upload arbitrary certificate to the user, host or service. Also requesting
certificate from dogtag takes some time and the test is slower for no good
reason.
More it's not posible to request certificate for stageuser even though it's
possible to upload certificates to stageusers now.

https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
308c790ee9 ipalib.x509: Handle missing SAN gracefully
When extension is not present None is returned instead of empty iterable
or exception thrown.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
7e2d185ba0 stageuser: Add stageuser-{add,remove}-principal
https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
David Kupka
9c0e86530e stageuser: Add stageuser-{add,remove}-cert
Move {add,remove}-cert implementation from user to baseuser and inherit
{,stage}user-{add,remove}-cert from it.

https://fedorahosted.org/freeipa/ticket/6623

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 13:58:48 +01:00
Jan Cholasta
054c1e013a replica install: do not log host OTP
Do not log the value of the --password option of ipa-client-install when it
is run from ipa-replica-install before replica promotion.

https://fedorahosted.org/freeipa/ticket/6633

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>
2017-02-07 13:57:48 +01:00
Martin Basti
bd83fdf516 pki-base: use pki-base-python2 as dependency
pki-base provides pki-base-python2, but we should depend directly on
pki-base-python2 because in future pki-base may provide pki-base-python3
instead.

Source: cheimes@redhat.com

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-07 13:18:27 +01:00
Martin Basti
66fa0585aa pki: add missing depedency pki-base[-python3]
FreeIPA server modules requires pki module

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-07 13:18:27 +01:00
Petr Čech
dc99d3c04e ipatests: nested netgroups (intg)
Adds a test case for issue in SSSD that manifested in
an inability to resolve nested membership in netgroups

The test case tests for direct and indirect membership.

https://fedorahosted.org/freeipa/ticket/6439

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-07 11:56:14 +01:00
Martin Basti
91ab650ac4 py3: x509.py: return principal as unicode string
X509 return principal as unicode string

https://fedorahosted.org/freeipa/ticket/4985
https://fedorahosted.org/freeipa/ticket/6640

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-07 11:36:38 +01:00
Fraser Tweedale
924794f62b Fix reference before assignment
In 'store_session_cookie', if the server does not set the session
cookie for some reason, the 'session_cookie' variable does not get
assigned, resulting in UnboundLocalError.  Set an initial value of
'None'.

Fixes: https://fedorahosted.org/freeipa/ticket/6636
Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-02-06 17:28:39 +01:00
David Kupka
f4088b3a00 build: Add missing dependency on libxmlrpc{,_util}
Change in libxmlrpc packaging uncovered missing linking  dependency in our
build system.

https://fedorahosted.org/freeipa/ticket/6637

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2017-02-06 17:18:26 +01:00
Jan Cholasta
89dfbab3ca tests: add test for PEM certificate files with leading text
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-02-06 14:59:46 +01:00
Florence Blanc-Renaud
066f5b7c90 ipa-kra-install must create directory if it does not exist
ipa-kra-install creates an admin cert file in
/root/.dogtag/pki-tomcat/ca_admin.cert but does not check that the
parent directory exists. This situation can happen when uninstall + restore
has been run.

The fix creates the directory if not present.

https://fedorahosted.org/freeipa/ticket/6606

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-02-02 13:44:47 +01:00
Martin Basti
5de70e3199 py3: tests_xmlrpc: do not call str() on bytes
Calling str() on bytes causes undesired side effect: it adds prefix "b"
to the result of conversion. The method decode() should be used instead.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-02-02 13:43:16 +01:00
Fraser Tweedale
caca181d3b private_ccache: yield ccache name
When using private_ccache, yield 'path' from the context manager.
This is cleaner than inspecting 'os.environ['KRB5CCNAME']' within
the context.

Part of: https://fedorahosted.org/freeipa/ticket/5011

Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-01-31 18:45:32 +01:00
Martin Basti
980c8a5f9e py3: normalize_certificate: support both bytes and unicode
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
b8d6524d43 py3: strip_header: support both bytes and unicode
Various method passed various bytes or unicode as parameter

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
47e76e16ef py3: fingerprint_hex_sha256: fix encoding/decoding
https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
d5ab0637fe py3: fix CSR encoding inside framework
csr must be in string because framework excpects only strings, so we
have to decode it back

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
1023cfebff Principal: validate type of input parameter
Bytes are unsupported and we should raise a TypeError from Principal
__init__ method otherwise we get hard to debug result

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
deaf9ae247 Use dict comprehension
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
b37d18288d py3: can_read: attributelevelrights is already string
Remove decode() as it causes error in py3 because the attribute is
already string not bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00
Martin Basti
49333058c8 py3: get_effective_rights: values passed to ldap must be bytes
Values passed to LDAP must be bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-01-31 18:33:27 +01:00