Commit Graph

94 Commits

Author SHA1 Message Date
Ondrej Hamada
f298a20d27 Case sensitive renaming of objects
When renaming object its case sensitivity is obeyed. This was DS bug.
Unit tests were corrected and minimal DS version was updated in spec
file.

https://fedorahosted.org/freeipa/ticket/2620
2012-06-20 15:47:02 +02:00
Rob Crittenden
54135ecd9a Store session cookie in ccache for cli users
Try to use the URI /ipa/session/xml if there is a key in the kernel
keyring. If there is no cookie or it turns out to be invalid (expired,
whatever) then use the standard URI /ipa/xml. This in turn will create
a session that the user can then use later.

https://fedorahosted.org/freeipa/ticket/2331
2012-06-14 14:02:26 +02:00
Alexander Bokovoy
a5fcfc2c7e Move AD trust support code to freeipa-server-trust-ad subpackage
DCERPC code in AD trusts implementation depends on Samba 4 Python bindings.
Make this dependency optional for main freeipa-server package by moving
the dependency to freeipa-server-trust-ad subpackage.

Main interface to AD trusts (ipalib/plugins/trust.py) will still stay,
as well as LDIF files and updates as they are not causing real dependency.

https://fedorahosted.org/freeipa/ticket/2821
2012-06-13 12:05:03 +03:00
Martin Kosek
ce97d6f8e7 Enable persistent search by default
From IPA version 3.0, the persistent search is a preferred mechanism
to for DNS zone list management. It will be also a requirement for
several bind-dyndb-ldap features, like SOA serial automatic updates
or DNSSEC.

Make this mechanism default in ipa-server-install and ipa-dns-istall.

https://fedorahosted.org/freeipa/ticket/2524
2012-06-10 21:23:15 -04:00
Martin Kosek
c856fb6073 Add sysupgrade state file
When IPA package is being updated, some of the configuration files
are also updated. Sometimes it may be useful to store upgrade meta
information for next package upgrades. For example an information
that some config file was already updated and we don't want to
update it again if user purposedly reverted the change.

This patch adds a new StateFile in /var/lib/ipa/sysupgrade which
is capable of holding this information. New sysupgrade.py module
was created to provide simple API to access the upgrade state
information.
2012-06-10 21:23:10 -04:00
Petr Viktorin
cf72738b21 Add samba4-python to BuildRequires 2012-06-07 11:42:39 +02:00
Alexander Bokovoy
e3d171126f Add python-crypto to build requires for AD server-side code 2012-06-07 09:39:11 +02:00
Alexander Bokovoy
a7420c1e83 Add trust management for Active Directory trusts 2012-06-07 09:39:09 +02:00
Martin Kosek
f1ed123cad Replace DNS client based on acutil with python-dns
IPA client and server tool set used authconfig acutil module to
for client DNS operations. This is not optimal DNS interface for
several reasons:
- does not provide native Python object oriented interface
  but but rather C-like interface based on functions and
  structures which is not easy to use and extend
- acutil is not meant to be used by third parties besides
  authconfig and thus can break without notice

Replace the acutil with python-dns package which has a feature rich
interface for dealing with all different aspects of DNS including
DNSSEC. The main target of this patch is to replace all uses of
acutil DNS library with a use python-dns. In most cases, even
though the larger parts of the code are changed, the actual
functionality is changed only in the following cases:
- redundant DNS checks were removed from verify_fqdn function
  in installutils to make the whole DNS check simpler and
  less error-prone. Logging was improves for the remaining
  checks
- improved logging for ipa-client-install DNS discovery

https://fedorahosted.org/freeipa/ticket/2730
https://fedorahosted.org/freeipa/ticket/1837
2012-05-24 13:55:56 +02:00
Rob Crittenden
717bbcd2bf Configure certmonger to execute restart scripts on renewal.
certmonger now has the ability to execute a script when it renews a
certificate. This can be used to automatically restart servers so
the certificate doesn't expire in the running server.

https://fedorahosted.org/freeipa/ticket/2050
2012-04-10 01:08:41 -04:00
Rob Crittenden
7471ba2237 Return consistent value when hostcat and usercat is all.
We were returning '' for the first entry when hostcat and usercat were
set to all. All subsequent entries were padded with - which effectively
denied access.

This requires slapi-nis 0.40+

https://fedorahosted.org/freeipa/ticket/2192
2012-04-08 16:54:32 -04:00
Rob Crittenden
9bb1e6c03e Add requires on python-krbV to client subpackage
This is needed since ipa-client-install initializes the ipalib api.

https://fedorahosted.org/freeipa/ticket/2577
2012-03-28 08:53:01 +02:00
John Dennis
e2a3907726 Replace broken i18n shell test with Python test
We had been using shell scripts and sed to test our translations. But
trying to edit pot and po files with sed is nearly impossible because
the file format can vary significantly and the sed editing was failing
and gettext tools were complaining about our test strategy.  We had
been using a Python script (test_i18n.py) to perform the actual test
after using shell, sed, and gettext tools to create the files. There
is a Python library (polib) which can read/write/edit pot/po/mo files
(used internally by Transifex, our translation portal). The strategy
now is to do everything in Python (in test_i18n.py). This is easier,
more robust and allows us to do more things.

* add python-polib to BuildRequires

* Remove the logic for creating the test lang from Makefile.in and
  replace it with calls to test_i18n.py

* add argument parsing, usage, configuration parameters, etc. to
  test_i18n.py to make it easier to use and configurable.

* add function to generate a test po and mo file. It also
  writes the files and creates the test directory structure.

* Took the existing validate code and refactored it into validation
  function. It used to just pick one string and test it, now it
  iterates over all strings and all plural forms.

* Validate anonymous Python format substitutions in pot file

* added support for plural forms.

* Add pot po file validation for variable substitution

* In install/po subdir you can now do:
  $ make test
  $ make validate-pot
  $ make validate-po

* The options for running test_i18n.py are:

$ ./test_i18n.py --help
Usage:

test_i18n.py --test-gettext
test_i18n.py --create-test
test_i18n.py --validate-pot [pot_file1, ...]
test_i18n.py --validate-po po_file1 [po_file2, ...]

Options:
  -h, --help            show this help message and exit
  -s, --show-strings    show the offending string when an error is detected
  --pedantic            be aggressive when validating
  -v, --verbose         be informative
  --traceback           print the traceback when an exception occurs

  Operational Mode:
    You must select one these modes to run in

    -g, --test-gettext  create the test translation file(s) and exercise them
    -c, --create-test   create the test translation file(s)
    -P, --validate-pot  validate pot file(s)
    -p, --validate-po   validate po file(s)

  Run Time Parameters:
    These may be used to modify the run time defaults

    --test-lang=TEST_LANG
                        test po file uses this as it's basename (default=test)
    --lang=LANG         lang used for locale, MUST be a valid lang
                        (default=xh_ZA)
    --domain=DOMAIN     translation domain used during test (default=ipa)
    --locale=LOCALE     locale used during test (default=test_locale)
    --pot-file=POT_FILE
                        default pot file, used when validating pot file or
                        generating test po and mo files (default=ipa.pot)

https://fedorahosted.org/freeipa/ticket/2044
2012-03-26 20:29:26 -04:00
Rob Crittenden
00ce15b744 Set minimum version of 389-ds-base to 1.2.10.4-2 to fix upgrade issue
The IPA upgrade process was starting before 389-ds had upgraded the
database which caused corruption.

https://fedorahosted.org/freeipa/ticket/2541
2012-03-26 09:48:43 +02:00
Petr Viktorin
a4394e5e4a Add missing BuildRequires
Since our build process runs pylint, we need all Python dependencies
installed at RPM creation time.
This adds python-lxml and python-pyasn1 to BuildRequires.

https://fedorahosted.org/freeipa/ticket/2538
2012-03-26 09:38:08 +02:00
Rob Crittenden
8f71f42ef7 No longer shell escape the DM password when calling pkisilent.
pkisilent was modified to handle escaping characters itself in
BZ https://bugzilla.redhat.com/show_bug.cgi?id=769388

This removes the workaround from ticket 1636.

https://fedorahosted.org/freeipa/ticket/2529
2012-03-21 10:08:43 +01:00
Martin Kosek
9d0ef96c67 Allow port numbers for idnsForwarders
Let user enter custom ports for zone conditional forwarders or
global forwarders in dnsconfig. Ports can be specified in
a standard BIND format: IP_ADDRESS [port PORT]

https://fedorahosted.org/freeipa/ticket/2462
2012-03-20 15:37:53 +01:00
Petr Vobornik
2449b4d827 Fixed rpm build warning - extension.js listed twice
Building the ipa rpms returns this:
warning: File listed twice: /usr/share/ipa/ui/extension.js

This is because of a glob:
%{_usr}/share/ipa/ui/*.js

and then more specifically:
%config(noreplace) %{_usr}/share/ipa/ui/extension.js

https://fedorahosted.org/freeipa/ticket/2253
2012-03-19 18:38:46 +01:00
Rob Crittenden
8b2090fae6 Set minimum version of selinux-policy to pick up memcached fix
This package version adds a boolean, httpd_manage_ipa, that enables
the ipa_memcached service to work.

https://fedorahosted.org/freeipa/ticket/2433
2012-03-11 22:36:44 -04:00
Jan Cholasta
afad0775e1 Configure SSH features of SSSD in ipa-client-install.
OpenSSH server (sshd) is configured to fetch user authorized keys from
SSSD and OpenSSH client (ssh) is configured to use and trigger updates
of the SSSD-managed known hosts file.

This requires SSSD 1.8.0.
2012-03-01 18:42:56 -05:00
Petr Voborník
368c624a74 Forms based authentication UI
Support for forms based authentication was added to UI.

It consist of:

1) new login page
Page url is [ipa server]/ipa/ui/login.html

Page contains a login form. For authentication it sends ajax request at [ipa server]/session/json/login_password. If authentication is successfull page is redirected to [ipa server]/ipa/ui if it fails from whatever reason a message is shown.

2) new enhanced error dialog - authorization_dialog.

This dialog is displayed when user is not authorized to perform action - usually when ticket and session expires.
It is a standard error dialog which shows kerberos ticket related error message and newly offers (as a link) to use form based authentication. If user click on the link, the dialog content and buttons switch to login dialog which has same functionality as 'new login page'. User is able to return back to the error message by clicking on a back button.

login.html uses same css styles as migration page -> ipa-migration.css was merged into ipa.css.

https://fedorahosted.org/freeipa/ticket/2450
2012-03-02 11:04:33 +01:00
Petr Voborník
87901ed709 Added logout button
Logout button was added to Web UI.

Click on logout button executes session_logout command. If command succeeds or xhr stutus is 401 (unauthorized - already logged out) page is redirected to logout.html.

logout.html is a simple page with "You have been logged out" text and a link to return back to main page.

https://fedorahosted.org/freeipa/ticket/2363
2012-02-28 23:58:51 -05:00
John Dennis
9753fd4230 Tweak the session auth to reflect developer consensus.
* Increase the session ID from 48 random bits to 128.

* Implement the sesison_logout RPC command. It permits the UI to send
  a command that destroys the users credentials in the current
  session.

* Restores the original web URL's and their authentication
  protections. Adds a new URL for sessions /ipa/session/json. Restores
  the original Kerberos auth which was for /ipa and everything
  below. New /ipa/session/json URL is treated as an exception and
  turns all authenticaion off. Similar to how /ipa/ui is handled.

* Refactor the RPC handlers in rpcserver.py such that there is one
  handler per URL, specifically one handler per RPC and AuthMechanism
  combination.

* Reworked how the URL names are used to map a URL to a
  handler. Previously it only permitted one level in the URL path
  hierarchy. We now dispatch on more that one URL path component.

* Renames the api.Backend.session object to wsgi_dispatch. The use of
  the name session was historical and is now confusing since we've
  implemented sessions in a different location than the
  api.Backend.session object, which is really a WSGI dispatcher, hence
  the new name wsgi_dispatch.

* Bullet-proof the setting of the KRB5CCNAME environment
  variable. ldap2.connect already sets it via the create_context()
  call but just in case that's not called or not called early enough
  (we now have other things besides ldap which need the ccache) we
  explicitly set it early as soon as we know it.

* Rework how we test for credential validity and expiration. The
  previous code did not work with s4u2proxy because it assumed the
  existance of a TGT. Now we first try ldap credentials and if we
  can't find those fallback to the TGT. This logic was moved to the
  KRB5_CCache object, it's an imperfect location for it but it's the
  only location that makes sense at the moment given some of the
  current code limitations. The new methods are KRB5_CCache.valid()
  and KRB5_CCache.endtime().

* Add two new classes to session.py AuthManager and
  SessionAuthManager. Their purpose is to emit authication events to
  interested listeners. At the moment the logout event is the only
  event, but the framework should support other events as they arise.

* Add BuildRequires python-memcached to freeipa.spec.in

* Removed the marshaled_dispatch method, it was cruft, no longer
  referenced.

https://fedorahosted.org/freeipa/ticket/2362
2012-02-27 05:54:29 -05:00
Rob Crittenden
872047fa0e Add Requires to ipa-client on oddjob-mkhomedir
https://fedorahosted.org/freeipa/ticket/2337
2012-02-27 11:00:26 +01:00
Martin Kosek
1816643a43 Update schema for bind-dyndb-ldap
Add new attributes and objectclasses to support new features:
  - global bind-dyndb-ldap settings in LDAP
  - conditional per-zone forwarding
  - per-zone configuration of automatic PTR updates
  - AllowQuery and AllowTransfer ACIs

https://fedorahosted.org/freeipa/ticket/2215
https://fedorahosted.org/freeipa/ticket/2072
2012-02-24 09:40:36 +01:00
Rob Crittenden
915286fed2 Add Conflicts on mod_ssl because it interferes with mod_proxy and dogtag
We had this in v1 but removed it with v2 because we no longer used
TurboGears for the UI. Because we are now proxying requests to dogtag
we need to re-add this so that mod_ssl doesn't interfere with our
communication.

mod_ssl always blindly registers itself as the SSL provider for mod_proxy.
mod_nss will only register itself if mod_ssl hasn't already done so.

https://fedorahosted.org/freeipa/ticket/2177
2012-02-22 18:27:54 -05:00
Rob Crittenden
dc5592af1d Set min for 389-ds-base to 1.2.10.1-1 to fix install segfault, schema replication.
https://fedorahosted.org/freeipa/ticket/2118
2012-02-15 23:43:08 -05:00
Simo Sorce
2e2b0c13e2 Require krb5 1.10 2012-02-16 14:45:38 -05:00
Rob Crittenden
2da6d6e746 Don't set delegation flag in client, we're using S4U2Proxy now
A forwardable ticket is still required but we no longer need to send
the TGT to the IPA server. A new flag, --delegate, is available if
the old behavior is required.

Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up
needed patches for S4U2Proxy to work.

https://fedorahosted.org/freeipa/ticket/1098
https://fedorahosted.org/freeipa/ticket/2246
2012-02-15 17:08:33 +01:00
Rob Crittenden
95b1848f19 Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf
The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On
upgrade it will be left running by the previous installation, we need
to stop it and uninstall the service.

The dbmodules section needs to reflect that we're now using the new
IPA kdb backend instead of the standard MIT ldap backend.

https://fedorahosted.org/freeipa/ticket/2341
2012-02-15 15:19:32 +01:00
John Dennis
d1e0c1b606 Add ipa_memcached service
* Adds ipa_memcached SystemV initscript

* Adds ipa_memcached service file and tmpfiles.d/ipa.conf
  to recreate /var/run/ipa_memcached on reboot.

* Adds ipa_memcached config file

* Adds memcacheinstnace.py to manage ipa_memcaced as
  as SimpleService object.

* Updates the IPA service list to include ipa_memcached,
  at service positon 39, httpd is position 40

* Updates the spec file:
  - requires the memcached daemon and python client
  - installs service or initscripts depending on OS
  - installs config file
  - creates /var/run/ipa_memcached directory

* Modifies ipa-server-install to install ipa_memcached
2012-02-09 13:20:28 -06:00
Rob Crittenden
4dfec211f7 %ghost the UI files that we install/create on the fly
https://fedorahosted.org/freeipa/ticket/1764
2012-01-31 18:38:46 +01:00
Rob Crittenden
f3b606b627 Update and package ipa-upgradeconfig man page.
Require that the tool be run as root to avoid a permission-related
backtrace.

https://fedorahosted.org/freeipa/ticket/1758
2012-01-23 16:07:49 +01:00
Simo Sorce
86f908a0e4 slapi-plugins: use thread-safe ldap library 2012-01-13 19:07:47 +02:00
Rob Crittenden
c08296adff Configure s4u2proxy during installation.
This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX

Within that container we control which services are allowed to
delegate tickets for other services. Right now that is limited
from the IPA HTTP to ldap services.

Requires a version of mod_auth_kerb that supports s4u2proxy

https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 22:39:26 -05:00
Alexander Bokovoy
d738b6e718 Fix dependency for samba4-devel package 2011-12-09 16:58:59 +02:00
Sumit Bose
edb6ed5007 Add ipasam samba passdb backend
https://fedorahosted.org/freeipa/ticket/1874
2011-12-06 08:29:53 -05:00
Simo Sorce
1039653a1b spec: We do not need krb5-server-ldap anymore
We now use our own ipa-kdb DAL driver
2011-11-29 09:29:42 -05:00
Rob Crittenden
2f4b3972a0 Add plugin framework to LDAP updates.
There are two reasons for the plugin framework:
1. To provide a way of doing manual/complex LDAP changes without having
   to keep extending ldapupdate.py (like we did with managed entries).
2. Allows for better control of restarts.

There are two types of plugins, preop and postop. A preop plugin runs
before any file-based updates are loaded. A postop plugin runs after
all file-based updates are applied.

A preop plugin may update LDAP directly or craft update entries to be
applied with the file-based updates.

Either a preop or postop plugin may attempt to restart the dirsrv instance.
The instance is only restartable if ipa-ldap-updater is being executed
as root. A warning is printed if a restart is requested for a non-root
user.

Plugins are not executed by default. This is so we can use ldapupdate
to apply simple updates in commands like ipa-nis-manage.

https://fedorahosted.org/freeipa/ticket/1789
https://fedorahosted.org/freeipa/ticket/1790
https://fedorahosted.org/freeipa/ticket/2032
2011-11-22 23:57:10 -05:00
Simo Sorce
710f435c20 Create skeleton CLDAP server as a DS plugin 2011-11-21 18:52:48 -05:00
Endi S. Dewata
20ad8fe1ba Removed develop.js.
The develop.js is no longer necessary because the code in it has
been merged into the main code.

An empty extension.js has been added to provide a place for UI
customization.

Ticket #2099
2011-11-14 16:47:10 -05:00
Simo Sorce
18537d55a7 Add support for generating PAC for AS requests for user principals 2011-11-07 14:25:07 -05:00
Endi S. Dewata
52981883ab Fixed inconsistent image names.
The images have been renamed to be more consistent and moved into
the "images" directory to mimic the original jQuery UI structure.

Ticket #1613
2011-10-27 14:05:12 +00:00
Endi S. Dewata
f168afbeb6 Removed HBAC deny rule warning.
The HBAC deny rule is no longer supported so it's no longer necessary
to show the warning.

Ticket #1444
2011-10-26 12:53:28 +00:00
Alexander Bokovoy
80b4220a05 Update spec file to use systemd on Fedora 16 and above 2011-10-24 15:11:04 +02:00
Rob Crittenden
da4b447bd0 Set min nvr of 389-ds-base to 1.2.10-0.4.a4 for limits fixes (740942, 742324) 2011-10-13 15:28:52 -04:00
Adam Young
ae65c01932 Force the upgrade of pki-setup when upgrading the RPMS 2011-10-09 23:36:36 -04:00
JR Aquino
1ac613fc18 25 Create Tool for Enabling/Disabling Managed Entry Plugins
Remove legacy ipa-host-net-manage
Add ipa-managed-entries tool
Add man page for ipa-managed-entries tool

https://fedorahosted.org/freeipa/ticket/1181
2011-09-21 09:22:13 +02:00
Rob Crittenden
80a4db80ba Change the Requires for the server and server-selinux for proper order
The server package needs to be installed before the server-selinux
package otherwise the SELinux contexts won't get set properly.

The (postun) is so you can continue to do yum erase freeipa-python
and it will pick up everything else.

https://fedorahosted.org/freeipa/ticket/1779
2011-09-15 23:41:56 -04:00
Sumit Bose
29a7a7e8ce Add ipa-adtrust-install utility
https://fedorahosted.org/freeipa/ticket/1619
2011-09-14 18:45:13 -04:00