Commit Graph

1001 Commits

Author SHA1 Message Date
Rob Crittenden
f305864d90 Ensure that every replica gets a unique replication ID. Otherwise changes won't propogate between all replicas.
468732
2008-10-29 17:08:27 -04:00
Rob Crittenden
4862a8f9d9 Fix error if more than one values is being set in an only. The first entry wasn't being properly converted into a list so subsequent values caused it to crap out.
467102
2008-10-15 15:29:08 -04:00
Rich Megginson
f02d1429ca add update to fix the index for the winsync attributes 2008-10-13 14:09:15 -04:00
Rich Megginson
5c56c43693 do not store the OUs from the AD DN in the IPA user entry when flattening 2008-10-13 14:09:14 -04:00
Rich Megginson
9f18858e58 add --win-subtree argument to ipa-replica-manage 2008-10-13 14:09:13 -04:00
Rich Megginson
0988e1c53c Do not depend on MMR plugin - start before MMR plugin
The ipa-winsync plugin needs to start before the MMR plugin, so that it
can register the API functions.  Also, the slapi-nis schema compat
plugin creates an entry that looks exactly like the default IPA group
gidNumber entry, so I added an extra (objectclass=groupOfNames) to the
filter since the slapi-nis entry doesn't have that.
2008-10-13 14:09:13 -04:00
Rich Megginson
d3637dde7c Just add eq,pres to the existing indices
There are already indexes created for ntUniqueID and ntUserDomainID by default
We just need to make sure they are indexed for equality and presence
2008-10-13 14:09:12 -04:00
Rich Megginson
38154073a8 Don't try to conditionally stop the server - it doesn't seem to work
Just call stop() - if it's not already running, no big deal
2008-10-13 14:09:11 -04:00
Rich Megginson
28195610f6 Add more winsync support to cli
The ipa-replica-manage list, init, and synch commands do not work for winsync
agreements.  This patch adds that support and some additional verbose logging.

The synch_master did not work correctly.  The way it should work is to set
the replication schedule to some bogus value, then reset it back to its
original setting.  This will force replication to take place immediately.
2008-10-13 14:09:10 -04:00
Rich Megginson
068ed81195 Do not add enabled user to activated group - clean up parse_acct_disable
If a user needs to be enabled, just delete the user from the inactivated group,
but do not add to the activated group.  If a user is in no group, the user is
active by default.  IPA uses the activated group for override purposes.

parse_acct_disable is only used when the config changes, but I cleaned it
up anyway to make the code clearer.
2008-10-13 14:09:10 -04:00
Rich Megginson
0e346ff6fb add winsync options to ipa-replica-manage man page 2008-10-13 14:09:09 -04:00
Rich Megginson
69180c2dcc Adds winsync account disable and force sync 2008-10-13 14:09:08 -04:00
Rich Megginson
e8bebebc23 fix issues brought up by initial review of ipa winsync enhancements 2008-10-13 14:09:08 -04:00
Rich Megginson
be5e783f72 add --no-host-dns option to ipa-server-install - allows specifying a hostname that might actually exist but you do not want to even attempt to resolve it via DNS 2008-10-13 14:09:07 -04:00
Rich Megginson
5a5bfa2c70 Added support to IPA server install to install the winsync plugin configuration entry Added support to ipa-replica-manage to add winsync agreements. I mostly used the existing code for setting up replication agreements since replication and winsync are quite similar in their configuration. I just had to add some extra attributes to the sync agreement configuration. The tricky part was importing the Windows CA cert. 2008-10-13 14:09:07 -04:00
Rich Megginson
2a2bc851bd The library name is libipa_winsync not libipa-winsync 2008-10-13 14:09:06 -04:00
Rich Megginson
434f9aca6a Use dirsrv/file.h with includes by default - only use the other style if we are debugging within the directory server 2008-10-13 14:09:05 -04:00
Rich Megginson
4bc89c427e fix some memory leaks 2008-10-13 14:09:04 -04:00
Rich Megginson
c80ecc8c2a Added ipa-winsync-config.c - this handles dynamic configuration via the DSE callbacks, and gets default values from various configuration entries in the IPA tree 2008-10-13 14:09:04 -04:00
Rich Megginson
61b5a95dd1 Added support for posixAccount -lookup attribute containing the homeDirectory prefix and use that to construct the homeDirectory attribute -lookup attribute containing the default gidNumber and use that to add the gidNumber to new users -construct the gecos field from the cn attribute 2008-10-13 14:09:03 -04:00
Rich Megginson
6454956d51 Added the new IPA WinSync Plug-in Work done so far * added the new plugin to makefiles, spec file * added stubs for the api, including begin update, end update, and destroy callbacks * added config code to allow dynamic dse config changes and auto-discovery of realm and new user objectclass list 2008-10-13 14:09:03 -04:00
Rich Megginson
0951496593 Initial addition of ipa-winsync plugin 2008-10-13 14:09:02 -04:00
Martin Nagy
83fa46a706 ipa-pwpolicy: correctly compare minlife and maxlife Fixes: 463849 2008-10-08 16:44:51 +02:00
Martin Nagy
574ca532b5 Fix a typo in ipa-modgroup causing it to fail Fixes: 463567 2008-10-08 16:44:51 +02:00
Martin Nagy
9b8f7b1eac ipa-change-master-key: Really exit when not run as root Also fix this for ipa-fix-CVE-2008-3274 2008-09-24 20:09:35 +02:00
Rob Crittenden
4d8a255c06 Fix segfault in ipa-getkeytab
463548
2008-09-24 18:04:28 -04:00
Rob Crittenden
7b799d8c6f Fix class declaration to work with Python 2.4 2008-09-19 23:09:59 -04:00
Martin Nagy
a62b85a233 Fix architecture detection in ldapupdate 2008-09-19 17:25:05 +02:00
Rob Crittenden
ca07cdb390 Add detection to the update tool to detect when it would apply changes.
Remove SUP name from RFC2307bis.update to match FDS
2008-09-19 18:04:40 -04:00
Simo Sorce
b4938f5e35 Fix syntax error 2008-09-18 17:23:13 -04:00
Simo Sorce
f6cd489909 We were assuming that, if the realm was correct then also the
rest of the krb5.conf configuration were. This clearly breaks
with the default EXAMPLE.COM realm configuratrion. Furthermore
it makes it not possible to try to 'fix' an installation by
rerruninng ipa-client-install

This patch removes the special case and avoids krb5.conf only
if the on_master flag is passed.
Fix also one inner 'if' statement to be simpler to understand.
2008-09-18 17:23:12 -04:00
Simo Sorce
bc70a5146f Remove reference to very unlikely service examples that are not
currently kerberized (and may never be due to their nature).
2008-09-18 17:23:12 -04:00
Martin Nagy
8683c23e9d Restart httpd and dirsrv services after yum upgrade.
Fixes: 441566
2008-09-17 23:06:33 +02:00
Martin Nagy
1913996584 Don't try to discover servers if we specified them on command line. 2008-09-17 23:06:23 +02:00
Martin Nagy
1634e09973 Add standard override options to ipa-replica-prepare
Fixes: 462489
2008-09-17 23:06:18 +02:00
Rob Crittenden
00d54a5668 Move the bulk of ipa-ldap-updater into a python library.
This significantly simplifies the tool and makes it possible to apply
updates from the installer without forking off another process.
2008-09-17 20:56:18 -04:00
Rob Crittenden
f736253b93 Run the LDAP updater at the end of the installation process.
Running at the end ensures that /etc/ipa/ipa.conf is created and generally
makes it more likely to succeed.

Added a new argument to ipa-server-installl, -y <password_file>, so we
don't have to pass it on the command-line.
2008-09-17 20:56:08 -04:00
Rob Crittenden
aa8c4a53bf Allow passwords to work without a tty ala: echo password | some_program 2008-09-17 20:56:03 -04:00
Rob Crittenden
661dee8c03 Add more development packages to test for 2008-09-12 20:37:36 -04:00
Rob Crittenden
88960f1597 Sort updates by DN length and by default process all files in the updates dir.
The updates directory is currently hardcoded to /usr/share/ipa/updates.

All of the files are read into memory and then sorted by the length of the DN.
This is so we can be sure that parent entries are added before children.

Also add a man page.
2008-09-12 20:07:48 -04:00
Rob Crittenden
1eec34393b Update files for the schema compatibility plugin and RFC4876 profiles
Also handle syntax errors a bit more gracefully and allow the updater to
work on more than one file at a time.

Adjust to new config.py and use a custom exception class for syntax errors.

Also fix a error in parsing the separate files

Include slapi-nis in Requires

Includes work provided by Martin Nagy

460055
2008-09-12 20:07:41 -04:00
Rob Crittenden
ec57bc3e44 Tool for doing configuration updates over LDAP
This tool takes as input a file which contains basically an LDIF, prefixed
with a command: default, add, remove or only. These define the operations
to perform such as adding new entries, adding new sub-entries to an existing
entry, adding or modifying attributes in a record.

If an index entry is modified a task is created to re-create the index.

Schema may be added using this tool.

454031
2008-09-12 20:06:46 -04:00
Rob Crittenden
d33b7fc839 The True/False logic was reversed, so "no" meant remove the existing instance 2008-09-12 19:38:48 -04:00
Rob Crittenden
567bab9850 Fix error where usage wasn't being updated properly 2008-09-12 18:14:22 -04:00
Martin Nagy
b5ee09c097 Fix spelling. 2008-09-12 00:03:50 +02:00
Martin Nagy
f33c57e6f8 Fix the -G option of ipa-adduser. Don't add the user if one of the groups doesn't exist. Fixes: 459801 2008-09-11 23:39:28 +02:00
Martin Nagy
fa019e932d Ignore GSS exception when iterating through server list. Fixes: 459864 2008-09-11 23:38:41 +02:00
Martin Nagy
a9e8a72059 Try servers from ipa.conf even if we specified them on the command line. 2008-09-11 23:34:01 +02:00
Martin Nagy
7206a6d43c More strict input checks in ipa-pwpolicy and return non-zero when unsuccessful. Fixes: 461213, 461325, 461332, 461543 2008-09-11 23:34:01 +02:00
Martin Nagy
885103c321 Rework config.py and change cli tools. Maintain order of IPA servers from command line, config and DNS. Parse options before detecting IPA configuration. Don't ignore rest of the options if one is missing in ipa.conf. Drop the --usage options, we will rely on --help. Fixes: 458869, 459070, 458980, 459234 2008-09-11 23:34:01 +02:00