IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
6,842 Commits 11 Branches 60 Tags
f39f4aaae2fef6de6a8312dcc652bcaa5766b22b
Commit Graph

666 Commits

Author SHA1 Message Date
Jan Cholasta
50c7f3b236 Fix update_ca_renewal_master plugin on CA-less installs. 
This also fixes updates from ancient versions of IPA which did not have
automatic CA subsystem certificate renewal.

https://fedorahosted.org/freeipa/ticket/4294

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-10 16:40:10 +02:00
Petr Viktorin
41607774bc Add mechanism for adding default permissions to privileges 
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-10 14:49:16 +02:00
Petr Viktorin
c58d6b2689 Allow overriding all attributes of default permissions 
Allow overriding ipapermtarget, ipapermtargetfilter, ipapermlocation,
objectclass of default managed permissions.
This allows defining permissions that are not tied to an object type.
Default values are same as before.

Also, do not reset ipapermbindruletype when updating an existing
managed permission.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-09 13:40:42 +02:00
Petr Viktorin
fb2f0ae8d5 Document the managed permission updater operation 
The method was explained on the [Design] page, but as the updater
is extended the design page would become obsolete.
Document the operation in the docstring of the plugin itself.

Design: http://www.freeipa.org/page/V3/Managed_Read_permissions#Default_Permission_Updater
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-09 13:40:42 +02:00
Jan Cholasta
915cd6942c Fix upload of CA certificate to LDAP in CA-less install. 
https://fedorahosted.org/freeipa/ticket/4300

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-08 14:04:40 +02:00
Jan Cholasta
0497d163d9 Remove unused method is_master of CAInstance. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:56 +01:00
Jan Cholasta
fd5ef28bf2 Use the same certmonger configuration for both CA masters and clones. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
fac6bf30b6 Merge restart_httpd functionality to renew_ra_cert. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
2c466b79e8 Merge restart_pkicad functionality to renew_ca_cert and remove restart_pkicad. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
b5d082ec4d Make the default dogtag-ipa-ca-renew-agent behavior depend on CA setup. 
On CA masters, a certificate is requested and stored to LDAP. On CA clones,
the certificate is retrieved from LDAP.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
c3169add3b Store information about which CA server is master for renewals in LDAP. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
6a19738a45 Use dogtag-ipa-ca-renew-agent to track certificates on master CA. 
Before, dogtag-ipa-renew-agent was used to track the certificates and the
certificates were stored to LDAP in renew_ca_cert and renew_ra_cert. Since
dogtag-ipa-ca-renew-agent can store the certificates itself, the storage code
was removed from renew_ca_cert and renew_ra_cert.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
babddaaee8 Use dogtag-ipa-ca-renew-agent to retrieve renewed certificates from LDAP. 
Before, this was done by dogtag-ipa-retrieve-agent-submit.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:55 +01:00
Jan Cholasta
57f0be7b5d Use certmonger D-Bus API to configure certmonger in CA install. 
Before, certmonger was configured by modifying its internal database directly.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
def727ce56 Show progress when enabling SSL in DS in ipa-server-install output. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
51caf48ed9 Remove unused method export_ca_cert of dsinstance. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
9b3055ca41 Upload CA certificate from DS NSS database in CA-less server install. 
Before, the file provided in the --root-ca-file option was used directly for
the upload. However, it is the same file which is imported to the NSS
database, so the second code path is not necessary.

Also removed now unused upload_ca_dercert method of dsinstance.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
48539b35d7 Use LDAP API to upload CA certificate instead of ldapmodify command. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
fea7163e87 Move CACERT definition to a single place. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Jan Cholasta
4c761108e8 Fix certificate renewal scripts to work with separate CA DS instance. 
https://fedorahosted.org/freeipa/ticket/3805

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Petr Viktorin
f4de4a2aa7 Add Object metadata and update plugin for managed permissions 
The default read permission is added for Netgroup as an example.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Managed_Read_permissions
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-03-25 14:18:12 +01:00
Petr Viktorin
7c9fa8fad9 ipaserver.install.service: Fix estimated time display 
Use basic math rather than timezone conversion to get
minutes and seconds.
Break out the message generation into a small tested function.

https://fedorahosted.org/freeipa/ticket/4242

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-03-13 18:15:43 +01:00
Martin Kosek
0be66e9a67 ipa-replica-install never checks for 7389 port 
When creating replica from a Dogtag 9 based IPA server, the port 7389
which is required for the installation is never checked by
ipa-replica-conncheck even though it knows that it is being installed
from the Dogtag 9 based FreeIPA. If the 7389 port would be blocked by
firewall, installation would stuck with no hint to user.

Make sure that the port configuration parsed from replica info file
is used consistently in the installers.

https://fedorahosted.org/freeipa/ticket/4240

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-11 17:10:28 +01:00
Alexander Bokovoy
e99fa380af adtrustinstance: make sure to stop and disable winbind in uninstall() 
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-02-28 09:50:14 +01:00
Alexander Bokovoy
090a9669d8 bindinstance: make sure zone manager is initialized in add_master_dns_records 
Bind instance is configured using a short-circuited way when replica is set up.
Make sure required properties are in place for that.

https://fedorahosted.org/freeipa/ticket/4186

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-02-26 12:44:56 +01:00
Petr Spacek
dd55e13aa9 Clarify error message about missing DNS component in ipa-replica-prepare. 
https://fedorahosted.org/freeipa/ticket/4188

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-02-21 16:04:20 +01:00
Nathaniel McCallum
49038cda9f Add OTP last token plugin 
This plugin prevents the deletion or deactivation of the last
valid token for a user. This prevents the user from migrating
back to single factor authentication once OTP has been enabled.

Thanks to Mark Reynolds for helping me with this patch.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-02-21 10:26:02 +01:00
Nathaniel McCallum
abb63ed9d1 Add HOTP support 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-02-21 10:26:02 +01:00
Petr Spacek
c919363538 Remove working directory for bind-dyndb-ldap plugin. 
The working directory will be provided directly
by bind-dyndb-ldap package.

This partially reverts commit 689382dc83.

https://fedorahosted.org/freeipa/ticket/3967
 2014-01-27 16:04:33 +01:00
Jan Cholasta
97c1c95f20 Convert remaining update code to LDAPEntry API. 2014-01-24 20:29:31 +01:00
Jan Cholasta
08051f1651 Convert remaining installer code to LDAPEntry API. 2014-01-24 20:29:31 +01:00
Martin Kosek
b7f1531262 httpd should destroy all CCACHEs 
Use "kdestroy -A" command to destroy all CCACHEs, both the primary
and the non-primary ones to make sure that the non-primary ones are
not used later.

https://fedorahosted.org/freeipa/ticket/4084
 2014-01-22 17:00:46 +01:00
Martin Kosek
f49c26db2c Switch httpd to use default CCACHE 
Stock httpd no longer uses systemd EnvironmentFile option which is
making FreeIPA's KRB5CCNAME setting ineffective. This can lead in hard
to debug problems during subsequent ipa-server-install's where HTTP
may use a stale CCACHE in the default kernel keyring CCACHE.

Avoid forcing custom CCACHE and switch to system one, just make sure
that it is properly cleaned by kdestroy run as "apache" user during
FreeIPA server installation process.

https://fedorahosted.org/freeipa/ticket/4084
 2014-01-22 10:14:05 +01:00
Alexander Bokovoy
531ede2904 ipa-adtrust-install: configure host netbios name by default 
Ensure we set host netbios name by default in smb.conf

https://fedorahosted.org/freeipa/ticket/4116
 2014-01-20 10:35:03 +01:00
Petr Spacek
79fa073411 Treat error during write to /etc/resolv.conf as non-fatal. 
https://fedorahosted.org/freeipa/ticket/4110
 2014-01-16 17:04:40 +01:00
Jan Cholasta
7ce3320996 Do not start the service in stopped_service if it was not running before. 
This fixes a possible NSS database corruption in renew_ca_cert.
 2014-01-15 17:44:10 +01:00
Alexander Bokovoy
cb411ff94e ipaserver/install/installutils: clean up properly after yield 
When a context to which we yield generates exception, the code in
private_ccache() and stopped_service() didn't get called for cleanup.
 2014-01-15 17:44:10 +01:00
Ana Krivokapic
689382dc83 Enable Retro Changelog and Content Synchronization DS plugins 
Enable Retro Changelog and Content Synchronization DS plugins which are required
for SyncRepl support.

Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+.

https://fedorahosted.org/freeipa/ticket/3967
 2014-01-14 16:37:56 +01:00
Jan Cholasta
f7128b9c03 Use raw LDAP data in ldapupdate. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:40 +01:00
Jan Cholasta
4284a8349b Remove legacy LDAPEntry properties data and orig_data. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta
61887ac392 Add LDAPEntry method generate_modlist. 
Use LDAPEntry.generate_modlist instead of LDAPClient._generate_modlist and
remove LDAPClient._generate_modlist.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta
9d4bcb63de Reduce amount of LDAPEntry.reset_modlist calls in ldapupdate. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta
21fab665f4 Use LDAPClient.update_entry for LDAP mods in ldapupdate. 
Remove legacy IPAdmin methods generateModList and updateEntry.

https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:41:39 +01:00
Jan Cholasta
7b3d9be388 Rename LDAPEntry method commit to reset_modlist. 
https://fedorahosted.org/freeipa/ticket/3488
 2014-01-10 14:38:29 +01:00
Jan Cholasta
911f5e9eb7 PKI service restart after CA renewal failed 
Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092
 2014-01-08 09:47:23 +01:00
Xiao-Long Chen
5e96fbc22a Use /usr/bin/python2 
Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com
 2014-01-03 09:46:05 +01:00
Martin Kosek
9677308caa Allow kernel keyring CCACHE when supported 
Server and client installer should allow kernel keyring ccache when
supported.

https://fedorahosted.org/freeipa/ticket/4013
 2013-12-09 12:21:22 +01:00
Tomas Babej
d361e12ae5 trusts: Always stop and disable smb service on uninstall 
https://fedorahosted.org/freeipa/ticket/4042
 2013-11-26 15:23:42 +01:00
Jan Cholasta
f20577ddc4 Remove mod_ssl port workaround. 
https://fedorahosted.org/freeipa/ticket/4021
 2013-11-26 12:58:17 +01:00
Petr Viktorin
ec1585f831 Add formerly update-only schema 
Some schema was only delivered in updates. Add it back as ldif files.

https://fedorahosted.org/freeipa/ticket/3454
 2013-11-18 16:54:21 +01:00