Rob Crittenden 202de166c6 Run HSM validation as pkiuser to verify token permissions ...

Run all commands as pkiuser when validating that the HSM token
is available, that the token library path is correct and that
the password can read keys. This will avoid issues where the
initial validation is ok but the pkiuser is not granted read
access to some part of the token. This is very possible
when using softhsm2.

Fixes: https://pagure.io/freeipa/issue/9626

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>

2024-07-31 18:33:29 +02:00

..

plugins

ipasam: make krbtgt TDO principal canonical

2024-01-23 13:19:37 +01:00

server

Re-organize HSM validation to be more consistent/less duplication

2024-07-12 13:53:25 -04:00

__init__.py

Remove __all__ specifications in ipaclient and ipaserver.install

2013-09-06 15:42:33 +02:00

adtrust.py

adtrust install: define constants for rid bases

2021-11-02 10:11:28 +01:00

adtrustinstance.py

adtrustinstance: make sure NetBIOS name defaults are set properly

2024-01-17 19:32:47 +01:00

bindinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

ca.py

Run HSM validation as pkiuser to verify token permissions

2024-07-31 18:33:29 +02:00

cainstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

certs.py

Add token support to installer certificate handling

2024-05-16 08:46:32 -04:00

conncheck.py

install: introduce installer class hierarchy

2016-11-11 12:17:25 +01:00

custodiainstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

dns.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

dnskeysyncinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

dogtag.py

Verify pki ini override early

2019-04-10 13:43:23 +02:00

dogtaginstance.py

Don't generate a cafile on HSM instalations

2024-05-16 08:46:32 -04:00

dsinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

httpinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

installutils.py

pylint: Fix used-before-assignment

2023-01-10 08:30:58 +01:00

ipa_acme_manage.py

ACME: Don't treat pki-server ca-config-show failures as fatal

2024-01-10 13:35:51 -05:00

ipa_backup.py

Use a unique task name for each backend in ipa-backup

2024-06-06 15:09:46 -04:00

ipa_cacert_manage.py

Compatibility fix for PyCA cryptography 42.0.0

2024-01-24 14:54:24 +01:00

ipa_cert_fix.py

Compatibility fix for PyCA cryptography 42.0.0

2024-01-24 14:54:24 +01:00

ipa_crlgen_manage.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

ipa_kra_install.py

Add HSM configuration options to installer scripts

2024-05-16 08:46:32 -04:00

ipa_ldap_updater.py

Remove -s option from ipa-ldap-updater usage

2021-05-20 14:45:27 -04:00

ipa_migrate_constants.py

IPA-to-IPA migration tool (beta)

2024-04-04 15:49:42 -04:00

ipa_migrate.py

ipa-migrate - properly handle invalid certificates

2024-07-31 18:13:53 +02:00

ipa_otptoken_import.py

ipa-otptoken-import: open the key file in binary mode

2024-06-17 14:49:39 -04:00

ipa_pkinit_manage.py

Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server

2021-06-17 17:28:48 -04:00

ipa_replica_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_restore.py

ipa-restore: adapt for 389-ds switch to LMDB

2024-02-23 14:11:25 +01:00

ipa_server_certinstall.py

Require an ipa-ca SAN on 3rd party certs if ACME is enabled

2020-11-02 14:01:05 -05:00

ipa_server_install.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

ipa_server_upgrade.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipa_subids.py

pylint: Fix arguments-renamed

2022-03-11 13:37:08 -05:00

ipa_trust_enable_agent.py

ipa-adtrust-install: run remote configuration for new agents

2020-03-05 14:40:58 +01:00

ipa_winsync_migrate.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipactl.py

pylint: Fix useless-suppression

2022-03-11 13:37:08 -05:00

kra.py

Re-organize HSM validation to be more consistent/less duplication

2024-07-12 13:53:25 -04:00

krainstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

krbinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

ldapupdate.py

pylint: remove useless suppression

2023-01-10 08:30:58 +01:00

odsexporterinstance.py

odsexporterinstance: use late binding for UID/GID resolution

2020-12-22 14:05:13 +02:00

opendnssecinstance.py

Clean up more files and directories created by the installer(s)

2024-06-26 07:40:54 +02:00

otpdinstance.py

Enable pylint missing-final-newline check

2015-12-23 07:59:22 +01:00

replication.py

check_repl_update: in progress is a boolean

2022-08-16 08:39:06 +02:00

schemaupdate.py

Unify access to FQDN

2020-10-26 17:11:19 +11:00

service.py

LDAP autobind authenticateAsDN for BIND named

2021-06-15 14:13:16 +03:00

sysupgrade.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

upgradeinstance.py

Use get_replication_plugin_name in LDAP updater

2021-06-21 10:58:02 +02:00