mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-03 12:48:53 -06:00
Alexander Bokovoy
cc763d78cc
When full 32-bit ID range usage is required, subordinate ID support have to be disabled. However, even if ID range for subordinate IDs were to be removed, it will be restored during the next data upgrade. Change upgrade code to only apply subID range creation when subID support is enabled. Do not allow allocating subIDs if their use is disabled. Allow full 32-bit uidNumber/gidNumber values in JSON payload. Fixes: https://pagure.io/freeipa/issue/9757 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
IPA platform abstraction
The ipaplatform package provides an abstraction layer for
supported Linux distributions and flavors. The package contains
constants, paths to commands and config files, services, and tasks.
- base abstract base platform
- debian Debian- and Ubuntu-like
- redhat abstract base for Red Hat platforms
- fedora Fedora
- fedora_container freeipa-container on Fedora
- rhel RHEL and CentOS
- rhel_container freeipa-container on RHEL and CentOS
- suse OpenSUSE and SLES
[base]
├─ debian
├─[redhat]
│ ├─ fedora
│ │ └─ fedora_container
│ └─ rhel
│ └─ rhel_container
└─ suse
(Note: Debian and SUSE use some definitions from Red Hat namespace.)
freeipa-container platform
The fedora_container and rhel_container platforms are flavors
of the fedora and rhel platforms. These platform definitions
are specifically designed for
freeipa-container.
The FreeIPA server container implements a read-only container. Paths
like /etc, /usr, and /var are mounted read-only and cannot
be modified. The image uses symlinks to store all variable data like
config files and LDAP database in /data.
- Some commands don't write through dangling symlinks. The IPA
platforms for containers prefix some paths with
/data. ipa-server-upgradeverifies that the platform does not change between versions. To allow upgrades of old containers, sysupgrade maps$distro_containerto$distroplatform.- The container images come with authselect pre-configured with
sssd with-sudooption. The tasksmodify_nsswitch_pam_stackandmigrate_auth_configurationare no-ops.ipa-restoredoes not restore authselect settings.ipa-backupstill stores authselect settings in backup data. - The
--mkhomediroption is not supported.