mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-13 01:31:56 -06:00
ba0da01c1d
The project's history is kept in Git. We used the spec changelog for changes to the spec itself, which doesn't make much sense. Downstreams like Fedora use their own changelog anyway. A single entry is left for tools that expect a changelog.
845 lines
30 KiB
RPMSpec
845 lines
30 KiB
RPMSpec
# Define ONLY_CLIENT to only make the ipa-client and ipa-python subpackages
|
|
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
|
|
|
|
%global plugin_dir %{_libdir}/dirsrv/plugins
|
|
%global POLICYCOREUTILSVER 2.1.12-5
|
|
%global gettext_domain ipa
|
|
|
|
Name: freeipa
|
|
Version: __VERSION__
|
|
Release: __RELEASE__%{?dist}
|
|
Summary: The Identity, Policy and Audit system
|
|
|
|
Group: System Environment/Base
|
|
License: GPLv3+
|
|
URL: http://www.freeipa.org/
|
|
Source0: freeipa-%{version}.tar.gz
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
BuildRequires: 389-ds-base-devel >= 1.3.1.3
|
|
BuildRequires: svrcore-devel
|
|
BuildRequires: policycoreutils >= %{POLICYCOREUTILSVER}
|
|
BuildRequires: systemd-units
|
|
%if 0%{?fedora} >= 18
|
|
BuildRequires: samba-devel >= 2:4.0.5-1
|
|
BuildRequires: samba-python
|
|
BuildRequires: libwbclient-devel
|
|
%else
|
|
BuildRequires: samba4-devel >= 4.0.0-139
|
|
BuildRequires: samba4-python
|
|
%endif
|
|
BuildRequires: libtalloc-devel
|
|
BuildRequires: libtevent-devel
|
|
%endif # ONLY_CLIENT
|
|
BuildRequires: nspr-devel
|
|
BuildRequires: nss-devel
|
|
BuildRequires: openssl-devel
|
|
BuildRequires: openldap-devel
|
|
BuildRequires: krb5-devel >= 1.11
|
|
BuildRequires: krb5-workstation
|
|
BuildRequires: libuuid-devel
|
|
BuildRequires: libcurl-devel >= 7.21.7-2
|
|
BuildRequires: xmlrpc-c-devel >= 1.27.4
|
|
BuildRequires: popt-devel
|
|
BuildRequires: autoconf
|
|
BuildRequires: automake
|
|
BuildRequires: m4
|
|
BuildRequires: libtool
|
|
BuildRequires: gettext
|
|
BuildRequires: python-devel
|
|
BuildRequires: python-ldap
|
|
BuildRequires: python-setuptools
|
|
BuildRequires: python-krbV
|
|
BuildRequires: python-nss
|
|
BuildRequires: python-netaddr
|
|
BuildRequires: python-kerberos
|
|
BuildRequires: python-rhsm
|
|
BuildRequires: pyOpenSSL
|
|
BuildRequires: pylint
|
|
BuildRequires: python-polib
|
|
BuildRequires: libipa_hbac-python
|
|
BuildRequires: python-memcached
|
|
BuildRequires: sssd >= 1.9.2
|
|
BuildRequires: python-lxml
|
|
BuildRequires: python-pyasn1 >= 0.0.9a
|
|
BuildRequires: python-dns
|
|
BuildRequires: m2crypto
|
|
BuildRequires: check
|
|
BuildRequires: libsss_idmap-devel
|
|
BuildRequires: libsss_nss_idmap-devel
|
|
BuildRequires: java-1.7.0-openjdk
|
|
BuildRequires: libverto-devel
|
|
BuildRequires: systemd
|
|
BuildRequires: libunistring-devel
|
|
|
|
# Find out Kerberos middle version to infer ABI changes in DAL driver
|
|
# We cannot load DAL driver into KDC with wrong ABI.
|
|
# This is also needed to support ipa-devel repository where krb5 1.11 is available for F18
|
|
%global krb5_dal_version %{expand:%(echo "#include <kdb.h>"|cpp -dM|grep KRB5_KDB_DAL_MAJOR_VERSION|cut -d' ' -f3)}
|
|
|
|
%description
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof).
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%package server
|
|
Summary: The IPA authentication server
|
|
Group: System Environment/Base
|
|
Requires: %{name}-python = %{version}-%{release}
|
|
Requires: %{name}-client = %{version}-%{release}
|
|
Requires: %{name}-admintools = %{version}-%{release}
|
|
Requires: 389-ds-base >= 1.3.1.3
|
|
Requires: openldap-clients > 2.4.35-4
|
|
%if 0%{?fedora} == 18
|
|
Requires: nss >= 3.14.3-2
|
|
Requires: nss-tools >= 3.14.3-2
|
|
%else
|
|
Requires: nss >= 3.14.3-12.0
|
|
Requires: nss-tools >= 3.14.3-12.0
|
|
%endif
|
|
%if 0%{?krb5_dal_version} >= 4
|
|
Requires: krb5-server >= 1.11.2-1
|
|
%else
|
|
%if 0%{krb5_dal_version} == 3
|
|
# krb5 1.11 bumped DAL interface major version, a rebuild is needed
|
|
Requires: krb5-server < 1.11
|
|
Requires: krb5-server >= 1.10
|
|
%else
|
|
Requires: krb5-server >= 1.10
|
|
%endif
|
|
%endif
|
|
Requires: krb5-pkinit-openssl
|
|
Requires: cyrus-sasl-gssapi%{?_isa}
|
|
Requires: ntp
|
|
Requires: httpd >= 2.4.6-6
|
|
Requires: mod_wsgi
|
|
%if 0%{?fedora} >= 18
|
|
Requires: mod_auth_kerb >= 5.4-16
|
|
%else
|
|
Requires: mod_auth_kerb >= 5.4-8
|
|
%endif
|
|
Requires: mod_nss >= 1.0.8-26
|
|
Requires: python-ldap
|
|
Requires: python-krbV
|
|
Requires: acl
|
|
Requires: python-pyasn1
|
|
Requires: memcached
|
|
Requires: python-memcached
|
|
Requires: systemd-units >= 38
|
|
Requires(pre): systemd-units
|
|
Requires(post): systemd-units
|
|
Requires: selinux-policy >= 3.12.1-65
|
|
Requires(post): selinux-policy-base
|
|
Requires: slapi-nis >= 0.47.7
|
|
Requires: pki-ca >= 10.0.4
|
|
Requires: dogtag-pki-server-theme
|
|
%if 0%{?rhel}
|
|
Requires: subscription-manager
|
|
%endif
|
|
Requires(preun): python systemd-units
|
|
Requires(postun): python systemd-units
|
|
Requires: python-dns
|
|
Requires: zip
|
|
Requires: policycoreutils >= %{POLICYCOREUTILSVER}
|
|
Requires: tar
|
|
Requires(pre): certmonger >= 0.65
|
|
Requires(pre): 389-ds-base >= 1.3.1.3
|
|
|
|
# With FreeIPA 3.3, package freeipa-server-selinux was obsoleted as the
|
|
# entire SELinux policy is stored in the system policy
|
|
Obsoletes: freeipa-server-selinux < 3.3.0
|
|
|
|
# We have a soft-requires on bind. It is an optional part of
|
|
# IPA but if it is configured we need a way to require versions
|
|
# that work for us.
|
|
%if 0%{?fedora} >= 18
|
|
Conflicts: bind-dyndb-ldap < 3.5
|
|
%else
|
|
Conflicts: bind-dyndb-ldap < 1.1.0-0.12.rc1
|
|
%endif
|
|
Conflicts: bind < 9.8.2-0.4.rc2
|
|
|
|
# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to
|
|
# member.
|
|
Conflicts: nss-pam-ldapd < 0.8.4
|
|
|
|
Obsoletes: ipa-server >= 1.0
|
|
|
|
%description server
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof). If you are installing an IPA server you need
|
|
to install this package (in other words, most people should NOT install
|
|
this package).
|
|
|
|
|
|
%package server-trust-ad
|
|
Summary: Virtual package to install packages required for Active Directory trusts
|
|
Group: System Environment/Base
|
|
Requires: %{name}-server = %version-%release
|
|
Requires: m2crypto
|
|
%if 0%{?fedora} >= 18
|
|
Requires: samba-python
|
|
Requires: samba >= 2:4.0.5-1
|
|
Requires: samba-winbind
|
|
%else
|
|
Requires: samba4-python
|
|
Requires: samba4
|
|
Requires: samba4-winbind
|
|
%endif
|
|
Requires: libsss_idmap
|
|
%if 0%{?fedora} >= 19
|
|
Requires: libsss_nss_idmap-python
|
|
%endif
|
|
# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5
|
|
# on the installes where server-trust-ad subpackage is installed because
|
|
# IPA AD trusts cannot be used at the same time with the locator plugin
|
|
# since Winbindd will be configured in a different mode
|
|
Requires(post): %{_sbindir}/update-alternatives
|
|
Requires(post): python
|
|
Requires(postun): %{_sbindir}/update-alternatives
|
|
Requires(preun): %{_sbindir}/update-alternatives
|
|
|
|
%description server-trust-ad
|
|
Cross-realm trusts with Active Directory in IPA require working Samba 4
|
|
installation. This package is provided for convenience to install all required
|
|
dependencies at once.
|
|
|
|
%endif # ONLY_CLIENT
|
|
|
|
|
|
%package client
|
|
Summary: IPA authentication for use on clients
|
|
Group: System Environment/Base
|
|
Requires: %{name}-python = %{version}-%{release}
|
|
Requires: python-ldap
|
|
Requires: cyrus-sasl-gssapi%{?_isa}
|
|
Requires: ntp
|
|
Requires: krb5-workstation
|
|
Requires: authconfig
|
|
Requires: pam_krb5
|
|
Requires: wget
|
|
Requires: libcurl >= 7.21.7-2
|
|
Requires: xmlrpc-c >= 1.27.4
|
|
Requires: sssd >= 1.11.1
|
|
Requires: certmonger >= 0.65
|
|
Requires: nss-tools
|
|
Requires: bind-utils
|
|
Requires: oddjob-mkhomedir
|
|
Requires: python-krbV
|
|
Requires: python-dns
|
|
Requires: libsss_autofs
|
|
Requires: autofs
|
|
Requires: libnfsidmap
|
|
Requires: nfs-utils
|
|
Requires(post): policycoreutils
|
|
|
|
Obsoletes: ipa-client >= 1.0
|
|
|
|
%description client
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof). If your network uses IPA for authentication,
|
|
this package should be installed on every client machine.
|
|
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%package admintools
|
|
Summary: IPA administrative tools
|
|
Group: System Environment/Base
|
|
Requires: %{name}-python = %{version}-%{release}
|
|
Requires: %{name}-client = %{version}-%{release}
|
|
Requires: python-krbV
|
|
Requires: python-ldap
|
|
|
|
Obsoletes: ipa-admintools >= 1.0
|
|
|
|
%description admintools
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof). This package provides command-line tools for
|
|
IPA administrators.
|
|
%endif # ONLY_CLIENT
|
|
|
|
%package python
|
|
Summary: Python libraries used by IPA
|
|
Group: System Environment/Libraries
|
|
Requires: python-kerberos
|
|
Requires: gnupg
|
|
Requires: iproute
|
|
Requires: keyutils
|
|
Requires: pyOpenSSL
|
|
Requires: python-nss
|
|
Requires: python-lxml
|
|
Requires: python-netaddr
|
|
Requires: libipa_hbac-python
|
|
|
|
Obsoletes: ipa-python >= 1.0
|
|
|
|
%description python
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof). If you are using IPA you need to install this
|
|
package.
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%package tests
|
|
Summary: IPA tests and test tools
|
|
Requires: %{name}-client = %{version}-%{release}
|
|
Requires: %{name}-python = %{version}-%{release}
|
|
Requires: tar
|
|
Requires: xz
|
|
Requires: python-nose
|
|
Requires: python-paste
|
|
Requires: python-coverage
|
|
Requires: python-polib
|
|
Requires: python-paramiko >= 1.7.7
|
|
|
|
%description tests
|
|
IPA is an integrated solution to provide centrally managed Identity (machine,
|
|
user, virtual machines, groups, authentication credentials), Policy
|
|
(configuration settings, access control information) and Audit (events,
|
|
logs, analysis thereof).
|
|
This package contains tests that verify IPA functionality.
|
|
|
|
%endif # ONLY_CLIENT
|
|
|
|
|
|
%prep
|
|
%setup -n freeipa-%{version} -q
|
|
|
|
%build
|
|
export CFLAGS="$CFLAGS %{optflags}"
|
|
export CPPFLAGS="$CPPFLAGS %{optflags}"
|
|
%if 0%{?fedora} >= 19
|
|
export SUPPORTED_PLATFORM=fedora19
|
|
%else
|
|
%if 0%{?fedora} >= 18
|
|
# use fedora18 platform which is based on fedora16 platform with systemd
|
|
# support + fedora18 changes
|
|
export SUPPORTED_PLATFORM=fedora18
|
|
%else
|
|
export SUPPORTED_PLATFORM=fedora16
|
|
%endif
|
|
%endif
|
|
# Force re-generate of platform support
|
|
rm -f ipapython/services.py
|
|
make version-update
|
|
cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
|
|
%if ! %{ONLY_CLIENT}
|
|
cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..
|
|
cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
|
|
%endif # ONLY_CLIENT
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
|
|
%else
|
|
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
|
|
%endif # ONLY_CLIENT
|
|
|
|
%install
|
|
rm -rf %{buildroot}
|
|
%if 0%{?fedora} >= 19
|
|
export SUPPORTED_PLATFORM=fedora19
|
|
%else
|
|
%if 0%{?fedora} >= 18
|
|
# use fedora18 platform which is based on fedora16 platform with systemd
|
|
# support + fedora18 changes
|
|
export SUPPORTED_PLATFORM=fedora18
|
|
%else
|
|
export SUPPORTED_PLATFORM=fedora16
|
|
%endif
|
|
%endif
|
|
# Force re-generate of platform support
|
|
rm -f ipapython/services.py
|
|
%if ! %{ONLY_CLIENT}
|
|
make install DESTDIR=%{buildroot}
|
|
%else
|
|
make client-install DESTDIR=%{buildroot}
|
|
%endif # ONLY_CLIENT
|
|
%find_lang %{gettext_domain}
|
|
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
# Remove .la files from libtool - we don't want to package
|
|
# these files
|
|
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
|
|
rm %{buildroot}/%{plugin_dir}/libipa_range_check.la
|
|
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
|
|
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
|
|
|
|
# Some user-modifiable HTML files are provided. Move these to /etc
|
|
# and link back.
|
|
mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html
|
|
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore
|
|
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysupgrade
|
|
mkdir %{buildroot}%{_usr}/share/ipa/html/
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig.js \
|
|
%{buildroot}%{_usr}/share/ipa/html/ffconfig.js
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig_page.js \
|
|
%{buildroot}%{_usr}/share/ipa/html/ffconfig_page.js
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \
|
|
%{buildroot}%{_usr}/share/ipa/html/ssbrowser.html
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \
|
|
%{buildroot}%{_usr}/share/ipa/html/unauthorized.html
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \
|
|
%{buildroot}%{_usr}/share/ipa/html/browserconfig.html
|
|
ln -s ../../../..%{_sysconfdir}/ipa/html/ipa_error.css \
|
|
%{buildroot}%{_usr}/share/ipa/html/ipa_error.css
|
|
|
|
# So we can own our Apache configuration
|
|
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
|
|
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
|
|
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
|
|
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
|
|
mkdir -p %{buildroot}%{_usr}/share/ipa/html/
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/configure.jar
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
|
|
/bin/touch %{buildroot}%{_usr}/share/ipa/html/preferences.html
|
|
mkdir -p %{buildroot}%{_initrddir}
|
|
mkdir %{buildroot}%{_sysconfdir}/sysconfig/
|
|
install -m 644 init/ipa_memcached.conf %{buildroot}%{_sysconfdir}/sysconfig/ipa_memcached
|
|
|
|
# Web UI plugin dir
|
|
mkdir -p %{buildroot}%{_usr}/share/ipa/ui/js/plugins
|
|
|
|
# NOTE: systemd specific section
|
|
mkdir -p %{buildroot}%{_prefix}/lib/tmpfiles.d
|
|
install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_prefix}/lib/tmpfiles.d/%{name}.conf
|
|
# END
|
|
|
|
mkdir -p %{buildroot}%{_localstatedir}/run/
|
|
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/
|
|
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/
|
|
|
|
mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
|
|
touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
|
|
|
|
# NOTE: systemd specific section
|
|
mkdir -p %{buildroot}%{_unitdir}
|
|
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
|
|
install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
|
|
# END
|
|
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa/backup
|
|
%endif # ONLY_CLIENT
|
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}/ipa/
|
|
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
|
|
/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt
|
|
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
|
|
install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa
|
|
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
|
|
|
|
(cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f | \
|
|
grep -v dcerpc | grep -v adtrustinstance | \
|
|
sed -e 's,\.py.*$,.*,g' | sort -u | \
|
|
sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list
|
|
|
|
(cd %{buildroot}/%{python_sitelib}/ipatests && find . -type f | \
|
|
sed -e 's,\.py.*$,.*,g' | sort -u | \
|
|
sed -e 's,\./,%%{python_sitelib}/ipatests/,g' ) >tests-python.list
|
|
%endif # ONLY_CLIENT
|
|
|
|
%clean
|
|
rm -rf %{buildroot}
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%post server
|
|
# NOTE: systemd specific section
|
|
/bin/systemctl --system daemon-reload 2>&1 || :
|
|
# END
|
|
if [ $1 -gt 1 ] ; then
|
|
/bin/systemctl condrestart certmonger.service 2>&1 || :
|
|
fi
|
|
|
|
%posttrans server
|
|
# This must be run in posttrans so that updates from previous
|
|
# execution that may no longer be shipped are not applied.
|
|
/usr/sbin/ipa-ldap-updater --upgrade --quiet >/dev/null || :
|
|
/usr/sbin/ipa-upgradeconfig --quiet >/dev/null || :
|
|
|
|
# Restart IPA processes. This must be also run in postrans so that plugins
|
|
# and software is in consistent state
|
|
python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
|
|
# NOTE: systemd specific section
|
|
if [ $? -eq 0 ]; then
|
|
/bin/systemctl try-restart ipa.service >/dev/null 2>&1 || :
|
|
fi
|
|
# END
|
|
|
|
%preun server
|
|
if [ $1 = 0 ]; then
|
|
# NOTE: systemd specific section
|
|
/bin/systemctl --quiet stop ipa.service || :
|
|
/bin/systemctl --quiet disable ipa.service || :
|
|
# END
|
|
fi
|
|
|
|
%pre server
|
|
# Stop ipa_kpasswd if it exists before upgrading so we don't have a
|
|
# zombie process when we're done.
|
|
if [ -e /usr/sbin/ipa_kpasswd ]; then
|
|
# NOTE: systemd specific section
|
|
/bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :
|
|
# END
|
|
fi
|
|
|
|
%postun server-trust-ad
|
|
if [ "$1" -ge "1" ]; then
|
|
if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
|
|
%{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null
|
|
fi
|
|
fi
|
|
|
|
%post server-trust-ad
|
|
%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
|
|
winbind_krb5_locator.so /dev/null 90
|
|
|
|
%posttrans server-trust-ad
|
|
python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
|
|
if [ $? -eq 0 ]; then
|
|
# NOTE: systemd specific section
|
|
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
|
|
# END
|
|
fi
|
|
|
|
%preun server-trust-ad
|
|
if [ $1 -eq 0 ]; then
|
|
%{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
|
|
fi
|
|
%endif # ONLY_CLIENT
|
|
|
|
%post client
|
|
if [ $1 -gt 1 ] ; then
|
|
# Has the client been configured?
|
|
restore=0
|
|
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
|
|
|
|
if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
|
|
if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf 2>/dev/null ; then
|
|
echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
|
|
cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
|
|
mv /etc/krb5.conf.ipanew /etc/krb5.conf
|
|
/sbin/restorecon /etc/krb5.conf
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
%triggerin -n freeipa-client -- openssh-server
|
|
# Has the client been configured?
|
|
restore=0
|
|
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
|
|
|
|
if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
|
|
if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
|
|
sed -r '
|
|
/^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
|
|
' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
|
|
|
|
if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
|
|
sed -ri '
|
|
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
|
|
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
|
|
' /etc/ssh/sshd_config.ipanew
|
|
elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
|
|
sed -ri '
|
|
s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
|
|
s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
|
|
' /etc/ssh/sshd_config.ipanew
|
|
elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
|
|
sed -ri '
|
|
s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
|
|
s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
|
|
' /etc/ssh/sshd_config.ipanew
|
|
fi
|
|
|
|
mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
|
|
/sbin/restorecon /etc/ssh/sshd_config
|
|
chmod 600 /etc/ssh/sshd_config
|
|
|
|
/bin/systemctl condrestart sshd.service 2>&1 || :
|
|
fi
|
|
fi
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%files server -f server-python.list
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING README Contributors.txt
|
|
%{_sbindir}/ipa-backup
|
|
%{_sbindir}/ipa-restore
|
|
%{_sbindir}/ipa-ca-install
|
|
%{_sbindir}/ipa-dns-install
|
|
%{_sbindir}/ipa-server-install
|
|
%{_sbindir}/ipa-replica-conncheck
|
|
%{_sbindir}/ipa-replica-install
|
|
%{_sbindir}/ipa-replica-prepare
|
|
%{_sbindir}/ipa-replica-manage
|
|
%{_sbindir}/ipa-csreplica-manage
|
|
%{_sbindir}/ipa-server-certinstall
|
|
%{_sbindir}/ipa-ldap-updater
|
|
%{_sbindir}/ipa-compat-manage
|
|
%{_sbindir}/ipa-nis-manage
|
|
%{_sbindir}/ipa-managed-entries
|
|
%{_sbindir}/ipactl
|
|
%{_sbindir}/ipa-upgradeconfig
|
|
%{_sbindir}/ipa-advise
|
|
%{_libexecdir}/certmonger/dogtag-ipa-retrieve-agent-submit
|
|
%{_libexecdir}/ipa-otpd
|
|
%config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
|
|
%dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
|
|
%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/
|
|
# NOTE: systemd specific section
|
|
%{_prefix}/lib/tmpfiles.d/%{name}.conf
|
|
%attr(644,root,root) %{_unitdir}/ipa.service
|
|
%attr(644,root,root) %{_unitdir}/ipa_memcached.service
|
|
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
|
|
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
|
|
# END
|
|
%dir %{python_sitelib}/ipaserver
|
|
%dir %{python_sitelib}/ipaserver/install
|
|
%dir %{python_sitelib}/ipaserver/install/plugins
|
|
%dir %{python_sitelib}/ipaserver/advise
|
|
%dir %{python_sitelib}/ipaserver/advise/plugins
|
|
%dir %{python_sitelib}/ipaserver/plugins
|
|
%dir %{_libdir}/ipa/certmonger
|
|
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
|
|
%dir %{_usr}/share/ipa
|
|
%{_usr}/share/ipa/wsgi.py*
|
|
%{_usr}/share/ipa/copy-schema-to-ca.py*
|
|
%{_usr}/share/ipa/*.ldif
|
|
%{_usr}/share/ipa/*.uldif
|
|
%{_usr}/share/ipa/*.template
|
|
%dir %{_usr}/share/ipa/advise
|
|
%dir %{_usr}/share/ipa/advise/legacy
|
|
%{_usr}/share/ipa/advise/legacy/*.template
|
|
%dir %{_usr}/share/ipa/ffextension
|
|
%{_usr}/share/ipa/ffextension/bootstrap.js
|
|
%{_usr}/share/ipa/ffextension/install.rdf
|
|
%{_usr}/share/ipa/ffextension/chrome.manifest
|
|
%dir %{_usr}/share/ipa/ffextension/chrome
|
|
%dir %{_usr}/share/ipa/ffextension/chrome/content
|
|
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth.js
|
|
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth_overlay.xul
|
|
%dir %{_usr}/share/ipa/ffextension/locale
|
|
%dir %{_usr}/share/ipa/ffextension/locale/en-US
|
|
%{_usr}/share/ipa/ffextension/locale/en-US/kerberosauth.properties
|
|
%dir %{_usr}/share/ipa/html
|
|
%{_usr}/share/ipa/html/ffconfig.js
|
|
%{_usr}/share/ipa/html/ffconfig_page.js
|
|
%{_usr}/share/ipa/html/ssbrowser.html
|
|
%{_usr}/share/ipa/html/browserconfig.html
|
|
%{_usr}/share/ipa/html/unauthorized.html
|
|
%{_usr}/share/ipa/html/ipa_error.css
|
|
%dir %{_usr}/share/ipa/migration
|
|
%{_usr}/share/ipa/migration/error.html
|
|
%{_usr}/share/ipa/migration/index.html
|
|
%{_usr}/share/ipa/migration/invalid.html
|
|
%{_usr}/share/ipa/migration/migration.py*
|
|
%dir %{_usr}/share/ipa/ui
|
|
%{_usr}/share/ipa/ui/index.html
|
|
%{_usr}/share/ipa/ui/login.html
|
|
%{_usr}/share/ipa/ui/logout.html
|
|
%{_usr}/share/ipa/ui/reset_password.html
|
|
%{_usr}/share/ipa/ui/*.ico
|
|
%{_usr}/share/ipa/ui/*.css
|
|
%{_usr}/share/ipa/ui/*.js
|
|
%{_usr}/share/ipa/ui/*.eot
|
|
%{_usr}/share/ipa/ui/*.svg
|
|
%{_usr}/share/ipa/ui/*.ttf
|
|
%{_usr}/share/ipa/ui/*.woff
|
|
%dir %{_usr}/share/ipa/ui/js/dojo
|
|
%{_usr}/share/ipa/ui/js/dojo/dojo.js
|
|
%dir %{_usr}/share/ipa/ui/js/libs
|
|
%{_usr}/share/ipa/ui/js/libs/*.js
|
|
%dir %{_usr}/share/ipa/ui/js/freeipa
|
|
%{_usr}/share/ipa/ui/js/freeipa/app.js
|
|
%dir %{_usr}/share/ipa/ui/js/plugins
|
|
%dir %{_usr}/share/ipa/ui/images
|
|
%{_usr}/share/ipa/ui/images/*.png
|
|
%{_usr}/share/ipa/ui/images/*.gif
|
|
%dir %{_usr}/share/ipa/wsgi
|
|
%{_usr}/share/ipa/wsgi/plugins.py*
|
|
%dir %{_sysconfdir}/ipa
|
|
%dir %{_sysconfdir}/ipa/html
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/ipa_error.css
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
|
|
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
|
|
%{_usr}/share/ipa/ca_renewal
|
|
%{_usr}/share/ipa/ipa.conf
|
|
%{_usr}/share/ipa/ipa-rewrite.conf
|
|
%{_usr}/share/ipa/ipa-pki-proxy.conf
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/configure.jar
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
|
|
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/preferences.html
|
|
%dir %{_usr}/share/ipa/updates/
|
|
%{_usr}/share/ipa/updates/*
|
|
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
|
|
%dir %{_localstatedir}/lib/ipa
|
|
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/backup
|
|
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
|
|
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysupgrade
|
|
%attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
|
|
%ghost %{_localstatedir}/lib/ipa/pki-ca/publish
|
|
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
|
|
%{_mandir}/man1/ipa-replica-conncheck.1.gz
|
|
%{_mandir}/man1/ipa-replica-install.1.gz
|
|
%{_mandir}/man1/ipa-replica-manage.1.gz
|
|
%{_mandir}/man1/ipa-csreplica-manage.1.gz
|
|
%{_mandir}/man1/ipa-replica-prepare.1.gz
|
|
%{_mandir}/man1/ipa-server-certinstall.1.gz
|
|
%{_mandir}/man1/ipa-server-install.1.gz
|
|
%{_mandir}/man1/ipa-dns-install.1.gz
|
|
%{_mandir}/man1/ipa-ca-install.1.gz
|
|
%{_mandir}/man1/ipa-compat-manage.1.gz
|
|
%{_mandir}/man1/ipa-nis-manage.1.gz
|
|
%{_mandir}/man1/ipa-managed-entries.1.gz
|
|
%{_mandir}/man1/ipa-ldap-updater.1.gz
|
|
%{_mandir}/man8/ipactl.8.gz
|
|
%{_mandir}/man8/ipa-upgradeconfig.8.gz
|
|
%{_mandir}/man1/ipa-backup.1.gz
|
|
%{_mandir}/man1/ipa-restore.1.gz
|
|
%{_mandir}/man1/ipa-advise.1.gz
|
|
|
|
%files server-trust-ad
|
|
%{_sbindir}/ipa-adtrust-install
|
|
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
|
|
%{_usr}/share/ipa/smb.conf.empty
|
|
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
|
|
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
|
|
%{_mandir}/man1/ipa-adtrust-install.1.gz
|
|
%{python_sitelib}/ipaserver/dcerpc*
|
|
%{python_sitelib}/ipaserver/install/adtrustinstance*
|
|
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
|
|
%endif # ONLY_CLIENT
|
|
|
|
%files client
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING README Contributors.txt
|
|
%{_sbindir}/ipa-client-install
|
|
%{_sbindir}/ipa-client-automount
|
|
%{_sbindir}/ipa-getkeytab
|
|
%{_sbindir}/ipa-rmkeytab
|
|
%{_sbindir}/ipa-join
|
|
%dir %{_usr}/share/ipa
|
|
%dir %{_localstatedir}/lib/ipa-client
|
|
%dir %{_localstatedir}/lib/ipa-client/sysrestore
|
|
%dir %{python_sitelib}/ipaclient
|
|
%{python_sitelib}/ipaclient/*.py*
|
|
%{_mandir}/man1/ipa-getkeytab.1.gz
|
|
%{_mandir}/man1/ipa-rmkeytab.1.gz
|
|
%{_mandir}/man1/ipa-client-install.1.gz
|
|
%{_mandir}/man1/ipa-client-automount.1.gz
|
|
%{_mandir}/man1/ipa-join.1.gz
|
|
%{_mandir}/man5/default.conf.5.gz
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%files admintools
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING README Contributors.txt
|
|
%{_bindir}/ipa
|
|
%config %{_sysconfdir}/bash_completion.d
|
|
%{_mandir}/man1/ipa.1.gz
|
|
%endif # ONLY_CLIENT
|
|
|
|
%files python -f %{gettext_domain}.lang
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING README Contributors.txt
|
|
%dir %{python_sitelib}/ipapython
|
|
%dir %{python_sitelib}/ipapython/platform
|
|
%dir %{python_sitelib}/ipapython/platform/base
|
|
%dir %{python_sitelib}/ipapython/platform/fedora16
|
|
%dir %{python_sitelib}/ipapython/platform/fedora18
|
|
%dir %{python_sitelib}/ipapython/platform/fedora19
|
|
%dir %{python_sitelib}/ipapython/platform/redhat
|
|
%{python_sitelib}/ipapython/*.py*
|
|
%{python_sitelib}/ipapython/platform/*.py*
|
|
%{python_sitelib}/ipapython/platform/base/*.py*
|
|
%{python_sitelib}/ipapython/platform/fedora16/*.py*
|
|
%{python_sitelib}/ipapython/platform/fedora18/*.py*
|
|
%{python_sitelib}/ipapython/platform/fedora19/*.py*
|
|
%{python_sitelib}/ipapython/platform/redhat/*.py*
|
|
%dir %{python_sitelib}/ipalib
|
|
%{python_sitelib}/ipalib/*
|
|
%attr(0644,root,root) %{python_sitearch}/default_encoding_utf8.so
|
|
%{python_sitelib}/ipapython-*.egg-info
|
|
%{python_sitelib}/freeipa-*.egg-info
|
|
%{python_sitearch}/python_default_encoding-*.egg-info
|
|
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
|
|
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
|
|
|
|
%if ! %{ONLY_CLIENT}
|
|
%files tests -f tests-python.list
|
|
%defattr(-,root,root,-)
|
|
%doc COPYING README Contributors.txt
|
|
%dir %{python_sitelib}/ipatests
|
|
%dir %{python_sitelib}/ipatests/test_cmdline
|
|
%dir %{python_sitelib}/ipatests/test_install
|
|
%dir %{python_sitelib}/ipatests/test_ipalib
|
|
%dir %{python_sitelib}/ipatests/test_ipapython
|
|
%dir %{python_sitelib}/ipatests/test_ipaserver
|
|
%dir %{python_sitelib}/ipatests/test_ipaserver/test_install
|
|
%dir %{python_sitelib}/ipatests/test_pkcs10
|
|
%dir %{python_sitelib}/ipatests/test_webui
|
|
%dir %{python_sitelib}/ipatests/test_xmlrpc
|
|
%{_bindir}/ipa-run-tests
|
|
%{_bindir}/ipa-test-config
|
|
%{_bindir}/ipa-test-task
|
|
%{python_sitelib}/ipatests-*.egg-info
|
|
%{_mandir}/man1/ipa-run-tests.1.gz
|
|
%{_mandir}/man1/ipa-test-config.1.gz
|
|
%{_mandir}/man1/ipa-test-task.1.gz
|
|
%endif # ONLY_CLIENT
|
|
|
|
%changelog
|
|
* Tue Nov 26 2013 Petr Viktorin<pviktori@redhat.com> - __VERSION__-__RELEASE__
|
|
- Remove changelog. The history is kept in Git, downstreams have own logs.
|
|
# note, this entry is here to placate tools that expect a non-empty changelog
|