From b0184d10aba3bd0302b4ef7bdcecb513ae00c54d Mon Sep 17 00:00:00 2001 From: Petr Vobornik Date: Fri, 1 Sep 2017 21:50:44 +0200 Subject: [PATCH] browser config: cleanup after removal of Firefox extension Firefox extension which served for configuring Kerberos auth in Firefox until version which banned self-signed extensions was removed in commit 6c53765ac1746ea3cb82554775a37fe43af062e8. Given that configure.jar, even older Firefox config tool, was removed sometime before that, there is no use for signtool tool. It is good because it is removed from Fedora 27 anyway. So removing last unused function which calls it. The removal of FF extension was not exactly clean so removing also browserconfig.html which only purpose was to use the extension. Therefore also related JS files are removed. This removal requires unauthorized.html to be updated so that it doesn't point to non-existing page. And given that it now points only to single config page, we can change link in UI login page to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html. Btw, commit 6c53765ac1746ea3cb82554775a37fe43af062e8 removed also generation of krb.js. It had one perk - with that info ssbrowser.html could display real Kerberos domain instead of only 'example.com'. I don't have time to revert this change so removing traces of krb.js as well. https://pagure.io/freeipa/issue/7135 Reviewed-By: Fraser Tweedale --- freeipa.spec.in | 10 -- install/html/Makefile.am | 3 - install/html/browserconfig.html | 128 -------------- install/html/ffconfig.js | 146 ---------------- install/html/ffconfig_page.js | 163 ------------------ install/html/jsl.conf | 2 - install/html/ssbrowser.html | 22 +-- install/html/unauthorized.html | 4 +- install/ui/src/freeipa/widgets/LoginScreen.js | 2 +- ipaplatform/base/paths.py | 1 - ipaserver/install/certs.py | 8 - 11 files changed, 11 insertions(+), 478 deletions(-) delete mode 100644 install/html/browserconfig.html delete mode 100644 install/html/ffconfig.js delete mode 100644 install/html/ffconfig_page.js diff --git a/freeipa.spec.in b/freeipa.spec.in index fdb87824f..6d992ba15 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -1067,9 +1067,7 @@ mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/ /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf /bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt -/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi /bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con -/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js /bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini /bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con @@ -1407,10 +1405,7 @@ fi %{_usr}/share/ipa/profiles/README %{_usr}/share/ipa/profiles/*.cfg %dir %{_usr}/share/ipa/html -%{_usr}/share/ipa/html/ffconfig.js -%{_usr}/share/ipa/html/ffconfig_page.js %{_usr}/share/ipa/html/ssbrowser.html -%{_usr}/share/ipa/html/browserconfig.html %{_usr}/share/ipa/html/unauthorized.html %dir %{_usr}/share/ipa/migration %{_usr}/share/ipa/migration/error.html @@ -1442,11 +1437,8 @@ fi %{_usr}/share/ipa/wsgi/plugins.py* %dir %{_sysconfdir}/ipa %dir %{_sysconfdir}/ipa/html -%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js -%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html -%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf @@ -1457,9 +1449,7 @@ fi %{_usr}/share/ipa/ipa-rewrite.conf %{_usr}/share/ipa/ipa-pki-proxy.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt -%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con -%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con %dir %{_usr}/share/ipa/updates/ diff --git a/install/html/Makefile.am b/install/html/Makefile.am index 3b7a0646b..49a12fc17 100644 --- a/install/html/Makefile.am +++ b/install/html/Makefile.am @@ -2,10 +2,7 @@ NULL = appdir = $(IPA_SYSCONF_DIR)/html app_DATA = \ - ffconfig.js \ - ffconfig_page.js \ ssbrowser.html \ - browserconfig.html \ unauthorized.html \ $(NULL) diff --git a/install/html/browserconfig.html b/install/html/browserconfig.html deleted file mode 100644 index f1ab764e7..000000000 --- a/install/html/browserconfig.html +++ /dev/null @@ -1,128 +0,0 @@ - - - - - IPA: Identity Policy Audit - - - - - - - - -
-
-
-
-

Firefox configuration

- - - -
-

Step 1

-

- Import Certificate Authority certificate -

-

- Make sure you select all three checkboxes. -

-
- - - - - - - -
-

Step 2

-
    -
  1. - In the address bar of Firefox, type about:config and press enter to display the list of current configuration options. -
    2. -
  2. - In the Filter field, type network.negotiate-auth.trusted-uris to restrict the list of options. -
    3. -
  3. - Double-click the entry to display the "Enter string value" dialog box. -
    4. -
  4. - Enter the name of the domain against which you want to authenticate, .example.com as an example. -
    5. -
-
- -
- -

Step 3

-

Return to Web UI

-
-
- -
-
-
- - - - diff --git a/install/html/ffconfig.js b/install/html/ffconfig.js deleted file mode 100644 index ecb1a635f..000000000 --- a/install/html/ffconfig.js +++ /dev/null @@ -1,146 +0,0 @@ -/* Authors: - * Petr Vobornik - * - * Copyright (C) 2012 Red Hat - * see file 'COPYING' for use and warranty information - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see . - */ - -var IPA = IPA || {}; - -IPA.browser_config = { - - configure_firefox: function(domain) { - - var self = this; - - domain = domain || self.get_domain(); - - self.send_message({ - method: 'configure', - predefined: 'ipa', - trusted_uris: domain - }); - }, - - - get_configure_result: function() { - - var self = this; - - var el = self.get_data_element(); - - var answer = el.getAttribute('answer'); - - return answer; - }, - - get_domain: function() { - return "."+IPA_DOMAIN; - }, - - send_message: function(options) { - - options = options || {}; - - var self = this; - - self.clear_data_element(); - var opt_element = self.get_data_element(); - - for (var opt in options) { - opt_element.setAttribute(opt, options[opt]); - } - - var msg_evt = document.createEvent('HTMLEvents'); - msg_evt.initEvent('kerberos-auth-config', true, false); - opt_element.dispatchEvent(msg_evt); - }, - - get_data_element: function() { - - var els = document.getElementsByTagName('kerberosauthdataelement'); - var element; - - if (els.length === 0) { - element = document.createElement('kerberosauthdataelement'); - document.documentElement.appendChild(element); - } else { - element = els[0]; - } - - return element; - }, - - clear_data_element: function() { - - var self = this; - - var el = self.get_data_element(); - var to_remove = []; - - for (var i=0; i - * - * Copyright (C) 2012 Red Hat - * see file 'COPYING' for use and warranty information - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see . - */ - - $(document).ready(function() { - - var set_enabled = function(steps, enabled) { - - for (var i=0; i 15 < 40 - // show krb extension method - $('#step2').show(); - $('#step3').show(); - $('#step4header').show(); - $('#step3bheader').hide(); - $('#step2b').hide(); - } - // else - // Firefox since version 40 has new extension signing policy - // this policy prevents to use self-signed FF extension and - // thus a manual config is needed - which is the default (step2b) - - // else if (compare_version(version, '15') === -1) { -// $('#step2a').show(); -// $('#older-compatible').show(); -// $('#older-required').hide(); -// } - } - }; - - var compare_version = function(a, b) { - - var only_digits =/[^\d.]/g; - - var a_parts = a.replace(only_digits, '').split('.'); - var b_parts = b.replace(only_digits, '').split('.'); - - for (var i=0; i b_num) return 1; - else if (a_num < b_num) return -1; - } - - if (a_parts.length !== b_parts.length) { - return a_parts.length > b_parts.length ? 1 : -1; - } - - return 0; - }; - - var button_handler = function(handler) { - return function(e) { - if ($(this).hasClass('disabled')) { - e.preventDefault(); - return false; - } - return handler.call(this, e); - }; - }; - - $('#install-link').click(button_handler(install)); - $('#reinstall-link').click(button_handler(install)); - $('#configure-link').click(button_handler(configure)); - - check_version(); - show_installed(IPA.browser_config.extension_installed()); -}); \ No newline at end of file diff --git a/install/html/jsl.conf b/install/html/jsl.conf index b9a8a9780..ad52043d7 100644 --- a/install/html/jsl.conf +++ b/install/html/jsl.conf @@ -127,5 +127,3 @@ # To add a set of files, use "+process FileName", "+process Folder\Path\*.js", # or "+process Folder\Path\*.htm". # -+process ffconfig.js -+process ffconfig_page.js \ No newline at end of file diff --git a/install/html/ssbrowser.html b/install/html/ssbrowser.html index 49d8c5be1..5ab871d8e 100644 --- a/install/html/ssbrowser.html +++ b/install/html/ssbrowser.html @@ -6,23 +6,14 @@ @@ -51,7 +42,12 @@
  1. - Import CA certificate. Make sure you checked all three checkboxes. +

    + Import Certificate Authority certificate +

    +

    + Make sure you select all three checkboxes. +

  2. In the address bar of Firefox, type about:config to display the list of current configuration options. @@ -65,7 +61,7 @@
  3. Enter the name of the domain against which you want to authenticate, for example, .example.com.
    4. -
  4. You are all set.
    5. +
  5. Return to Web UI

Chrome

diff --git a/install/html/unauthorized.html b/install/html/unauthorized.html index 0b4414f55..8c57ce822 100644 --- a/install/html/unauthorized.html +++ b/install/html/unauthorized.html @@ -36,9 +36,7 @@

- If this is your first time, please configure your browser. - Use Firefox configuration page for Firefox - or manual configuration page for other browsers. + If this is your first time, please configure your browser.

diff --git a/install/ui/src/freeipa/widgets/LoginScreen.js b/install/ui/src/freeipa/widgets/LoginScreen.js index 66d672e7b..d7c53d4f7 100644 --- a/install/ui/src/freeipa/widgets/LoginScreen.js +++ b/install/ui/src/freeipa/widgets/LoginScreen.js @@ -55,7 +55,7 @@ define(['dojo/_base/declare', kerberos_msg: " To login with Kerberos, please make sure you" + " have valid tickets (obtainable via kinit) and " + - "configured" + + "configured" + " the browser correctly, then click Login. ", cert_msg: " To login with certificate," + " please make sure you have valid personal certificate. ", diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index d48ffca08..2d96dc2ef 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -171,7 +171,6 @@ class BasePathNamespace(object): ODS_SIGNER = "/usr/sbin/ods-signer" OPENSSL = "/usr/bin/openssl" PK12UTIL = "/usr/bin/pk12util" - SIGNTOOL = "/usr/bin/signtool" SOFTHSM2_UTIL = "/usr/bin/softhsm2-util" SSLGET = "/usr/bin/sslget" SSS_SSH_AUTHORIZEDKEYS = "/usr/bin/sss_ssh_authorizedkeys" diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index b12283948..4215de402 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -226,14 +226,6 @@ class CertDB(object): def run_certutil(self, args, stdin=None, **kwargs): return self.nssdb.run_certutil(args, stdin, **kwargs) - def run_signtool(self, args, stdin=None): - with open(self.passwd_fname, "r") as f: - password = f.readline() - new_args = [paths.SIGNTOOL, "-d", self.secdir, "-p", password] - - new_args = new_args + args - ipautil.run(new_args, stdin) - def create_noise_file(self): if ipautil.file_exists(self.noise_fname): os.remove(self.noise_fname)