Commit Graph
791 Commits
Author SHA1 Message Date
Rob Crittenden 5f6f20ffaa Fix error in validation when adding new groups via the UI
469256
2008-10-31 14:27:58 -04:00
Rob Crittenden 08c49c5806 Install replication update file 2008-10-31 12:34:30 -04:00
Rob Crittenden c13726ff66 Gracefully handle running on an unconfigured IPA server 2008-10-30 10:25:01 -04:00
Rob Crittenden 4699fc534b Don't report spurious upgrade message if IPA has not been configured yet.
This was throwing the error
"Unable to determine hostname from ipa-rewrite.conf"
during RPM %post on unconfigured servers where there is nothing to do.

468947
2008-10-29 17:08:32 -04:00
Rob Crittenden f305864d90 Ensure that every replica gets a unique replication ID. Otherwise changes won't propogate between all replicas.
468732
2008-10-29 17:08:27 -04:00
Rob Crittenden 4862a8f9d9 Fix error if more than one values is being set in an only. The first entry wasn't being properly converted into a list so subsequent values caused it to crap out.
467102
2008-10-15 15:29:08 -04:00
Rich Megginson f02d1429ca add update to fix the index for the winsync attributes 2008-10-13 14:09:15 -04:00
Rich Megginson 5c56c43693 do not store the OUs from the AD DN in the IPA user entry when flattening 2008-10-13 14:09:14 -04:00
Rich Megginson 9f18858e58 add --win-subtree argument to ipa-replica-manage 2008-10-13 14:09:13 -04:00
Rich Megginson 0988e1c53c Do not depend on MMR plugin - start before MMR plugin
The ipa-winsync plugin needs to start before the MMR plugin, so that it
can register the API functions.  Also, the slapi-nis schema compat
plugin creates an entry that looks exactly like the default IPA group
gidNumber entry, so I added an extra (objectclass=groupOfNames) to the
filter since the slapi-nis entry doesn't have that.
2008-10-13 14:09:13 -04:00
Rich Megginson d3637dde7c Just add eq,pres to the existing indices
There are already indexes created for ntUniqueID and ntUserDomainID by default
We just need to make sure they are indexed for equality and presence
2008-10-13 14:09:12 -04:00
Rich Megginson 38154073a8 Don't try to conditionally stop the server - it doesn't seem to work
Just call stop() - if it's not already running, no big deal
2008-10-13 14:09:11 -04:00
Rich Megginson 28195610f6 Add more winsync support to cli
The ipa-replica-manage list, init, and synch commands do not work for winsync
agreements.  This patch adds that support and some additional verbose logging.

The synch_master did not work correctly.  The way it should work is to set
the replication schedule to some bogus value, then reset it back to its
original setting.  This will force replication to take place immediately.
2008-10-13 14:09:10 -04:00
Rich Megginson 068ed81195 Do not add enabled user to activated group - clean up parse_acct_disable
If a user needs to be enabled, just delete the user from the inactivated group,
but do not add to the activated group.  If a user is in no group, the user is
active by default.  IPA uses the activated group for override purposes.

parse_acct_disable is only used when the config changes, but I cleaned it
up anyway to make the code clearer.
2008-10-13 14:09:10 -04:00
Rich Megginson 0e346ff6fb add winsync options to ipa-replica-manage man page 2008-10-13 14:09:09 -04:00
Rich Megginson 69180c2dcc Adds winsync account disable and force sync 2008-10-13 14:09:08 -04:00
Rich Megginson e8bebebc23 fix issues brought up by initial review of ipa winsync enhancements 2008-10-13 14:09:08 -04:00
Rich Megginson be5e783f72 add --no-host-dns option to ipa-server-install - allows specifying a hostname that might actually exist but you do not want to even attempt to resolve it via DNS 2008-10-13 14:09:07 -04:00
Rich Megginson 5a5bfa2c70 Added support to IPA server install to install the winsync plugin configuration entry Added support to ipa-replica-manage to add winsync agreements. I mostly used the existing code for setting up replication agreements since replication and winsync are quite similar in their configuration. I just had to add some extra attributes to the sync agreement configuration. The tricky part was importing the Windows CA cert. 2008-10-13 14:09:07 -04:00
Rich Megginson 2a2bc851bd The library name is libipa_winsync not libipa-winsync 2008-10-13 14:09:06 -04:00
Rich Megginson 434f9aca6a Use dirsrv/file.h with includes by default - only use the other style if we are debugging within the directory server 2008-10-13 14:09:05 -04:00
Rich Megginson 4bc89c427e fix some memory leaks 2008-10-13 14:09:04 -04:00
Rich Megginson c80ecc8c2a Added ipa-winsync-config.c - this handles dynamic configuration via the DSE callbacks, and gets default values from various configuration entries in the IPA tree 2008-10-13 14:09:04 -04:00
Rich Megginson 61b5a95dd1 Added support for posixAccount -lookup attribute containing the homeDirectory prefix and use that to construct the homeDirectory attribute -lookup attribute containing the default gidNumber and use that to add the gidNumber to new users -construct the gecos field from the cn attribute 2008-10-13 14:09:03 -04:00
Rich Megginson 6454956d51 Added the new IPA WinSync Plug-in Work done so far * added the new plugin to makefiles, spec file * added stubs for the api, including begin update, end update, and destroy callbacks * added config code to allow dynamic dse config changes and auto-discovery of realm and new user objectclass list 2008-10-13 14:09:03 -04:00
Rich Megginson 0951496593 Initial addition of ipa-winsync plugin 2008-10-13 14:09:02 -04:00
Martin Nagy 9b8f7b1eac ipa-change-master-key: Really exit when not run as root Also fix this for ipa-fix-CVE-2008-3274 2008-09-24 20:09:35 +02:00
Rob Crittenden 7b799d8c6f Fix class declaration to work with Python 2.4 2008-09-19 23:09:59 -04:00
Martin Nagy a62b85a233 Fix architecture detection in ldapupdate 2008-09-19 17:25:05 +02:00
Rob Crittenden ca07cdb390 Add detection to the update tool to detect when it would apply changes.
Remove SUP name from RFC2307bis.update to match FDS
2008-09-19 18:04:40 -04:00
Simo Sorce b4938f5e35 Fix syntax error 2008-09-18 17:23:13 -04:00
Simo Sorce bc70a5146f Remove reference to very unlikely service examples that are not
currently kerberized (and may never be due to their nature).
2008-09-18 17:23:12 -04:00
Martin Nagy 8683c23e9d Restart httpd and dirsrv services after yum upgrade.
Fixes: 441566
2008-09-17 23:06:33 +02:00
Martin Nagy 1634e09973 Add standard override options to ipa-replica-prepare
Fixes: 462489
2008-09-17 23:06:18 +02:00
Rob Crittenden 00d54a5668 Move the bulk of ipa-ldap-updater into a python library.
This significantly simplifies the tool and makes it possible to apply
updates from the installer without forking off another process.
2008-09-17 20:56:18 -04:00
Rob Crittenden f736253b93 Run the LDAP updater at the end of the installation process.
Running at the end ensures that /etc/ipa/ipa.conf is created and generally
makes it more likely to succeed.

Added a new argument to ipa-server-installl, -y <password_file>, so we
don't have to pass it on the command-line.
2008-09-17 20:56:08 -04:00
Rob Crittenden aa8c4a53bf Allow passwords to work without a tty ala: echo password | some_program 2008-09-17 20:56:03 -04:00
Rob Crittenden 661dee8c03 Add more development packages to test for 2008-09-12 20:37:36 -04:00
Rob Crittenden 88960f1597 Sort updates by DN length and by default process all files in the updates dir.
The updates directory is currently hardcoded to /usr/share/ipa/updates.

All of the files are read into memory and then sorted by the length of the DN.
This is so we can be sure that parent entries are added before children.

Also add a man page.
2008-09-12 20:07:48 -04:00
Rob Crittenden 1eec34393b Update files for the schema compatibility plugin and RFC4876 profiles
Also handle syntax errors a bit more gracefully and allow the updater to
work on more than one file at a time.

Adjust to new config.py and use a custom exception class for syntax errors.

Also fix a error in parsing the separate files

Include slapi-nis in Requires

Includes work provided by Martin Nagy

460055
2008-09-12 20:07:41 -04:00
Rob Crittenden ec57bc3e44 Tool for doing configuration updates over LDAP
This tool takes as input a file which contains basically an LDIF, prefixed
with a command: default, add, remove or only. These define the operations
to perform such as adding new entries, adding new sub-entries to an existing
entry, adding or modifying attributes in a record.

If an index entry is modified a task is created to re-create the index.

Schema may be added using this tool.

454031
2008-09-12 20:06:46 -04:00
Rob Crittenden d33b7fc839 The True/False logic was reversed, so "no" meant remove the existing instance 2008-09-12 19:38:48 -04:00
Martin Nagy 885103c321 Rework config.py and change cli tools. Maintain order of IPA servers from command line, config and DNS. Parse options before detecting IPA configuration. Don't ignore rest of the options if one is missing in ipa.conf. Drop the --usage options, we will rely on --help. Fixes: 458869, 459070, 458980, 459234 2008-09-11 23:34:01 +02:00
Simo Sorce 57669ba432 Add script to simplify operations to fix CVE 2008 3274
Import all of change master key directly into the help fix,
allows for better control
2008-09-10 15:07:42 -04:00
Simo Sorce 8e7c98eb7f CVE 2008 3274 related fixes 2008-09-10 15:07:33 -04:00
Simo Sorce 86afc680cd Retrieve the kerberos configuration every time a new, it will be a bit slower
but will allow for changing configurations without having to restart DS.
Password operations are slow and rare enough this is an acceptable compromise.
2008-09-10 15:07:17 -04:00
Simo Sorce 2659fb0eb4 Minor bugs found while testing stuff.
- wrong import in certs.py makes ipa-replica-manage fail
- close the fs after the stash file is written so that the file is updated
  immediately and not when the fd is garbage collected
2008-08-21 11:04:52 -04:00
Rob Crittenden ff82c4c1e5 Limit the mod_rewrite rules to just /ipa
459209
2008-08-21 09:48:48 -04:00
Simo Sorce 0c6aeee6f1 Fix segfault cause by empty target entry 2008-08-19 11:14:27 -04:00
Rob Crittenden 548c169c5a Create temporary files used in self-signed cert requests in a temporary directory and ensure that it gets cleaned up when we're done with it.
458159
2008-08-15 11:05:31 -04:00