public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,542 Commits 9 Branches 0 Tags
98f0077360884da6df31b351caaed7510dec94de
Commit Graph
1480 Commits
Author SHA1 Message Date
Jan Cholasta d27e77adc5 Allow upgrading CA-less to CA-full using ipa-ca-install. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 8bbdfff102 Allow adding CA certificates to certificate store in ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 18aa3216e0 Allow changing chaining of the IPA CA certificate in ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta f39c6ee544 Add new NSSDatabase method get_cert for getting certs from NSS databases. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 987bf3fbf0 Allow multiple CA certificates in replica info files. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 6870eb909e Add function for writing list of certificates to a PEM file to ipalib.x509. 
Also rename load_certificate_chain_from_file to
load_certificate_list_from_file.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 6f01499419 Import CA certs from certificate store to HTTP NSS database on server install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 82d682fa64 Import CA certs from certificate store to DS NSS database on replica install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 88706c5674 Add new add_cert method for adding certificates to NSSDatabase and CertDB. 
Replace all uses of NSSDatabase method add_single_pem_cert with add_cert and
remove add_single_pem_cert.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta feecdb4cdc Rename CertDB method add_cert to import_cert. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 5f29a71bd7 Upload CA chain from DS NSS database to certificate store on server update. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 05212a17a9 Upload CA chain from DS NSS database to certificate store on server install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 586373cf07 Add permissions for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 25c10bc161 Add LDAP schema for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta d2bf0b8b54 Fix trust flags in HTTP and DS NSS databases. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 9d4eeeda55 Allow specifying trust flags in NSSDatabase and CertDB method trust_root_cert. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 52f72ec058 Do not treat the IPA RA cert as CA cert in DS NSS database. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 1778f0ebc9 Allow IPA master hosts to read and update IPA master information. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 7086183519 Do not use ldapi in certificate renewal scripts. 
This prevents SELinux denials when accessing the ldapi socket.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta e16d2623ae Remove master ACIs when deleting a replica. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta baa665fe40 Load sysupgrade.state on demand. 
This prevents SELinux denials when the sysupgrade module is imported in a
confined process.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta ba3c7b4a89 Add CA certificate management tool ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2870db7913 Add permissions for CA certificate renewal. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 031b281921 Add method for verifying CA certificates to NSSDatabase. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2c43a3d0d5 Move external cert validation from ipa-server-install to installutils. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 9e188574a5 Add method for setting CA renewal master in LDAP to CAInstance. 
Allow checking and setting CA renewal master for non-local CA instances.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2f6990c256 Track CA certificate using dogtag-ipa-ca-renew-agent. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Martin Basti 00309f8e42 Fix DNS upgrade plugin should check if DNS container exists 
Fortunately this cause no error, because dnszone-find doesnt raise
exception if there is no DNS container

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-28 17:42:38 +02:00
David Kupka 41b057e387 Always record that pkicreate has been executed. 
Record that pkicreate/pkispawn has been executed to allow cleanup even if the
installation did not finish correctly.

https://fedorahosted.org/freeipa/ticket/2796

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-22 09:03:56 +02:00
Gabe 2afcbff133 Enable debug pid in smb.conf 
https://fedorahosted.org/freeipa/ticket/3485

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-07-18 10:10:46 +02:00
Petr Viktorin 2f99140c92 ldapupdate: Restore 'replace' functionality 
The replace directive was made a no-op by mistake in commit 6381d76.
Restore it.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 15:51:55 +02:00
Martin Basti f8b6595f49 Restore privileges after forward zones update 
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 12:48:50 +02:00
Alexander Bokovoy a9fe37e066 ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration 
When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 08:13:23 +02:00
Martin Basti eea1015441 Fix upgrade to forward zones 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 14:04:57 +02:00
Martin Basti 5c2ddaf660 Allow to add non string values to named conf 
Non string values should not start and end with '"' in options section
in named.conf

Required by ticket: https://fedorahosted.org/freeipa/ticket/4408

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-02 18:41:57 +02:00
Petr Viktorin 8c98561c20 Do not fail if there are multiple nsDS5ReplicaId values in cn=replication,cn=etc 
On systems installed before #3394 was fixed and nsDS5ReplicaId became
single-valued, there are two replica ID values stored in cn=replication:
the default (3) and the actual value we want.
Instead of failing when multiple values are found, use the largest one.

https://fedorahosted.org/freeipa/ticket/4375

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-02 16:16:09 +02:00
Martin Basti aa2ef07b8c Upgrade special master zones to forward zones 
This upgrade is executed only if IPA version is older than 4.0
Requires detection if 'idnsforwardzone' objectclass is presented in
schema before schema is upgraded

Design: http://www.freeipa.org/page/V4/Forward_zones#Updates_and_Upgrades

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-27 14:54:35 +02:00
Martin Basti c1f3fd6831 Added upgrade step executed before schmema is upgraded 
Class PreSchemaUpdate is executed before ldap schema update

This is required by ticket: https://fedorahosted.org/freeipa/ticket/3210

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-27 14:54:35 +02:00
Tomas Babej e5e42fc83a ipaplatform: Move paths from installers to paths module 
Part of: https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-26 09:22:21 +02:00
Nathaniel McCallum 5baa941317 Implement OTP token importing 
This patch adds support for importing tokens using RFC 6030 key container
files. This includes decryption support. For sysadmin sanity, any tokens
which fail to add will be written to the output file for examination. The
main use case here is where a small subset of a large set of tokens fails
to validate or add. Using the output file, the sysadmin can attempt to
recover these specific tokens.

This code is implemented as a server-side script. However, it doesn't
actually need to run on the server. This was done because importing is an
odd fit for the IPA command framework:
1. We need to write an output file.
2. The operation may be long-running (thousands of tokens).
3. Only admins need to perform this task and it only happens infrequently.

https://fedorahosted.org/freeipa/ticket/4261

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-25 12:55:02 +02:00
Jan Cholasta e675e427c7 Allow SAN in IPA certificate profile. 
https://fedorahosted.org/freeipa/ticket/3977

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 12:10:01 +02:00
Petr Viktorin 02b5074d84 permission plugin: Join --type objectclass filters with OR 
For groups, we will need to filter on either posixgroup (which UPGs
have but non-posix groups don't) and groupofnames/nestedgroup
(which normal groups have but UPGs don't).
Join permission_filter_objectclasses with `|` and add them as
a single ipapermtargetfilter value.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-23 10:54:43 +02:00
Petr Viktorin 83cb982858 Add $REALM to variables supported by the managed permission updater 
This will allow converting password policy permissions

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-18 14:56:42 +02:00
Petr Viktorin 700ac6c116 Remove the update_dns_permissions plugin 
This plugin created permissions that the managed permission
updater would remove right away.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-18 14:45:51 +02:00
Petr Viktorin 16ee6847e4 managed permission updater: Add mechanism to replace SYSTEM permissions 
The "Read DNS Entries" permission, which was marked SYSTEM (no associated
ACI), can now be converted to a regular managed permission.

Add a mechanism for the updater to replace old SYSTEM permissions.

This cannot be done in an update file because we do not want to replace
V2 permissions with the same name.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-18 14:45:50 +02:00
Tomas Babej 4d2ef43f28 ipaplatform: Move all filesystem paths to ipaplatform.paths module 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:20 +02:00
Tomas Babej c7edd7b68c ipaplatform: Remove redundant imports of ipaservices 
Also fixes few incorrect imports.

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:20 +02:00
Tomas Babej 49fcd42f8f ipaplatform: Change service code in freeipa to use ipaplatform services 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 926f8647d2 ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasks 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Petr Viktorin 2f3cdba546 Make 'permission' the default bind type for managed permissions 
This reduces typing (or copy/pasting), and draws a bit of attention
to any non-default privileges (currently 'any' or 'anonymous').

Leaving the bindtype out by mistake isn't dangerous: by default
a permission is not granted to anyone, since it is not included in
any priviliges.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-11 13:21:29 +02:00