public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,935 Commits 9 Branches 0 Tags
baed2e6f91ecc65d4c1a3473ee94de2ca365f983
Commit Graph
2363 Commits
Author SHA1 Message Date
Martin Basti 0c7274ead8 Server Upgrade: Update entries in order specified in file 
Dictionary replaced with list. Particular upgrades are
executed in the same order as they are specified in update
a file.

Different updates for the smae cn, are not merged into one upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 144bc6c1eb Server Upgrade: Set modified to false, before each update 
Variable self.modified should be set to false before each run of update

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 10bc6bd0bf Server Upgrade: Upgrade one file per time 
* Files are sorted alphabetically, no numbering required anymore
* One file updated per time

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti bb1d7a741c Server Upgrade: do not sort updates by DN 
Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti d3f5d5d1ff Server Upgrade: Remove unused PRE_SCHEMA_UPDATE 
This is not used anymore.

Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:33:22 +01:00
Martin Babinsky 26d6c6fbbb ipa-dns-install: use LDAPI to connect to DS 
ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of
DNS/DNSSEC-related service and thus makes -p option obsolete.

Futhermore, now it makes more sense to use LDAPI also for API Backend
connections to DS and thus all forms of Kerberos auth were removed.

This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer
to fixing https://fedorahosted.org/freeipa/ticket/2957

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
Martin Babinsky 7b6bee030d ipa-dns-install: use STARTTLS to connect to DS 
BindInstance et al. now use STARTTLS to set up secure connection to DS during
ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
David Kupka 4a20115ce8 Restore default.conf and use it to build API. 
When restoring ipa after uninstallation we need to extract and load
configuration of the restored environment.

https://fedorahosted.org/freeipa/ticket/4896

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-03-05 12:17:23 +00:00
Martin Basti 52b7101c11 Fix uniqueness plugins 
* add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users
will not be forced to have unique uid

* remove unneded update plugins -> update was moved to .update file

* add uniqueness-across-all-subtrees required by user lifecycle
management

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Martin Basti 4b2ec5468f Migrate uniquess plugins configuration to new style 
New configuration style contains options required for user lifecycle
management.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Jan Cholasta 8713c5a695 replica-install: Use different API instance for the remote server 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-03-05 11:01:36 +01:00
Martin Basti d216cab619 Fix saving named restore status 
Accidentaly status was stored after service was stopped by installer

Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti b5e06b90c9 Uninstall configured services only 
Fixes:
dnskeysyncisntance - requires a stored state to be uninstalled
bindinstance - uninstal service only if bind was configured by IPA

Ticket:https://fedorahosted.org/freeipa/ticket/4869

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti f499e506c8 Fix do not enable service before storing status 
Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti c3edfa2d8c Fix restoring services status during uninstall 
Services hasn't been restored correctly, which causes disabling already
disabled services, or some service did not start. This patch fix these
issues.

Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Jan Cholasta deb70d5b13 Do not crash when replica is unreachable in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4857

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-27 16:44:02 +01:00
Martin Babinsky 55b7eed77e Use 'remove-ds.pl' to remove DS instance 
The patch adds a function which calls 'remove-ds.pl' during DS instance
removal. This should allow for a more thorough removal of DS related data
during server uninstallation (such as closing custom ports, cleaning up
slapd-* entries etc.)

This patch is related to https://fedorahosted.org/freeipa/ticket/4487.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-01-27 13:35:06 +01:00
Jan Cholasta c90286cbbc Create correct log directories during full restore in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4865

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-27 07:41:58 +00:00
Martin Kosek 0a7a8d6604 Add anonymous read ACI for DUA profile 
DUA profile(s) are consumed by Solaris clients.

https://fedorahosted.org/freeipa/ticket/4850

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-21 07:47:22 +00:00
Jan Cholasta 4994cd1d8d Put LDIF files to their original location in ipa-restore 
This prevents SELinux failures during online data restore.

https://fedorahosted.org/freeipa/ticket/4822

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-21 08:27:44 +01:00
Jan Cholasta 82ab0eabf8 Do not assume certmonger is running in httpinstance 
https://fedorahosted.org/freeipa/ticket/4835

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-20 15:35:18 +01:00
Martin Kosek 6652c4eb2e Allow PassSync user to locate and update NT users 
Add new PassSync Service privilege that have sufficient access to
let AD PassSync service search for NT users and update the password.
To make sure existing PassSync user keeps working, it is added as
a member of the new privilege.

New update plugin is added to add link to the new privilege to the
potentially existing PassSync user to avoid breaking the PassSync
service.

https://fedorahosted.org/freeipa/ticket/4837

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-19 16:49:27 +01:00
Martin Kosek 35c4fa2e36 Fix IPA_BACKUP_DIR path name 
Path name was not updated during patch rebase.

https://fedorahosted.org/freeipa/ticket/4797
 2015-01-14 13:05:09 +01:00
Jan Cholasta 10fe918acd Fix validation of ipa-restore options 
Fix restore mode checks. Do some of the existing checks earlier to make them
effective. Check if --instance and --backend exist both in the filesystem and
in the backup.

Log backup type and restore mode before performing restore.

Update ipa-restore man page.

https://fedorahosted.org/freeipa/ticket/4797

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-14 09:10:06 +01:00
Jan Cholasta b9ae769048 Make certificate renewal process synchronized 
Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 18:34:59 +00:00
Jan Cholasta 6a1304324f Restart dogtag when its server certificate is renewed 
https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 18:34:59 +00:00
Jan Cholasta 5bf1c9a6f7 Do not crash on unknown services in installutils.stopped_service 
https://fedorahosted.org/freeipa/ticket/4835

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 17:54:12 +00:00
Jan Cholasta 05e6adecb5 Remove RUV from LDIF files before using them in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4822

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-01-13 16:58:34 +00:00
Jan Cholasta abcbe271d5 Fix ipa-restore on systems without IPA installed 
https://fedorahosted.org/freeipa/ticket/4824

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-01-13 16:28:20 +00:00
David Kupka b6c58ff238 Abort backup restoration on not matching host. 
When restoring backup on master other than it was created there is high risk
of unexpected and hard-to-debug behavior. Refuse such restore.

https://fedorahosted.org/freeipa/ticket/4823

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-13 15:01:31 +00:00
Martin Basti 727f8099af Fix traceback if zonemgr error contains unicode 
Ticket: https://fedorahosted.org/freeipa/ticket/4805
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-12 17:10:22 +01:00
Martin Basti af6aece39b Fix zone find during forwardzone upgrade 
https://fedorahosted.org/freeipa/ticket/4818

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-01-09 13:30:37 +01:00
Martin Basti bb405bd972 Fix: Upgrade forwardzones zones after adding newer replica 
Patch fixes issue, when forwardzones has not been upgraded after adding
replica >=4.0 into topology with IPA 3.x servers.

Ticket: https://fedorahosted.org/freeipa/ticket/4818
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-01-09 13:30:37 +01:00
David Kupka 3c69435c1b Always add /etc/hosts record when DNS is being configured. 
This was done previosly but accidentally removed when later with patch for
ticket #3575.

https://fedorahosted.org/freeipa/ticket/4817

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-18 13:09:58 +01:00
Simo Sorce 8822be36d3 Stop saving the master key in a stash file 
This hasn't been used for a number of releases now, as ipa-kdb directly
fetches the key via LDAP.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-12-11 07:04:18 +01:00
Jan Cholasta 8f9c5988e2 Refer the user to freeipa.org when something goes wrong in ipa-cacert-manage 
https://fedorahosted.org/freeipa/ticket/4781

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-10 17:08:49 +00:00
Jan Cholasta f7f3c83748 Check subject name encoding in ipa-cacert-manage renew 
https://fedorahosted.org/freeipa/ticket/4781

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-12-10 17:07:05 +00:00
Gabe 6d3403edac Remove usage of app_PYTHON in ipaserver Makefiles 
- Remove ChangeLog from ipa-client/Makefile.am

https://fedorahosted.org/freeipa/ticket/4700

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-10 15:42:39 +01:00
Jan Cholasta 7b0149f32b Improve validation of --instance and --backend options in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4744

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-12-09 13:46:29 +00:00
Tomas Babej faec4ef9de certs: Fix incorrect flag handling in load_cacert 
For CA certificates that are not certificates of IPA CA, we incorrectly
set the trust flags to ",,", regardless what the actual trust_flags
parameter was passed.

Make the load_cacert method respect trust_flags and make it a required
argument.

https://fedorahosted.org/freeipa/ticket/4779

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-12-02 14:44:42 +00:00
Gabe 5f223a89ad Update default NTP configuration 
- Add in missing 4th default ntp server
- Add iburst to configuration

https://fedorahosted.org/freeipa/ticket/4583

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-12-02 12:36:03 +01:00
David Kupka 3a6d714bb2 Use singular in help metavars + update man pages. 
https://fedorahosted.org/freeipa/ticket/4695

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-11-26 14:33:23 +01:00
Martin Basti c13862104a Fix zonemgr option encoding detection 
Ticket: https://fedorahosted.org/freeipa/ticket/4766
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-25 13:15:44 +00:00
Jan Cholasta bef1d18878 Add TLS 1.2 to the protocol list in mod_nss config 
https://fedorahosted.org/freeipa/ticket/4653

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-11-25 12:44:13 +01:00
Martin Basti 230df95ed9 Fix detection of encoding in zonemgr option 
Ticket: https://fedorahosted.org/freeipa/ticket/4762
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-24 13:20:35 +00:00
Jan Cholasta aa9ecb253a Stop tracking certificates before restoring them in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4727

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-11-21 16:29:51 +01:00
David Kupka 373bbee4e3 ipa-restore: Check if directory is provided + better errors. 
https://fedorahosted.org/freeipa/ticket/4683

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-11-21 15:19:56 +01:00
Jan Cholasta 71c4d3e979 Use correct service name in cainstance.backup_config 
https://fedorahosted.org/freeipa/ticket/4754

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-11-21 13:22:11 +01:00
Martin Basti 7de424f425 Fix: read_ip_addresses should return ipaddr object 
Interactive prompt callback returns list of str instead of CheckedIPAddress
instances.

Ticket: https://fedorahosted.org/freeipa/ticket/4747
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-11-21 08:54:17 +00:00
Petr Vobornik a3c799f2f4 restore: clear httpd ccache after restore 
so that httpd ccache won't contain old credentials which would make ipa CLI fail with error:

 Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Decrypt integrity check failed)

https://fedorahosted.org/freeipa/ticket/4726

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-11-20 16:43:26 +01:00