public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,935 Commits 9 Branches 0 Tags
baed2e6f91ecc65d4c1a3473ee94de2ca365f983
Commit Graph
3552 Commits
Author SHA1 Message Date
Martin Basti 882ce85ad5 Server Upgrade: use LDIF parser to modify DSE.ldif 
Ticket: https://fedorahosted.org/freeipa/ticket/4925
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 522cbb23f1 move realm_to_serverid to installutils module 
To avoid cyclic imports realm_to_serverid function had to be moved to
installutils from dsinstance.

Required for: https://fedorahosted.org/freeipa/ticket/4925

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-05 11:56:49 +02:00
Martin Basti 81df7b501e Server Upgrade: fix a comment in ldapupdater 
DN sorting was removed in previous patches

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-05 11:47:49 +02:00
Gabe 26c1851e98 Remove unneeded ip-address option in ipa-adtrust-install 
https://fedorahosted.org/freeipa/ticket/4575

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-05-05 11:44:51 +02:00
Martin Basti 9f049ca144 Server Upgrade: Verify version and platform 
Verify version and platform before upgrade or ipactl start|restart

Upgrade:
* do not allow upgrade on different platforms
* do not allow upgrade data with higher version than build has

Start:
* do not start services if platform mismatch
* do not start services if upgrade is needed
* do not start services if data with higher version than build has

New ipactl options:
--skip-version-check: do not validate IPA version
--ignore-service-failures (was --force): ignore if a service start fail
      and continue with starting other services
--force: combine --skip-version-check and --ignore-service-failures

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00
Martin Basti 3942696606 Server Upgrade: ipa-server-upgrade command 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-05-04 11:16:26 +00:00
Martin Babinsky a1f91247cc point the users to PKI-related logs when CA configuration fails 
This patch adds an error handler which prints out the paths to logs related to
configuration and installation of Dogtag/CA in the case of failure.

https://fedorahosted.org/freeipa/ticket/4900

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-29 05:19:29 +00:00
David Kupka 9b706e74d5 Make lint work on Fedora 22. 
pylint added 'confidence' parameter to 'add_message' method of PyLinter.
To be compatible with both, pre- and post- 1.4  IPALinter must accept
the parameter but not pass it over.
Also python3 checker was added and enabled by default. FreeIPA is still
not ready for python3.
Additionally few false-positives was marked.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-27 11:02:57 +02:00
Petr Vobornik 4364ac08c5 speed up indirect member processing 
the old implementation tried to get all entries which are member of group.
That means also user. User can't have any members therefore this costly
processing was unnecessary.

New implementation reduces the search only to entries which have members.

Also page size was removed to avoid paging by small pages(default size: 100)
which is very slow for many members.

https://fedorahosted.org/freeipa/ticket/4947

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-27 05:55:04 +00:00
Petr Viktorin 5b3ee6842f rename_managed: Remove use of EditableDN 
This was the last use of EditableDN in IPA; the class can now be removed.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-23 11:34:39 +00:00
Martin Babinsky 3d2feac0e4 Adopted kinit_keytab and kinit_password for kerberos auth 
Calls to ipautil.run using kinit were replaced with calls
kinit_keytab/kinit_password functions implemented in the PATCH 0015.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-04-20 08:27:35 +00:00
Jan Cholasta 955885d8d9 ldap: Move value encoding from IPASimpleLDAPObject to LDAPClient 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Jan Cholasta 8dca1cbd53 cainstance: Use LDAPClient instead of IPASimpleLDAPObject 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Jan Cholasta e1f7bcfbea ldap: Use LDAPClient instead of IPASimpleLDAPObject in ldap2.modify_password 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Jan Cholasta 32505157ea ldap: Use LDAPClient bind and unbind methods in ldap2 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Jan Cholasta 8f263df245 ldap: Use LDAPClient connection management in ldap2 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Jan Cholasta 02e1ebe07c ldap: Add connection management to LDAPClient 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Martin Basti b9c5744031 Server Upgrade: only root can run updates 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti d09706a8c8 Server Upgrade: restart DS using ipaplatfom service 
Removes extra class DSRestart which do the same thing

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b605ccc94b Server Upgrade: use ldap2 connection in fix_replica_agreements 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 4aec9d2280 Server Upgrade: Handle connection better in updates_from_dict 
Connection should be closed if update is done

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 0e752aab29 Server Upgrade: plugins should use ldapupdater API instance 
This is required to have proper LDAP connection in plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti f24f614396 Server Upgrade: specify order of plugins in update files 
* add 'plugin' directive
* specify plugins order in update files
* remove 'run plugins' options
* use ldapupdater API instance in plugins
* add update files representing former PreUpdate and PostUpdate order of plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti cc19b5a76a Server Upgrade: Apply plugin updates immediately 
Preparation to moving plugins executin into update files.
* remove apply_now flag
* plugins will return only (restart, modifications)

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b4ca5c57d2 Server Upgrade: remove unused code in upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 13c4631813 Server Upgrade: use only LDAPI connection 
Use only ldapi connection to execute upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b92136cba2 Fix ldap2 shared connection 
Since API is not singleton anymore, ldap2 connections should not be
shared by default.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-02 12:26:04 +00:00
Martin Babinsky c311af06f6 fix improper handling of boolean option in 
read_replica_info_kra_enabled

This patch fixes https://fedorahosted.org/freeipa/ticket/4530.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-02 11:31:27 +00:00
Martin Basti b5e941d49b Server Upgrade: Fix comments 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-02 08:42:43 +00:00
David Kupka 5a03462bfc Use mod_auth_gssapi instead of mod_auth_kerb. 
https://fedorahosted.org/freeipa/ticket/4190

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-03-30 13:06:12 +00:00
Jan Cholasta fa50068607 upload_cacrt: Fix empty cACertificate in cn=CAcert 
https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
Martin Basti c3d441ae03 Server Upgrade: remove --test option 
As --test option is not used for developing, and it is not recommended
to test if upgrade will pass, this path removes it copmletely.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:48:41 +01:00
Tomas Babej 4190b1a47c Revert "Server Upgrade: respect --test option in plugins" 
This reverts commit c95c4849ae.
 2015-03-19 12:48:06 +01:00
Martin Basti c95c4849ae Server Upgrade: respect --test option in plugins 
Several plugins do the LDAP data modification directly.
In test mode these plugis should not be executed.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:40:24 +01:00
Martin Basti a42fcfc18b Server Upgrade: order update files by default 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 0c7274ead8 Server Upgrade: Update entries in order specified in file 
Dictionary replaced with list. Particular upgrades are
executed in the same order as they are specified in update
a file.

Different updates for the smae cn, are not merged into one upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 144bc6c1eb Server Upgrade: Set modified to false, before each update 
Variable self.modified should be set to false before each run of update

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 10bc6bd0bf Server Upgrade: Upgrade one file per time 
* Files are sorted alphabetically, no numbering required anymore
* One file updated per time

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti bb1d7a741c Server Upgrade: do not sort updates by DN 
Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti d3f5d5d1ff Server Upgrade: Remove unused PRE_SCHEMA_UPDATE 
This is not used anymore.

Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:33:22 +01:00
Martin Babinsky 26d6c6fbbb ipa-dns-install: use LDAPI to connect to DS 
ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of
DNS/DNSSEC-related service and thus makes -p option obsolete.

Futhermore, now it makes more sense to use LDAPI also for API Backend
connections to DS and thus all forms of Kerberos auth were removed.

This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer
to fixing https://fedorahosted.org/freeipa/ticket/2957

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
Martin Babinsky 7b6bee030d ipa-dns-install: use STARTTLS to connect to DS 
BindInstance et al. now use STARTTLS to set up secure connection to DS during
ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
David Kupka 4a20115ce8 Restore default.conf and use it to build API. 
When restoring ipa after uninstallation we need to extract and load
configuration of the restored environment.

https://fedorahosted.org/freeipa/ticket/4896

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-03-05 12:17:23 +00:00
Martin Basti 52b7101c11 Fix uniqueness plugins 
* add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users
will not be forced to have unique uid

* remove unneded update plugins -> update was moved to .update file

* add uniqueness-across-all-subtrees required by user lifecycle
management

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Martin Basti 4b2ec5468f Migrate uniquess plugins configuration to new style 
New configuration style contains options required for user lifecycle
management.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Jan Cholasta 8713c5a695 replica-install: Use different API instance for the remote server 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-03-05 11:01:36 +01:00
Jan Cholasta d7ef7e1ca0 ldap2: Use self API instance instead of ipalib.api 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-03-05 11:01:36 +01:00
Jan Cholasta 2625efa727 advise: Add separate API object for ipa-advise 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-03-05 11:01:36 +01:00
Martin Basti d216cab619 Fix saving named restore status 
Accidentaly status was stored after service was stopped by installer

Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti b5e06b90c9 Uninstall configured services only 
Fixes:
dnskeysyncisntance - requires a stored state to be uninstalled
bindinstance - uninstal service only if bind was configured by IPA

Ticket:https://fedorahosted.org/freeipa/ticket/4869

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00