public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,856 Commits 9 Branches 0 Tags
c4ed025001895bfc65c613cabbbfcb27c19cc29f
Commit Graph
249 Commits
Author SHA1 Message Date
Simo Sorce 077d6a0d35 Make KDC listen to TCP port as well by default 2009-01-26 14:44:40 -05:00
Simo Sorce 2b8b87b4d6 memberof was not indexed in older versions of fedora-ds, keep it around 
as an update so that if it is not there it will be added
 2008-12-05 18:18:14 -05:00
Simo Sorce 7c5ae7f402 Fix stupid typo in update file 2008-12-03 12:03:04 -05:00
Simo Sorce d006587937 Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster. 2008-12-02 19:28:51 -05:00
Simo Sorce 3fb6343149 Fix makefiles after schema compat changes 2008-12-02 16:39:57 -05:00
Nathan Kinder f9d6ac9529 Corrected usage messages and manpage to match the logic for the ipa-replica-manage init command. 2008-12-01 17:19:10 -05:00
Simo Sorce 78166d949c Run updates on the replica too, otherwise changes to cn=config will be missing. 2008-12-01 17:19:10 -05:00
Simo Sorce 3a263e9466 Make sure the CA cert is copied to the replica, fail if no ca.crt is available. Cope with some versions of ipa that forgot to copy the ca.crt cert in the right place. 2008-12-01 17:19:10 -05:00
Simo Sorce 5d1d292c15 Add tool to enable or disable the schema compatibility plugin 2008-12-01 17:19:10 -05:00
Rich Megginson 502aff73a2 do not use ipaerror directly in ipa-replica-manage - use ldap exception instead 2008-11-25 18:09:49 -05:00
Rob Crittenden 93c2e4e3b4 Present a less-cryptic error if the replication agreement doesn't exist 2008-11-12 15:53:00 -05:00
Rob Crittenden 17261c2520 Create a user for Windows PassSync and grant password changing permissions 
This does 3 things:
1. Create a user for the Windows PassSync service
2. Add this use to the list of users that can skip password policies
3. Add an aci that grants permission to write the password attributes

471130
 2008-11-12 15:52:57 -05:00
Rob Crittenden 49e4876ba9 Fix deleting a winsync replication agreement. 2008-11-12 15:52:51 -05:00
Rob Crittenden 08c49c5806 Install replication update file 2008-10-31 12:34:30 -04:00
Rob Crittenden f305864d90 Ensure that every replica gets a unique replication ID. Otherwise changes won't propogate between all replicas. 
468732
 2008-10-29 17:08:27 -04:00
Rich Megginson f02d1429ca add update to fix the index for the winsync attributes 2008-10-13 14:09:15 -04:00
Rich Megginson 9f18858e58 add --win-subtree argument to ipa-replica-manage 2008-10-13 14:09:13 -04:00
Rich Megginson d3637dde7c Just add eq,pres to the existing indices 
There are already indexes created for ntUniqueID and ntUserDomainID by default
We just need to make sure they are indexed for equality and presence
 2008-10-13 14:09:12 -04:00
Rich Megginson 28195610f6 Add more winsync support to cli 
The ipa-replica-manage list, init, and synch commands do not work for winsync
agreements.  This patch adds that support and some additional verbose logging.

The synch_master did not work correctly.  The way it should work is to set
the replication schedule to some bogus value, then reset it back to its
original setting.  This will force replication to take place immediately.
 2008-10-13 14:09:10 -04:00
Rich Megginson e8bebebc23 fix issues brought up by initial review of ipa winsync enhancements 2008-10-13 14:09:08 -04:00
Rich Megginson be5e783f72 add --no-host-dns option to ipa-server-install - allows specifying a hostname that might actually exist but you do not want to even attempt to resolve it via DNS 2008-10-13 14:09:07 -04:00
Rich Megginson 5a5bfa2c70 Added support to IPA server install to install the winsync plugin configuration entry Added support to ipa-replica-manage to add winsync agreements. I mostly used the existing code for setting up replication agreements since replication and winsync are quite similar in their configuration. I just had to add some extra attributes to the sync agreement configuration. The tricky part was importing the Windows CA cert. 2008-10-13 14:09:07 -04:00
Rob Crittenden ca07cdb390 Add detection to the update tool to detect when it would apply changes. 
Remove SUP name from RFC2307bis.update to match FDS
 2008-09-19 18:04:40 -04:00
Martin Nagy 1634e09973 Add standard override options to ipa-replica-prepare 
Fixes: 462489
 2008-09-17 23:06:18 +02:00
Rob Crittenden f736253b93 Run the LDAP updater at the end of the installation process. 
Running at the end ensures that /etc/ipa/ipa.conf is created and generally
makes it more likely to succeed.

Added a new argument to ipa-server-installl, -y <password_file>, so we
don't have to pass it on the command-line.
 2008-09-17 20:56:08 -04:00
Rob Crittenden 1eec34393b Update files for the schema compatibility plugin and RFC4876 profiles 
Also handle syntax errors a bit more gracefully and allow the updater to
work on more than one file at a time.

Adjust to new config.py and use a custom exception class for syntax errors.

Also fix a error in parsing the separate files

Include slapi-nis in Requires

Includes work provided by Martin Nagy

460055
 2008-09-12 20:07:41 -04:00
Rob Crittenden d33b7fc839 The True/False logic was reversed, so "no" meant remove the existing instance 2008-09-12 19:38:48 -04:00
Martin Nagy 885103c321 Rework config.py and change cli tools. Maintain order of IPA servers from command line, config and DNS. Parse options before detecting IPA configuration. Don't ignore rest of the options if one is missing in ipa.conf. Drop the --usage options, we will rely on --help. Fixes: 458869, 459070, 458980, 459234 2008-09-11 23:34:01 +02:00
Simo Sorce 8e7c98eb7f CVE 2008 3274 related fixes 2008-09-10 15:07:33 -04:00
Rob Crittenden 4be5d862a6 When installing with an IPA-created CA generate the Firefox autoconfiguration files. 
458871
 2008-08-14 18:07:52 -04:00
Simo Sorce f5177e6b84 Install the ca.crt file early on so that we can always enforce SSL 
protected connections to other LDAP servers
Fix error reporting on replica creation.
 2008-08-13 15:36:57 -04:00
Simo Sorce 0368d4329a Used the encrypt_file and decrypt_file utility functions to encrypt replica 
information. This way we do not risk to leave around sensitive data.
Set the destination host in the replica file too and do checks against
in ipa-replica-install
 2008-08-11 18:30:57 -04:00
Martin Nagy fbc74a0cb4 Fix few syntax errors. 2008-08-06 19:17:13 +02:00
Rob Crittenden df2b40303f Fix python syntax error: missing colon. 2008-08-06 11:27:30 -04:00
Rob Crittenden cf06dd9f84 Don't assume that the Firefox autoconfig files exist. 
These are created by an object-signing cert and needs to be done
after the fact if a server is created with user-supplied PKCS#12 files.

452402
 2008-07-28 09:54:16 -04:00
Rob Crittenden a19d27717a Move the self-signed CA serialno file to /var/lib/ipa to adhere to the FHS 
455064
 2008-07-25 09:05:14 -04:00
Martin Nagy f7ca405716 Wrap up the raw_input() to user_input() for convenience and uniformity. 2008-07-23 10:05:06 -04:00
Rob Crittenden 6980b07303 Rework the way SSL certificates are imported from PKCS#12 files. 
Add the ability to provide PKCS#12 files during initial installation
Add the ability to provide PKCS#12 files when preparing a replica
Correct some issues with ipa-server-certinstall

452402
 2008-07-14 09:06:52 -04:00
Simo Sorce f86c8420b1 Admin must be able to add/delete too 2008-07-09 16:50:54 -04:00
Rob Crittenden fb9f92c9f3 Merge branch 'master' of ssh://rcritten@git.fedorahosted.org/git/freeipa 2008-07-03 15:20:36 -04:00
Rob Crittenden 1bd0a868a2 NSS_DIR is already fetched into a variable, use that instead. 
451098
 2008-07-03 15:20:19 -04:00
Simo Sorce 675df04806 Make sure we listen only on the krb5 port and therefore disable krb4 support 2008-07-02 15:24:36 -04:00
Rob Crittenden e9196e2d93 Properly convert the realm to a DS instance name 
451014
 2008-07-01 15:07:00 -04:00
Rob Crittenden ec597b0ef1 Ensure correct permissions and file ownership of Apache NSS database 
451098
 2008-07-01 15:06:59 -04:00
Simo Sorce d2bd1b29a0 Must index uidnumber and gidnumber and any attribute that dna plugin is going 
to generate or that we need to search on.
 2008-06-12 19:06:38 -04:00
Simo Sorce 9c34dde165 Change default. 
By default increment by one  but set the maximum value to one million.

when installing a replica change values to start from 1 million +1 and
cap it to 2 million and so on for any other replica.
 2008-06-12 19:05:45 -04:00
Rob Crittenden 4665700fef Index the memberof attribute 
450951
 2008-06-11 17:26:45 -04:00
Rob Crittenden d1322c6517 Ensure that the realm name is upper-case. 
449182
 2008-06-09 22:18:00 -04:00
Rob Crittenden 77483ac808 Make it clear which packages are being configured and which aren't. 
450175
 2008-06-09 22:09:19 -04:00
Rob Crittenden d600f9bb09 Fix typo 
450077
 2008-06-05 09:00:20 -04:00