public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,024 Commits 9 Branches 0 Tags
f19f3e57419df112c1d83aebddc71663e49b659f
Commit Graph
882 Commits
Author SHA1 Message Date
David Kupka 9b706e74d5 Make lint work on Fedora 22. 
pylint added 'confidence' parameter to 'add_message' method of PyLinter.
To be compatible with both, pre- and post- 1.4  IPALinter must accept
the parameter but not pass it over.
Also python3 checker was added and enabled by default. FreeIPA is still
not ready for python3.
Additionally few false-positives was marked.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-27 11:02:57 +02:00
Petr Viktorin 5b3ee6842f rename_managed: Remove use of EditableDN 
This was the last use of EditableDN in IPA; the class can now be removed.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-23 11:34:39 +00:00
Jan Cholasta 8dca1cbd53 cainstance: Use LDAPClient instead of IPASimpleLDAPObject 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2015-04-16 06:58:31 +00:00
Martin Basti b9c5744031 Server Upgrade: only root can run updates 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti d09706a8c8 Server Upgrade: restart DS using ipaplatfom service 
Removes extra class DSRestart which do the same thing

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b605ccc94b Server Upgrade: use ldap2 connection in fix_replica_agreements 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 4aec9d2280 Server Upgrade: Handle connection better in updates_from_dict 
Connection should be closed if update is done

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 0e752aab29 Server Upgrade: plugins should use ldapupdater API instance 
This is required to have proper LDAP connection in plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti f24f614396 Server Upgrade: specify order of plugins in update files 
* add 'plugin' directive
* specify plugins order in update files
* remove 'run plugins' options
* use ldapupdater API instance in plugins
* add update files representing former PreUpdate and PostUpdate order of plugins

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti cc19b5a76a Server Upgrade: Apply plugin updates immediately 
Preparation to moving plugins executin into update files.
* remove apply_now flag
* plugins will return only (restart, modifications)

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti b4ca5c57d2 Server Upgrade: remove unused code in upgrade 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Basti 13c4631813 Server Upgrade: use only LDAPI connection 
Use only ldapi connection to execute upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-14 19:25:47 +02:00
Martin Babinsky c311af06f6 fix improper handling of boolean option in 
read_replica_info_kra_enabled

This patch fixes https://fedorahosted.org/freeipa/ticket/4530.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-02 11:31:27 +00:00
Martin Basti b5e941d49b Server Upgrade: Fix comments 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-04-02 08:42:43 +00:00
Jan Cholasta fa50068607 upload_cacrt: Fix empty cACertificate in cn=CAcert 
https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
Martin Basti c3d441ae03 Server Upgrade: remove --test option 
As --test option is not used for developing, and it is not recommended
to test if upgrade will pass, this path removes it copmletely.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:48:41 +01:00
Tomas Babej 4190b1a47c Revert "Server Upgrade: respect --test option in plugins" 
This reverts commit c95c4849ae.
 2015-03-19 12:48:06 +01:00
Martin Basti c95c4849ae Server Upgrade: respect --test option in plugins 
Several plugins do the LDAP data modification directly.
In test mode these plugis should not be executed.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:40:24 +01:00
Martin Basti a42fcfc18b Server Upgrade: order update files by default 
https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 0c7274ead8 Server Upgrade: Update entries in order specified in file 
Dictionary replaced with list. Particular upgrades are
executed in the same order as they are specified in update
a file.

Different updates for the smae cn, are not merged into one upgrade

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 144bc6c1eb Server Upgrade: Set modified to false, before each update 
Variable self.modified should be set to false before each run of update

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti 10bc6bd0bf Server Upgrade: Upgrade one file per time 
* Files are sorted alphabetically, no numbering required anymore
* One file updated per time

Ticket: https://fedorahosted.org/freeipa/ticket/3560
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti bb1d7a741c Server Upgrade: do not sort updates by DN 
Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:37:09 +01:00
Martin Basti d3f5d5d1ff Server Upgrade: Remove unused PRE_SCHEMA_UPDATE 
This is not used anymore.

Ticket: https://fedorahosted.org/freeipa/ticket/4904
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 12:33:22 +01:00
Martin Babinsky 26d6c6fbbb ipa-dns-install: use LDAPI to connect to DS 
ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of
DNS/DNSSEC-related service and thus makes -p option obsolete.

Futhermore, now it makes more sense to use LDAPI also for API Backend
connections to DS and thus all forms of Kerberos auth were removed.

This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer
to fixing https://fedorahosted.org/freeipa/ticket/2957

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
Martin Babinsky 7b6bee030d ipa-dns-install: use STARTTLS to connect to DS 
BindInstance et al. now use STARTTLS to set up secure connection to DS during
ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-03-18 12:31:23 +01:00
David Kupka 4a20115ce8 Restore default.conf and use it to build API. 
When restoring ipa after uninstallation we need to extract and load
configuration of the restored environment.

https://fedorahosted.org/freeipa/ticket/4896

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-03-05 12:17:23 +00:00
Martin Basti 52b7101c11 Fix uniqueness plugins 
* add uniqueness-subtree-entries-oc:posixAccount to ensure idviews users
will not be forced to have unique uid

* remove unneded update plugins -> update was moved to .update file

* add uniqueness-across-all-subtrees required by user lifecycle
management

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Martin Basti 4b2ec5468f Migrate uniquess plugins configuration to new style 
New configuration style contains options required for user lifecycle
management.

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-03-05 12:43:35 +01:00
Jan Cholasta 8713c5a695 replica-install: Use different API instance for the remote server 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-03-05 11:01:36 +01:00
Martin Basti d216cab619 Fix saving named restore status 
Accidentaly status was stored after service was stopped by installer

Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti b5e06b90c9 Uninstall configured services only 
Fixes:
dnskeysyncisntance - requires a stored state to be uninstalled
bindinstance - uninstal service only if bind was configured by IPA

Ticket:https://fedorahosted.org/freeipa/ticket/4869

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti f499e506c8 Fix do not enable service before storing status 
Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Martin Basti c3edfa2d8c Fix restoring services status during uninstall 
Services hasn't been restored correctly, which causes disabling already
disabled services, or some service did not start. This patch fix these
issues.

Ticket: https://fedorahosted.org/freeipa/ticket/4869
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-02-18 10:05:45 +01:00
Jan Cholasta deb70d5b13 Do not crash when replica is unreachable in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4857

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-27 16:44:02 +01:00
Martin Babinsky 55b7eed77e Use 'remove-ds.pl' to remove DS instance 
The patch adds a function which calls 'remove-ds.pl' during DS instance
removal. This should allow for a more thorough removal of DS related data
during server uninstallation (such as closing custom ports, cleaning up
slapd-* entries etc.)

This patch is related to https://fedorahosted.org/freeipa/ticket/4487.

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-01-27 13:35:06 +01:00
Jan Cholasta c90286cbbc Create correct log directories during full restore in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4865

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-27 07:41:58 +00:00
Martin Kosek 0a7a8d6604 Add anonymous read ACI for DUA profile 
DUA profile(s) are consumed by Solaris clients.

https://fedorahosted.org/freeipa/ticket/4850

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-21 07:47:22 +00:00
Jan Cholasta 4994cd1d8d Put LDIF files to their original location in ipa-restore 
This prevents SELinux failures during online data restore.

https://fedorahosted.org/freeipa/ticket/4822

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-21 08:27:44 +01:00
Jan Cholasta 82ab0eabf8 Do not assume certmonger is running in httpinstance 
https://fedorahosted.org/freeipa/ticket/4835

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-20 15:35:18 +01:00
Martin Kosek 6652c4eb2e Allow PassSync user to locate and update NT users 
Add new PassSync Service privilege that have sufficient access to
let AD PassSync service search for NT users and update the password.
To make sure existing PassSync user keeps working, it is added as
a member of the new privilege.

New update plugin is added to add link to the new privilege to the
potentially existing PassSync user to avoid breaking the PassSync
service.

https://fedorahosted.org/freeipa/ticket/4837

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-19 16:49:27 +01:00
Martin Kosek 35c4fa2e36 Fix IPA_BACKUP_DIR path name 
Path name was not updated during patch rebase.

https://fedorahosted.org/freeipa/ticket/4797
 2015-01-14 13:05:09 +01:00
Jan Cholasta 10fe918acd Fix validation of ipa-restore options 
Fix restore mode checks. Do some of the existing checks earlier to make them
effective. Check if --instance and --backend exist both in the filesystem and
in the backup.

Log backup type and restore mode before performing restore.

Update ipa-restore man page.

https://fedorahosted.org/freeipa/ticket/4797

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-01-14 09:10:06 +01:00
Jan Cholasta b9ae769048 Make certificate renewal process synchronized 
Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 18:34:59 +00:00
Jan Cholasta 6a1304324f Restart dogtag when its server certificate is renewed 
https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 18:34:59 +00:00
Jan Cholasta 5bf1c9a6f7 Do not crash on unknown services in installutils.stopped_service 
https://fedorahosted.org/freeipa/ticket/4835

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-13 17:54:12 +00:00
Jan Cholasta 05e6adecb5 Remove RUV from LDIF files before using them in ipa-restore 
https://fedorahosted.org/freeipa/ticket/4822

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-01-13 16:58:34 +00:00
Jan Cholasta abcbe271d5 Fix ipa-restore on systems without IPA installed 
https://fedorahosted.org/freeipa/ticket/4824

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-01-13 16:28:20 +00:00
David Kupka b6c58ff238 Abort backup restoration on not matching host. 
When restoring backup on master other than it was created there is high risk
of unexpected and hard-to-debug behavior. Refuse such restore.

https://fedorahosted.org/freeipa/ticket/4823

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-01-13 15:01:31 +00:00
Martin Basti 727f8099af Fix traceback if zonemgr error contains unicode 
Ticket: https://fedorahosted.org/freeipa/ticket/4805
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-01-12 17:10:22 +01:00