ipaserver: Move /etc/httpd/ipa to /etc/ipa/httpd

ipaserver: Use apache VirtualHost for IPA UI
Become IPA 4.11.0
2023-11-12 17:35:42 +01:00 · 2023-11-12 17:35:35 +01:00 · 2023-10-03 14:45:56 +02:00 · 2023-10-03 14:43:19 +02:00 · 2023-10-03 14:40:40 +02:00 · 2023-10-02 17:44:23 -04:00
17 changed files with 166 additions and 79 deletions
@@ -20,7 +20,7 @@
 #  ->  "1.0.0"                                         #
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
-define(IPA_VERSION_MINOR, 12)
+define(IPA_VERSION_MINOR, 11)
 define(IPA_VERSION_RELEASE, 0)

 ########################################################
@@ -49,7 +49,7 @@ define(IPA_VERSION_PRE_RELEASE, )
 # This option works only with GNU m4:                  #
 # it requires esyscmd m4 macro.                        #
 ########################################################
-define(IPA_VERSION_IS_GIT_SNAPSHOT, yes)
+define(IPA_VERSION_IS_GIT_SNAPSHOT, no)

 ########################################################
 # git development branch:                              #
@@ -1555,10 +1555,11 @@ fi
 %dir %{_sysconfdir}/ipa/html
 %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
 %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
-%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
+%dir %{_sysconfdir}/ipa/http
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-rewrite.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-kdc-proxy.conf
+%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-pki-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
 %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf
@@ -101,6 +101,7 @@ dist_app_DATA =				\
 	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf.template	\
 	ipa-rewrite.conf.template	\
+	ipa-vhost.conf.template		\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\
@@ -0,0 +1,50 @@
+#
+# VERSION 32 - DO NOT REMOVE THIS LINE
+#
+# This file may be overwritten on upgrades.
+#
+
+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
+# Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
+
+<VirtualHost *:80>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
+
+# the below section is only need if you have above 3 lines and want SSL
+<VirtualHost *:443>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    # SSL
+    SSLEngine on
+    SSLCertificateFile $HTTPD_CERT_FILE
+    SSLCertificateKeyFile $HTTPD_KEY_FILE
+    SSLCACertificateFile $IPA_CA_CRT
+    SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH
+
+    # FreeIPA
+    IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
@@ -35,19 +35,11 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml \
 application/javascript application/json text/css \
 application/x-font-ttf

-# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
-# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
-WSGISocketPrefix $WSGI_PREFIX_DIR
-
 # Configure mod_wsgi handler for /ipa
-WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
-  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
-  lang=C.UTF-8 locale=C.UTF-8
 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \
  application-group=%{GLOBAL}
 WSGIScriptReloading Off

-
 # Turn off mod_msgi handler for errors, config, crl:
 <Location "/ipa/errors">
  SetHandler None
@@ -45,11 +45,13 @@ class BasePathNamespace:
    GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
    OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
    HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd"
    HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf"
    HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
    HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"
@@ -20,10 +20,12 @@ class DebianPathNamespace(BasePathNamespace):
    ETC_HTTPD_DIR = "/etc/apache2"
    HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
    HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
    HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
    HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"
@@ -17,10 +17,12 @@ class SusePathNamespace(BasePathNamespace):
    HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
    GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
    HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
    HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
    HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"
@@ -111,6 +111,14 @@ class HTTPInstance(service.Service):
            IPA_CCACHES=paths.IPA_CCACHES,
            WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
            WSGI_PROCESSES=constants.WSGI_PROCESSES,
+            HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+            HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+            HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+            HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+            HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+            IPA_CA_CRT=paths.IPA_CA_CRT,
+            MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
        )
        self.ca_file = ca_file
        if ca_is_configured is not None:
@@ -128,7 +136,6 @@ class HTTPInstance(service.Service):
        self.step("configuring mod_ssl log directory",
                  self.set_mod_ssl_logdir)
        self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp)
-        self.step("adding URL rewriting rules", self.__add_include)
        self.step("configuring httpd", self.__configure_http)
        self.step("setting up httpd keytab", self.request_service_keytab)
        self.step("configuring Gssproxy", self.configure_gssproxy)
@@ -197,6 +204,14 @@ class HTTPInstance(service.Service):
        # https://pagure.io/freeipa/issue/7662
        tasks.restore_context(session_dir)

+        # create /etc/httpd/ipa
+        if not os.path.isdir(paths.HTTPD_IPA_DIR):
+            os.makedirs(paths.HTTPD_IPA_DIR)
+        # Must be world-readable / executable
+        os.chmod(paths.HTTPD_IPA_DIR, 0o755)
+        # Restore SELinux context of /etc/httpd/ipa
+        tasks.restore_context(paths.HTTPD_IPA_DIR)
+
        target_fname = paths.HTTPD_IPA_CONF
        http_txt = ipautil.template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -208,6 +223,17 @@ class HTTPInstance(service.Service):
        http_fd.close()
        os.chmod(target_fname, 0o644)

+        target_fname = paths.HTTPD_IPA_SITE_CONF
+        http_txt = ipautil.template_file(
+            os.path.join(paths.USR_SHARE_IPA_DIR,
+                         "ipa-vhost.conf.template"),
+            self.sub_dict)
+        self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
+        http_fd = open(target_fname, "w")
+        http_fd.write(http_txt)
+        http_fd.close()
+        os.chmod(target_fname, 0o644)
+
        target_fname = paths.HTTPD_IPA_REWRITE_CONF
        http_txt = ipautil.template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -285,17 +311,6 @@ class HTTPInstance(service.Service):
            aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
            aug.save()

-    def __add_include(self):
-        """This should run after __set_mod_nss_port so is already backed up"""
-        if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
-                                    '</VirtualHost>',
-                                    'Include {path}\n'
-                                    '</VirtualHost>'.format(
-                                        path=paths.HTTPD_IPA_REWRITE_CONF)
-                                    ) != 0:
-            self.print_msg("Adding Include conf.d/ipa-rewrite to "
-                           "%s failed." % paths.HTTPD_SSL_SITE_CONF)
-
    def configure_certmonger_renewal_guard(self):
        certmonger = services.knownservices.certmonger
        certmonger_stopped = not certmonger.is_running()
@@ -553,13 +568,14 @@ class HTTPInstance(service.Service):
            paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host),
            paths.HTTPD_IPA_REWRITE_CONF,
            paths.HTTPD_IPA_CONF,
+            paths.HTTPD_IPA_SITE_CONF,
            paths.HTTPD_IPA_PKI_PROXY_CONF,
            paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
            paths.HTTPD_IPA_KDCPROXY_CONF,
            paths.GSSPROXY_CONF,
            paths.GSSAPI_SESSION_KEY,
            paths.HTTPD_PASSWORD_CONF,
-            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
+            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF
        ]
        # NSS DB backups
        remove_files.extend(
@@ -671,7 +687,6 @@ class HTTPInstance(service.Service):
        self.configure_mod_ssl_certs()
        self.set_mod_ssl_protocol()
        self.set_mod_ssl_logdir()
-        self.__add_include()

        self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE)

@@ -154,6 +154,7 @@ class Backup(admintool.AdminTool):
        paths.HTTPD_CERT_FILE,
        paths.HTTPD_KEY_FILE,
        paths.HTTPD_IPA_CONF,
+        paths.HTTPD_IPA_SITE_CONF,
        paths.SSHD_CONFIG,
        paths.SSHD_IPA_CONFIG,
        paths.SSH_CONFIG,
@@ -22,7 +22,7 @@ import six

 from ipaclient.install.client import check_ldap_conf, sssd_enable_ifp
 import ipaclient.install.timeconf
-from ipalib.install import sysrestore
+from ipalib.install import certstore, sysrestore
 from ipalib.install.kinit import kinit_keytab
 from ipapython import ipaldap, ipautil
 from ipapython.dn import DN
@@ -32,7 +32,7 @@ from ipapython.ipachangeconf import IPAChangeConf
 from ipaplatform import services
 from ipaplatform.tasks import tasks
 from ipaplatform.paths import paths
-from ipalib import api, constants, create_api, errors, rpc
+from ipalib import api, constants, create_api, errors, rpc, x509
 from ipalib.config import Env
 from ipalib.facts import is_ipa_configured, is_ipa_client_configured
 from ipalib.util import no_matching_interface_for_ip_address_warning
@@ -132,6 +132,24 @@ def install_krb(config, setup_pkinit=False, pkcs12_info=None, fstore=None):
    return krb


+def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
+    try:
+        try:
+            certs = certstore.get_ca_certs(ldap, base_dn, realm, False)
+        except errors.NotFound:
+            try:
+                shutil.copy(cafile, destfile)
+            except shutil.Error:
+                # cafile == IPA_CA_CRT
+                pass
+        else:
+            certs = [c[0] for c in certs if c[2] is not False]
+            x509.write_certificate_list(certs, destfile, mode=0o644)
+    except Exception as e:
+        raise ScriptError("error copying files: " + str(e))
+    return destfile
+
+
 def install_http(config, auto_redirect, ca_is_configured, ca_file,
                 pkcs12_info=None, fstore=None):
    # if we have a pkcs12 file, create the cert db from
@@ -793,8 +811,7 @@ def promote_check(installer):
        raise ScriptError("--setup-ca and --*-cert-file options are "
                          "mutually exclusive")

-    ipa_client_installed = is_ipa_client_configured(on_master=True)
-    if not ipa_client_installed:
+    if not is_ipa_client_configured(on_master=True):
        # One-step replica installation
        if options.password and options.admin_password:
            raise ScriptError("--password and --admin-password options are "
@@ -935,13 +952,10 @@ def promote_check(installer):
                 paths.KRB5_KEYTAB,
                 ccache)

-    if ipa_client_installed:
-        # host was already an IPA client, refresh client cert stores to
-        # ensure we have up to date CA certs.
-        try:
-            ipautil.run([paths.IPA_CERTUPDATE])
-        except ipautil.CalledProcessError:
-            raise RuntimeError("ipa-certupdate failed to refresh certs.")
+    cafile = paths.IPA_CA_CRT
+    if not os.path.isfile(cafile):
+        raise RuntimeError("CA cert file is not available! Please reinstall"
+                           "the client and try again.")

    remote_api = remote_connection(config)
    installer._remote_api = remote_api
@@ -1206,14 +1220,14 @@ def promote_check(installer):
                config.master_host_name, config.host_name, config.realm_name,
                options.setup_ca, 389,
                options.admin_password, principal=options.principal,
-                ca_cert_file=paths.IPA_CA_CRT)
+                ca_cert_file=cafile)
        finally:
            if add_to_ipaservers:
                os.environ['KRB5CCNAME'] = ccache

    installer._ca_enabled = ca_enabled
    installer._kra_enabled = kra_enabled
-    installer._ca_file = paths.IPA_CA_CRT
+    installer._ca_file = cafile
    installer._fstore = fstore
    installer._sstore = sstore
    installer._config = config
@@ -1234,6 +1248,7 @@ def install(installer):
    fstore = installer._fstore
    sstore = installer._sstore
    config = installer._config
+    cafile = installer._ca_file
    dirsrv_pkcs12_info = installer._dirsrv_pkcs12_info
    http_pkcs12_info = installer._http_pkcs12_info
    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
@@ -1285,10 +1300,18 @@ def install(installer):

    try:
        conn.connect(ccache=ccache)
+
+        # Update and istall updated CA file
+        cafile = install_ca_cert(conn, api.env.basedn, api.env.realm, cafile)
+        install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
+                        destfile=paths.KDC_CA_BUNDLE_PEM)
+        install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
+                        destfile=paths.CA_BUNDLE_PEM)
+
        # Configure dirsrv
        ds = install_replica_ds(config, options, ca_enabled,
                                remote_api,
-                                ca_file=paths.IPA_CA_CRT,
+                                ca_file=cafile,
                                pkcs12_info=dirsrv_pkcs12_info,
                                fstore=fstore)

@@ -1339,7 +1362,7 @@ def install(installer):
        auto_redirect=not options.no_ui_redirect,
        pkcs12_info=http_pkcs12_info,
        ca_is_configured=ca_enabled,
-        ca_file=paths.IPA_CA_CRT,
+        ca_file=cafile,
        fstore=fstore)

    # Need to point back to ourself after the cert for HTTP is obtained
@@ -20,7 +20,7 @@ from augeas import Augeas
 from pkg_resources import parse_version

 from ipalib import api, x509
-from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD
+from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH
 from ipalib.install import certmonger
 from ipalib import sysrestore
 from ipalib.facts import is_ipa_configured
@@ -1698,6 +1698,14 @@ def upgrade_configuration():
        IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
        KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
        DOMAIN=api.env.domain,
+        HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+        HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+        HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+        HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+        HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+        IPA_CA_CRT=paths.IPA_CA_CRT,
+        MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
    )

    subject_base = find_subject_base()
@@ -1734,6 +1742,9 @@ def upgrade_configuration():
        upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                     os.path.join(paths.USR_SHARE_IPA_DIR,
                                  "ipa.conf.template"))
+        upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
+                     os.path.join(paths.USR_SHARE_IPA_DIR,
+                                  "ipa-vhost.conf.template"))
        upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF,
                     os.path.join(paths.USR_SHARE_IPA_DIR,
                                  "ipa-rewrite.conf.template"))
@@ -32,10 +32,10 @@ vms:
      clients: 1
      resources:
        replica:
-          mem_limit: "2300m"
+          mem_limit: "2200m"
          memswap_limit: "3300m"
        client:
-          mem_limit: "805m"
+          mem_limit: "768m"
          memswap_limit: "1024m"
    tests:
    - test_integration/test_forced_client_reenrollment.py
@@ -187,7 +187,7 @@ vms:
    containers:
      resources:
        server:
-          mem_limit: "2450m"
+          mem_limit: "2200m"
          memswap_limit: "3300m"
    tests:
    - test_integration/test_upgrade.py
@@ -695,7 +695,7 @@ def get_pki_tomcatd_pid(host):
 def get_ipa_services_pids(host):
    ipa_services_name = [
        "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia",
-        "pki_tomcatd"
+        "pki_tomcatd", "ipa-dnskeysyncd"
    ]
    pids_of_ipa_services = {}
    for name in ipa_services_name:
@@ -1640,19 +1640,13 @@ class TestIpaHealthCheckWithoutDNS(IntegrationTest):
                "Got {count} ipa-ca AAAA records, expected {expected}",
                "Expected URI record missing",
            }
-        elif (parse_version(version) < parse_version('0.13')):
+        else:
            expected_msgs = {
                "Expected SRV record missing",
                "Unexpected ipa-ca address {ipaddr}",
                "expected ipa-ca to contain {ipaddr} for {server}",
                "Expected URI record missing",
            }
-        else:
-            expected_msgs = {
-                "Expected SRV record missing",
-                "Expected URI record missing",
-                "missing IP address for ipa-ca server {server}",
-            }

        tasks.install_packages(self.master, HEALTHCHECK_PKG)
        returncode, data = run_healthcheck(
@@ -2412,19 +2406,12 @@ class TestIpaHealthCLI(IntegrationTest):
            cmd = self.base_cmd + ["--indent", option]
            result = self.master.run_command(cmd, raiseonerr=False)
            assert result.returncode == 2
-            assert ('invalid int value' in result.stderr_text
-                    or 'is not an integer' in result.stderr_text)
+            assert 'invalid int value' in result.stderr_text

-        version = tasks.get_healthcheck_version(self.master)
+        # unusual success, arguably odd but not invalid :-)
        for option in ('-1', '5000'):
            cmd = self.base_cmd + ["--indent", option]
-            result = self.master.run_command(cmd, raiseonerr=False)
-            if parse_version(version) >= parse_version('0.13'):
-                assert result.returncode == 2
-                assert 'is not in the range 0-32' in result.stderr_text
-            else:
-                # Older versions did not check for a given allowed range
-                assert result.returncode == 0
+            result = self.master.run_command(cmd)

    def test_severity(self):
        """
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: freeipa 4.12.0.dev202310031255+git1a2cd7f40\n"
+"Project-Id-Version: freeipa 4.11.1.dev202310031238+gitfd01b234e\n"
 "Report-Msgid-Bugs-To: https://pagure.io/freeipa/new_issue\n"
-"POT-Creation-Date: 2023-10-03 14:56+0200\n"
+"POT-Creation-Date: 2023-10-03 14:39+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
Author	SHA1	Message	Date
zpericic	3da77ab3d6	ipaserver: Move /etc/httpd/ipa to /etc/ipa/httpd	2023-11-12 17:35:42 +01:00
zpericic	958266d36c	ipaserver: Use apache VirtualHost for IPA UI	2023-11-12 17:35:35 +01:00
Antonio Torres	63f5e57685	Become IPA 4.11.0 Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-03 14:45:56 +02:00
Antonio Torres	50c555c5ea	Update contributors list Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-03 14:43:19 +02:00
Antonio Torres	f35d168ff3	Update translations to FreeIPA ipa-4-11 state Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-03 14:40:40 +02:00
Florence Blanc-Renaud	cb14a30a15	Covscan issues: deadcode and Use after free Covscan detected an unused value in ipa_kdb_principals.c and a use-after-free in ipa-print-pac.c. Fixes: https://pagure.io/freeipa/issue/9431 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-10-02 17:44:23 -04:00
Christian Heimes	ed094e11ec	Add context manager to ipalib.API `ipalib.API` instances like `ipalib.api` now provide a context manager that connects and disconnects the API object. Users no longer have to deal with different types of backends or finalize the API correctly. ```python import ipalib with ipalib.api as api: api.Commands.ping() ``` See: https://pagure.io/freeipa/issue/9443 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-10-02 17:40:57 -04:00
Alexander Bokovoy	305912e467	Use datetime.timezone.utc instead of newer datetime.UTC alias datetime.UTC alias was added in Python 3.11: https://docs.python.org/3/library/datetime.html#datetime.UTC datetime.timezone.utc was present since Python 3.2. Since RHEL 9 is using Python 3.9, use more compatible variant. Fixes: https://pagure.io/freeipa/issue/9454 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-02 17:39:50 -04:00
Francisco Trivino	fd01b234e3	Workshop: fix broken Sphinx cross-references. Many of the workshop pages links are directing to URLs that end with ".rst" instead of ".html", as a result, these links are broken. This commit introduces explicit targets and references to ensure that the pages are correctly linked. Signed-off-by: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-26 16:48:39 +02:00
Mohammad Rizwan	9c10d7ee2c	ipatests: restart ipa services after moving date When system date is moved into future, it have unprecedented behavior i.e CA becomes irresponsive or unexpected certificcate state. Hence restart the ipa service after moving the date to gracefully serve the request. Fixes: https://pagure.io/freeipa/issue/9379 Signed-off-by: Mohammad Rizwan <myusuf@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-19 13:48:07 +02:00
Christian Heimes	bc9385d15c	Use find_spec() in meta importer The `find_module()` method of meta importers has been deprecated for a long time. Python 3.12 no longer falls back to `find_module()`. See: https://docs.python.org/3.12/whatsnew/3.12.html#removed Related: https://pagure.io/freeipa/issue/9437 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>	2023-09-19 13:46:10 +02:00
Alexander Bokovoy	637ccae0b4	Allow ipa-otpd to access USB devices for passkeys Main SELinux policy will allow transition of passkey_child (SSSD) to ipa_otpd_t context to perform FIDO2 operations with USB devices. This means ipa-otpd will need to be able to read data from sysfs and connect to USB devices. Add required permissions to IPA subpolicy as well. See rhbz#2238224 for discussion. Related: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Zdenek Pytela <zpytela@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-19 08:05:42 +02:00
Rob Crittenden	169f9abb6b	Don't assume KRB5CCNAME is in the environment in replica install The replica install was unilaterally removing KRB5CCNAME from os.environ in some cases. Instead check first to see if it is present and only remove in that case. Fixes: https://pagure.io/freeipa/issue/9446 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-15 13:53:12 +02:00
Rob Crittenden	54a251bcea	Configure affinity during server installation Write a new krb5.conf in case any values changed finding the right server to configure against (e.g. for CA, KRA) and ensure the API connection is to the remote server that will be installed against. When finding a CA or KRA during initial replica installation set the remote master as well. The order is: - existing server value in /etc/ipa/default.conf - the chosen CA host if the server doesn't provide one - the chosen KRA host if the server doesn't provide one This is more or less heirarchical. If a server is provided then that is considered first. If it provides all the optional services needed (CA and/or KRA) then it will be used. Otherwise it will fall back to a server that provides all the required services. In short, providing --server either at client install or with ipa-replica-install is no guarantee that it will define all topology. This may be unexpected behavior. For the case of adding a CA or KRA things are effectively unchanged. This type of install does not appear to be impacted by affinity issues. Fixes: https://pagure.io/freeipa/issue/9289 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-15 13:53:12 +02:00
Alexander Bokovoy	2220f72321	Restore selinux states if they exist at uninstall time Related: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-09-14 13:08:29 +02:00
Alexander Bokovoy	d62be1da45	ipa-client-install: enable SELinux for SSSD For passkeys (FIDO2) support, SSSD uses libfido2 library which needs access to USB devices. Add SELinux booleans handling to ipa-client-install so that correct SELinux booleans can be enabled and disabled during install and uninstall. Ignore and record a warning when SELinux policy does not support the boolean. Fixes: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-09-14 13:08:29 +02:00
Alexandra Nikandrova	f7422b7812	doc: typo in basic_usage.md Reviewed-By: Antonio Torres <antorres@redhat.com>	2023-09-13 11:23:59 +02:00
Alexander Bokovoy	fc9b527dee	updates: add ACIs for RBCD self-management Fixes: https://pagure.io/freeipa/issue/9354 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com>	2023-09-12 13:36:17 +02:00
Antonio Torres	4746329409	ipatests: rename 'ipatuura' directory to 'scim' in bridge tests A recent commit [1] in ipa-tuura project renamed the 'ipatuura' django app to 'scim'. Change it in IPA side as well to fix tests. [1]: https://github.com/freeipa/ipa-tuura/commit/f12592cea496818af782f953e0e9643c9ea440b5 Fixes: https://pagure.io/freeipa/issue/9447 Signed-off-by: Antonio Torres <antorres@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com>	2023-09-11 17:52:31 +02:00
Viktor Ashirov	3f874eece9	BDB tuning should be applied only when BDB backend is used 389DS supports BDB and LMDB backends. FreeIPA installation fails with LMDB backend since it tries to apply tuning for BDB backend. Instead, tuning for BDB should be applied only when 389DS uses BDB backend. Fixes: https://pagure.io/freeipa/issue/9435 Signed-off-by: Viktor Ashirov <vashirov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-09-11 09:17:41 +02:00
Florence Blanc-Renaud	f16b6e3e0a	idp: add the ipaidpuser objectclass when needed The ipaidpuser objectclass is required for the attribute ipaidpsub. When a user is created or modified with --idp-user-id, the operation must ensure that the objectclass is added if missing. Add a test for user creation and user modification with --idp-user-id. Fixes: https://pagure.io/freeipa/issue/9433 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-09-01 13:20:34 -04:00
Rob Crittenden	37b433d4a7	Adjust test to handle revocation reason REMOVE_FROM_CRL The dogtag REST API has a change of behavior regarding revocation reason 8, REMOVE_FROM_CRL. The XML interface accepts it blindly and marks the certifiate as revoked. This is complicated within RFC 5280 but the jist is that it only affects a certificate on hold and only for delta CRLs. So this modifies the behavior of revocation 8 so that the certificate is put on hold (6) first. Fixes: https://pagure.io/freeipa/issue/9345 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-08-28 13:40:39 -04:00
Rob Crittenden	0b870694f6	Use the PKI REST API wherever possible instead of XML The XML API is already deprecated and will be removed in some future release. All but the updateCRL API has an equivalent in REST. The upstream dogtag project documents most of the API at https://github.com/dogtagpki/pki/wiki/REST-API . I say most because not every API includes sample input/output. The pki ca-cert command is a good substitute for seeing how the API is used by their own tooling. This changes no pre-existing conventions. All serial numbers are converted to decimal prior to transmission and are treated as strings to avoid previous limitations with sizing (which would have been exacerbated by random serial numbers). Fixes: https://pagure.io/freeipa/issue/9345 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-08-28 13:40:39 -04:00
Mohammad Rizwan	b13b8fbb47	ipatests: accommodate DST in ACME cert expiry There is one hour time difference between expiry of ACME cert if the certificate is issued while daylight saving is start and expires after DST ends. For 2023 daylight saving time start at Sunday 12 March and ends at Sunday 5 November. Every certificate which is expiring after November 5th will have 1 hour difference in expiry. Fix is to use 90days+2hours to expire the cert. Fixes: https://pagure.io/freeipa/issue/9428 Signed-off-by: Mohammad Rizwan <myusuf@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-08-24 11:12:56 -04:00
Antonio Torres	4b1c5a5a83	Back to git snapshots Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-08-21 16:55:10 +02:00
Antonio Torres	cb351476ed	Become IPA 4.11.0beta1 Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-08-21 16:45:13 +02:00