ipaserver: Use apache VirtualHost for IPA UI

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>

.gitignore

@@ -155,6 +155,7 @@ install/custodia/ipa-custodia-dmldap
 install/custodia/ipa-custodia-pki-tomcat
 install/custodia/ipa-custodia-pki-tomcat-wrapped
 install/custodia/ipa-custodia-ra-agent
+install/oddjob/org.freeipa.server.config-enable-sid
 install/oddjob/org.freeipa.server.trust-enable-agent
 install/oddjob/com.redhat.idm.trust-fetch-domains
 install/oddjob/etc/oddjobd.conf.d/ipa-server.conf

ACI.txt

@@ -29,7 +29,7 @@ aci: (targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System:
 dn: cn=cas,cn=ca,dc=ipa,dc=example
 aci: (targetattr = "cn || description")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Modify CA";allow (write) groupdn = "ldap:///cn=System: Modify CA,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=cas,cn=ca,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || description || entryusn || ipacaid || ipacaissuerdn || ipacarandomserialnumberversion || ipacasubjectdn || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Read CAs";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || description || entryusn || ipacaid || ipacaissuerdn || ipacasubjectdn || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaca)")(version 3.0;acl "permission:System: Read CAs";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=caacls,cn=ca,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipacaacl)")(version 3.0;acl "permission:System: Add CA ACL";allow (add) groupdn = "ldap:///cn=System: Add CA ACL,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=caacls,cn=ca,dc=ipa,dc=example

API.txt

@@ -493,14 +493,13 @@ output: Output('result', type=[<type 'bool'>])
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
 command: ca_find/1
-args: 1,12,4
+args: 1,11,4
 arg: Str('criteria?')
 option: Flag('all', autofill=True, cli_name='all', default=False)
 option: Str('cn?', autofill=False, cli_name='name')
 option: Str('description?', autofill=False, cli_name='desc')
 option: Str('ipacaid?', autofill=False, cli_name='id')
 option: DNParam('ipacaissuerdn?', autofill=False, cli_name='issuer')
-option: Int('ipacarandomserialnumberversion?', autofill=False, cli_name='randomserialnumberversion')
 option: DNParam('ipacasubjectdn?', autofill=False, cli_name='subject')
 option: Flag('pkey_only?', autofill=True, default=False)
 option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -763,8 +762,8 @@ option: Str('host*', cli_name='hosts')
 option: DateTime('issuedon_from?', autofill=False)
 option: DateTime('issuedon_to?', autofill=False)
 option: DNParam('issuer?', autofill=False)
-option: SerialNumber('max_serial_number?', autofill=False)
-option: SerialNumber('min_serial_number?', autofill=False)
+option: Int('max_serial_number?', autofill=False)
+option: Int('min_serial_number?', autofill=False)
 option: Str('no_host*', cli_name='no_hosts')
 option: Flag('no_members', autofill=True, default=True)
 option: Principal('no_service*', cli_name='no_services')
@@ -791,7 +790,7 @@ output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: Output('truncated', type=[<type 'bool'>])
 command: cert_remove_hold/1
 args: 1,2,1
-arg: SerialNumber('serial_number')
+arg: Int('serial_number')
 option: Str('cacn?', autofill=True, cli_name='ca', default=u'ipa')
 option: Str('version?')
 output: Output('result')
@@ -812,14 +811,14 @@ output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
 command: cert_revoke/1
 args: 1,3,1
-arg: SerialNumber('serial_number')
+arg: Int('serial_number')
 option: Str('cacn?', autofill=True, cli_name='ca', default=u'ipa')
 option: Int('revocation_reason', autofill=True, default=0)
 option: Str('version?')
 output: Output('result')
 command: cert_show/1
 args: 1,7,3
-arg: SerialNumber('serial_number')
+arg: Int('serial_number')
 option: Flag('all', autofill=True, cli_name='all', default=False)
 option: Str('cacn?', autofill=True, cli_name='ca', default=u'ipa')
 option: Flag('chain', autofill=True, default=False)
@@ -832,7 +831,7 @@ output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
 command: cert_status/1
 args: 1,4,3
-arg: Str('request_id')
+arg: Int('request_id')
 option: Flag('all', autofill=True, cli_name='all', default=False)
 option: Str('cacn?', autofill=True, cli_name='ca', default=u'ipa')
 option: Flag('raw', autofill=True, cli_name='raw', default=False)
@@ -5672,7 +5671,7 @@ command: sudorule_add_option/1
 args: 1,5,3
 arg: Str('cn', cli_name='sudorule_name')
 option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Str('ipasudoopt+', cli_name='sudooption')
+option: Str('ipasudoopt', cli_name='sudooption')
 option: Flag('no_members', autofill=True, default=False)
 option: Flag('raw', autofill=True, cli_name='raw', default=False)
 option: Str('version?')
@@ -5827,7 +5826,7 @@ command: sudorule_remove_option/1
 args: 1,5,3
 arg: Str('cn', cli_name='sudorule_name')
 option: Flag('all', autofill=True, cli_name='all', default=False)
-option: Str('ipasudoopt+', cli_name='sudooption')
+option: Str('ipasudoopt', cli_name='sudooption')
 option: Flag('no_members', autofill=True, default=False)
 option: Flag('raw', autofill=True, cli_name='raw', default=False)
 option: Str('version?')

Contributors.txt

@@ -66,7 +66,6 @@ Developers:
 	German Parente
 	Gowrishankar Rajaiyan
 	Günther Deschner
-	Hela Basa
 	Ian Kumlien
 	Ian Pilcher
 	Isaac Boukris
@@ -74,7 +73,6 @@ Developers:
 	James Groffen
 	Jan Barta
 	Jan Cholasta
-	Jan Kuparinen
 	Jan Pazdziora
 	Jan Zelený
 	Jason Gerard DeRose
@@ -107,7 +105,6 @@ Developers:
 	Ludwig Krispenz
 	Lukáš Slebodník
 	Lynn Root
-	Marcin Stanclik
 	Mark McLoughlin
 	Mark Reynolds
 	Marko Myllynen

Makefile.am

@@ -23,6 +23,8 @@ PYTHON_SCRIPT_SUBDIRS = \
         $(top_builddir)/install/tools \
         $(NULL)
 
+PRCI_DEFINITIONS_DIR = $(top_srcdir)/ipatests/prci_definitions
+
 AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure
 
 IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests
@@ -336,6 +338,8 @@ endif  # WITH_RPMLINT
 # There are Jinja yaml templates, which differ from reqular ones. These
 # files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise
 # safe_load fails.
+# Also check PRCI definitions yaml files jobs format and content with
+# prci_checker script
 .PHONY: yamllint
 yamllint:
 	YAML_TEMPLATE_FILES="\
@@ -357,7 +361,10 @@ yamllint:
 		echo $${YAML}; \
 		$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \
 	done; \
-	echo "-----------"
+	echo -e "\nCheck PRCI definitions";
+	@echo "-----------"
+	$(PYTHON) $(PRCI_DEFINITIONS_DIR)/prci_checker.py -d $(PRCI_DEFINITIONS_DIR) -s $(PRCI_DEFINITIONS_DIR)/prci_jobs_spec.yaml;
+	@echo "-----------"
 
 # Build & lint documentation.
 #
@@ -389,7 +396,7 @@ pylint: $(GENERATED_PYTHON_FILES) ipasetup.py python_scripts
 		-name '*~' -o \
 		-name '*.py' -print -o \
 		-type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
-	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)"`; \
+	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)\n$(PRCI_DEFINITIONS_DIR)"`; \
 	echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \
 	$(PYTHON) -m pylint --version; \
 	PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \

VERSION.m4

@@ -20,8 +20,8 @@
 #  ->  "1.0.0"                                         #
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
-define(IPA_VERSION_MINOR, 10)
-define(IPA_VERSION_RELEASE, 0)
+define(IPA_VERSION_MINOR, 9)
+define(IPA_VERSION_RELEASE, 11)
 
 ########################################################
 # For 'pre' releases the version will be               #
@@ -34,7 +34,7 @@ define(IPA_VERSION_RELEASE, 0)
 # e.g. define(IPA_VERSION_PRE_RELEASE, rc1)            #
 #  ->  "1.0.0rc1"                                      #
 ########################################################
-define(IPA_VERSION_PRE_RELEASE, )
+define(IPA_VERSION_PRE_RELEASE,)
 
 ########################################################
 # To mark GIT snapshots this should be set to 'yes'    #
@@ -49,7 +49,7 @@ define(IPA_VERSION_PRE_RELEASE, )
 # This option works only with GNU m4:                  #
 # it requires esyscmd m4 macro.                        #
 ########################################################
-define(IPA_VERSION_IS_GIT_SNAPSHOT, no)
+define(IPA_VERSION_IS_GIT_SNAPSHOT, yes)
 
 ########################################################
 # git development branch:                              #
@@ -58,8 +58,8 @@ define(IPA_VERSION_IS_GIT_SNAPSHOT, no)
 # - ipa-X-X: define(IPA_GIT_BRANCH,                    #
 #       ipa-IPA_VERSION_MAJOR-IPA_VERSION_MINOR)       #
 ########################################################
-define(IPA_GIT_BRANCH, master)
-dnl define(IPA_GIT_BRANCH, ipa-IPA_VERSION_MAJOR-IPA_VERSION_MINOR)
+dnl define(IPA_GIT_BRANCH, master)
+define(IPA_GIT_BRANCH, ipa-IPA_VERSION_MAJOR-IPA_VERSION_MINOR)
 
 ########################################################
 # The version of IPA data. This is used to identify    #
@@ -86,8 +86,8 @@ define(IPA_DATA_VERSION, 20100614120000)
 #                                                      #
 ########################################################
 define(IPA_API_VERSION_MAJOR, 2)
-# Last change: add Random Serial Numbers v3
-define(IPA_API_VERSION_MINOR, 249)
+# Last change: add graceperiodlimit
+define(IPA_API_VERSION_MINOR, 248)
 
 ########################################################
 # Following values are auto-generated from values above

client/Makefile.am

@@ -4,6 +4,14 @@ AUTOMAKE_OPTIONS = 1.7 subdir-objects
 
 NULL =
 
+AM_CFLAGS = $(NULL)
+if HAVE_GCC
+    AM_CFLAGS += -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith \
+		-Wcast-align -Werror-implicit-function-declaration \
+		$(NULL)
+endif
+export AM_CFLAGS
+
 IPA_CONF_FILE=$(sysconfdir)/ipa/default.conf
 
 AM_CPPFLAGS =							\

client/ipa-getkeytab.c

@@ -769,7 +769,7 @@ static char *ask_password(krb5_context krbctx, char *prompt1, char *prompt2,
                 NULL, NULL,
                 num_prompts, ap_prompts);
 
-    if (match && (strcmp(pw0, pw1) != 0)) {
+    if (match && (strcmp(pw0, pw1))) {
         fprintf(stderr, _("Passwords do not match!\n"));
         return NULL;
     }

client/ipa-join.c

@@ -62,7 +62,8 @@ static int debug = 0;
 
 #define ASPRINTF(strp, fmt...) \
     if (asprintf(strp, fmt) == -1) { \
-        fprintf(stderr, _("Out of memory!\n")); \
+        if (!quiet) \
+            fprintf(stderr, _("Out of memory!\n")); \
         rval = 3; \
         goto cleanup; \
     }
@@ -296,7 +297,7 @@ check_ipa_server(LDAP *ld, char **ldap_base, struct berval **vals)
 
         entry = ldap_first_entry(ld, res);
         infovals = ldap_get_values_len(ld, entry, info_attrs[0]);
-        if (strcmp(infovals[0]->bv_val, "IPA V2.0") == 0)
+        if (!strcmp(infovals[0]->bv_val, "IPA V2.0"))
             *ldap_base = strdup(vals[i]->bv_val);
         ldap_msgfree(res);
         res = NULL;
@@ -417,35 +418,34 @@ join_ldap(const char *ipaserver, const char *hostname, char ** binddn, const cha
     if (NULL != basedn) {
         ldap_base = strdup(basedn);
         if (!ldap_base) {
-            fprintf(stderr, _("Out of memory!\n"));
+            if (!quiet)
+                fprintf(stderr, _("Out of memory!\n"));
             rval = 3;
             goto done;
         }
     } else {
         if (get_root_dn(ipaserver, &ldap_base) != 0) {
-            fprintf(stderr, _("Unable to determine root DN of %s\n"),
-                              ipaserver);
+            if (!quiet)
+                fprintf(stderr, _("Unable to determine root DN of %s\n"),
+                                ipaserver);
             rval = 14;
             goto done;
-        } else {
-            if (debug) {
-                fprintf(stderr, "root DN %s\n", ldap_base);
-            }
         }
     }
 
     ret = asprintf(binddn, "fqdn=%s,cn=computers,cn=accounts,%s", hostname, ldap_base);
     if (ret == -1)
     {
-        fprintf(stderr, _("Out of memory!\n"));
+        if (!quiet)
+            fprintf(stderr, _("Out of memory!\n"));
         rval = 3;
         goto done;
     }
-    if (debug) {
-        fprintf(stderr, "Connecting to %s as %s\n", ipaserver, *binddn);
-    }
     ld = connect_ldap(ipaserver, *binddn, bindpw, &ret);
-    if (ld == NULL) {
+    if (!ld) {
+        if (quiet)
+            goto done;
+
         switch(ret) {
             case LDAP_NO_MEMORY:
                 rval = 3;
@@ -471,7 +471,8 @@ join_ldap(const char *ipaserver, const char *hostname, char ** binddn, const cha
 #else
         ldap_get_option(ld, LDAP_OPT_ERROR_STRING, &s);
 #endif
-        fprintf(stderr, _("Enrollment failed. %s\n"), s);
+        if (!quiet)
+            fprintf(stderr, _("Enrollment failed. %s\n"), s);
         if (debug) {
             fprintf(stderr, "ldap_extended_operation_s failed: %s",
                             ldap_err2string(rc));
@@ -535,7 +536,8 @@ join_krb5_xmlrpc(const char *ipaserver, const char *hostname, char **hostdn, con
 #endif
     if (ret == -1)
     {
-        fprintf(stderr, _("Out of memory!\n"));
+        if (!quiet)
+            fprintf(stderr, _("Out of memory!\n"));
         rval = 3;
         goto cleanup;
     }
@@ -589,7 +591,8 @@ join_krb5_xmlrpc(const char *ipaserver, const char *hostname, char **hostdn, con
         xmlrpc_DECREF(princP);
         xmlrpc_DECREF(singleprincP);
     } else {
-        fprintf(stderr, _("principal not found in XML-RPC response\n"));
+        if (!quiet)
+            fprintf(stderr, _("principal not found in XML-RPC response\n"));
         rval = 12;
         goto cleanup;
     }
@@ -603,7 +606,8 @@ join_krb5_xmlrpc(const char *ipaserver, const char *hostname, char **hostdn, con
         xmlrpc_array_read_item(&env, krblastpwdchangeP, 0, &singleprincP);
         xmlrpc_read_string(&env, singleprincP, &krblastpwdchange);
         xmlrpc_DECREF(krblastpwdchangeP);
-        fprintf(stderr, _("Host is already joined.\n"));
+        if (!quiet)
+            fprintf(stderr, _("Host is already joined.\n"));
         rval = 13;
         goto cleanup;
     }
@@ -629,7 +633,8 @@ static inline struct curl_slist *
 curl_slist_append_log(struct curl_slist *list, char *string, bool quiet) {
     list = curl_slist_append(list, string);
     if (!list) {
-        fprintf(stderr, _("curl_slist_append() failed for value: '%s'\n"), string);
+        if (!quiet)
+            fprintf(stderr, _("curl_slist_append() failed for value: '%s'\n"), string);
         return NULL;
     }
     return list;
@@ -637,7 +642,8 @@ curl_slist_append_log(struct curl_slist *list, char *string, bool quiet) {
 
 #define CURL_SETOPT(curl, opt, val) \
     if (curl_easy_setopt(curl, opt, val) != CURLE_OK) { \
-        fprintf(stderr, _("curl_easy_setopt() failed\n")); \
+        if (!quiet) \
+            fprintf(stderr, _("curl_easy_setopt() failed\n")); \
         rval = 17; \
         goto cleanup; \
     }
@@ -677,14 +683,18 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response
     char *json_str = NULL;
 
     if (curl_global_init(CURL_GLOBAL_DEFAULT) != CURLE_OK) {
-        fprintf(stderr, _("curl_global_init() failed\n"));
+        if (!quiet)
+            fprintf(stderr, _("curl_global_init() failed\n"));
+
         rval = 17;
         goto cleanup;
     }
 
     curl = curl_easy_init();
     if (!curl) {
-        fprintf(stderr, _("curl_easy_init() failed\n"));
+        if (!quiet)
+            fprintf(stderr, _("curl_easy_init() failed\n"));
+
         rval = 17;
         goto cleanup;
     }
@@ -734,6 +744,7 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response
     json_str = json_dumps(json, 0);
     if (!json_str) {
         fprintf(stderr, _("json_dumps() failed\n"));
+
         rval = 17;
         goto cleanup;
     }
@@ -756,10 +767,10 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response
     curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &resp_code);
 
     if (resp_code != 200) {
-        if (resp_code == 401)
+        fprintf(stderr, _("JSON-RPC call failed with status code: %li\n"), resp_code);
+
+        if (!quiet && resp_code == 401)
             fprintf(stderr, _("JSON-RPC call was unauthorized. Check your credentials.\n"));
-        else
-            fprintf(stderr, _("JSON-RPC call failed with status code: %li\n"), resp_code);
 
         rval = 17;
         goto cleanup;
@@ -942,7 +953,9 @@ join_krb5_jsonrpc(const char *ipaserver, const char *hostname, char **hostdn, co
     *princ = join_i.krb_principal;
 
     if (!force && join_i.is_provisioned) {
-        fprintf(stderr, _("Host is already joined.\n"));
+        if (!quiet)
+            fprintf(stderr, _("Host is already joined.\n"));
+
         rval = 13;
         goto cleanup;
     }
@@ -1018,7 +1031,8 @@ jsonrpc_unenroll_host(const char *ipaserver, const char *host, bool quiet) {
         if (!quiet)
             fprintf(stderr, _("Unenrollment successful.\n"));
     } else {
-        fprintf(stderr, _("Unenrollment failed.\n"));
+        if (!quiet)
+            fprintf(stderr, _("Unenrollment failed.\n"));
     }
 
 cleanup:
@@ -1062,7 +1076,8 @@ xmlrpc_unenroll_host(const char *ipaserver, const char *host, bool quiet)
 #endif
     if (ret == -1)
     {
-        fprintf(stderr, _("Out of memory!\n"));
+        if (!quiet)
+            fprintf(stderr, _("Out of memory!\n"));
         rval = 3;
         goto cleanup;
     }
@@ -1095,7 +1110,8 @@ xmlrpc_unenroll_host(const char *ipaserver, const char *host, bool quiet)
             if (!quiet)
                 fprintf(stderr, _("Unenrollment successful.\n"));
         } else {
-            fprintf(stderr, _("Unenrollment failed.\n"));
+            if (!quiet)
+                fprintf(stderr, _("Unenrollment failed.\n"));
         }
 
         xmlrpc_DECREF(princP);
@@ -1212,9 +1228,6 @@ join(const char *server, const char *hostname, const char *bindpw, const char *b
             argv[arg++] = "-w";
             argv[arg++] = (char *)bindpw;
         }
-        if (quiet) {
-            argv[arg++] = "-q";
-        }
         argv[arg++] = NULL;
         err = execv(path, argv);
         if (err == -1) {
@@ -1284,8 +1297,9 @@ unenroll_host(const char *server, const char *hostname, const char *ktname, bool
     } else {
         char * conf_data = read_config_file(IPA_CONFIG);
         if ((ipaserver = getIPAserver(conf_data)) == NULL) {
-            fprintf(stderr, _("Unable to determine IPA server from %s\n"),
-                    IPA_CONFIG);
+            if (!quiet)
+                fprintf(stderr, _("Unable to determine IPA server from %s\n"),
+                        IPA_CONFIG);
             exit(1);
         }
         free(conf_data);
@@ -1293,24 +1307,27 @@ unenroll_host(const char *server, const char *hostname, const char *ktname, bool
 
     krberr = krb5_init_context(&krbctx);
     if (krberr) {
-        fprintf(stderr, _("Unable to join host: "
-                          "Kerberos context initialization failed\n"));
+        if (!quiet)
+            fprintf(stderr, _("Unable to join host: "
+                              "Kerberos context initialization failed\n"));
         rval = 1;
         goto cleanup;
     }
 
     krberr = krb5_kt_resolve(krbctx, ktname, &keytab);
     if (krberr != 0) {
-        fprintf(stderr, _("Error resolving keytab: %s.\n"),
-                error_message(krberr));
+        if (!quiet)
+            fprintf(stderr, _("Error resolving keytab: %s.\n"),
+                    error_message(krberr));
         rval = 7;
         goto cleanup;
     }
 
     krberr = krb5_get_default_realm(krbctx, &realm);
     if (krberr != 0) {
-        fprintf(stderr, _("Error getting default Kerberos realm: %s.\n"),
-                error_message(krberr));
+        if (!quiet)
+            fprintf(stderr, _("Error getting default Kerberos realm: %s.\n"),
+                    error_message(krberr));
         rval = 21;
         goto cleanup;
     }
@@ -1319,8 +1336,9 @@ unenroll_host(const char *server, const char *hostname, const char *ktname, bool
 
     krberr = krb5_parse_name(krbctx, principal, &princ);
     if (krberr != 0) {
-        fprintf(stderr, _("Error parsing \"%1$s\": %2$s.\n"),
-                principal, error_message(krberr));
+        if (!quiet)
+            fprintf(stderr, _("Error parsing \"%1$s\": %2$s.\n"),
+                    principal, error_message(krberr));
         rval = 4;
         goto cleanup;
     }
@@ -1337,8 +1355,9 @@ unenroll_host(const char *server, const char *hostname, const char *ktname, bool
     krberr = krb5_get_init_creds_keytab(krbctx, &creds, princ, keytab,
                                         0, tgs, &gicopts);
     if (krberr != 0) {
-        fprintf(stderr, _("Error obtaining initial credentials: %s.\n"),
-                error_message(krberr));
+        if (!quiet)
+            fprintf(stderr, _("Error obtaining initial credentials: %s.\n"),
+                    error_message(krberr));
         rval = 19;
         goto cleanup;
     }
@@ -1347,24 +1366,27 @@ unenroll_host(const char *server, const char *hostname, const char *ktname, bool
     if (krberr == 0) {
         krberr = krb5_cc_initialize(krbctx, ccache, creds.client);
     } else {
-        fprintf(stderr,
-                _("Unable to generate Kerberos Credential Cache\n"));
+        if (!quiet)
+            fprintf(stderr,
+                    _("Unable to generate Kerberos Credential Cache\n"));
         rval = 19;
         goto cleanup;
     }
 
     if (krberr != 0) {
-        fprintf(stderr,
-                _("Unable to generate Kerberos Credential Cache\n"));
+        if (!quiet)
+            fprintf(stderr,
+                    _("Unable to generate Kerberos Credential Cache\n"));
         rval = 19;
         goto cleanup;
     }
 
     krberr = krb5_cc_store_cred(krbctx, ccache, &creds);
     if (krberr != 0) {
-        fprintf(stderr,
-                _("Error storing creds in credential cache: %s.\n"),
-                error_message(krberr));
+        if (!quiet)
+            fprintf(stderr,
+                    _("Error storing creds in credential cache: %s.\n"),
+                    error_message(krberr));
         rval = 19;
         goto cleanup;
     }
@@ -1468,16 +1490,21 @@ main(int argc, const char **argv) {
     if (!hostname) {
         hostname = ipa_gethostfqdn();
         if (hostname == NULL) {
-            fprintf(stderr, _("Cannot get host's FQDN!\n"));
+            if (!quiet)
+                fprintf(stderr, _("Cannot get host's FQDN!\n"));
             exit(22);
         }
     }
     if (NULL == strstr(hostname, ".")) {
-        fprintf(stderr, _("The hostname must be fully-qualified: %s\n"), hostname);
+        if (!quiet) {
+            fprintf(stderr, _("The hostname must be fully-qualified: %s\n"), hostname);
+        }
         exit(16);
     }
-    if ((strcmp(hostname, "localhost") == 0) || (strcmp(hostname, "localhost.localdomain") == 0)){
-        fprintf(stderr, _("The hostname must not be: %s\n"), hostname);
+    if ((!strcmp(hostname, "localhost")) || (!strcmp(hostname, "localhost.localdomain"))){
+        if (!quiet) {
+            fprintf(stderr, _("The hostname must not be: %s\n"), hostname);
+        }
         exit(16);
     }
 

configure.ac

@@ -492,7 +492,7 @@ AC_ARG_ENABLE(more-warnings,
 	[AC_HELP_STRING([--enable-more-warnings],
 	[Maximum compiler warnings])],
 	set_more_warnings="$enableval",[
-        	if test -d $srcdir/.git; then
+        	if test -d $srcdir/../.hg; then
         		set_more_warnings=yes
               	else
                   	set_more_warnings=no
@@ -506,8 +506,23 @@ if test "$GCC" = "yes" -a "$set_more_warnings" != "no"; then
         -Wchar-subscripts -Wmissing-declarations -Wmissing-prototypes \
         -Wnested-externs -Wpointer-arith \
         -Wcast-align -Wsign-compare \
-        -Wshadow -Wstrict-prototypes \
         $CFLAGS"
+
+        for option in -Wno-strict-aliasing -Wno-sign-compare; do
+                SAVE_CFLAGS="$CFLAGS"
+                CFLAGS="$CFLAGS $option"
+                AC_MSG_CHECKING([whether gcc understands $option])
+                AC_TRY_COMPILE([], [],
+                        has_option=yes,
+                        has_option=no,)
+                if test $has_option = no; then
+                        CFLAGS="$SAVE_CFLAGS"
+                fi
+                AC_MSG_RESULT($has_option)
+                unset has_option
+                unset SAVE_CFLAGS
+        done
+        unset option
 else
         AC_MSG_RESULT(no)
 fi

daemons/Makefile.am

@@ -4,6 +4,14 @@ AUTOMAKE_OPTIONS = 1.7 subdir-objects
 
 NULL =
 
+AM_CFLAGS = $(NULL)
+if HAVE_GCC
+    AM_CFLAGS += -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith \
+		-Wcast-align -Werror-implicit-function-declaration \
+		$(NULL)
+endif
+export AM_CFLAGS
+
 nodist_noinst_HEADERS = ipa-version.h
 noinst_HEADERS = ipa-version.h.in
 

daemons/ipa-kdb/ipa-print-pac.c

@@ -600,7 +600,7 @@ ask_password(TALLOC_CTX *context, char *prompt1, char *prompt2, bool match)
     /* krb5_prompter_posix does not use krb5_context internally */
     krb5_prompter_posix(NULL, NULL, NULL, NULL, num_prompts, ap_prompts);
 
-    if (match && (strcmp(pw0, pw1) != 0)) {
+    if (match && (strcmp(pw0, pw1))) {
         fprintf(stderr, "Passwords do not match!\n");
         return NULL;
     }

daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c

@@ -359,7 +359,8 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     Slapi_ValueSet *values = NULL;
     long grace_limit = 0;
     int grace_user_time;
-    char *pwd_expiration = NULL;
+    char *tmpstr = NULL;
+    time_t pwd_expiration;
     int pwresponse_requested = 0;
     Slapi_PBlock *pbtm = NULL;
     Slapi_Mods *smods = NULL;
@@ -414,12 +415,17 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     }
     slapi_value_free(&objectclass);
 
-    pwd_expiration = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
-    if (pwd_expiration == NULL) {
+    tmpstr = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
+    if (tmpstr == NULL) {
         /* No expiration means nothing to do */
         LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn);
         goto done;
     }
+    pwd_expiration = ipapwd_gentime_to_time_t(tmpstr);
+    if (pwd_expiration > time(NULL)) {
+        /* Not expired, nothing to see here */
+        goto done;
+    }
 
     ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry,
                                     &values, &actual_type_name,
@@ -473,7 +479,7 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
         if (pwresponse_requested) {
             slapi_pwpolicy_make_response_control(pb, -1, grace_limit - grace_user_time , -1);
         }
-    } else if ((grace_limit > 0) && (grace_user_time >= grace_limit)) {
+    } else if (grace_user_time >= grace_limit) {
         LOG_TRACE("%s password is expired and out of grace limit\n", dn);
         errstr = "Password is expired.\n";
         ret = LDAP_INVALID_CREDENTIALS;

daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c

@@ -351,7 +351,7 @@ parse_req_done:
 		/* If user is authenticated, they already gave their password during
 		the bind operation (or used sasl or client cert auth or OS creds) */
 		slapi_pblock_get(pb, SLAPI_CONN_AUTHMETHOD, &authmethod);
-		if (!authmethod || strcmp(authmethod, SLAPD_AUTH_NONE) == 0) {
+		if (!authmethod || !strcmp(authmethod, SLAPD_AUTH_NONE)) {
 			errMesg = "User must be authenticated to the directory server.\n";
 			rc = LDAP_INSUFFICIENT_ACCESS;
 			goto free_and_return;

daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-config.c

@@ -800,7 +800,7 @@ internal_find_entry_get_attr_val(const Slapi_DN *basedn, int scope,
             }
         }
         if (attrval) {
-            if (strcmp(attrname, "dn") == 0) { /* special - to just get the DN */
+            if (!strcmp(attrname, "dn")) { /* special - to just get the DN */
                 *attrval = slapi_ch_strdup(slapi_entry_get_dn_const(entries[0]));
             } else {
                 *attrval = slapi_entry_attr_get_charptr(entries[0], attrname);

daemons/ipa-slapi-plugins/topology/topology_cfg.c

@@ -461,7 +461,7 @@ ipa_topo_cfg_host_find(TopoReplica *tconf, char *findhost, int lock)
                             "ipa_topo_cfg_host_find: found a NULL hostname in host list\n");
             continue;
         }
-        if (strcasecmp(host->hostname, findhost) == 0) {
+        if (!strcasecmp(host->hostname,findhost)) {
            break;
         }
     }
@@ -530,7 +530,7 @@ ipa_topo_cfg_host_del(Slapi_Entry *hostentry)
         hostnode = replica->hosts;
         prevnode = NULL;
         while (hostnode) {
-            if (strcasecmp(hostnode->hostname,delhost) == 0) {
+            if (!strcasecmp(hostnode->hostname,delhost)) {
                 /*remove from list and free*/
                 if (prevnode) {
                     prevnode->next = hostnode->next;
@@ -566,9 +566,9 @@ ipa_topo_cfg_replica_segment_find(TopoReplica *replica, char *leftHost, char *ri
     while (segments) {
 
         tsegm = segments->segm;
-        if ( ((strcasecmp(leftHost,tsegm->from) == 0) && (strcasecmp(rightHost,tsegm->to) == 0) &&
+        if ( (!strcasecmp(leftHost,tsegm->from) && !strcasecmp(rightHost,tsegm->to) &&
              (tsegm->direct & dir)) ||
-             ((strcasecmp(leftHost,tsegm->to) == 0) && (strcasecmp(rightHost,tsegm->from) == 0) &&
+             (!strcasecmp(leftHost,tsegm->to) && !strcasecmp(rightHost,tsegm->from) &&
              (tsegm->direct & reverse_dir))) {
            break;
         }
@@ -719,9 +719,9 @@ ipa_topo_cfg_segment_set_visited(TopoReplica *replica, TopoReplicaSegment *vsegm
     segments = replica->repl_segments;
     while (segments) {
         tsegm = segments->segm;
-        if ( ((strcasecmp(leftHost,tsegm->from) == 0) && (strcasecmp(rightHost,tsegm->to) == 0) &&
+        if ( (!strcasecmp(leftHost,tsegm->from) && !strcasecmp(rightHost,tsegm->to) &&
              (tsegm->direct == SEGMENT_BIDIRECTIONAL || tsegm->direct == SEGMENT_LEFT_RIGHT)) ||
-             ((strcasecmp(leftHost,tsegm->to) == 0) && (strcasecmp(rightHost,tsegm->from) == 0) &&
+             (!strcasecmp(leftHost,tsegm->to) && !strcasecmp(rightHost,tsegm->from) &&
              (tsegm->direct == SEGMENT_BIDIRECTIONAL || tsegm->direct == SEGMENT_RIGHT_LEFT))) {
             segments->visited = 1;
             break;
@@ -879,7 +879,7 @@ ipa_topo_cfg_replica_find(char *repl_root, int lock)
 
     tconf = topo_shared_conf.replicas;
     while (tconf) {
-        if (strcasecmp(repl_root,tconf->repl_root) == 0) {
+        if (!strcasecmp(repl_root,tconf->repl_root)) {
            break;
         }
         tconf = tconf->next;

daemons/ipa-slapi-plugins/topology/topology_post.c

@@ -82,7 +82,7 @@ ipa_topo_post_add(Slapi_PBlock *pb)
          */
         tsegm =  ipa_topo_util_segment_from_entry(tconf, add_entry);
         status = slapi_entry_attr_get_charptr(add_entry, "ipaReplTopoSegmentStatus");
-        if (status == NULL || (strcasecmp(status,"autogen") != 0)) {
+        if (status == NULL || strcasecmp(status,"autogen")) {
             ipa_topo_util_missing_agmts_add(tconf, tsegm,
                                             ipa_topo_get_plugin_hostname());
         }

daemons/ipa-slapi-plugins/topology/topology_pre.c

@@ -241,7 +241,7 @@ ipa_topo_connection_fanout(TopoReplica *tconf, TopoReplicaSegment *tseg)
     TopoReplicaSegmentList *seglist = tconf->repl_segments;
     while (seglist) {
         segm = seglist->segm;
-        if (strcasecmp(segm->name, tseg->name) != 0) {
+        if (strcasecmp(segm->name, tseg->name)) {
             if (segm->direct == SEGMENT_LEFT_RIGHT ||
                 segm->direct == SEGMENT_BIDIRECTIONAL ) {
                 fout = ipa_topo_connection_fanout_extend(fout, segm->from, segm->to);
@@ -339,9 +339,8 @@ ipa_topo_check_segment_is_valid(Slapi_PBlock *pb, char **errtxt)
                 *errtxt = slapi_ch_smprintf("Segment definition is incomplete"
                                    ". Add rejected.\n");
             rc = 1;
-        } else if ((strcasecmp(dir,SEGMENT_DIR_BOTH) != 0) &&
-                   (strcasecmp(dir,SEGMENT_DIR_LEFT_ORIGIN) != 0) &&
-                   (strcasecmp(dir,SEGMENT_DIR_RIGHT_ORIGIN) != 0)) {
+        } else if (strcasecmp(dir,SEGMENT_DIR_BOTH) && strcasecmp(dir,SEGMENT_DIR_LEFT_ORIGIN) &&
+            strcasecmp(dir,SEGMENT_DIR_RIGHT_ORIGIN)) {
                 *errtxt = slapi_ch_smprintf("Segment has unsupported direction"
                                    ". Add rejected.\n");
                 slapi_log_error(SLAPI_LOG_FATAL, IPA_TOPO_PLUGIN_SUBSYSTEM,

daemons/ipa-slapi-plugins/topology/topology_util.c

@@ -545,7 +545,7 @@ ipa_topo_util_set_agmt_rdn(TopoReplicaAgmt *topo_agmt, Slapi_Entry *repl_agmt)
     Slapi_RDN *agmt_rdn = slapi_rdn_new();
     slapi_sdn_get_rdn(agmt_dn, agmt_rdn);
     const char *agmt_rdn_str  = slapi_rdn_get_rdn(agmt_rdn);
-    if (strcasecmp(agmt_rdn_str, topo_agmt->rdn) != 0) {
+    if (strcasecmp(agmt_rdn_str, topo_agmt->rdn)) {
         slapi_ch_free_string(&topo_agmt->rdn);
         topo_agmt->rdn = slapi_ch_strdup(agmt_rdn_str);
     }
@@ -669,7 +669,7 @@ ipa_topo_util_update_agmt_list(TopoReplica *conf, TopoReplicaSegmentList *repl_s
                     }
                     agmt_attr_val =  slapi_entry_attr_get_charptr(repl_agmt,mattrs[i]);
                     if (agmt_attr_val == NULL ||
-                        (strcasecmp(agmt_attr_val,segm_attr_val) != 0)) {
+                        strcasecmp(agmt_attr_val,segm_attr_val)) {
                         /* value does not exist in agmt or
                          * is different from segment: replace
                          */
@@ -1185,8 +1185,8 @@ ipa_topo_util_segment_merge(TopoReplica *tconf,
 
     if (tsegm->direct == SEGMENT_BIDIRECTIONAL) return;
 
-    if ((strcasecmp(tsegm->from,ipa_topo_get_plugin_hostname()) != 0) &&
-        (strcasecmp(tsegm->to,ipa_topo_get_plugin_hostname()) != 0)) {
+    if (strcasecmp(tsegm->from,ipa_topo_get_plugin_hostname()) &&
+        strcasecmp(tsegm->to,ipa_topo_get_plugin_hostname())) {
         /* merging is only done on one of the endpoints of the segm */
         return;
     }

doc/Makefile

@@ -35,4 +35,5 @@ distclean: clean
 venv:
 	$(PYTHON) -m venv $(VENVDIR)
 	$(VENVDIR)/bin/python3 -m pip install -U pip setuptools
-	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt
+	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt \
+		-c constraints.txt

doc/conf.py

@@ -58,8 +58,7 @@ language = 'en'
 # directories to ignore when looking for source files.
 # This pattern also affects html_static_path and html_extra_path.
 exclude_patterns = [
-    '_build', 'Thumbs.db', '.DS_Store', 'workshop/README.rst', '.venv/*',
-    'designs/template.md'
+    '_build', 'Thumbs.db', '.DS_Store', 'workshop/README.rst', '.venv/*'
 ]
 
 

doc/constraints.txt

@@ -0,0 +1 @@
+docutils < 0.19

doc/designs/adtrust/sidconfig.md

@@ -1,301 +0,0 @@
-#  Integrate SID configuration into base IPA installers
-
-## Overview
-
-FreeIPA is able to issue Kerberos tickets with PAC data when it is configured
-for trust. The goal of this feature is to allow PAC generation in the
-general use case, even without trust, as it is a first step towards
-IPA-IPA trust.
-
-Reference: https://pagure.io/freeipa/issue/8995
-
-In order to generate PAC data for a kerberos principal, IPA needs to assign
-a SID to the users and groups. IPA installers (`ipa-server-install`,
-`ipa-replica-install`) must handle the configuration related to SID:
-- assign a NetBIOS name to the server
-- assign a domain SID to the IPA domain
-- configure the local id range with primary RID base and secondary RID base
-- enable the sidgen plugin on 389ds server
-
-The code handling these steps is already available in ipa-adtrust-install
-and needs to be moved to the general installers.
-
-## Use Cases
-
-### Fresh install
-As administrator, I want to deploy an IPA topology that automatically
-assigns SIDs to users and groups and issues kerberos tickets with PAC data,
-without the need to configure IPA for trust.
-
-If I later decide to configure IPA for trust, I can still run the command
-`ipa-adtrust-install`.
-
-### Existing installation, no trust
-
-As IPA administrator, I am managing an existing IPA installation without any
-trust. I want to update IPA and have the choice of enabling (or not) the
-generation of SIDs and PAC data.
-
-If I choose to enable PAC data, I just need to run a command that requires
-an admin kerberos ticket. The command handles the SID-related configuration 
-and prompts me whether I want to immediately generate SIDs for
-existing users/groups or run that task later.
-
-### Existing installation, trust configured
-
-In this topology with trust configured (the command `ipa-adtrust-install` has 
-been executed), IPA is already able to issue Kerberos tickets with PAC data.
-Update does not modify the configuration.
-
-### Mixed topology
-
-As IPA administrator, I am managing an existing server setup without trust and
-without PAC data. I want to add a replica into my existing topology and
-automatically enable PAC data generation, without the need to configure IPA
-for trust.
-
-## How to Use
-
-### Fresh installation
-Run `ipa-server-install`, with the ability to define:
-- NetBIOS Name: if not specified, the default value is generated from
-the IPA domain name (transform the left-most label into uppercase, keep only
-ascii characters, digits and dashes).
-- Primary RID base (default if not set: 1000)
-- Secondary RID base (default if not set: 1000000)
-
-On a replica: run `ipa-replica-install`, with the ability to define the same
-parameters as `ipa-server-install`, plus the following parameter:
-- Run SIDgen task immediately: yes/no (default=no)
-
-If conflicting values are specified in `ipa-replica-install`, the installer
-must warn that existing values will be overwritten (same message as when
-`ipa-adtrust-install` is run multiple times with conflicting values).
-
-### Upgrade
-
-- Run `dnf update *ipa-server`. The upgrade doesn't configure SID-related
-options and doesn't enable PAC generation.
-- Obtain a ticket for the admin (or any member of the admins group).
-- Run the new command allowing to setup the SID-related configuration.
-- Run the existing command to modify base RID and secondary base RID:
-```
-ipa idrange-mod --rid-base INT --secondary-rid-base INT RANGENAME
-```
-
-### Mixed topology
-
-The existing server is not setup for PAC data generation. The future replica
-is installed with the latest packages, containing the updated installers.
-
-Run `ipa-replica-install`, with the ability to define:
-- NetBIOS Name: if not specified, the default value is generated from
-the IPA domain name (transform the left-most label into uppercase, keep only
-ascii characters, digits and dashes).
-- Primary RID base (default if not set: 1000)
-- Secondary RID base (default if not set: 1000000)
-- Run SIDgen task immediately: yes/no (default=no)
-
-
-## Design
-
-Installers and SID-related options:
-- the options `--add-sids`, `--netbios-name`, `--rid-base` and 
-`--secondary-rid-base` are moved from ADTrustInstallInterface to a separate
-new InstallInterface: SIDInstallInterface.
-- ADTrustInstallInterface now inherits from SIDInstallInterface.
-- `adtrustinstance.ADTRUSTInstance.__init__` now accepts an additional
-parameter: `fulltrust`. When set to True, the class ADTRUSTInstance configures
-the trust as usual. When set to False, only the SID-related part is executed.
-- `ipa-server-install` and `ipa-replica-install` now always call
-`adtrust.install_check` and `adtrust.install`, but the method is using the
-provided options (especially `options.setup_adtrust`) to know if full
-configuration is required or only the SID-related part.
-
-The `ipa-adtrust-install` code is already written in order to be
-idempotent (can be called multiple times, even with different values), and
-this property is of great value for this feature. It allows to keep
-the changes as minimal as possible to the existing installers, and
-call `ipa-adtrust-install` even if the SID-part is already setup.
-
-New command to enable SID generation after an upgrade:
-as we don't want to automatically enable SID generation during an upgrade,
-a new command is provided in order to manually enable the feature. The command
-only requires an admin ticket (no need to be root) and relies on the admin
-framework.
-
-The command uses a mechanism similar to server_conncheck:
-- the user must have Replication Administrators privilege
-- the user launches an ipa command communicating with IPA framework
-- the admin framework uses Dbus to get access a DBus interface that
-launches a command through oddjob, allowing the command to run as root.
-The oddjob command is a wrapper around `adtrustinstance.ADTRUSTInstance`.
-
-## Implementation
-
-- Dependencies: no additional dependency on ipa-server package
-- Backup and Restore: no new file to backup
-
-## Feature Management
-
-### UI
-
-No new UI for server/replica installation.
-
-`IPA server / ID ranges` tab is already available and displays Primary and 
-Secondary RID base.
-
-`IPA Server / Trusts / Global Trust Configuration` tab already displays the
-NetBIOS Name and Security Identifier.
-
-These values can also be added in the `IPA Server / Configuration` tab.
-
-The User View displays SMB attributes if they exist and could be enhanced
-with a note if the user entry does not have any SID, pointing the admin
-to a procedure in order to generate the missing SIDs.
-
-### CLI
-
-| Command |	Options |
-| --- | ----- |
-| ipa-server-install | [--netbios-name=NETBIOS_NAME] [--rid-base=RID_BASE] [--secondary-rid-base=SECONDARY_RID_BASE]  |
-| ipa-replica-install | [--netbios-name=NETBIOS_NAME] [--rid-base=RID_BASE] [--secondary-rid-base=SECONDARY_RID_BASE] [--add-sids] |
-| ipa config-mod | --enable-sid [--add-sids] [--netbios-name=NETBIOS_NAME]  |
-
-#### `ipa config-mod --enable-sid` details:
-
-The `--enable-sid` option turns the feature on, and `--add-sids` triggers
-the SIDgen task in order to immediately generate SID for existing users or
-groups.
-
-`--add-sids` requires the `--enable-sid`option.
-
-The `--netbios-name` option specifies the NetBIOS Name and is optional. If
-not provided, the NetBIOS Name is generated from the leading part of the
-DNS name.
-
-`--netbios-name` requires the `--enable-sid` option.
-
-
-### Configuration
-
-When the feature is turned on, it is possible to modify the primary and
-secondary RID bases for the local id range with the existing
-`ipa idrange-mod` command.
-
-The NetBIOS Name can be overwritten (with warning) when `ipa-adtrust-install`
-is run.
-
-## Upgrade
-
-The upgrade does not turn on the feature. If the admin wants to enable
-SID generation, he needs to update the packages and run the new command
-`ipa config-mod --enable-sid`.
-
-
-## Test plan
-
-Note: PRCI currently doesn't have the ability to test upgrade.
-
-Scenarios to be tested: fresh install, test PAC generation
-- Add active user testuser (reinitialize password)
-- On IPA server run `kinit -k` to get a ticket for `host/fqdn@REALM`
-- On IPA server run `/usr/libexec/ipa/ipa-print-pac ticket testuser` and
-ensure that PAC data is properly displayed.
-- Same test on IPA replica
-
-Tests outside of PRCI:
-- Existing topology without trust, update one server, ensure SID generation
-hasn't been automatically enabled
-- Existing topology without trust, update one server, manually enable SID
-generation with the new command
-- Existing topology without trust, insert a new replica, ensure SID generation
-has been automatically enabled
-- Existing topology with trust, update one server, ensure SID generation is
-still working
-- Existing topology with trust, insert a new replica, ensure SID generation
-is still working
-- Ensure that `ipa-adtrust-install` is still working with the previous
-scenarios.
-
-## Troubleshooting and debugging
-
-When the feature is turned on (whatever the path, either through fresh
-server installation, fresh replica installation, or with the new command), the
-following LDAP entries are expected:
-
-- `cn=ad,cn=trusts,dc=ipa,dc=test` which is a simple `nsContainer`
-- `cn=ad,cn=etc,dc=ipa,dc=test` which is a simple `nsContainer`
-- `cn=ipa.test,cn=ad,cn=etc,dc=ipa,dc=test`: must define the NetBIOS Name in
-`ipaNTFlatName`, the SID in `ipaNTSecurityIdentifier` and the default SMB
-group in `ipaNTFallbackPrimaryGroup`
-- `cn=Default SMB Group,cn=groups,cn=accounts,dc=ipa,dc=test`: must define
-a SID belonging to the IPA domain SID in `ipaNTSecurityIdentifier`
-
-(replace ipa.test with the actual domain name and dc=ipa,dc=test with the
-actual base DN).
-
-The admin user must have a SID ending with -500 (well-known SID for the
-domain administrator):
-```
-# ipa user-show admin --all | grep ipantsecurityidentifier
-  ipantsecurityidentifier: S-1-5-21-2633809701-976279387-419745629-500
-```
-
-The admins group must have a SID ending with -512 (well-known SID for domain
-administrators group):
-```
-# ipa group-show admins --all | grep ipantsecurityidentifier
-  ipantsecurityidentifier: S-1-5-21-2633809701-976279387-419745629-512
-```
-
-The sidgen plugin must be enabled in /etc/dirsrv/slapd-IPA-TEST/dse.ldif:
-```
-dn: cn=IPA SIDGEN,cn=plugins,cn=config
-cn: IPA SIDGEN
-nsslapd-basedn: dc=ipa,dc=test
-nsslapd-plugin-depends-on-type: database
-nsslapd-pluginDescription: Add a SID to newly added or modified objects with u
- id pr gid numbers
-nsslapd-pluginEnabled: on
-nsslapd-pluginId: IPA SIDGEN postop plugin
-nsslapd-pluginInitfunc: ipa_sidgen_init
-nsslapd-pluginPath: libipa_sidgen
-nsslapd-pluginType: postoperation
-nsslapd-pluginVendor: FreeIPA project
-nsslapd-pluginVersion: FreeIPA/1.0
-objectClass: top
-objectClass: nsSlapdPlugin
-objectClass: extensibleObject
-
-```
-
-If the PAC data is not generated for a user, ensure that the user contains a
-SID in its `ipantsecurityidentifier` attribute. If the SID is missing, run
-the SIDgen task in order to generate SID for existing users and groups:
-- Find ipa base DN with: `grep basedn /etc/ipa/default.conf | cut -d= -f2-`
-- Copy `/usr/share/ipa/ipa-sidgen-task-run.ldif` to
-`/tmp/ipa-sidgen-task-run.ldif`
-- Edit the copy `/tmp/ipa-sidgen-task-run.ldif` and replace $SUFFIX with
-IPA base DN
-- As root, launch the task (replace IPA-TEST with the proper value):
-`ldapmodify -H ldapi://%2Frun%2Fslapd-IPA-TEST.socket -f /tmp/ipa-sidgen-task-run.ldif`
-
-In order to check if the PAC data gets added to the user ticket, on a server:
-```
-# kinit -k
-# /usr/libexec/ipa/ipa-print-pac ticket USERNAME
-```
-
-If the PAC data is properly added, the `ipa-print-pac` command displays:
-```
-# /usr/libexec/ipa/ipa-print-pac ticket testuser
-Password: 
-Acquired credentials for testuser
-PAC_DATA: struct PAC_DATA
-    num_buffers              : 0x00000005 (5)
-    version                  : 0x00000000 (0)
-    buffers: ARRAY(5)
-        buffers: struct PAC_BUFFER
-...
-```

doc/designs/index.rst

@@ -10,19 +10,14 @@ FreeIPA design documentation
    adtrust/admin-ipa-as-trusted-user.md
    adtrust/sudorules-with-ad-objects.md
    adtrust/auto-private-groups.md
-   adtrust/sidconfig.md
    krb-ticket-policy.md
    extdom-plugin-protocol.md
    expiring-password-notification.md
    ldap_grace_period.md
-   ldap_pam_passthrough.md
    libpwquality.md
    membermanager.md
-   ipa_to_ipa_migration.md
    hidden-replicas.md
    disable-stale-users.md
-   ldapi-autobind-services.md
    subordinate-ids.md
    external-idp/external-idp.md
    external-idp/idp-api.md
-   random-serial-numbers.md

doc/designs/ipa_to_ipa_migration.md

@@ -1,468 +0,0 @@
-# IPA Migration
-
-## Overview
-
-IPA has had a plugin-based migration for remote LDAP servers since
-version 2.0.0. It will only migrate users and groups.
-
-It has some powerful capabilities for working around eccentricities in
-the remote server including:
-
-* it is idempotent
-* support for both RFC2307 and 2307bis
-* support for ignoring specified objectclasses and attributes
-* allows excluding some users and/or groups
-* flexibility in the remote DIT, e.g. specifying user/group containers
-
-This is insufficient for the following reasons:
-
-* It severely limits IPA-to-IPA migration as all other entry types are lost
-* User-private groups are not maintained
-* Syntax errors can cause migration to fail with the only resolution
-  being to skip broken entries or fix the remote LDAP server
-* It is executed as a server-side plugin and if it runs long enough the
-  client may disconnect
-* There is no feedback during the migration beyond watching the logs
-* There is no migration-specific log
-
-The basic operation includes:
-
-* loop through the remote user and group containers examining each entry
-* if it looks like a user or group (based on objectclass) try to
-  migrate it
-* convert group membership from the detected or provided RFC
-* retain passwords if the provider LDAP bind user can read them
-* drop conflicting attributes (like kerberos)
-* skip duplicates so it can be rerun multiple times
-* convert groups to IPA POSIX groups
-
-## Use Cases
-
-There are two use-cases driving a re-implementation (or extension) of
-migration:
-
-1. Addressing bugs in current LDAP-only migration code
-
-2. Adding IPA-to-IPA migration including all entry types.
-
-## Migration basics
-
-### General considerations
-
-LDAP stores information in a tree structure known as the Directory
-Information Tree (DIT). Each node in the tree is an entry and each
-entry contains information in an attribute=value form. It is a very
-different storage model than a relational database as there is no
-"join" capability between entries (among other things).
-
-The organization of the entries depends on schema which defines which
-object types (objectclasses) and attributes (attributetypes) are
-allowed. https://ldap.com/ has a pretty decent introduction to LDAP,
-schemas, etc. The important thing to understand is that in order for
-an attribute to be in an entry, there must be a corresponding
-objectclass which allows it, either as a MUST or MAY. The schema defines
-a syntax for that attribute which defines what type of data may be
-stored in it. Some LDAP servers do a better job than others at enforcing
-this syntax.
-
-### pure LDAP migration
-
-While it is easy to see a remote LDAP migration as a subset of IPA to
-IPA it is better to keep them as separate for the following reasons:
-
-1. It represents a small subset of a typical IPA installation: only
-   users and groups.
-2. The remote schema and DIT are unknown and different for each migration so it will require more care.
-3. The quality of the data is unknown. 389-ds, used by IPA, enforces proper syntax where other servers may not.
-
-### IPA to IPA migration
-
-For an IPA to IPA migration it is possible to make certain assumptions
-that aren't possible in a pure LDAP migration including:
-
-1. The DIT is understood and consistent
-2. Unique UID/GID/login/group name(s) so additional checking is not necessary
-3. A consistent schema (perhaps variability for users and groups)
-
-## Design
-
-### IPA to IPA migration
-
-It would be risky to hardcode the data to pull in. It is far simpler to
-iterate the things you *don't* want to migrate. This should also improve
-the chances for future-proofing and preventing bugs like not migrating
-some new feature area. It will require that versions only migrate up or
-sideways and not backwards.
-
-IPA-to-IPA migration will be implemented as an AdminTool standalone
-client.
-
-#### Prerequisites
-
-A migration should only be done to a single IPA server. This will greatly
-simplify certain things, particularly performance. We may want an option
-to allow this and deny it by default.
-
-If DNS is enabled on the remote server it will need to be enabled in
-the local one in order to migrate DNS data. It would need to be determined
-if the DNS DIT exists in a migrated server would allow bind to be
-configured (I suspect it will) but we don't want to get into a situation
-where the migrated DNS data is unusable.
-
-#### Retain REALM/domain
-
-It will be optional to retain the same REALM and domain. This will make the
-use-cases of staging and development server migration possible.
-
-#### Retain ranges
-
-This is TBD. I don't know of a reason why a user wouldn't want to retain the
-ranges as it would affect owned files, etc, but *someone* may want to make a
-clean break. I don't believe it would be difficult to deal with as we would
-just set the magic values for DNA generation.
-
-In order to retain the range then the remote and local ranges would need to
-be compared and the migration rejected if they do not overlap (perhaps allowed
-with --force).
-
-As for DNA, if the range remains some effort will need to be made to set the
-local DNS configuration to match what is available remotely.
-
-This may not be ideal. The basic process would be:
-
-  * connect to all servers in the remote IPA installation
-  * collect the DNA and on-deck ranges
-  * determine the starting point
-  * set the local DNA range to this starting point + the range end - 1
-
-This could well leave huge holes of allocated values within the range but the
-DNA plugin should be able to handle that.
-
-subids TBD. It may be fine to just straight migrate the range and records.
-
-#### Discovery of IPA objects
-
-The objects to migrate can be determined by examining the local API.
-It can be iterated to discover the available class objects which contain
-the container_dn and other useful information. Not all objects need
-to be migrated either because they are internal objects, represent
-schema or represent commands that have no underlying storage.
-Initialize the API and iterate over Object:
-
-    api.bootstrap(in_server=True, context='migrate')
-    api.finalize()
-
-    for obj in api.Object:
-       work()
-
-This gives us an alphabetized list of objects. An implicit relationship
-can be determined by examining the member* values in `obj.attribute_members`
-if it is present.
-
-Using this list we know which are "leaf" entries which have no dependencies.
-These are migrated first. Then the list is iterated again looking for
-those with dependencies that are already satisfied and those are migrated.
-And so on.
-
-So for example users and hosts are migrated. Then groups, which has a dependency on
-users. Then hostgroups can then be migrated.
-
-Some objects, like hostgroups, can be nested. These will need to be deferred until
-all of their members are added. If a running list of objects that have been migrated
-is maintained then it can be easily calculated which are ready for migration and
-which are not without having to refer to LDAP.
-
-#### Objects to ignore
-
-The IPA API object list includes an number of internal-only objects and
-some classes that represent informational commands so they can be skipped
-for migration.
-
-| Object |	Reason |
-| --- | ----- |
-| certreq | no storage |
-| class | schema |
-| command | internal |
-| cosentry | migration not needed |
-| dns_system_records | no storage |
-| metaobject | schema |
-| param | internal |
-| pkinit | no storage |
-| topic | internal |
-| userstatus | no storage |
-
-#### Objects TBD
-
-Each DNS record type is represented as a separate class. It is probably safe
-to just bulk import all dns records as there isn't any IPA-specific information in them.
-
-So basically add them to the ignore list.
-
-#### Other Containers
-
-Not all data in IPA can be manipulated with the API.
-
-cn=certificates,cn=ipa,cn=etc,$SUFFIX contains any user-provided certificates.
-I think we can skip this and require that any necessary certificates be
-re-added. Otherwise, to be safe, we should validatate the trust and expiration
-dates on all of them.
-
-DNA ranges. Depending on the local ranges we could try to recover them.
-
-#### Items to NOT be migrated
-
-We will not have migrate existing keys from the remote IPA server so the
-following will not be migrated:
-
-* Self-signed CA certificates (maybe we import user-added CA certs)
-* KRA keys
-* sub-CAs
-* caacls
-* DNSSEC keys
-* admin password
-* DM password
-* Basically anything in Custodia
-
-#### Migrating conflicting data
-
-For new entries (users, groups, hosts, etc) we can do a straight LDAP
-ADD after massaging necessary attributes (see Attributes to not migrate).
-
-That is the easy part.
-
-There are some parts of IPA that are default and will exist in both servers
-such as the configuration (config commands), allow_all HBAC rule,
-permissions, privileges, roles, selinux mappings, ipaservers hostgroup and more.
-
-The strategy for this will be use the existing entry comparison in ldap2 and
-modify the new IPA instation to match the original minus some specific things like
-the CA subject base in the config. So in most cases we favor the remote IPA
-installation except for things which are installation-dependent.
-
-The downside of this is that it could interpret "fresher" defaults in the
-new IPA server with stale ones from the old. We will need good logging around
-these types of entries.
-
-Standard boilerplate will not be evaluated, things like cosTemplates. These are not
-user-modifiable and if a user decides to mess with them, they can correct it
-after migration.
-
-#### Migrating cn=config
-
-A number of plugins are optional in IPA: nis, compat, ACME.
-
-These will be enabled in the new IPA server if enabled in the remote at
-the end of migration:
-
-* cn=Schema Compatibility, cn=plugins, cn=config
-* cn=NIS Server, cn=plugins, cn=config
-
-Schema compatibility will be disabled during migration as it can cause
-performance issues and we don't want to try to migrate anything in
-cn=compat since it is generated data.
-
-ACME is a feature of the CA. We should be able to import ipa_acme_manage
-and call enable/disable within the migration if it is remotely enabled.
-
-#### Configuration to not migrate
-
-These will not be migrated:
-
-* AD Trusts
-* Winsync configuration (though the entries will)
-* CA, KRA
-* DNSSEC
-
-#### Special migration
-
-cn=kerberos contains the Kerberos master key as well as the default
-ticket policy. Only the policy can be migrated.
-
-#### Attributes to not migrate
-
-Some attributes we will need to completely drop because they contain key or
-server-specific information for the remote IPA server. This may also
-include objectClasses that may need to be dropped if the last attribute
-is removed.
-
-* krbPrincipalKey (will require dropping objectclasses)
-* krbExtraData
-* ipaNTSecurityIdentifier
-* memberOf (will be reconstructed after the migration)
-* userCertificate if issued by the remote IPA server
-
-#### Attributes to update to new REALM
-
-If a REALM change is part of migration then these will need to be updated
-to reflect the new installation.
-
-* krbPrincipalKey
-* krbCanonicalName
-
-#### Attributes to change basedn
-
-Prior to writing a new value any DN syntax attributes will need to be
-examined to see if they contain the remote baseDN if it is different. If
-so then the following need to be updated:
-
-* mepManagedEntry
-* mepManagedBy
-
-#### Migrating custom schema
-
-Schema is stored in LDAP so we *should* be able to use our ldap library
-to discover differences. We probably want to do only ADD and bail if we
-determine something will be a MOD or DEL.
-
-#### Excluding specific entries
-
-The ignore user/group options of migrate-ds were introduced so that non-compliant
-entries could be skipped to not block the migration. We can ignore these for now.
-
-#### Performance considerations
-
-Some benefits would be likely if common entry types were added in
-batches rather than individually. This would not easily allow for a
-"stop on failure" approach but could be considerably faster.
-
-The basic idea is that added entries of the same type (user, group, etc)
-would be accumulated and added together. The result would be iterated
-through and logged.
-
-The memberOf plugin should be disabled. A fixup task can be run post-migration
-to calculate the memberships.
-
-#### Idempotency
-
-The migrate-ds plugin manages idempotency because it skips over entries
-that already have been migrated (or exist). This new migration will handle
-it by merging the remote and local entries. This may not be desirable in
-all cases.
-
-#### Migration steps
-
-A simplistic view of the steps
-
-Set migration mode=True
-Disable compat
-Disable memberof
-Migrate schema
-Loop through the list of remote objects:
-  - fix up any DN values or other syntaxes
-  - remove conflicting attributes/objectclasses
-  - write new entry
-      - if entry already exists, merge them if possible preferring remote side
-Enable memberOf
-Create memberOf fixup task
-Enable compat
-Restart world
-Run ipa-server-upgrade
-
-### pure LDAP migration
-
-The current code generally works minus a few bugs and RFEs, some of which are resolved
-by doing an IPA-to-IPA migration instead. It should be maintained for now and migrated
-to the standalone client in the future.
-
-These bugs should be considered for the existing plugin.
-
-* https://pagure.io/freeipa/issue/3096 - error when migrating unknown schema
-* https://pagure.io/freeipa/issue/3100 - Check for userPassword in migration
-* https://pagure.io/freeipa/issue/4738 - [RFE] ipa migrate-ds should provide option for creating UPG from posixGroup objectClass
-* https://pagure.io/freeipa/issue/5020 - migrate-ds: does not show migrated users if an error happened during group migration
-* https://pagure.io/freeipa/issue/5693 - Passwords become "expired" when migrating from directory server to IPA
-* https://pagure.io/freeipa/issue/6105 - migrate-ds is not completely ignoring attributes.
-* https://pagure.io/freeipa/issue/6360 - ipa migrate-ds does not rename uniquemember/member attributes properly
-* https://pagure.io/freeipa/issue/6380 - ipa migrate-ds should print warning for referrals
-* https://pagure.io/freeipa/issue/7368 - ipa migrate-ds converts groupofuniquenames objects to groupofnames, but leaves groupofuniquenames objectclass present
-* https://pagure.io/freeipa/issue/7749 - `ipa migrate-ds` fails to migrate user and group data from directory server to IDM.
-
-## Logging
-
-By default the log file will be /var/log/ipa-migrate.log and will be appended to
-and not overwritten. This is so it can reflect multiple runs if they are required.
-
-At least the DN of all entries written should be logged (pkey may be sufficient).
-
-Logging by object type could be handy and should natural since this is how the
-objects will be sorted.
-
-DEBUG logging may want to show gory details, particularly when merging entries.
-
-## Implementation
-
-The command will be named ipa-migrate. It must determine whether the remote server is
-actually an IPA server or not. ipaclient/discovery.py::ipacheckldap may be re-usable.
-
-The standalone client should use a unique context, migration. This will
-allow for a separate configuration file.
-
-## Feature Management
-
-### UI
-
-No UI option will be provided. This is command-line client only.
-
-### CLI
-
-Overview of the CLI commands.
-
-#### IPA to IPA
-
-Advance knowledge of the DIT substantially reduces the number of options
-necessary for migration.
-
-| Option | Description |
-| --- | --- |
-| --dry-run | try the migration without writing data |
-| --force | ignore errors and keep going |
-| --version | version of the tool |
-| --quiet | output only errors |
-| --log-file | log to the given file |
-| --help | this message |
-
-The DM password will be prompted for interactively.
-
-| Argument | Description |
-| url | ldap url for remote IPA server |
-
-#### pure LDAP
-
-Will remain unchanged unless one of the bug fixes requires it (perhaps for the UPG
-ticket).
-
-### Configuration
-
-N/A
-
-## Upgrade
-
-N/A
-
-## Test plan
-
-There are currently no tests for migration.
-
-Some simplisitic approaches for starting testing might include:
-* Count the number of entries that will be migrated and ensure they were migrated, by type (hosts, groups, etc).
-* Verify that the services enabled on the remote side are enabled after migration (NIS, ACME, etc).
-* Double-check, perhaps spot-checking, memberOf
-* Migrate a password to ensure it was imported properly
-
-We have a data generation script in freeipa-tools that may be leveraged to generate the data but it currently generates a LOT of entries which is likely too much for automation.
-
-## Troubleshooting and debugging
-
-Include as much information as possible that would help troubleshooting:
-- Does the feature rely on existing files (keytabs, config file...)
-- Does the feature produce logs? in a file or in the journal?
-- Does the feature create/rely on LDAP entries? 
-- How to enable debug logs?
-- When the feature doesn't work, is it possible to diagnose which step failed? Are there intermediate steps that produce logs?
-
-[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/migrating-from-an-ldap-directory-to-idm_migrating-to-idm-from-external-sources
-
-## Future
-
-We may eventually want to add the ability to skip entire types of data.
-For example, drop all sudo rules.

doc/designs/ldap_pam_passthrough.md

@@ -1,330 +0,0 @@
-**IMPORTANT**: This is a design proposal and is not implemented yet.
-
-# LDAP PAM Passthrough support
-
-## Overview
-
-Many organizations have authentication mechanisms already in place.
-They may not want to have IPA be the central repository for authentication.
-
-RADIUS is a common authentication protocol used for external authentication
-into existing systems. IPA currently has support for verifying credentails
-over RADIUS for Kerberos connections using the radius authentication
-indicator, but this does not work with LDAP authentication.
-
-For this document "PAM Passthrough" is defined as any subsequent
-plugin that handles authentication of the user entry using the PAM stack.
-
-### Expected Workflow
-
-There are a lot of components potentially involved in LDAP authentication
-over RADIUS:
-
- - 389-ds
- - PAM
- - SSSD
- - KDC
- - ipa-otpd
- - the remote RADIUS server
-
-The workflow starts with an LDAP bind.
-
- - On an LDAP BIND with uid=user,cn=users,cn=accounts,$SUFFIX, the BIND
-   request will get processed by the IPA password plugin preop.
-   If both radius and otp auth types are set and there are no tokens
-   the plugin will return 0, allowing further authentication to happen.
-   389-ds treats this as no authentication decision so allows other
-   plugins to try.
-
- - At this point another 389-ds plugin can step in to handle the
-   authentication using the PAM stack.
-
- - As PAM authentication processing happens, if pam_sss.so is present in
-   the PAM stack, it will attempt to perform password-based authentication
-   for the 'user' account using the provided credentials.
-
- - Since the user account matches the IPA domain, it will be treated as
-   Kerberos authentication against IPA KDC running on the same host, as
-   we are authenticating on a IPA server.
-
- - The IPA KDB driver in the KDC will notice that the 'user@IPA' principal
-   has the 'radius' pre-authentication method configured with TL data
-   "otp\0[{\"indicators\": [\"radius\"]}]" meaning it should advertise
-   the OTP pre-auth mechanism to the Kerberos client.
-
- - The client (SSSD) notices the availability of the OTP pre-auth
-   mechanism and uses host principal's TGT as its FAST channel wrapper to
-   proceed with OTP pre-auth.
-
- - OTP pre-auth mechanism will talk between KDC and the client to ask
-   for additional details (OTP value) via prompting mechanism it has.
-
- - The client (SSSD) will return the OTP value and the KDC then will
-   issue a RADIUS request "Accept-Request" to a RADIUS server configured
-   in the KDC configuration. The OTP value in this case is the
-   credentials the user provided.
-
- - ipa-otpd handles OTP requests and will connect to LDAP (the LDAP URI
-   is passed as part of ipa-otpd@.service definition from
-   /etc/ipa/default.conf, so it'll be an LDAPI access). ipa-otpd will
-   parse the RADIUS packet and look up requested user principal entry from
-   LDAP.
-
- - If the user principal entry has the 'radius' authentication indicator
-   configured (or it is default for IPA deployment) and there is a
-   RADIUS proxy link in the user entry (there is no default so it must
-   be set per user), it will send the same RADIUS packet to the RADIUS
-   server configured as a proxy link with the credentials provided by
-   KDC
-
- - For a native OTP setup where the user has the 'otp' authentication
-   indicator the process is about the same: instead of sending a RADIUS
-   proxy request, ipa-otpd will bind to LDAP with the user DN and pass
-   the credentials provided by KDC.
-
-## Existing Workaround
-
-Due to the way passwords and OTP are handled by the current IPA
-password plugin it is possible to make this work today using the
-389-ds password plugin but it is complicated to setup and
-prone to error.
-
- - Install IPA
-
- - Configure the 389-ds PAM pass-through plugin to a PAM service that
-   relies on pam_sss.so (e.g. system-auth)
-
- - Add a RADIUS proxy configuration in IPA
-
- - Add this proxy to one or more users
-
- - Set default authentication indicator in IPA to 'radius, otp' or on
-   one or more of those users
-
- - The user has no userPassword or krbPrincipalKey set
-
- - The user has no OTP tokens
-
-The key is having otp as an authentication indictor. If otp is
-not set as an authentication indicator then ipapwd_pre_bind_otp() will
-return 1 and fail the authentication request. By setting otp but having
-no tokens ipapwd_pre_bind_otp() will return 0. Next a password comparison
-will happen but since the user has no password this will be skipped
-and 0 returned to 389-ds as the result and then PAM passthrough plugin
-can be initiated.
-
-### Workaround confusion
-
-Strictly speaking, a user can have this configuration and still have
-a userPassword and krbPrincipalKey set but this is a no-op for an LDAP bind.
-Regardless of whether the provided password is valid or not authentication
-will proceed to the RADIUS server for the final word.
-
-This is similar behavior if a user tries a raw kinit without armor:
-there may be a password/key but it isn't used.
-
-This could lead to "I can't log in" calls and an admin resetting their
-password in IPA with no real effect.
-
-### Why is otp required in the workaround?
-
-This scheme works because RADIUS isn't considered at all in the
-password plugin.
-
-In prepost.c::ipapwd_pre_bind_otp() the user is checked to see if
-they have OTP auth enabled. If they do then the tokens are examined
-and if there aren't any, the function exits in a way that allows
-subsequent authentication. This will then fall out and return a 0
-to 389-ds to allow PAM Passthrough to execute.
-
-If the user does not have OTP auth enabled then that code will be
-skipped and return a 1 because the auth_type is not
-OTP_CONFIG_AUTH_TYPE_PASSWORD.
-
-## Proposal
-
-This proposal may break existing installations who have found this
-workaround.
-
-Currently PAM passthrough authentication basically works by accident
-and by working around the lack of direct handling of RADIUS in the
-password plugin. It would be better, and more secure, to deal directly
-with this in the IPA password plugin and not rely on side-effects.
-
-### IPA Framework plugin changes:
-
-For users with the RADIUS authentication indicator set:
-1. Require no userPassword and krbPrincipalKey 
-2. Require a radius proxy server set 
-3. Do not allow the RADIUS authentication indicator along with others
-   since the point of it is to outsource authentication.
-
-These will not be enforced retroactivly on upgrade since LDAP bind
-using RADIUS was not supported.
-
-### IPA password plugin changes:
-
-If the RADIUS authentication indicator is set on a user and the user
-has a userPassword or krbPrincipalKey and does not have a radius 
-proxy setting (ipatokenradiusconfiglink) then return
-LDAP_INVALID_CREDENTIALS.
-
-If the OTP authentication indicator is not set, in
-ipapwd_pre_bind_otp() return 0 if any authentication indicator is set.
-
-Additionally, multiple mechanisms should be supported simultaneously
-so a user configured with PKINIT and RADIUS can authenticate using
-either. Currently only RADIUS will work. See 
-https://pagure.io/freeipa/issue/8820 for more details. This should
-also work for an LDAP bind for consistency.
-
-### The workflow
-
- - RADIUS will be evaluated first.
-
- - If RADIUS authtype is set:
-    - require no userPassword and krbPrincipalKey
-    - require radius proxy setting
-
- - If RADIUS is an authentication indicator for a user on a BIND request
-     - If these conditions are not set then LOG_FATAL() and end the
-       authentication attempt by returning LDAP_INVALID_CREDENTIALS.
-     - Otherwise continue the authentication process.
-
- - If RADIUS is not an authentication indicator then proceed with
-   authentication.
-
- - If OTP is an authentication indictorn or the user
-     - Evaluate tokens using the existing workflow
-     - Otherwise fall back to PASSWORD authentication
-
-OTP checking is done in ipapwd_pre_bind_otp() which is called unless
-there is a sync request. Authentication indicator type handling needs to
-be better centralized here. There are two paths that can return different
-results (assuming otpreq = False).
-
-1. User has otp auth type and has no tokens it will return 0.
-2. User does not have otp auth type it will only return 0 if the
-   user has OTP_CONFIG_AUTH_TYPE_PASSWORD.
-
-This loophole needs to be closed. Perhaps change to return false if
-auth type is OTP_CONFIG_AUTH_TYPE_NONE. This would likely be more
-future-proof if more authentication indicators are added.
-
-If the OTP check doesn't return an error then the password will be
-authenticted, if there is one. This is the two-step first check
-OTP, then check the password.
-
-Since a 389-ds plugin returning 0 will allow subsequent authentication,
-for the case of RADIUS we need to enforce the no password(s) and
-RADIUS server requirements because with any PAM passthrough method
-enabled it becomes the defacto default method. In fact we may want
-to always ensure there is no RADIUS server defined if the RADIUS
-authentication indicator is not set to set. This would need to check
-both the global and per-use authentication indicators.
-
-389-ds FATAL logging is recommended because the authentication path is
-so opaque that administrators won't know why or where it failed. This
-will ensure a useful message is logged, at least for the administrators.
-
-It might be nice to check that PAM passthrough is enabled but there
-is is no way to validate the configuration so we may well skip it.
-
-## Testing
-
-This creates quite a large test matrix as a number of different
-tests are required. These are only for LDAP binds. Kerberos should be
-unaffected.
-
-- RADIUS authentication indicator set globally and the user is not
-  configured properly
-  - user has a password
-  - user has a principal key
-  - user has no radius proxy set
-
-- RADIUS authentication indicator set for the user and the user is not
-  configured properly
-  - user has a password
-  - user has a principal key
-  - user has no radius proxy set
-
-- RADIUS authentication indicator set globally and user is ok
-  - test user with correct password
-  - test user with incorrect password
-
-- RADIUS authentication indicator set for the user and user is ok
-  - test user with correct password
-  - test user with incorrect password
-
-Others depending on whether we will allow the RADIUS authentication
-indicator with others. If we restrict the authentication indicators
-to either be only RADIUS or anything but RADIUS this should not
-affect other mechanisms and will be covered by other tests. But this
-poses a problem with upgrades.
-
-### Setup using the 389-ds PAM Passthrough plugin
-
-In order to test we'll need to setup a RADIUS server to test against.
-The pyrad project provides a sample in
-https://raw.githubusercontent.com/pyradius/pyrad/master/example
-
-It would need to be adapted for our needs to actually do authentication
-and ideally dynamically setup its listening hosts. The passwords
-could be hardcoded with a "good" one that is always accepted.
-
-And the ldapserver PAM service needs to be created and cleaned up.
-Making a copy of system-auth is sufficient.
-
-To enable the PAM Passthrough plugin in 389-ds can be done with this
-ldif:
-
-dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
-changetype: modify
-replace: nsslapd-pluginEnabled
-nsslapd-pluginEnabled: on
--
-replace: pamSecure
-pamSecure: FALSE
--
-replace: pamService
-pamService: ldapserver
-
-Followed by a restart of dirsrv.target.
-
-The dsconf configuration for enabling/configuring Passthrough
-is currently not working in 389-ds.
-
-### Creating a RADIUS proxy server
-
-Create a radius proxy named 'pyrad' pointing to the current server.
-
-$ echo somesecret | ipa radiusproxy-add pyrad --server ipa.example.test --secret
-
-### Creating an appropriate user to test with
-
-Create a user with the RADIUS authentication indicator and a radius proxy link.
-
-$ ipa user-add --first=tim --last=user --radius pyrad --user-auth-type radius tuser
-
-### Executing the search
-
-$ ldapsearch -x -w password -D "uid=tuser1,cn=users,cn=accounts,dc=example,dc=test" -b "cn=users,cn=accounts,dc=example,dc=test" uid=admin
-
-The password here is the RADIUS password. In the case of pyrad it currently
-accepts anything.
-
-## Backup/Restore
-
-There should be no impact for backup and restore as this only modifies
-the IPA password plugin and does not ship new files or configuration.
-
-## Upgrades
-
-The additional enforcement of no userPassword/krbPrincipalKey and
-radius link for the RADIUS authentication indicator could cause issues
-for some users. We will need to be absolutely clear in error logging
-why authentication is failing, and document the change in a release
-note.
-
-If we require that RADIUS be a standalone indicator that could also
-pose upgrade problems.

doc/designs/ldapi-autobind-services.md

@@ -1,135 +0,0 @@
-# LDAPI autobind authentication for services
-
-## Overview
-
-This design proposed to use LDAPI autobind for some internal FreeIPA
-services, so they can be started and used before KRB5 KDC service is
-operational. The proposal makes use of 389 DS' existing [LDAPI autobind](
-https://www.port389.org/docs/389ds/FAQ/ldapi-and-autobind.html)
-implementation and new [LDAPI autobind DN rewriter](
-https://www.port389.org/docs/389ds/design/ldapi-auto-auth-dn-design.html)
-feature, which will be available in early 2021.
-
-LDAPI autobind is a form of authentication that uses the effective
-UID and GID of a process as credentials. It uses ``SO_PEERCRED`` feature
-of [unix socket](https://man7.org/linux/man-pages/man7/unix.7.html)
-connection and SASL EXTERNAL mechanism. Autobind enables secure and
-fast authentication for local services without using KRB5 KDC.
-
-## Technical background
-
-### Benefits
-
-LDAPI autobind does not depend on Kerberos/GSSAPI. This fact permits
-services to authenticate and operate before KRB5 KDC is up and running.
-For example DNS services can be started before KDC, so a time sync
-daemon can synchronize clocks before KDC starts.
-
-It's faster than GSSAPI. On a test system ``ldapwhoami`` command
-with ``-Y EXTERNAL`` takes around 12ms real time. On the same system
-``-Y GSSAPI`` over LDAPI with a cached service ticket takes between
-20ms to 500ms real time.
-
-### Drawbacks
-
-On Fedora and RHEL-based systems, FreeIPA's keytabs are not only
-protected by DAC permissions (discrete access control, also known as
-Unix file permissions) but also by SELinux's mandatory access control.
-For example ``named.keytab`` is only readable by user ``named`` or
-group members of group ``named`` and processes that are
-allowed to open files with SELinux type ``etc_t``. ``SO_PEERCRED``-based
-authentication no longer verifies the SELinux context of a process.
-It is possible to retrieve the security context of a peer process
-with ``SO_PEERSEC``, but 389-DS does not implement the feature.
-
-The risk is negligible for BIND named. Most process are allowed to
-read files with ``etc_t`` any way.
-
-### Containers
-
-``SO_PEERCRED`` based authentication works across containers if and
-only if the 389-DS server process and LDAP client process can share a
-mount point and a common user namespace. The mount point is required
-to share the Unix socket file of the 389-DS process. The user namespace
-must be shared, because the Kernel translates UID and GID numbers
-between namespaces. Disjunct namespaces result in UID/GID ``-1``.
-
-## Candidates
-
-* BIND named service, so ``named`` and ``chronyd`` can be started
-  before KDC.
-* krb5kdc and kadmin service (after dropping root privileges)
-* ipa-custodia (after dropping root privileges)
-
-## Implementation
-
-The implementation makes use of the new DN rewriter feature for
-autobind. The feature enables FreeIPA to store the UID/GID mapping in
-the local, non-replicated ``cn=config`` backend and then map succesful
-binds to a DN in the replicated domain database. The approach has two
-benefits:
-
-1) FreeIPA does not depend on reserved and uniform UID/GID allocation
-   across all servers. Each server can map its local UID/GID assignment
-   to a principal.
-2) FreeIPA can map UID/GID combination to a host-specific service
-   principal. For example server ``srv1`` can map UID ``25`` / GID
-   ``25`` to ``DNS/srv1.ipa.example@IPA.EXAMPLE``. ``srv2`` can map the
-   same UID and GID to its principal
-   ``DNS/srv2.ipa.example@IPA.EXAMPLE``.
-
-### global settings
-
-LDAPI mappings, search base for UID/GID, and mapping base for
-``nsslapd-authenticateAsDN`` must be configured in ``cn=config``.
-
-```
-dn: cn=config
-nsslapd-ldapimaptoentries: on
-nsslapd-ldapientrysearchbase: cn=auto_bind,cn=config
-nsslapd-ldapidnmappingbase: cn=auto_bind,cn=config
-```
-
-### service-specific settings
-
-LDAPI DN rewriter feature comes with a new object class for mapping
-UID/GID to another DN. For example a mapping for BIND named would look
-like this:
-
-```
-dn: cn=named,cn=auto_bind,cn=config
-objectClass: top
-objectClass: nsLDAPIFixedAuthMap
-cn: named
-uidNumber: $NAMED_UID
-gidNumber: $NAMED_GID
-nsslapd-authenticateAsDN: krbprincipalname=DNS/$FQDN@$REALM,cn=services,cn=accounts,$SUFFIX
-```
-
-**NOTE** 389-DS does not enforce referential integrity in ``cn=config``.
-``nsslapd-authenticateAsDN`` can reference DNs that do not exist yet. A
-missing target results into authenticate error.
-
-### reload LDAPI mappings
-
-389-DS has an internal cache for LDAPI mappings. The cache must be
-refreshed after mapping are added, removed, or changed. A refresh can
-be accomplished by either restarting the server process or running the
-`reload ldapi mappings` task. The implementation detail will be
-handled automatically by new API and ``ipa-ldap-updater`` framework.
-
-### backup / restore
-
-It is possible that UID or GID can change, when a server is reinstalled
-and restored from a backup. ``ipa-restore`` will refresh all mappings
-on restore.
-
-## References
-
-* [389-DS LDAPI autobind](
-https://www.port389.org/docs/389ds/FAQ/ldapi-and-autobind.html)
-* [LDAPI autobind DN rewriter](
-https://www.port389.org/docs/389ds/design/ldapi-auto-auth-dn-design.html)
-* 389-DS feature request [GH-4381](https://github.com/389ds/389-ds-base/issues/4381)
-* FreeIPA bug report [pagure-8544](https://pagure.io/freeipa/issue/8544)
-  for replication issue due to clock mismatch.

doc/designs/random-serial-numbers.md

@@ -1,130 +0,0 @@
-# Random Serial Numbers v3 (RSNv3)
-
-## Overview
-
-Previously PKI used range-based serial numbers in order to ensure uniqueness across multiple clones. Based on their experience they determined that this would not fit well into cloud environments with short-lived certificates.
-
-The new version 3 implementation of serial numbers uses a 128-bit random value for the serial number which they compute collisions will be mathematically small.
-
-See https://github.com/dogtagpki/pki/wiki/Random-Certificate-Serial-Numbers-v3 for more details.
-
-Given the known issues reported this will be supported in IPA for new installations only.
-
-## Use Cases
-
-RSNv3 will be supported only for new installations. If enabled it is required to use RSNv3 on all PKI services including the CA and KRA in the deployment.
-
-The PKI team currently discourages mixing ranged and random serial numbers and in practice creating a ranged clone from a RSNv3 server will fail. At some point in the future it may be possible to write a tool to flip values in an existing deployment to enable RSNv3 on existing servers prior to creating new replicas but it will be complex and require significant testing. Currently interoperability between ranged and RSNv3 is not a good experience.
-
-## How to Use
-
-Instructions for installing a CA: https://github.com/dogtagpki/pki/blob/master/docs/installation/ca/Installing-CA-with-Random-Serial-Numbers-v3.adoc
-
-Instructions for installing a KRA: https://github.com/dogtagpki/pki/blob/master/docs/installation/kra/Installig-KRA-with-Random-Serial-Numbers-v3.adoc
-
-A new option was added for ipa-server-install and ipa-ca-install to --random-serial-numbers to enable RSNv3. This sets the configuration values as described in the documentation above.
-
-## Design
-
-### SerialNumber class
-
-The first limitation within IPA related to RSNv3 is the size of the serial numbers which can be up to 40-digit decimal values. This far exceeds the limits of XML-RPC and JSON integer values.
-
-There has never been a reason to treat serial numbers as integers and the original CA implementation transmitted them as strings. A new class will be needed to handle the huge integers as strings with some basic validation.
-
-The validation will include:
-
-- Minimum length of 1, no empty serial numbers
-- Maximum length of 40 (2^^128)
-- No negative values
-- Greater than 0
-- If prefixed with 0x a valid hex value
-
-The only "math" we do on serial numbers is conversion to and from hex. Python internally can handle these huge numbers, it is only in the transmission that there is a problem.
-
-### Determining RSN version
-
-There are two possible methods to handle the introduction of random serial numbers:
-
-#### Implement as a Domain Level 2
-
-There are existing checks which will limit interoperability that may be extended as needed. This was not chosen because with RSNv3 it is an all or nothing affair according to the PKI documentation. All existing servers would need to be moved at once, not something easily enforceable or doable in large installations.
-
-#### Store the RSN version as a value in LDAP
-
-Instead store the version number in LDAP which is easily searchable and a common practice in IPA. A non-existent value will be treated as 0 and therefore no RSN capability. This will allow for expansion into future RSN versions. Current CA ACLs can be extended to allow read/write to this for admin users.
-
-### KRA impact
-
-The PKI team strongly encouraged that if RSNv3 is enabled anywhere then it should be enabled everywhere. This includes request and key IDs and a KRA. A check will be done on KRA installation to automatically enable RSNv3 if it is enabled on the underlying CA.
-
-## Implementation
-
-The RSN version will be stored in the IPA CA entry which will exist on any IPA server with a CA.
-
-The new attribute is named ipaCaRandomSerialNumberVersion and consists of:
-
-attributeTypes: (2.16.840.1.113730.3.8.21.1.9 NAME 'ipaCaRandomSerialNumberVersion' DESC 'Random Serial Number Version' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'IPA v4.9 RSNv3' )
-
-This attribute is not yet merged into IANA pending design approval.
-
-It will be added as MAY to ipaCa objectclass.
-
-A sample entry looks like:
-```
-dn: cn=ipa,cn=cas,cn=ca,dc=example,dc=test
-objectClass: top
-objectClass: ipaca
-cn: ipa
-description: IPA CA
-ipaCaId: <UUID>
-ipaCaIssuerDN: CN=Certificate Authority,O=EXAMPLE.TEST
-ipaCaSubjectDN: CN=Certificate Authority,O=EXAMPLE.TEST
-ipaCaRandomSerialNumberVersion: 3
-```
-
-During replica install or ipa-ca-install a check will be made to determine if RSN is > 0 to determine whether it is allowed or not.
-
-No special effort is needed to include externally signed IPA certificates.
-
-CAless installations are unaffected. Promotion from CAless can include RSN and be held to the same standards as a new installation.
-
-Unfortunately the PKI server provides no mechanism to determine whether the RSNv3 capability exists in the server so a straight version number check is required. It is only available in 11.2.0+.
-
-## Feature Management
-
-### UI
-
-N/A
-
-### CLI
-
-A new option, --random-serial-numbers, is added to ipa-server-install and ipa-ca-install. If --setup-ca is provided to ipa-replica-install then RSN is determined automatically based on the capability of the remote CA.
-
-### Configuration
-
-N/A
-
-## Upgrade
-
-Not currently allowed. While theoretically possible to write a tool to enable it doing so is complex and prone to user error which could result in a non-functioning installation.
-
-## Test plan
-
-A RSNv3 installation varies only from a ranged installation in its CA/KRA configuration. Existing CA tests can be extended to pass the --random-serial-numbers option and from a user perspective, beyond getting certificates with potentially huge serial numbers, there is no difference.
-
-A selected set of existing tests will be subclassed to add the RSNv3 installation option, including CA-less to CA-full installations.
-
-Typically "is the CA ok" tests which do "ipa cert-show 1" can still work to show that communication is working (e.g. Not Found is a fine answer), existing tests will be extended to use the IPA CA serial number so we get a positive answer back.
-
-During development the entire test suite was successfully executed with RSNv3 enabled. Doing so even on a nightly basis is an extremely heavy-weight option.
-
-## Troubleshooting and debugging
-
-Given this supports new installations only that greatly simplifies the possible conditions.
-
-There are only two conditions which would disallow a server to be installed:
-- PKI < 11.2.0
-- The LDAP-stored RSNv3 value prevents ipa-ca-install or ipa-replica-install
-
-It is possible that some client tools may not honor huge serial numbers but testing has not borne any out yet.

doc/designs/template.md

@@ -1,73 +0,0 @@
-# Feature name
-
-## Overview
-
-Short overview of the problem set and any background material or references one would need to understand the details. 
-
-## Use Cases
-
-Walk through one or more full examples of how the feature will be used. These should not all be the simplest cases. 
-
-## How to Use
-
-This a starting point for design discussions.
-
-Easy to follow instructions how to use the new feature according to the [use cases](#use-cases) described above. FreeIPA user needs to be able to follow the steps and demonstrate the new features.
-
-The chapter may be divided in sub-sections per [Use Case](#use-cases). 
-
-## Design
-
-The proposed solution. This may include but is not limited to:
-
-- High Level schema([Example 1](https://www.freeipa.org/page/V4/OTP), [Example 2](https://www.freeipa.org/page/V4/Migrating_existing_environments_to_Trust))
-- Information or update workflow
-- Access control (may include [new permissions](https://www.freeipa.org/page/V4/Permissions_V2))
-- Compatibility with other (older) version of FreeIPA. Think if the feature requires a minimum [Domain level](https://www.freeipa.org/page/V4/Domain_Levels).
-
-For other hints what to consider see [general considerations](https://www.freeipa.org/page/General_considerations) page. 
-
-## Implementation
-
-Any implementation details you would like to spell out. Describe any technical details here. Make sure you cover
-
-- Dependencies: any new dependencies that FreeIPA project packages would gain and that needs to be packaged in distros? The proposal needs to be carefully reviewed, so that FreeIPA dependency size does not increase without strong justification.
-- Backup and Restore: any new file to back up or change required in [Backup and Restore](https://www.freeipa.org/page/V3/Backup_and_Restore)?
-
-If this section is not trivial, move it to /Implementation sub page and only include link. 
-
-## Feature Management
-
-### UI
-
-How the feature will be managed via the Web UI. 
-
-### CLI
-
-Overview of the CLI commands. Example:
-
-| Command |	Options |
-| --- | ----- |
-| config-mod | --user-auth-type=password/otp/radius |
-| user-mod | --user-auth-type=password/otp/radius --radius=STR --radius-username=STR |
-
-### Configuration
-
-Any configuration options? Any commands to enable/disable the feature or turn on/off its parts? 
-
-## Upgrade
-
-Any impact on upgrades? Remove this section if not applicable. 
-
-## Test plan
-
-Test scenarios that will be transformed to test cases for FreeIPA [Continuous Integration](https://www.freeipa.org/page/V3/Integration_testing) during implementation or review phase. This can be also link to source in [pagure](https://pagure.io/freeipa.git) with the test, if appropriate. 
-
-## Troubleshooting and debugging
-
-Include as much information as possible that would help troubleshooting:
-- Does the feature rely on existing files (keytabs, config file...)
-- Does the feature produce logs? in a file or in the journal?
-- Does the feature create/rely on LDAP entries? 
-- How to enable debug logs?
-- When the feature doesn't work, is it possible to diagnose which step failed? Are there intermediate steps that produce logs?

freeipa.spec.in

@@ -1525,11 +1525,10 @@ fi
 %dir %{_sysconfdir}/ipa/html
 %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
 %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
-%dir %{_sysconfdir}/ipa/http
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-rewrite.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-kdc-proxy.conf
-%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-pki-proxy.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
+%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
 %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf

install/share/60certificate-profiles.ldif

@@ -7,7 +7,6 @@ attributeTypes: (2.16.840.1.113730.3.8.21.1.5 NAME 'ipaCertProfileCategory' DESC
 attributeTypes: (2.16.840.1.113730.3.8.21.1.6 NAME 'ipaCaId' DESC 'Dogtag Authority ID' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v4.4 Lightweight CAs' )
 attributeTypes: (2.16.840.1.113730.3.8.21.1.7 NAME 'ipaCaIssuerDN' DESC 'Issuer DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )
 attributeTypes: (2.16.840.1.113730.3.8.21.1.8 NAME 'ipaCaSubjectDN' DESC 'Subject DN' SUP distinguishedName X-ORIGIN 'IPA v4.4 Lightweight CAs' )
-attributeTypes: (2.16.840.1.113730.3.8.21.1.9 NAME 'ipaCaRandomSerialNumberVersion' DESC 'Random Serial Number Version' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'IPA v4.9 RSNv3' )
 objectClasses: (2.16.840.1.113730.3.8.21.2.1 NAME 'ipaCertProfile' SUP top STRUCTURAL MUST ( cn $ description $ ipaCertProfileStoreIssued ) X-ORIGIN 'IPA v4.2' )
 objectClasses: (2.16.840.1.113730.3.8.21.2.2 NAME 'ipaCaAcl' SUP ipaAssociation STRUCTURAL MUST cn MAY ( ipaCaCategory $ ipaCertProfileCategory $ userCategory $ hostCategory $ serviceCategory $ ipaMemberCa $ ipaMemberCertProfile $ memberService ) X-ORIGIN 'IPA v4.2' )
-objectClasses: (2.16.840.1.113730.3.8.21.2.3 NAME 'ipaCa' SUP top STRUCTURAL MUST ( cn $ ipaCaId $ ipaCaSubjectDN $ ipaCaIssuerDN ) MAY ( description $ ipaCaRandomSerialNumberVersion ) X-ORIGIN 'IPA v4.4 Lightweight CAs' )
+objectClasses: (2.16.840.1.113730.3.8.21.2.3 NAME 'ipaCa' SUP top STRUCTURAL MUST ( cn $ ipaCaId $ ipaCaSubjectDN $ ipaCaIssuerDN ) MAY description X-ORIGIN 'IPA v4.4 Lightweight CAs' )

install/share/Makefile.am

@@ -98,10 +98,10 @@ dist_app_DATA =				\
 	kdcproxy.wsgi			\
 	ipakrb5.aug			\
 	ipa.conf.template		\
+	ipa-wsgi.conf.template		\
 	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf.template	\
 	ipa-rewrite.conf.template	\
-	ipa-vhost.conf.template		\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\

install/share/bind.named.conf.template

@@ -57,5 +57,6 @@ dyndb "ipa" "$BIND_LDAP_SO" {
 	base "cn=dns,$SUFFIX";
 	server_id "$FQDN";
 	auth_method "sasl";
-	sasl_mech "EXTERNAL";
+	sasl_mech "GSSAPI";
+	sasl_user "DNS/$FQDN";
 };

install/share/ipa-vhost.conf.template

@@ -12,6 +12,7 @@ WSGISocketPrefix $WSGI_PREFIX_DIR
 WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
   user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
   lang=C.UTF-8 locale=C.UTF-8
+WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
 
 <VirtualHost *:80>
     ServerName $FQDN
@@ -37,12 +38,14 @@ WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
 
     # SSL
     SSLEngine on
-    SSLCertificateFile $HTTPD_CERT_FILE
-    SSLCertificateKeyFile $HTTPD_KEY_FILE
-    SSLCACertificateFile $IPA_CA_CRT
-    SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH
+    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+    SSLCACertificateFile /etc/ipa/ca.crt
+    SSLCertificateKeyFile /var/lib/ipa/private/httpd.key
+    SSLCertificateFile /var/lib/ipa/certs/httpd.crt
+    SSLCipherSuite PROFILE=SYSTEM
+    SSLProxyCipherSuite PROFILE=SYSTEM
 
-    # FreeIPA
+    #
     IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
     IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
     Include $HTTPD_IPA_REWRITE_CONF

install/share/ipa-wsgi.conf.template

@@ -0,0 +1,15 @@
+#
+# VERSION 32 - DO NOT REMOVE THIS LINE
+#
+# This file may be overwritten on upgrades.
+#
+
+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
+# Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
+

install/share/ipa.conf.template

@@ -40,6 +40,7 @@ WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \
   application-group=%{GLOBAL}
 WSGIScriptReloading Off
 
+
 # Turn off mod_msgi handler for errors, config, crl:
 <Location "/ipa/errors">
   SetHandler None

install/share/ipaca_customize.ini

@@ -85,6 +85,7 @@ pki_subsystem_key_type=%(ipa_key_type)s
 pki_subsystem_token=%(pki_token_name)s
 
 [CA]
+pki_random_serial_numbers_enable=False
 
 ## caSigningCert cert-pki-ca
 pki_ca_signing_key_algorithm=%(ipa_ca_key_algorithm)s

install/tools/ipa-ca-install.in

@@ -106,10 +106,6 @@ def parse_options():
                       default=None,
                       help="Path to ini file with config overrides.")
 
-    parser.add_option("--random-serial-numbers", dest="random_serial_numbers",
-                      default=False, help="Enable random serial numbers",
-                      action="store_true")
-
     options, args = parser.parse_args()
     safe_options = parser.get_safe_opts(options)
 
@@ -230,10 +226,6 @@ def install_master(safe_options, options):
         options.ca_subject = str(
             installutils.default_ca_subject_dn(options.subject_base))
 
-    try:
-        ca.random_serial_numbers_validator(options.random_serial_numbers)
-    except ValueError as e:
-        sys.exit(str(e))
     try:
         ca.subject_validator(ca.VALID_SUBJECT_BASE_ATTRS, options.subject_base)
     except ValueError as e:
@@ -278,11 +270,6 @@ def install(safe_options, options):
         if ca_host is None:
             install_master(safe_options, options)
         else:
-            if options.random_serial_numbers:
-                if ca.lookup_random_serial_number_version(api) == 0:
-                    sys.exit(
-                        "\nRandom serial numbers cannot be enabled in an "
-                        "existing CA installation.\n")
             install_replica(safe_options, options)
 
 

install/tools/man/ipa-ca-install.1

@@ -82,9 +82,6 @@ Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SH
 \fB\-\-no\-host\-dns\fR
 Do not use DNS for hostname lookup during installation
 .TP
-\fB\-\-random\-serial\-numbers\fR
-Enable Random Serial Numbers. Random serial numbers cannot be used in a mixed environment. Either all CA's have it enabled or none do.
-.TP
 \fB\-\-skip\-conncheck\fR
 Skip connection check to remote master
 .TP

install/tools/man/ipa-cacert-manage.1

@@ -27,8 +27,6 @@ ipa\-cacert\-manage \- Manage CA certificates in IPA
 \fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] delete \fINICKNAME\fR
 .br
 \fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] list
-.br
-\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] prune
 .SH "DESCRIPTION"
 \fBipa\-cacert\-manage\fR can be used to manage CA certificates in IPA.
 .SH "COMMANDS"
@@ -74,13 +72,6 @@ Please do not forget to run ipa-certupdate on the master, all the replicas and a
 .RS
 Display a list of the nicknames or subjects of the CA certificates that have been installed.
 .RE
-.TP
-\fBprune\fR
-\- Prune the stored CA certificates
-.sp
-.RS
-Removes installed CA certificates that are expired.
-.RE
 .SH "COMMON OPTIONS"
 .TP
 \fB\-\-version\fR

install/tools/man/ipa-replica-install.1

@@ -98,6 +98,9 @@ Configure SSSD as data source for subid.
 \fB\-\-skip\-conncheck\fR
 Skip connection check to remote master
 .TP
+\fB\-\-skip\-mem\-check\fR
+Skip checking for minimum required memory
+.TP
 \fB\-d\fR, \fB\-\-debug
 Enable debug logging when more verbose output is needed
 .TP

install/tools/man/ipa-server-install.1

@@ -83,6 +83,9 @@ Do not configure OpenSSH server.
 \fB\-\-subid\fR
 Configure SSSD as data source for subid.
 .TP
+\fB\-\-skip\-mem\-check\fR
+Skip checking for minimum required memory
+.TP
 \fB\-d\fR, \fB\-\-debug\fR
 Enable debug logging when more verbose output is needed.
 .TP
@@ -122,9 +125,6 @@ If no template is specified, the template name "SubCA" is used.
 \fB\-\-external\-cert\-file\fR=\fIFILE\fR
 File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
 .TP
-\fB\-\-random\-serial\-numbers\fR
-Enable Random Serial Numbers. Random serial numbers cannot be used in a mixed environment. Either all CA's have it enabled or none do.
-.TP
 \fB\-\-no\-pkinit\fR
 Disables pkinit setup steps.
 .TP

install/ui/src/freeipa/Application_controller.js

@@ -318,6 +318,7 @@ define([
                         $type: 'text',
                         name: 'pagination_size',
                         label: '@i18n:customization.table_pagination',
+                        required: true,
                         validators: ['positive_integer']
                     }
                 ]

install/ui/src/freeipa/policy.js

@@ -72,6 +72,9 @@ return {
                         {
                             name: 'cospriority',
                             required: true
+                        },
+                        {
+                            name: 'passwordgracelimit'
                         }
                     ]
                 }]

install/ui/src/freeipa/user.js

@@ -318,6 +318,11 @@ return {
                             label: '@mo-param:pwpolicy:krbpwdlockoutduration:label',
                             read_only: true,
                             measurement_unit: 'seconds'
+                        },
+                        {
+                            name: 'passwordgracelimit',
+                            label: '@mo-param:pwpolicy:passwordgracelimit:label',
+                            read_only: true
                         }
                     ]
                 },

install/updates/20-autobind.update

@@ -1,14 +1,6 @@
-# countainer for autobind, already exists in new 389-DS instances
-dn: cn=auto_bind,cn=config
-default: objectClass: nsContainer
-default: objectClass: top
-default: cn: auto_bind
-
 # map LDAPI autobind uid/gid to user entries (not used by root autobind)
 dn: cn=config
 only: nsslapd-ldapimaptoentries: on
-only: nsslapd-ldapientrysearchbase: cn=auto_bind,cn=config
-only: nsslapd-ldapidnmappingbase: cn=auto_bind,cn=config
 
 # lib389 configures 389-DS for root-autobind. This entry is no longer needed.
 dn: cn=root-autobind,cn=config

install/updates/49-autobind-services.update

@@ -1,7 +0,0 @@
-# create / update LDAPI autobind rules for services
-# also used by ipa-restore to ensure correct mappings
-# NOTE: ipa-ldap-updater runs reload ldapi mappings tasks
-
-dn: cn=named,cn=auto_bind,cn=config
-onlyifexist: uidNumber: $NAMED_UID
-onlyifexist: gidNumber: $NAMED_GID

install/updates/Makefile.am

@@ -46,7 +46,6 @@ app_DATA =				\
 	41-caacl.update			\
 	41-lightweight-cas.update	\
 	45-roles.update			\
-	49-autobind-services.update	\
 	50-7_bit_check.update	        \
 	50-dogtag10-migration.update	\
 	50-groupuuid.update		\

ipaclient/plugins/sudorule.py

@@ -39,11 +39,9 @@ class sudorule_disable(MethodOverride):
 @register(override=True, no_fail=True)
 class sudorule_add_option(MethodOverride):
     def output_for_cli(self, textui, result, cn, **options):
-        opts = self.normalize(**options)
         textui.print_dashed(
             _('Added option "%(option)s" to Sudo Rule "%(rule)s"')
-            % dict(option=','.join(opts['ipasudoopt']), rule=cn)
-        )
+              % dict(option=options['ipasudoopt'], rule=cn))
 
         super(sudorule_add_option, self).output_for_cli(textui, result, cn,
                                                         **options)
@@ -52,10 +50,8 @@ class sudorule_add_option(MethodOverride):
 @register(override=True, no_fail=True)
 class sudorule_remove_option(MethodOverride):
     def output_for_cli(self, textui, result, cn, **options):
-        opts = self.normalize(**options)
         textui.print_dashed(
             _('Removed option "%(option)s" from Sudo Rule "%(rule)s"')
-            % dict(option=','.join(opts['ipasudoopt']), rule=cn)
-        )
+              % dict(option=options['ipasudoopt'], rule=cn))
         super(sudorule_remove_option, self).output_for_cli(textui, result, cn,
                                                            **options)

ipalib/__init__.py

@@ -921,10 +921,7 @@ from ipalib.backend import Backend
 from ipalib.frontend import Command, LocalOrRemote, Updater
 from ipalib.frontend import Object, Method
 from ipalib.crud import Create, Retrieve, Update, Delete, Search
-from ipalib.parameters import (
-    DefaultFrom, Bool, Flag, Int, Decimal, Bytes, Str, IA5Str,
-    Password, DNParam, SerialNumber
-)
+from ipalib.parameters import DefaultFrom, Bool, Flag, Int, Decimal, Bytes, Str, IA5Str, Password, DNParam
 from ipalib.parameters import (BytesEnum, StrEnum, IntEnum, AccessTime, File,
                         DateTime, DNSNameParam)
 from ipalib.errors import SkipPluginModule

ipalib/messages.py

@@ -18,7 +18,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 """
-Custom message (debug, info, wraning) classes passed through RPC.
+Custom message (debug, info, warning) classes passed through RPC.
 
 These are added to the "messages" entry in a RPC response, and printed to the
 user as log messages.
@@ -27,7 +27,7 @@ Each message class has a unique numeric "errno" attribute from the 10000-10999
 range, so that it does not clash with PublicError numbers.
 
 Messages also have the 'type' argument, set to one of 'debug', 'info',
-'warning', 'error'. This determines the severity of themessage.
+'warning', 'error'. This determines the severity of the message.
 """
 from __future__ import print_function
 
@@ -496,6 +496,16 @@ class LightweightCACertificateNotAvailable(PublicMessage):
     format = _("The certificate for %(ca)s is not available on this server.")
 
 
+class MissingTargetAttributesinPermission(PublicMessage):
+    """
+    **13032** A permission was added with no target attributes
+    """
+    errno = 13032
+    type = "warning"
+    format = _("The permission has %(right)s rights but no attributes "
+               "are set.")
+
+
 def iter_messages(variables, base):
     """Return a tuple with all subclasses
     """

ipalib/parameters.py

@@ -2254,47 +2254,3 @@ def create_signature(command):
     )
 
     return signature
-
-
-class SerialNumber(Str):
-    """Certificate serial number parameter type
-    """
-
-    type = str
-    allowed_types = (str,)
-
-    # FIXME: currently unused, perhaps drop it
-    MAX_VALUE = 340282366920938463463374607431768211456  # 2^128
-
-    kwargs = Param.kwargs + (
-        ('minlength', int, 1),
-        ('maxlength', int, 40),  # Up to 128-bit values
-        ('length', int, None),
-    )
-
-    def _validate_scalar(self, value, index=None):
-        super(SerialNumber, self)._validate_scalar(value)
-        if value.startswith('-'):
-            raise ValidationError(
-                name=self.name, error=_('must be at least 0')
-            )
-        if not value.isdigit():
-            if value.lower().startswith('0x'):
-                try:
-                    int(value[2:], 16)
-                except ValueError:
-                    raise ValidationError(
-                        name=self.name, error=_(
-                            _('invalid valid hex'),
-                        )
-                    )
-            else:
-                raise ValidationError(
-                    name=self.name, error=_(
-                        _('must be an integer'),
-                    )
-                )
-        if value == '0':
-            raise ValidationError(
-                name=self.name, error=_('invalid serial number 0')
-            )

ipaplatform/base/paths.py

@@ -45,13 +45,14 @@ class BasePathNamespace:
     GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
     OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
     HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd"
+    HTTPD_IPA_DIR = "/etc/httpd/ipa"
     HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
-    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/httpd/ipa/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/vhost-ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/httpd/ipa/ipa-wsgi.conf"
     HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"

ipaplatform/debian/paths.py

@@ -20,11 +20,12 @@ class DebianPathNamespace(BasePathNamespace):
     ETC_HTTPD_DIR = "/etc/apache2"
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/apache2/ipa/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
     HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
     HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"

ipaplatform/suse/paths.py

@@ -17,11 +17,12 @@ class SusePathNamespace(BasePathNamespace):
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/apache2/ipa/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
     HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"

ipapython/dnsutil.py

@@ -144,6 +144,47 @@ class DNSResolver(dns.resolver.Resolver):
             nameservers.remove(ipv4_loopback)
         self.nameservers = nameservers
 
+    @dns.resolver.Resolver.nameservers.setter
+    def nameservers(self, nameservers):
+        """
+        *nameservers*, a ``list`` of nameservers with optional ports:
+            "SERVER_IP port PORT_NUMBER".
+
+        Overloads dns.resolver.Resolver.nameservers setter to split off ports
+        into nameserver_ports after setting nameservers successfully with the
+        setter in dns.resolver.Resolver.
+        """
+        # Get nameserver_ports if it is already set
+        if hasattr(self, "nameserver_ports"):
+            nameserver_ports = self.nameserver_ports
+        else:
+            nameserver_ports = {}
+
+        # Check nameserver items in list and split out converted port number
+        # into nameserver_ports: { nameserver: port }
+        if isinstance(nameservers, list):
+            _nameservers = []
+            for nameserver in nameservers:
+                splits = nameserver.split()
+                if len(splits) == 3 and splits[1] == "port":
+                    nameserver = splits[0]
+                    try:
+                        port = int(splits[2])
+                        if port < 0 or port > 65535:
+                            raise ValueError()
+                    except ValueError:
+                        raise ValueError(
+                            "invalid nameserver: %s is not a valid port" %
+                            splits[2])
+                    nameserver_ports[nameserver] = port
+                _nameservers.append(nameserver)
+            nameservers = _nameservers
+
+        # Call dns.resolver.Resolver.nameservers setter
+        dns.resolver.Resolver.nameservers.__set__(self, nameservers)
+        # Set nameserver_ports after successfull call to setter
+        self.nameserver_ports = nameserver_ports
+
 
 class DNSZoneAlreadyExists(dns.exception.DNSException):
     supp_kwargs = {'zone', 'ns'}

ipapython/ipaldap.py

@@ -758,8 +758,6 @@ class LDAPClient:
         'nsslapd-enable-upgrade-hash': True,
         'nsslapd-db-locks': True,
         'nsslapd-logging-hr-timestamps-enabled': True,
-        'nsslapd-ldapientrysearchbase': True,
-        'nsslapd-ldapidnmappingbase': True,
         'nsslapd-sizelimit': True,
     })
 

ipaserver/dcerpc.py

@@ -1581,7 +1581,7 @@ def fetch_domains(api, mydomain, trustdomain, creds=None, server=None):
     def communicate(td):
         td.init_lsa_pipe(td.info['dc'])
         netr_pipe = netlogon.netlogon(td.binding, td.parm, td.creds)
-        # Older FreeIPA versions used netr_DsrEnumerateDomainTrusts call
+        # Older IPA versions used netr_DsrEnumerateDomainTrusts call
         # but it doesn't provide information about non-domain UPNs associated
         # with the forest, thus we have to use netr_DsRGetForestTrustInformation
         domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'],

ipaserver/install/bindinstance.py

@@ -760,11 +760,8 @@ class BindInstance(service.Service):
             self.step("setting up records for other masters", self.__add_others)
         # all zones must be created before this step
         self.step("adding NS record to the zones", self.__add_self_ns)
-        # The service entry is used for LDAPI autobind. The keytab is no
-        # longer used to authenticate the server. The server still needs
-        # the keytab to handle incoming nsupdate requests with TSIG.
+
         self.step("setting up kerberos principal", self.__setup_principal)
-        self.step("setting up LDAPI autobind", self.setup_autobind)
         self.step("setting up named.conf", self.setup_named_conf)
         self.step("setting up server configuration",
             self.__setup_server_configuration)
@@ -1032,11 +1029,6 @@ class BindInstance(service.Service):
                             dns_principal, str(e))
             raise
 
-    def setup_autobind(self):
-        self.add_autobind_entry(
-            constants.NAMED_USER, constants.NAMED_GROUP, self.principal
-        )
-
     def setup_named_conf(self, backup=False):
         """Create, update, or migrate named configuration files
 

ipaserver/install/ca.py

@@ -11,7 +11,6 @@ from __future__ import print_function, absolute_import
 import enum
 import logging
 import os.path
-import pki.util
 
 import six
 
@@ -70,26 +69,6 @@ def subject_validator(valid_attrs, value):
         raise ValueError("invalid DN: %s" % e)
 
 
-def random_serial_numbers_version(enabled):
-    """Return True if  PKI supports RSNv3
-
-       The caller is responsible for raising the exception.
-    """
-    if not enabled:
-        return None, None
-    pki_version = pki.util.Version(pki.specification_version())
-    return pki_version >= pki.util.Version("11.2.0"), pki_version
-
-
-def random_serial_numbers_validator(enabled):
-    val, pki_version = random_serial_numbers_version(enabled)
-    if val is False:
-        raise ValueError(
-            "Random Serial Numbers are not supported in PKI version %s"
-            % pki_version
-        )
-
-
 def lookup_ca_subject(api, subject_base):
     dn = DN(('cn', IPA_CA_CN), api.env.container_ca, api.env.basedn)
     try:
@@ -109,38 +88,6 @@ def lookup_ca_subject(api, subject_base):
     return str(ca_subject)
 
 
-def lookup_random_serial_number_version(api):
-    """
-    Retrieve the random serial number version number from the
-    remote server.
-
-    If the value is > 0 then RSN was enabled. Return the raw
-    value for future-proofing in case version-specific decisions
-    need to be made.
-
-    Returns 0 if RSN is not enabled or otherwise not available.
-    """
-    dn = DN(('cn', IPA_CA_CN), api.env.container_ca, api.env.basedn)
-    version = 0
-    try:
-        # we do not use api.Command.ca_show because it attempts to
-        # talk to the CA (to read certificate / chain), but the RA
-        # backend may be unavailable (ipa-replica-install) or unusable
-        # due to RA Agent cert not yet created (ipa-ca-install).
-        entry = api.Backend.ldap2.get_entry(dn)
-
-        # If the attribute doesn't exist then the remote didn't
-        # enable RSN.
-        if 'ipacarandomserialnumberversion' in entry:
-            version = int(entry['ipacarandomserialnumberversion'][0])
-    except (errors.NotFound, KeyError):
-        # if the entry doesn't exist then the remote doesn't support
-        # RSN so there is nothing to do.
-        pass
-
-    return version
-
-
 def set_subject_base_in_config(subject_base):
     entry_attrs = api.Backend.ldap2.get_ipa_config()
     entry_attrs['ipacertificatesubjectbase'] = [str(subject_base)]
@@ -209,7 +156,6 @@ def install_check(standalone, replica_config, options):
     if replica_config is None:
         options._subject_base = options.subject_base
         options._ca_subject = options.ca_subject
-        options._random_serial_numbers = options.random_serial_numbers
     else:
         # during replica install, this gets invoked before local DS is
         # available, so use the remote api.
@@ -219,18 +165,6 @@ def install_check(standalone, replica_config, options):
         options._subject_base = str(replica_config.subject_base)
         options._ca_subject = lookup_ca_subject(_api, options._subject_base)
 
-        options._random_serial_numbers = (
-            lookup_random_serial_number_version(_api) > 0
-        )
-
-        if options._random_serial_numbers and replica_config.setup_ca:
-            try:
-                random_serial_numbers_validator(
-                    options._random_serial_numbers
-                )
-            except ValueError as e:
-                raise ScriptError(str(e))
-
     if replica_config is not None and not replica_config.setup_ca:
         return
 
@@ -419,7 +353,6 @@ def install_step_0(standalone, replica_config, options, custodia):
         promote=promote,
         use_ldaps=use_ldaps,
         pki_config_override=options.pki_config_override,
-        random_serial_numbers=options._random_serial_numbers,
     )
 
 
@@ -612,13 +545,3 @@ class CAInstallInterface(dogtag.DogtagInstallInterface,
     )
     skip_schema_check = enroll_only(skip_schema_check)
     skip_schema_check = replica_install_only(skip_schema_check)
-
-    random_serial_numbers = knob(
-        None,
-        description="Enable random serial numbers",
-    )
-    random_serial_numbers = master_install_only(random_serial_numbers)
-
-    @random_serial_numbers.validator
-    def random_serial_numbers(self, value):
-        random_serial_numbers_validator(value)

ipaserver/install/cainstance.py

@@ -345,8 +345,7 @@ class CAInstance(DogtagInstance):
                            ca_type=None, external_ca_profile=None,
                            ra_p12=None, ra_only=False,
                            promote=False, use_ldaps=False,
-                           pki_config_override=None,
-                           random_serial_numbers=False):
+                           pki_config_override=None):
         """Create a CA instance.
 
            To create a clone, pass in pkcs12_info.
@@ -386,7 +385,6 @@ class CAInstance(DogtagInstance):
         else:
             self.ca_type = x509.ExternalCAType.GENERIC.value
         self.external_ca_profile = external_ca_profile
-        self.random_serial_numbers = random_serial_numbers
 
         self.no_db_setup = promote
         self.use_ldaps = use_ldaps
@@ -483,9 +481,6 @@ class CAInstance(DogtagInstance):
                               migrate_profiles_to_ldap)
                     self.step("adding default CA ACL", ensure_default_caacl)
                     self.step("adding 'ipa' CA entry", ensure_ipa_authority_entry)
-                    if not self.clone:
-                        self.step("Recording random serial number state",
-                                  self.__store_random_serial_number_state)
                 else:
                     # Re-import profiles in the promote case to pick up any
                     # that will only be triggered by an upgrade.
@@ -525,11 +520,6 @@ class CAInstance(DogtagInstance):
         if self.ca_signing_algorithm is not None:
             cfg['ipa_ca_signing_algorithm'] = self.ca_signing_algorithm
 
-        cfg['pki_random_serial_numbers_enable'] = self.random_serial_numbers
-        if self.random_serial_numbers:
-            cfg['pki_request_id_generator'] = 'random'
-            cfg['pki_cert_id_generator'] = 'random'
-
         if not (os.path.isdir(paths.PKI_TOMCAT_ALIAS_DIR) and
                 os.path.isfile(paths.PKI_TOMCAT_PASSWORD_CONF)):
             # generate pin which we know can be used for FIPS NSS database
@@ -567,17 +557,6 @@ class CAInstance(DogtagInstance):
             shutil.copy(cafile, paths.TMP_CA_P12)
             self.service_user.chown(paths.TMP_CA_P12)
 
-            if self.random_serial_numbers:
-                cfg.update(
-                    pki_random_serial_numbers_enable=True,
-                    pki_request_id_generator="random",
-                    pki_cert_id_generator="random",
-                )
-            else:
-                cfg.update(
-                    pki_random_serial_numbers_enable=False,
-                )
-
             self._configure_clone(
                 cfg,
                 security_domain_hostname=self.master_host,
@@ -1573,24 +1552,6 @@ class CAInstance(DogtagInstance):
 
         return True
 
-    def __store_random_serial_number_state(self):
-        """
-        Save the Random Serial Number (RSN) version.
-
-        This is intended to add flexibility in case RSN bumps
-        another version in dogtag. For now we only support v3
-        or no randomization (0).
-        """
-        if self.random_serial_numbers:
-            value = 3
-        else:
-            value = 0
-        dn = DN(('cn', ipalib.constants.IPA_CA_CN), api.env.container_ca,
-                api.env.basedn)
-        entry_attrs = api.Backend.ldap2.get_entry(dn)
-        entry_attrs['ipaCaRandomSerialNumberVersion'] = value
-        api.Backend.ldap2.update_entry(entry_attrs)
-
 
 def __update_entry_from_cert(make_filter, make_entry, cert):
     """

ipaserver/install/httpinstance.py

@@ -87,13 +87,14 @@ class HTTPInstance(service.Service):
 
     def create_instance(self, realm, fqdn, domain_name, dm_password=None,
                         pkcs12_info=None,
-                        subject_base=None, auto_redirect=True, ca_file=None,
-                        ca_is_configured=None, promote=False,
+                        subject_base=None, auto_redirect=True, ui_vhost=False,
+                        ca_file=None, ca_is_configured=None, promote=False,
                         master_fqdn=None):
         self.fqdn = fqdn
         self.realm = realm
         self.domain = domain_name
         self.dm_password = dm_password
+        self.ui_vhost = ui_vhost
         self.suffix = ipautil.realm_to_suffix(self.realm)
         self.pkcs12_info = pkcs12_info
         self.cert = None
@@ -115,11 +116,7 @@ class HTTPInstance(service.Service):
             HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
             HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
             HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
-            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
-            HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
-            HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
-            IPA_CA_CRT=paths.IPA_CA_CRT,
-            MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
+            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
         )
         self.ca_file = ca_file
         if ca_is_configured is not None:
@@ -137,6 +134,7 @@ class HTTPInstance(service.Service):
         self.step("configuring mod_ssl log directory",
                   self.set_mod_ssl_logdir)
         self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp)
+        self.step("adding URL rewriting rules", self.__add_include)
         self.step("configuring httpd", self.__configure_http)
         self.step("setting up httpd keytab", self.request_service_keytab)
         self.step("configuring Gssproxy", self.configure_gssproxy)
@@ -224,6 +222,18 @@ class HTTPInstance(service.Service):
         http_fd.close()
         os.chmod(target_fname, 0o644)
 
+        target_fname = paths.HTTPD_IPA_WSGI_CONF
+        http_txt = ipautil.template_file(
+            os.path.join(paths.USR_SHARE_IPA_DIR,
+                         "ipa-wsgi.conf.template"),
+            self.sub_dict)
+        self.fstore.backup_file(paths.HTTPD_IPA_CONF)
+        http_fd = open(target_fname, "w")
+        http_fd.write(http_txt)
+        http_fd.close()
+        os.chmod(target_fname, 0o644)
+
+
         target_fname = paths.HTTPD_IPA_SITE_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -312,6 +322,17 @@ class HTTPInstance(service.Service):
             aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
             aug.save()
 
+    def __add_include(self):
+        """This should run after __set_mod_nss_port so is already backed up"""
+        if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
+                                    '</VirtualHost>',
+                                    'Include {path}\n'
+                                    '</VirtualHost>'.format(
+                                        path=paths.HTTPD_IPA_REWRITE_CONF)
+                                    ) != 0:
+            self.print_msg("Adding Include conf.d/ipa-rewrite to "
+                           "%s failed." % paths.HTTPD_SSL_SITE_CONF)
+
     def configure_certmonger_renewal_guard(self):
         certmonger = services.knownservices.certmonger
         certmonger_stopped = not certmonger.is_running()
@@ -554,8 +575,9 @@ class HTTPInstance(service.Service):
                 ca_iface.Set('org.fedorahosted.certmonger.ca',
                              'external-helper', helper)
 
-        for f in [paths.HTTPD_IPA_CONF, paths.HTTPD_SSL_CONF,
-                  paths.HTTPD_SSL_SITE_CONF, paths.HTTPD_NSS_CONF]:
+        for f in [paths.HTTPD_IPA_CONF, paths.HTTPD_IPA_WSGI_CONF,
+                  paths.HTTPD_SSL_CONF, paths.HTTPD_SSL_SITE_CONF,
+                  paths.HTTPD_NSS_CONF]:
             try:
                 self.fstore.restore_file(f)
             except ValueError as error:
@@ -569,14 +591,14 @@ class HTTPInstance(service.Service):
             paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host),
             paths.HTTPD_IPA_REWRITE_CONF,
             paths.HTTPD_IPA_CONF,
-            paths.HTTPD_IPA_SITE_CONF,
+            paths.HTTPD_IPA_WSGI_CONF,
             paths.HTTPD_IPA_PKI_PROXY_CONF,
             paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
             paths.HTTPD_IPA_KDCPROXY_CONF,
             paths.GSSPROXY_CONF,
             paths.GSSAPI_SESSION_KEY,
             paths.HTTPD_PASSWORD_CONF,
-            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF
+            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
         ]
         # NSS DB backups
         remove_files.extend(
@@ -688,6 +710,7 @@ class HTTPInstance(service.Service):
         self.configure_mod_ssl_certs()
         self.set_mod_ssl_protocol()
         self.set_mod_ssl_logdir()
+        self.__add_include()
 
         self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE)
 

ipaserver/install/installutils.py

@@ -1132,7 +1132,8 @@ def check_available_memory(ca=False):
     if available < minimum_suggested:
         raise ScriptError(
             "Less than the minimum 1.2GB of RAM is available, "
-            "%.2fGB available" % (available / (1024 * 1024 * 1024))
+            "%.2fGB available.  Use --skip-mem-check to suppress this check."
+            % (available / (1024 * 1024 * 1024))
         )
 
 def load_external_cert(files, ca_subject):

ipaserver/install/ipa_backup.py

@@ -155,6 +155,7 @@ class Backup(admintool.AdminTool):
         paths.HTTPD_KEY_FILE,
         paths.HTTPD_IPA_CONF,
         paths.HTTPD_IPA_SITE_CONF,
+        paths.HTTPD_WSGI_CONF,
         paths.SSHD_CONFIG,
         paths.SSHD_IPA_CONFIG,
         paths.SSH_CONFIG,

ipaserver/install/ipa_cacert_manage.py

@@ -19,7 +19,6 @@
 
 from __future__ import print_function, absolute_import
 
-import datetime
 import logging
 import os
 from optparse import OptionGroup  # pylint: disable=deprecated-module
@@ -47,7 +46,7 @@ class CACertManage(admintool.AdminTool):
     command_name = 'ipa-cacert-manage'
 
     usage = "%prog renew [options]\n%prog install [options] CERTFILE\n" \
-            "%prog delete [options] NICKNAME\n%prog list\n%prog prune"
+            "%prog delete [options] NICKNAME\n%prog list"
 
     description = "Manage CA certificates."
 
@@ -116,14 +115,18 @@ class CACertManage(admintool.AdminTool):
 
         command = self.command = self.args[0]
 
-        if command not in ('renew', 'list', 'install', 'delete', 'prune'):
-            parser.error("unknown command \"%s\"" % command)
+        if command == 'renew':
+            pass
         elif command == 'install':
             if len(self.args) < 2:
                 parser.error("certificate file name not provided")
+        elif command == 'list':
+            pass
         elif command == 'delete':
             if len(self.args) < 2:
                 parser.error("nickname not provided")
+        else:
+            parser.error("unknown command \"%s\"" % command)
 
     def run(self):
         command = self.command
@@ -142,8 +145,6 @@ class CACertManage(admintool.AdminTool):
                 return self.list()
             elif command == 'delete':
                 return self.delete()
-            elif command == 'prune':
-                return self.prune()
             else:
                 raise NotImplementedError
         finally:
@@ -480,7 +481,9 @@ class CACertManage(admintool.AdminTool):
         for _ca_cert, ca_nickname, _ca_trust_flags in ca_certs:
             print(ca_nickname)
 
-    def _delete_by_nickname(self, nickname, options):
+    def delete(self):
+        options = self.options
+        nickname = self.args[1]
         conn = api.Backend.ldap2
 
         ca_certs = certstore.get_ca_certs_nss(api.Backend.ldap2,
@@ -543,31 +546,6 @@ class CACertManage(admintool.AdminTool):
                 conn.delete_entry(dn)
                 return
 
-    def delete(self):
-        nickname = self.args[1]
-        self._delete_by_nickname(nickname, self.options)
-
-    def prune(self):
-        expired_certs = []
-        ca_certs = certstore.get_ca_certs_nss(api.Backend.ldap2,
-                                              api.env.basedn,
-                                              api.env.realm,
-                                              False)
-
-        now = datetime.datetime.utcnow()
-        for ca_cert, ca_nickname, _ca_trust_flags in ca_certs:
-            if ca_cert.not_valid_after < now:
-                expired_certs.append(ca_nickname)
-                self._delete_by_nickname(ca_nickname, self.options)
-
-        if expired_certs:
-            print("Expired certificates deleted:")
-            for nickname in expired_certs:
-                print(nickname)
-            print("Run ipa-certupdate on enrolled machines to apply changes.")
-        else:
-            print("No certificates were deleted")
-
 
 def update_ipa_ca_entry(api, cert):
     """

ipaserver/install/ipa_restore.py

@@ -40,7 +40,7 @@ from ipapython import admintool, certdb
 from ipapython.dn import DN
 from ipaserver.install.replication import (wait_for_task, ReplicationManager,
                                            get_cs_replication_manager)
-from ipaserver.install import installutils, ldapupdate
+from ipaserver.install import installutils
 from ipaserver.install import dsinstance, httpinstance, cainstance, krbinstance
 from ipaserver.masters import get_masters
 from ipapython import ipaldap
@@ -476,12 +476,6 @@ class Restore(admintool.AdminTool):
                     oddjobd.enable()
                 oddjobd.start()
                 http.remove_httpd_ccaches()
-                # update autobind configuration in case uid/gid have changed
-                ld = ldapupdate.LDAPUpdate(api=api)
-                autobind_update = os.path.join(
-                    paths.UPDATES_DIR, "49-autobind-services.update"
-                )
-                ld.update([autobind_update])
                 # have the daemons pick up their restored configs
                 tasks.systemd_daemon_reload()
                 # Restart IPA a final time.

ipaserver/install/krainstance.py

@@ -35,7 +35,6 @@ from ipapython.dn import DN
 from ipaserver.install import cainstance
 from ipaserver.install import installutils
 from ipaserver.install.dogtaginstance import DogtagInstance
-from ipaserver.install.ca import lookup_random_serial_number_version
 
 
 logger = logging.getLogger(__name__)
@@ -166,9 +165,6 @@ class KRAInstance(DogtagInstance):
             pki_import_admin_cert=False,
             pki_client_admin_cert_p12=admin_p12_file,
         )
-        if lookup_random_serial_number_version(api) > 0:
-            cfg['pki_key_id_generator'] = 'random'
-            cfg['pki_request_id_generator'] = 'random'
 
         if not (os.path.isdir(paths.PKI_TOMCAT_ALIAS_DIR) and
                 os.path.isfile(paths.PKI_TOMCAT_PASSWORD_CONF)):

ipaserver/install/ldapupdate.py

@@ -197,35 +197,6 @@ def safe_output(attr, values):
 _sentinel = object()
 
 
-def run_ldapi_reload_task(conn):
-    """Create and wait for reload ldapi mappings task
-
-    :param conn: ldap2 connection
-    :return: exitcode
-    """
-    task_cn = "reload_{}".format(int(time.time()))
-    task_dn = DN(
-        ('cn', task_cn), ('cn', 'reload ldapi mappings'),
-        ('cn', 'tasks'), ('cn', 'config')
-    )
-    entry = conn.make_entry(
-        task_dn,
-        objectClass=['top', 'extensibleObject'],
-        cn=[task_cn],
-        ttl=[10],
-    )
-    logger.debug('Creating reload task %s', task_dn)
-    conn.add_entry(entry)
-    # task usually finishes in a few ms, avoid 1 sec delay in wait_for_task
-    time.sleep(0.1)
-    exitcode = replication.wait_for_task(api.Backend.ldap2, task_dn)
-    logger.debug(
-        'Task %s has finished with exit code %i',
-        task_dn, exitcode
-    )
-    return exitcode
-
-
 class LDAPUpdate:
     action_keywords = {
         "default", "add", "remove", "only", "onlyifexist", "deleteentry",
@@ -235,7 +206,6 @@ class LDAPUpdate:
         ('cn', 'index'), ('cn', 'userRoot'), ('cn', 'ldbm database'),
         ('cn', 'plugins'), ('cn', 'config')
     )
-    ldapi_autobind_suffix = DN(('cn', 'auto_bind'), ('cn', 'config'))
 
     def __init__(self, dm_password=_sentinel, sub_dict=None,
                  online=_sentinel, ldapi=_sentinel, api=api):
@@ -984,7 +954,6 @@ class LDAPUpdate:
 
     def _run_updates(self, all_updates):
         index_attributes = set()
-        update_ldapi_mappings = False
         for update in all_updates:
             if 'deleteentry' in update:
                 self._delete_record(update)
@@ -992,16 +961,8 @@ class LDAPUpdate:
                 self._run_update_plugin(update['plugin'])
             else:
                 entry, modified = self._update_record(update)
-                if modified:
-                    if entry.dn.endswith(self.index_suffix):
-                        index_attributes.add(entry.single_value['cn'])
-                    if (
-                        entry.dn.endswith(self.ldapi_autobind_suffix)
-                        and "nsLDAPIFixedAuthMap" in entry.get(
-                            "objectClass", ()
-                        )
-                    ):
-                        update_ldapi_mappings = True
+                if modified and entry.dn.endswith(self.index_suffix):
+                    index_attributes.add(entry.single_value['cn'])
 
         if index_attributes:
             # The LDAPUpdate framework now keeps record of all changed/added
@@ -1011,10 +972,6 @@ class LDAPUpdate:
             task_dn = self.create_index_task(*sorted(index_attributes))
             self.monitor_index_task(task_dn)
 
-        if update_ldapi_mappings:
-            # update mappings when any autobind entry is added or modified
-            run_ldapi_reload_task(self.conn)
-
     def update(self, files, ordered=True):
         """Execute the update. files is a list of the update files to use.
         :param ordered: Update files are executed in alphabetical order

ipaserver/install/replication.py

@@ -1152,7 +1152,7 @@ class ReplicationManager:
             except (ValueError, TypeError, KeyError):
                 end = 0
             # incremental update is done if inprogress is false and end >= start
-            done = inprogress and inprogress.lower() == 'false' and start <= end
+            done = inprogress is not None and not inprogress and start <= end
             logger.info("Replication Update in progress: %s: status: %s: "
                         "start: %d: end: %d",
                         inprogress, status, start, end)

ipaserver/install/server/__init__.py

@@ -317,6 +317,12 @@ class ServerInstallInterface(ServerCertificateInstallInterface,
     )
     no_ui_redirect = enroll_only(no_ui_redirect)
 
+    ui_vhost = knob(
+        None,
+        description="Use virtual host for Web UI",
+    )
+    ui_vhost = enroll_only(ui_vhost)
+
     dirsrv_config_file = knob(
         str, None,
         description="The path to LDIF file that will be used to modify "

ipaserver/install/server/install.py

@@ -943,12 +943,14 @@ def install(installer):
             realm_name, host_name, domain_name, dm_password,
             pkcs12_info=http_pkcs12_info, subject_base=options.subject_base,
             auto_redirect=not options.no_ui_redirect,
+            ui_vhost=options.ui_vhost,
             ca_is_configured=setup_ca)
     else:
         http.create_instance(
             realm_name, host_name, domain_name, dm_password,
             subject_base=options.subject_base,
             auto_redirect=not options.no_ui_redirect,
+            ui_vhost=options.ui_vhost,
             ca_is_configured=setup_ca)
 
     ca.set_subject_base_in_config(options.subject_base)

ipaserver/install/server/replicainstall.py

@@ -150,7 +150,7 @@ def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
     return destfile
 
 
-def install_http(config, auto_redirect, ca_is_configured, ca_file,
+def install_http(config, auto_redirect, ui_vhost, ca_is_configured, ca_file,
                  pkcs12_info=None, fstore=None):
     # if we have a pkcs12 file, create the cert db from
     # that. Otherwise the ds setup will create the CA
@@ -163,7 +163,7 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
     http.create_instance(
         config.realm_name, config.host_name, config.domain_name,
         config.dirman_password, pkcs12_info,
-        auto_redirect=auto_redirect, ca_file=ca_file,
+        auto_redirect=auto_redirect, ui_vhost=ui_vhost, ca_file=ca_file,
         ca_is_configured=ca_is_configured, promote=True,
         subject_base=config.subject_base, master_fqdn=config.master_host_name)
 
@@ -1315,6 +1315,7 @@ def install(installer):
     install_http(
         config,
         auto_redirect=not options.no_ui_redirect,
+        ui_vhost=options.ui_vhost,
         pkcs12_info=http_pkcs12_info,
         ca_is_configured=ca_enabled,
         ca_file=cafile,

ipaserver/install/server/upgrade.py

@@ -20,7 +20,7 @@ from contextlib import contextmanager
 from augeas import Augeas
 
 from ipalib import api, x509
-from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH
+from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD
 from ipalib.install import certmonger
 from ipalib import sysrestore
 from ipalib.facts import is_ipa_configured
@@ -152,6 +152,19 @@ def find_autoredirect(fqdn):
         return False
     return True
 
+def find_uivhost(fqdn):
+    """
+    When upgrading we need to see if the UI virtual host usage
+    was disabled during install time (or afterward). So sift through the
+    configuration file and see if we can determine the status.
+
+    Returns True if use_vhost is enabled, False otherwise
+    """
+    filename = paths.HTTPD_IPA_SITE_CONF
+    if os.path.exists(filename):
+        return True
+    return False
+
 def find_version(filename):
     """Find the version of a configuration file
 
@@ -1523,9 +1536,6 @@ def upgrade_bind(fstore):
     else:
         bind_started = False
 
-    # create or update autobind entry
-    bind.setup_autobind()
-
     try:
         changed = bind.setup_named_conf(backup=True)
         if changed:
@@ -1680,10 +1690,12 @@ def upgrade_configuration():
     fix_permissions()
 
     auto_redirect = find_autoredirect(fqdn)
+    use_vhost = find_usevhost(fqdn)
     sub_dict = dict(
         REALM=api.env.realm,
         FQDN=fqdn,
         AUTOREDIR='' if auto_redirect else '#',
+        UI_VHOST='' if use_vhost else '#',
         CRL_PUBLISH_PATH=paths.PKI_CA_PUBLISH_DIR,
         DOGTAG_PORT=8009,
         CLONE='#',
@@ -1700,11 +1712,7 @@ def upgrade_configuration():
         HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
         HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
         HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
-        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
-        HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
-        HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
-        IPA_CA_CRT=paths.IPA_CA_CRT,
-        MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
+        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
     )
 
     subject_base = find_subject_base()
@@ -1744,6 +1752,9 @@ def upgrade_configuration():
         upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa-vhost.conf.template"))
+        upgrade_file(sub_dict, paths.HTTPD_IPA_WSGI_CONF,
+                     os.path.join(paths.USR_SHARE_IPA_DIR,
+                                  "ipa-wsgi.conf.template"))
         upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa-rewrite.conf.template"))
@@ -1899,9 +1910,12 @@ def upgrade_configuration():
     custodia = custodiainstance.CustodiaInstance(api.env.host, api.env.realm)
     custodia.upgrade_instance()
 
+    # Don't include schema upgrades in restart consideration, see
+    # https://pagure.io/freeipa/issue/9204
+    ca_upgrade_schema(ca)
+
     ca_restart = any([
         ca_restart,
-        ca_upgrade_schema(ca),
         certificate_renewal_update(ca, kra, ds, http),
         ca_enable_pkix(ca),
         ca_configure_profiles_acl(ca),

ipaserver/install/service.py

@@ -42,7 +42,7 @@ from ipaserver.masters import (
     CONFIGURED_SERVICE, ENABLED_SERVICE, HIDDEN_SERVICE, SERVICE_LIST
 )
 from ipaserver.servroles import HIDDEN
-from ipaserver.install.ldapupdate import LDAPUpdate, run_ldapi_reload_task
+from ipaserver.install.ldapupdate import LDAPUpdate
 
 logger = logging.getLogger(__name__)
 
@@ -332,15 +332,6 @@ class Service:
             kerberos.Principal(
                 (self.service_prefix, self.fqdn), realm=self.realm))
 
-    def get_principal_dn(self, principal=None):
-        if principal is None:
-            principal = self.principal
-        return DN(
-            ('krbprincipalname', principal),
-            self.api.env.container_service,
-            self.suffix
-        )
-
     def _ldap_update(self, filenames, *, basedir=paths.UPDATES_DIR):
         """Apply update ldif files
 
@@ -428,7 +419,7 @@ class Service:
             # This can happen when installing a replica
             return None
         entry.pop('krbpwdpolicyreference', None)  # don't copy virtual attr
-        newdn = self.get_principal_dn(principal)
+        newdn = DN(('krbprincipalname', principal), ('cn', 'services'), ('cn', 'accounts'), self.suffix)
         hostdn = DN(('fqdn', self.fqdn), ('cn', 'computers'), ('cn', 'accounts'), self.suffix)
         api.Backend.ldap2.delete_entry(entry)
         entry.dn = newdn
@@ -446,7 +437,7 @@ class Service:
 
         The principal needs to be fully-formed: service/host@REALM
         """
-        dn = self.get_principal_dn(principal)
+        dn = DN(('krbprincipalname', principal), ('cn', 'services'), ('cn', 'accounts'), self.suffix)
         hostdn = DN(('fqdn', self.fqdn), ('cn', 'computers'), ('cn', 'accounts'), self.suffix)
         entry = api.Backend.ldap2.make_entry(
             dn,
@@ -460,49 +451,6 @@ class Service:
         api.Backend.ldap2.add_entry(entry)
         return dn
 
-    def add_autobind_entry(self, user, group, principal):
-        """Add or update LDAPI autobind entry to map uid/gid to principal
-
-        :param user: ipaplatform User object
-        :param group: ipaplatform Group object
-        :param principal: service principal to bind as
-        :return: dn of new autobind entry
-        """
-        authdn = self.get_principal_dn(principal)
-        dn = DN(
-            ("cn", self.service_name), ("cn", "auto_bind"), ("cn", "config")
-        )
-        settings = {
-            "uidNumber": [user.uid],
-            "gidNumber": [group.gid],
-            "nsslapd-authenticateAsDN": [authdn]
-        }
-        ldap2 = self.api.Backend.ldap2
-        try:
-            entry = ldap2.get_entry(dn)
-        except errors.NotFound:
-            entry = ldap2.make_entry(
-                dn,
-                objectclass=["top", "nsLDAPIFixedAuthMap"],
-                cn=[self.service_name],
-                **settings,
-            )
-            ldap2.add_entry(entry)
-            logger.debug("Created autobind entry %s", dn)
-        else:
-            entry.update(settings)
-            try:
-                ldap2.update_entry(entry)
-            except errors.EmptyModlist:
-                logger.debug("Autobind entry %s already configured", dn)
-            else:
-                logger.debug("Updated autobind entry %s", dn)
-
-        # refresh LDAPI mappings
-        run_ldapi_reload_task(self.api.Backend.ldap2)
-
-        return dn
-
     def add_cert_to_service(self):
         """
         Add a certificate to a service
@@ -511,7 +459,8 @@ class Service:
         """
         if self.cert is None:
             raise ValueError("{} has no cert".format(self.service_name))
-        dn = self.get_principal_dn()
+        dn = DN(('krbprincipalname', self.principal), ('cn', 'services'),
+                ('cn', 'accounts'), self.suffix)
         entry = api.Backend.ldap2.get_entry(dn)
         entry.setdefault('userCertificate', []).append(self.cert)
         try:

ipaserver/plugins/ca.py

@@ -6,8 +6,7 @@ import base64
 
 import six
 
-from ipalib import api, errors, messages, output
-from ipalib import Bytes, DNParam, Flag, Str, Int
+from ipalib import api, errors, messages, output, Bytes, DNParam, Flag, Str
 from ipalib.constants import IPA_CA_CN
 from ipalib.plugable import Registry
 from ipapython.dn import ATTR_NAME_BY_OID
@@ -72,7 +71,6 @@ class ca(LDAPObject):
     permission_filter_objectclasses = ['ipaca']
     default_attributes = [
         'cn', 'description', 'ipacaid', 'ipacaissuerdn', 'ipacasubjectdn',
-        'ipacarandomserialnumberversion',
     ]
     rdn_attribute = 'cn'
     allow_rename = True
@@ -121,13 +119,6 @@ class ca(LDAPObject):
             doc=_("X.509 certificate chain"),
             flags={'no_create', 'no_update', 'no_search'},
         ),
-        Int(
-            'ipacarandomserialnumberversion',
-            cli_name='randomserialnumberversion',
-            label=_('RSN Version'),
-            doc=_('Random Serial Number Version'),
-            flags={'no_create', 'no_update'},
-        ),
     )
 
     permission_filter_objectclasses = ['ipaca']
@@ -142,7 +133,6 @@ class ca(LDAPObject):
                 'ipacaid',
                 'ipacaissuerdn',
                 'ipacasubjectdn',
-                'ipacarandomserialnumberversion',
                 'objectclass',
             },
         },

ipaserver/plugins/cert.py

@@ -31,7 +31,7 @@ from cryptography.hazmat.primitives import hashes, serialization
 from dns import resolver, reversename
 import six
 
-from ipalib import Command, Str, Int, Flag, StrEnum, SerialNumber
+from ipalib import Command, Str, Int, Flag, StrEnum
 from ipalib import api
 from ipalib import errors, messages
 from ipalib import x509
@@ -446,7 +446,7 @@ class BaseCertObject(Object):
             label=_('Fingerprint (SHA256)'),
             flags={'no_create', 'no_update', 'no_search'},
         ),
-        SerialNumber(
+        Int(
             'serial_number',
             label=_('Serial number'),
             doc=_('Serial number in decimal or if prefixed with 0x in hexadecimal'),
@@ -483,8 +483,7 @@ class BaseCertObject(Object):
                 base64.b64decode(obj['certificate']))
             obj['subject'] = DN(cert.subject)
             obj['issuer'] = DN(cert.issuer)
-            obj['serial_number'] = str(cert.serial_number)
-            obj['serial_number_hex'] = '0x%X' % cert.serial_number
+            obj['serial_number'] = cert.serial_number
             obj['valid_not_before'] = x509.format_datetime(
                     cert.not_valid_before)
             obj['valid_not_after'] = x509.format_datetime(
@@ -507,6 +506,10 @@ class BaseCertObject(Object):
                     logger.warning(
                         "Encountered bad GeneralName; skipping", exc_info=True)
 
+        serial_number = obj.get('serial_number')
+        if serial_number is not None:
+            obj['serial_number_hex'] = u'0x%X' % serial_number
+
     def _add_san_attribute(self, obj, full, gn):
         name_type_map = {
             cryptography.x509.RFC822Name:
@@ -581,7 +584,7 @@ class certreq(BaseCertObject):
             label=_('Request status'),
             flags={'no_create', 'no_update', 'no_search'},
         ),
-        Str(
+        Int(
             'request_id',
             label=_('Request id'),
             primary_key=True,
@@ -951,7 +954,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
                         reason=e,
                     )
                 )
-            result['request_id'] = result['request_id']
+            result['request_id'] = int(result['request_id'])
             result['cacn'] = ca_obj['cn'][0]
 
         # Success? Then add it to the principal's entry
@@ -982,7 +985,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
 
         return dict(
             result=result,
-            value=pkey_to_value(result['request_id'], kw),
+            value=pkey_to_value(int(result['request_id']), kw),
         )
 
     def lookup_principal(self, principal):
@@ -1367,7 +1370,7 @@ class cert_show(Retrieve, CertMethod, VirtualCommand):
         # Dogtag lightweight CAs have shared serial number domain, so
         # we don't tell Dogtag the issuer (but we check the cert after).
         #
-        result = self.Backend.ra.get_certificate(serial_number)
+        result = self.Backend.ra.get_certificate(str(serial_number))
         cert = x509.load_der_x509_certificate(
                     base64.b64decode(result['certificate']))
 
@@ -1440,7 +1443,7 @@ class cert_revoke(PKQuery, CertMethod, VirtualCommand):
 
         # Make sure that the cert specified by issuer+serial exists.
         # Will raise NotFound if it does not.
-        resp = api.Command.cert_show(serial_number, cacn=kw['cacn'])
+        resp = api.Command.cert_show(unicode(serial_number), cacn=kw['cacn'])
 
         try:
             self.check_access()
@@ -1462,8 +1465,7 @@ class cert_revoke(PKQuery, CertMethod, VirtualCommand):
             # we don't tell Dogtag the issuer (but we already checked that
             # the given serial was issued by the named ca).
             result=self.Backend.ra.revoke_certificate(
-                serial_number,
-                revocation_reason=revocation_reason)
+                str(serial_number), revocation_reason=revocation_reason)
         )
 
 
@@ -1487,8 +1489,7 @@ class cert_remove_hold(PKQuery, CertMethod, VirtualCommand):
             # we don't tell Dogtag the issuer (but we already checked that
             # the given serial was issued by the named ca).
             result=self.Backend.ra.take_certificate_off_hold(
-                serial_number
-            )
+                str(serial_number))
         )
 
 
@@ -1502,13 +1503,17 @@ class cert_find(Search, CertMethod):
             doc=_('Match cn attribute in subject'),
             autofill=False,
         ),
-        SerialNumber('min_serial_number?',
+        Int('min_serial_number?',
             doc=_("minimum serial number"),
             autofill=False,
+            minvalue=0,
+            maxvalue=2147483647,
         ),
-        SerialNumber('max_serial_number?',
+        Int('max_serial_number?',
             doc=_("maximum serial number"),
             autofill=False,
+            minvalue=0,
+            maxvalue=2147483647,
         ),
         Flag('exactly?',
             doc=_('match the common name exactly'),
@@ -1891,9 +1896,7 @@ class cert_find(Search, CertMethod):
                         ca_obj = ca_objs[cacn] = (
                             self.api.Command.ca_show(cacn, all=True)['result'])
 
-                    obj.update(
-                        ra.get_certificate(serial_number)
-                    )
+                    obj.update(ra.get_certificate(str(serial_number)))
                     if not raw:
                         obj['certificate'] = (
                             obj['certificate'].replace('\r\n', ''))

ipaserver/plugins/permission.py

@@ -28,6 +28,7 @@ from .privilege import validate_permission_to_privilege
 from ipalib import errors
 from ipalib.parameters import Str, StrEnum, DNParam, Flag
 from ipalib import api, _, ngettext
+from ipalib import messages
 from ipalib.plugable import Registry
 from ipalib.capabilities import client_has_capability
 from ipalib.aci import ACI
@@ -553,6 +554,7 @@ class permission(baseldap.LDAPObject):
     def make_aci(self, entry):
         """Make an ACI string from the given permission entry"""
 
+        msg = None
         aci_parts = []
         name = entry.single_value['cn']
 
@@ -560,6 +562,18 @@ class permission(baseldap.LDAPObject):
         attrs = self.get_effective_attrs(entry)
         if attrs:
             aci_parts.append("(targetattr = \"%s\")" % ' || '.join(attrs))
+        else:
+            # If we are re-parsing an entry for validation then
+            # the effective attrs may be empty.
+            if entry.get('attrs') is None:
+                rights = set(['read', 'write', 'search', 'compare'])
+                permrights = set(entry['ipapermright'])
+                for right in ('add', 'delete'):
+                    permrights.discard(right)
+                if permrights and permrights.issubset(rights):
+                    msg = messages.MissingTargetAttributesinPermission(
+                        right=', '.join(sorted(entry['ipapermright']))
+                    )
 
         # target
         ipapermtarget = entry.single_value.get('ipapermtarget')
@@ -608,12 +622,12 @@ class permission(baseldap.LDAPObject):
         aci_parts.append('(version 3.0;acl "permission:%s";allow (%s) %s;)' % (
             name, ','.join(sorted(entry['ipapermright'])), bindrule))
 
-        return ''.join(aci_parts)
+        return ''.join(aci_parts), msg
 
     def add_aci(self, permission_entry):
         """Add the ACI coresponding to the given permission entry"""
         ldap = self.api.Backend.ldap2
-        acistring = self.make_aci(permission_entry)
+        acistring, _msg = self.make_aci(permission_entry)
         location = permission_entry.single_value.get('ipapermlocation',
                                                      self.api.env.basedn)
 
@@ -641,7 +655,7 @@ class permission(baseldap.LDAPObject):
             - entry
             - removed ACI string, or None if none existed previously
         """
-        new_acistring = self.make_aci(permission_entry)
+        new_acistring, _msg = self.make_aci(permission_entry)
         return self._replace_aci(permission_entry, old_name, new_acistring)
 
     def _replace_aci(self, permission_entry, old_name=None, new_acistring=None):
@@ -672,6 +686,25 @@ class permission(baseldap.LDAPObject):
             logger.debug('No changes to ACI')
         return acientry, acistring
 
+    def check_attrs(self, result, *keys, **options):
+        """Re-build the ACI to determine if there are rights that
+           only work when there are attributes defined."""
+        ldap = self.backend
+
+        dn = self.get_dn(*keys, **options)
+        entry = ldap.make_entry(dn, result['result'])
+        for old_name, new_name in _DEPRECATED_OPTION_ALIASES.items():
+            if old_name in entry:
+                entry[new_name] = entry[old_name]
+                del entry[old_name]
+        _acistring, msg = self.make_aci(entry)
+        if msg:
+            messages.add_message(
+                options['version'],
+                result,
+                msg,
+            )
+
     def _get_aci_entry_and_string(self, permission_entry, name=None,
                                   notfound_ok=False, cached_acientry=None):
         """Get the entry and ACI corresponding to the permission entry
@@ -776,7 +809,7 @@ class permission(baseldap.LDAPObject):
         target_entry['ipapermlocation'] = [self.api.env.basedn]
 
         # Make sure we're not losing *any info* by the upgrade
-        new_acistring = self.make_aci(target_entry)
+        new_acistring, _msg = self.make_aci(target_entry)
         if not ACI(new_acistring).isequal(aci):
             raise ValueError('Cannot convert ACI, %r != %r' % (new_acistring,
                                                                acistring))
@@ -992,7 +1025,9 @@ class permission_add(baseldap.LDAPCreate):
     # the whole command, not just the callbacks
     def execute(self, *keys, **options):
         self.obj.preprocess_options(options, merge_targetfilter=True)
-        return super(permission_add, self).execute(*keys, **options)
+        result = super(permission_add, self).execute(*keys, **options)
+        self.obj.check_attrs(result, *keys, **options)
+        return result
 
     def get_args(self):
         for arg in super(permission_add, self).get_args():
@@ -1094,7 +1129,9 @@ class permission_mod(baseldap.LDAPUpdate):
     def execute(self, *keys, **options):
         context.filter_ops = self.obj.preprocess_options(
             options, return_filter_ops=True)
-        return super(permission_mod, self).execute(*keys, **options)
+        result = super(permission_mod, self).execute(*keys, **options)
+        self.obj.check_attrs(result, *keys, **options)
+        return result
 
     def get_options(self):
         for opt in super(permission_mod, self).get_options():

ipaserver/plugins/sudorule.py

@@ -57,11 +57,6 @@ IPA provides a means to configure the various aspects of Sudo:
    RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.
    Options: The various Sudoers Options that can modify Sudo's behavior.
 """) + _("""
-Each option needs to be added separately and no validation is done whether
-the option is known by sudo or is in a valid format. Environment variables
-also need to be set individually. For example env_keep="FOO BAR" in sudoers
-needs be represented as --sudooption env_keep=FOO --sudooption env_keep+=BAR.
-""") + _("""
 An order can be added to a sudorule to control the order in which they
 are evaluated (if the client supports it). This order is an integer and
 must be unique.
@@ -94,10 +89,6 @@ EXAMPLES:
 """) + _("""
  Set a default Sudo option:
    ipa sudorule-add-option defaults --sudooption '!authenticate'
-""") + _("""
- Set multiple default Sudo options:
-   ipa sudorule-add-option defaults --sudooption '!authenticate' \
-   --sudooption mail_badpass
 """) + _("""
  Set SELinux type and role transitions on a rule:
    ipa sudorule-add-option sysadmin_sudo --sudooption type=unconfined_t
@@ -362,7 +353,7 @@ class sudorule(LDAPObject):
             label=_('RunAs External Group'),
             doc=_('External Group the commands can run as (sudorule-find only)'),
         ),
-        Str('ipasudoopt*',
+        Str('ipasudoopt?',
             label=_('Sudo Option'),
             flags=['no_create', 'no_update', 'no_search'],
         ),
@@ -998,7 +989,7 @@ class sudorule_add_option(LDAPQuery):
 
     has_output = output.standard_entry
     takes_options = (
-        Str('ipasudoopt+',
+        Str('ipasudoopt',
             cli_name='sudooption',
             label=_('Sudo Option'),
         ),
@@ -1009,17 +1000,16 @@ class sudorule_add_option(LDAPQuery):
 
         dn = self.obj.get_dn(cn)
 
-        if len(options.get('ipasudoopt',[])) == 0:
+        if not options['ipasudoopt'].strip():
             raise errors.EmptyModlist()
         entry_attrs = ldap.get_entry(dn, ['ipasudoopt'])
 
         try:
-            entry_attrs.setdefault('ipasudoopt', [])
-            for option in options['ipasudoopt']:
-                if option not in entry_attrs['ipasudoopt']:
-                    entry_attrs['ipasudoopt'].append(option)
-                else:
-                    raise errors.DuplicateEntry
+            if options['ipasudoopt'] not in entry_attrs['ipasudoopt']:
+                entry_attrs.setdefault('ipasudoopt', []).append(
+                    options['ipasudoopt'])
+            else:
+                raise errors.DuplicateEntry
         except KeyError:
             entry_attrs.setdefault('ipasudoopt', []).append(
                 options['ipasudoopt'])
@@ -1047,7 +1037,7 @@ class sudorule_remove_option(LDAPQuery):
 
     has_output = output.standard_entry
     takes_options = (
-        Str('ipasudoopt+',
+        Str('ipasudoopt',
             cli_name='sudooption',
             label=_('Sudo Option'),
         ),
@@ -1057,20 +1047,22 @@ class sudorule_remove_option(LDAPQuery):
         ldap = self.obj.backend
 
         dn = self.obj.get_dn(cn)
-        if len(options.get('ipasudoopt',[])) == 0:
+
+        if not options['ipasudoopt'].strip():
             raise errors.EmptyModlist()
 
         entry_attrs = ldap.get_entry(dn, ['ipasudoopt'])
 
         try:
-            entry_attrs.setdefault('ipasudoopt', [])
-            for option in options['ipasudoopt']:
-                if option in entry_attrs['ipasudoopt']:
-                    entry_attrs['ipasudoopt'].remove(option)
-                else:
-                    raise errors.AttrValueNotFound(
-                        attr='ipasudoopt',
-                        value=option)
+            if options['ipasudoopt'] in entry_attrs['ipasudoopt']:
+                entry_attrs.setdefault('ipasudoopt', []).remove(
+                    options['ipasudoopt'])
+                ldap.update_entry(entry_attrs)
+            else:
+                raise errors.AttrValueNotFound(
+                    attr='ipasudoopt',
+                    value=options['ipasudoopt']
+                    )
         except ValueError:
             pass
         except KeyError:
@@ -1078,11 +1070,6 @@ class sudorule_remove_option(LDAPQuery):
                     attr='ipasudoopt',
                     value=options['ipasudoopt']
                     )
-
-        try:
-            ldap.update_entry(entry_attrs)
-        except errors.EmptyModlist:
-            pass
         except errors.NotFound:
             raise self.obj.handle_not_found(cn)
 

ipatests/azure/azure_definitions/gating-fedora.yml

@@ -45,15 +45,16 @@ vms:
     - test_integration/test_external_ca.py::TestExternalCAInstall
 
 - vm_jobs:
-  - container_job: InstallDNSSECFirst
-    containers:
-      replicas: 1
-      resources:
-        replica:
-          mem_limit: "2400m"
-          memswap_limit: "3500m"
-    tests:
-    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
+# Temporary disable - see https://pagure.io/freeipa/issue/9216
+#  - container_job: InstallDNSSECFirst
+#    containers:
+#      replicas: 1
+#      resources:
+#        replica:
+#          mem_limit: "2400m"
+#          memswap_limit: "3500m"
+#    tests:
+#    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
 
   - container_job: simple_replication
     containers:
@@ -69,14 +70,6 @@ vms:
     tests:
     - test_integration/test_service_permissions.py
 
-  - container_job: netgroup
-    tests:
-    - test_integration/test_netgroup.py
-
-  - container_job: external_ca_ExternalCAProfileScenarios
-    tests:
-    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-
 - vm_jobs:
   - container_job: sudo
     containers:
@@ -137,6 +130,15 @@ vms:
     tests:
     - test_integration/test_membermanager.py
 
+  - container_job: netgroup
+    tests:
+    - test_integration/test_netgroup.py
+
+  - container_job: external_ca_ExternalCAProfileScenarios
+    tests:
+    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
+
+
 - vm_jobs:
   - container_job: ServerReplicaCALessToCAFull
     tests:

ipatests/azure/scripts/setup_containers.py

@@ -12,7 +12,7 @@ from jinja2 import Template
 from typing import NamedTuple, TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from typing import List, Tuple, Union
+    from typing import List, Tuple, Union, Dict
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
 
@@ -77,14 +77,19 @@ class Container:
         return self._ipv6
 
     def execute(
-        self, args: Union[str, List[str]], raiseonerr: bool = True
+        self,
+        args: Union[str, List[str]],
+        raiseonerr: bool = True,
+        env: Union[Dict[str, str], List[str], None] = None,
     ) -> ExecRunReturn:
         """
         Exec an arbitrary command within container
         """
         dcont = self.dclient.containers.get(self.name)
         logging.info("%s: run: %s", dcont.name, args)
-        result: ExecRunReturn = dcont.exec_run(args, demux=True)
+        result: ExecRunReturn = dcont.exec_run(
+            args, demux=True, environment=env
+        )
         if result.output[0] is not None:
             logging.info("%s: %s", dcont.name, result.output[0])
         logging.info("%s: result: %s", dcont.name, result.exit_code)
@@ -127,13 +132,13 @@ class ContainersGroup:
             for c in range(1, self.scale + 1)
         ]
 
-    def execute_all(self, args):
+    def execute_all(self, args, env=None):
         """
         Sequentially exec an arbitrary command within every container of group
         """
         results = []
         for cont in self.containers:
-            results.append(cont.execute(args))
+            results.append(cont.execute(args, env=env))
         return results
 
     def ips(self):
@@ -199,7 +204,8 @@ class ContainersGroup:
             cont.execute(cmd)
 
             cmd = ["hostnamectl", "set-hostname", cont.hostname]
-            cont.execute(cmd)
+            # default timeout (25s) maybe not enough
+            cont.execute(cmd, env={"SYSTEMD_BUS_TIMEOUT": "50"})
 
     def setup_resolvconf(self):
         """
@@ -331,7 +337,7 @@ class Controller(Container):
 
         return self._master_container
 
-    def execute(self, args):
+    def execute(self, args, env=None):
         """
         Execute a command on controller (either master or local machine)
         """
@@ -339,7 +345,7 @@ class Controller(Container):
             proc = subprocess.run(args, check=True, capture_output=True)
             return [proc.stdout.decode().rstrip().strip("'")]
 
-        return self.master_container.execute(args)
+        return self.master_container.execute(args, env=env)
 
     def setup_hosts(self):
         """

ipatests/azure/templates/test-jobs.yml

@@ -4,6 +4,11 @@ steps:
     env | sort
   displayName: Print Host Enviroment
 
+- script: |
+    set -e
+    sudo apt list --installed
+  displayName: Show Host's installed packages
+
 - script: |
     set -e
     sudo apt-get update
@@ -16,6 +21,21 @@ steps:
         python3-docker
   displayName: Install Host's tests requirements
 
+- script: |
+    set -e
+    sudo systemctl
+  displayName: Show Host's systemd status
+
+- script: |
+    set -e
+    # most of the time systemd killed hostnamed with SIGKILL on timeout
+    # kill without waiting for graceful termination
+    sudo systemctl kill -s SIGKILL azsecd ||:
+    sudo systemctl disable --now azsecmond ||:
+    sudo systemctl disable --now azsecd ||:
+    sudo systemctl disable --now clamav-freshclam ||:
+  displayName: Disable azsec services (clamav)
+
 - script: |
     set -e
     printf "AppArmor status\n"
@@ -52,6 +72,16 @@ steps:
 
 - template: setup-test-environment.yml
 
+- script: |
+    set -eu
+    sudo top -b -o +%MEM n 1
+  displayName: Show Host's top
+
+- script: |
+    set -eu
+    sudo ps -auxf
+  displayName: Show Host's processes
+
 - template: run-test.yml
 
 - script: |

ipatests/prci_definitions/gating.yaml

@@ -21,7 +21,7 @@ topologies:
     memory: 2400
 
 jobs:
-  fedora-latest/build:
+  fedora-latest-ipa-4-9/build:
     requires: []
     priority: 150
     job:
@@ -29,284 +29,284 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
+        template: &ci-ipa-4-9-latest
+          name: freeipa/ci-ipa-4-9-f36
+          version: 0.0.2
         timeout: 1800
         topology: *build
 
-  fedora-latest/test_installation_TestInstallMaster:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_installation_TestInstallMaster:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_installation.py::TestInstallMaster
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 7200
         topology: *master_1repl
 
-  fedora-latest/simple_replication:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/simple_replication:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_simple_replication.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_caless_TestServerReplicaCALessToCAFull:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_caless_TestServerReplicaCALessToCAFull:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_caless.py::TestServerReplicaCALessToCAFull
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_external_ca_TestExternalCA:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_external_ca_TestExternalCA:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_external_ca_TestSelfExternalSelf:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_external_ca_TestSelfExternalSelf:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_external_ca.py::TestSelfExternalSelf test_integration/test_external_ca.py::TestExternalCAInstall
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/external_ca_templates:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/external_ca_templates:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_topologies:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_topologies:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_topologies.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_sudo:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_sudo:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_sudo.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_commands:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_commands:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_commands.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest/test_kerberos_flags:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_kerberos_flags:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_kerberos_flags.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest/test_forced_client_enrolment:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_forced_client_enrolment:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_forced_client_reenrollment.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_advise:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_advise:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_advise.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest/test_testconfig:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_testconfig:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_testconfig.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_service_permissions:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_service_permissions:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_service_permissions.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_netgroup:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_netgroup:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_netgroup.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_authconfig:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_authconfig:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_authselect.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_replica_promotion_TestSubCAkeyReplication:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_replica_promotion_TestSubCAkeyReplication:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_replica_promotion.py::TestSubCAkeyReplication
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_dnssec_TestInstallDNSSECFirst:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_dnssec_TestInstallDNSSECFirst:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_membermanager:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_membermanager:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_membermanager.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 1800
         topology: *master_1repl
 
-  fedora-latest/test_adtrust_install:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_adtrust_install:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_adtrust_install.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_cert:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_cert:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_cert.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest/test_upgrade:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_upgrade:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_upgrade.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_subids:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/test_subids:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_subids.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
-        topology: *master_1repl
+        topology: *master_1repl_1client

ipatests/prci_definitions/nightly_latest_389ds.yaml

@@ -1,658 +0,0 @@
-topologies:
-  build: &build
-    name: build
-    cpu: 2
-    memory: 3800
-  master_1repl: &master_1repl
-    name: master_1repl
-    cpu: 4
-    memory: 6450
-  master_1repl_1client: &master_1repl_1client
-    name: master_1repl_1client
-    cpu: 4
-    memory: 7400
-  ipaserver: &ipaserver
-    name: ipaserver
-    cpu: 2
-    memory: 2400
-  master_2repl_1client: &master_2repl_1client
-    name: master_2repl_1client
-    cpu: 5
-    memory: 10150
-  master_3repl_1client: &master_3repl_1client
-    name: master_3repl_1client
-    cpu: 6
-    memory: 12900
-
-jobs:
-  389ds-fedora/build:
-    requires: []
-    priority: 100
-    job:
-      class: Build
-      args:
-        copr: '@389ds/389-ds-base-nightly'
-        git_repo: '{git_repo}'
-        git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
-        timeout: 1800
-        topology: *build
-
-  389ds-fedora/simple_replication:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_simple_replication.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_commands:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_commands.py
-        template: *ci-master-latest
-        timeout: 5400
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_server_del:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_server_del.py
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_installation_TestInstallWithCA1:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_installation.py::TestInstallWithCA1
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_caless_TestServerInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestServerInstall
-        template: *ci-master-latest
-        timeout: 12000
-        topology: *master_1repl
-
-  389ds-fedora/test_caless_TestReplicaInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestReplicaInstall
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_caless_TestClientInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestClientInstall
-        template: *ci-master-latest
-        timeout: 5400
-        # actually master_1client
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_caless_TestCertInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestCertInstall
-        template: *ci-master-latest
-        timeout: 5400
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestUserRootFilesOwnershipPermission:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestUserRootFilesOwnershipPermission
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestore:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestore
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNSSEC:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNSSEC
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNSSEC:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNSSEC
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNS:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNS
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNS:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNS
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithReplica:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithReplica
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreDMPassword:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreDMPassword
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestReplicaInstallAfterRestore:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestReplicaInstallAfterRestore
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_dnssec:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_dnssec.py
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_replica_promotion_TestReplicaPromotionLevel1:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_replica_promotion_TestProhibitReplicaUninstallation:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestProhibitReplicaUninstallation
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_replica_promotion_TestHiddenReplicaPromotion:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_upgrade:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_upgrade.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_topology_TestCASpecificRUVs:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_topology.py::TestCASpecificRUVs
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_topology_TestTopologyOptions:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_topology.py::TestTopologyOptions
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts.py_TestStarTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestStarTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestStarTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_client_uninstallation:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_uninstallation.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl_1client
-
-  389ds-fedora/customized_ds_config_install:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_customized_ds_config_install.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/dns_locations:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_dns_locations.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_2repl_1client
-
-  389ds-fedora/external_ca_TestExternalCAdirsrvStop:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_external_ca.py::TestExternalCAdirsrvStop
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/mask:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_installation.py::TestMaskInstall
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/automember:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_automember.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_fips:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_fips.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_pwpolicy:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_pwpolicy.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_external_idp:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_idp.py
-        template: *ci-master-latest
-        timeout: 5000
-        topology: *master_2repl_1client

ipatests/prci_definitions/prci_checker.py

@@ -0,0 +1,433 @@
+#! /usr/bin/python3
+import os
+import glob
+import sys
+import argparse
+from argparse import RawTextHelpFormatter
+import yaml
+
+# Get default DIR from script location
+DEFAULT_DIR = os.path.dirname(os.path.abspath(__file__))
+# Default jobs specification file name and path
+JOBS_SPEC_YAML = "prci_jobs_spec.yaml"
+JOBS_SPEC_PATH = os.path.join(DEFAULT_DIR, JOBS_SPEC_YAML)
+# Files to ignore on check
+IGNORE_FILES = {JOBS_SPEC_YAML, "temp_commit.yaml"}
+
+
+def load_yaml(path):
+    """Load YAML file into Python object."""
+    with open(path, "r") as file_data:
+        data = yaml.safe_load(file_data)
+
+    return data
+
+
+def print_error(msg):
+    """Helper function to print error messages"""
+    print("ERROR: " + msg)
+
+
+def print_warning(msg):
+    """Helper function to print warning messages"""
+    print("WARNING: " + msg)
+
+
+def print_hint(msg):
+    """Helper function to print hint messages"""
+    print("HINT: " + msg)
+
+
+def print_field_error(
+    jobname, fieldname=None, expected_value=None, custom_msg=None
+):
+    """Helper function to print field errors"""
+    msg = f"In job '{jobname}':\n"
+    if custom_msg:
+        msg += f"  {custom_msg}"
+    elif fieldname and expected_value:
+        msg += (
+            f'  Job field "{fieldname}" should be defined as: '
+            f'"{fieldname}: {expected_value}"'
+        )
+    else:
+        msg = f"In job '{jobname}'."
+    print_error(msg)
+
+
+def check_jobs(filename, jobs_def, topologies, current_spec, supported_classes):
+    """
+    Check if given job definition file has all jobs correctly defined according
+    to specification file.
+
+    :param filename: file name of the definition file to be checked
+    :param jobs_def: definition file jobs as a dict object
+    :param topologies: list of dicts of predefined topologies
+    :param jobs_spec: PRCI specification file containing correct definitions
+    :param supported_classes: List of supported test-run classes
+
+    :returns: Boolean with the checks result
+    """
+    correct_fields = True
+
+    try:
+        job_prefix = current_spec["job_prefix"]
+    except KeyError as e:
+        print_error(
+            "Specification file has bad format "
+            f"and '{filename}' could not be analyzed.\n"
+            f"  KeyError: {e} in '{filename}'"
+        )
+        return False
+
+    requires = [f"{job_prefix}build"]
+    build_url = f"{{{job_prefix}build_url}}"
+
+    # Get template from build job
+    build_job_name = job_prefix + "build"
+    build_job = jobs_def.get(build_job_name)
+    if not build_job:
+        print_error(
+            " Build job is not defined or has incorrect name.\n"
+            f"  Name should be: '{build_job_name}'"
+        )
+        return False
+    build_args = build_job["job"]["args"]
+    template = build_args["template"]
+
+    copr = build_args.get("copr")
+    copr_defined = current_spec.get("copr_defined", False)
+
+    update_packages = current_spec.get("update_packages", False)
+    selinux = current_spec.get("selinux_enforcing", False)
+    enable_testing_repo = current_spec.get("enable_testing_repo", False)
+
+    for job_name, params in jobs_def.items():
+        # Checks for all kind of jobs
+        args = params.get("job").get("args")
+        if not job_name.startswith(job_prefix):
+            msg = f"Job name should start with prefix '{job_prefix}'"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("template") != template:
+            print_field_error(job_name, "template", template)
+            correct_fields = False
+        if "timeout" not in args:
+            msg = "'timeout' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+        if args.get("topology") not in topologies:
+            msg = (
+                "'topology' field should be defined with one of the "
+                "pre-defined topologies"
+            )
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("enable_testing_repo", False) != enable_testing_repo:
+            if enable_testing_repo:
+                print_field_error(
+                    job_name, "enable_testing_repo", enable_testing_repo
+                )
+            else:
+                msg = (
+                    "'enable_testing_repo' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+
+        # Checks for build job
+        if job_name == build_job_name:
+            if copr_defined and not copr:
+                msg = "'copr' field should be defined for the build job"
+                print_field_error(job_name, custom_msg=msg)
+                correct_fields = False
+            elif not copr_defined and copr:
+                msg = "'copr' field should NOT be defined for the build job"
+                print_field_error(job_name, custom_msg=msg)
+                correct_fields = False
+            if params.get("job").get("class") != "Build":
+                print_field_error(job_name, "class", "Build")
+                correct_fields = False
+            continue
+
+        # Checks only for non-build jobs
+        if params.get("requires") != requires:
+            print_field_error(job_name, "requires", requires)
+            correct_fields = False
+        if params.get("job").get("class") not in supported_classes:
+            msg = (
+                "'class' field should be defined with one of the "
+                f"supported: {supported_classes}"
+            )
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("build_url") != build_url:
+            print_field_error(job_name, "build_url", f"'{build_url}'")
+            correct_fields = False
+        if "test_suite" not in args:
+            msg = "'test_suite' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        # Check template field against build target
+        if args.get("template") != template:
+            print_field_error(job_name, "template", template)
+            correct_fields = False
+        if "timeout" not in args:
+            msg = "'timeout' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        # If build target has a copr repo, check that the job also defines it
+        if args.get("copr") != copr:
+            if copr and copr_defined:
+                print_field_error(job_name, "copr", copr)
+            elif not copr and not copr_defined:
+                msg = "'copr' field should not be defined"
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("update_packages", False) != update_packages:
+            if update_packages:
+                print_field_error(job_name, "update_packages", update_packages)
+            else:
+                msg = (
+                    "'update_packages' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("selinux_enforcing", False) != selinux:
+            if selinux:
+                print_field_error(job_name, "selinux_enforcing", selinux)
+            else:
+                msg = (
+                    "'selinux_enforcing' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+
+    return correct_fields
+
+
+def process_def_file(file, jobs_spec, supported_classes):
+    """Function to process PRCI definition file
+
+    :param file: name of the definition file to be
+                 processed (extension included)
+    :param jobs_spec: PRCI specification file containing correct definitions
+    :param supported_classes: List of supported test-run classes
+
+    :returns: Boolean with the checks result, filename,
+              and number of jobs in the definition
+              file (-1 when error / warning)
+    """
+    # File base name without extension
+    filename = os.path.splitext(os.path.basename(file))[0]
+    try:
+        def_suite = load_yaml(file)
+    except FileNotFoundError as e:
+        print(e)
+        print_error(f"File '{file}' was not found.")
+        sys.exit(1)
+    except yaml.composer.ComposerError as e:
+        print_error(str(e))
+        print_hint(
+            "You probably defined a wrong alias "
+            "in the newly added or modified job."
+        )
+        sys.exit(1)
+    except yaml.YAMLError as e:
+        print(e)
+        print_error(f"Error loading YAML definition file {file}")
+        sys.exit(1)
+
+    # Get spec for file to be analyzed
+    current_spec = jobs_spec.get(filename)
+    if current_spec is None:
+        print_warning(
+            f"'{filename}' file is not defined in the PRCI "
+            "specification file and "
+            "could not be analyzed."
+        )
+        return True, "", -1
+
+    jobs_def = def_suite.get("jobs")
+    if jobs_def is None:
+        print_error(
+            f"'{filename}' file doesn't have a jobs section following "
+            "the format."
+        )
+        return False, "", -1
+
+    # Get list of pre-defined topologies
+    topologies_def = def_suite.get("topologies")
+    if topologies_def is None:
+        print_error(
+            f"'{filename}' file doesn't have a topologies section following "
+            "the format."
+        )
+        return False, "", -1
+    topologies = list(topologies_def.values())
+
+    # Print file to be analyzed and its number of jobs
+    n_jobs = len(jobs_def)
+    print("[File] " + filename + " [Jobs] " + str(n_jobs))
+
+    result = check_jobs(
+        filename, jobs_def, topologies, current_spec, supported_classes
+    )
+    return result, filename, n_jobs
+
+
+def process_spec_file(filepath):
+    """Function to process jobs specification file
+
+    :param filepath: Filepath for spec file
+
+    :returns: Definition specification dict, supported classes and
+              list of files that should contain the same number of jobs
+    """
+    try:
+        spec_root = load_yaml(filepath)
+    except FileNotFoundError as e:
+        print(e)
+        print_error(f"Jobs specification file '{filepath}' not found.")
+        sys.exit(1)
+    except yaml.YAMLError as e:
+        print(e)
+        print_error(f"Error loading YAML specification file '{filepath}'")
+        sys.exit(1)
+
+    jobs_spec = spec_root.get("prci_job_spec")
+    if not jobs_spec:
+        print_error(
+            f"Specification definition not found in spec file '{filepath}'\n"
+            "  Key 'prci_job_spec' is not present."
+        )
+        sys.exit(1)
+
+    supported_classes = spec_root.get("classes")
+    if not supported_classes:
+        print_error(
+            f"Supported classes not defined in spec file '{filepath}'\n"
+            "  Key 'classes' is not present."
+        )
+        sys.exit(1)
+
+    f_fixed_jobs = spec_root.get("fixed_n_jobs")
+
+    return jobs_spec, supported_classes, f_fixed_jobs
+
+
+def check_n_jobs(defs_n_jobs):
+    """
+    Function to check if definition files have the same number of jobs
+
+    :param defs_n_jobs: Dict of definition filenames as keys and number
+                        of jobs as values
+
+    :returns: Boolean, if definitions have the same number of jobs
+    """
+    if not defs_n_jobs:  # Spec not defined to check num of jobs
+        return True
+    elif len(set(defs_n_jobs.values())) == 1:
+        return True
+    else:
+        print_error(
+            "Following PRCI definitions should have the same number of jobs:"
+            f" {list(defs_n_jobs.keys())}"
+        )
+        return False
+
+
+def parse_arguments(description):
+    """Parse and return arguments if specified"""
+    parser = argparse.ArgumentParser(
+        description=description, formatter_class=RawTextHelpFormatter
+    )
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument(
+        "-f", "--file", help="Specify YAML definition file to be analyzed"
+    )
+    group.add_argument(
+        "-d",
+        "--defs",
+        default=DEFAULT_DIR,
+        help="Specify directory for definition files to be analyzed",
+    )
+    parser.add_argument(
+        "-s",
+        "--spec",
+        default=JOBS_SPEC_PATH,
+        help="Specify path for specification file",
+    )
+    return parser.parse_args()
+
+
+def main():
+    """
+    Checker script for prci definition files.\n
+    This script checks whether jobs in a prci definition file have the correct
+    naming format, requirements, and arguments, which are defined in the
+    specification file.
+
+    If no defition file, definition directory or spec file is specified,
+    script will look for them in its own dir location.
+
+    Examples of the usage for the tool:\n
+    # Check all yaml definition files in default dir\n
+    python3 prci_checker.py\n
+    # Check only specified file\n
+    python3 prci_checker.py -f gating.yaml\n
+    # Check with custom path for spec file\n
+    python3 prci_checker.py -s ../../alternative_spec.yaml
+    # Check with custom path for spec file\n
+    python3 prci_checker.py -d ./definitions
+    """
+    args = parse_arguments(main.__doc__)
+
+    print("BEGINNING PRCI JOB DEFINITIONS CHECKS")
+
+    # Get data from jobs specification file
+    jobs_spec, supported_classes, f_fixed_jobs = process_spec_file(args.spec)
+
+    if args.file:
+        result = process_def_file(args.file, jobs_spec, supported_classes)
+    else:
+        # Get all yaml files in default dir, except those in IGNORE_FILES
+        def_files_dir = os.path.join(args.defs, "*.y*ml")
+        defs_files = glob.glob(def_files_dir)
+        ignore_files_paths = {
+            os.path.join(args.defs, ignore_file) for ignore_file in IGNORE_FILES
+        }
+        defs_files = set(defs_files) - ignore_files_paths
+        if not defs_files:
+            print_warning(
+                "No yaml job definition files found to analyze "
+                "in specified directory."
+            )
+            return
+
+        result = True
+        defs_n_jobs = {}
+
+        for def_file in defs_files:
+            result_file, filename, n_jobs = process_def_file(
+                def_file, jobs_spec, supported_classes
+            )
+            if not result_file:
+                result = False
+                continue
+            if n_jobs > -1 and f_fixed_jobs and filename in f_fixed_jobs:
+                defs_n_jobs[filename] = n_jobs
+
+        result = result and check_n_jobs(defs_n_jobs)
+
+    if not result:
+        print("CHECKS FINISHED WITH ERRORS")
+        sys.exit(1)
+
+    print("CHECKS FINISHED SUCCESSFULLY")
+
+
+if __name__ == "__main__":
+    main()

ipatests/prci_definitions/prci_jobs_spec.yaml

@@ -0,0 +1,32 @@
+# Specification file for PRCI definitions used by prci_checker script
+
+# List of supported test-run classes for non-build jobs
+classes:
+  - "RunPytest"
+  - "RunPytest2"
+  - "RunPytest3"
+  - "RunWebuiTests"
+  - "RunADTests"
+
+# (Optional) Definition files that should contain the same number of jobs
+fixed_n_jobs:
+  - nightly_ipa-4-9_latest.yaml
+  - nightly_ipa-4-9_latest_selinux.yaml
+  - nightly_ipa-4-9_latest_previous.yaml
+
+# Info specific to prci definition files
+# 'job_prefix' field is mandatory
+# 'update_packages', 'selinux_enforcing', 'enable_testing_repo' and
+# 'copr_defined' are optional boolean fields (if not specified,
+# false value is assumed).
+# New definitions specifications may be added anytime
+prci_job_spec:
+  gating:
+    job_prefix: 'fedora-latest-ipa-4-9/'
+  nightly_ipa-4-9_latest:
+    job_prefix: 'fedora-latest-ipa-4-9/'
+  nightly_ipa-4-9_latest_selinux:
+    job_prefix: 'fedora-latest-ipa-4-9/'
+    selinux_enforcing: True
+  nightly_ipa-4-9_previous:
+    job_prefix: 'fedora-previous-ipa-4-9/'

ipatests/prci_definitions/temp_commit.yaml

@@ -47,7 +47,7 @@ topologies:
     memory: 14500
 
 jobs:
-  fedora-latest/build:
+  fedora-latest-ipa-4-9/build:
     requires: []
     priority: 100
     job:
@@ -55,20 +55,20 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
+        template: &ci-ipa-4-9-latest
+          name: freeipa/ci-ipa-4-9-f36
+          version: 0.0.2
         timeout: 1800
         topology: *build
 
-  fedora-latest/temp_commit:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-9/temp_commit:
+    requires: [fedora-latest-ipa-4-9/build]
     priority: 50
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-9/build_url}'
         test_suite: test_integration/test_REPLACEME.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-9-latest
         timeout: 3600
         topology: *master_1repl_1client

ipatests/pytest_ipa/integration/tasks.py

@@ -324,8 +324,7 @@ def set_default_ttl_for_ipa_dns_zone(host, raiseonerr=True):
 
 def install_master(host, setup_dns=True, setup_kra=False, setup_adtrust=False,
                    extra_args=(), domain_level=None, unattended=True,
-                   external_ca=False, stdin_text=None, raiseonerr=True,
-                   random_serial=False):
+                   external_ca=False, stdin_text=None, raiseonerr=True):
     if domain_level is None:
         domain_level = host.config.domain_level
     check_domain_level(domain_level)
@@ -346,10 +345,6 @@ def install_master(host, setup_dns=True, setup_kra=False, setup_adtrust=False,
         '-a', host.config.admin_password,
         "--domain-level=%i" % domain_level,
     ]
-
-    if random_serial:
-        args.append('--random-serial-numbers')
-
     if ipatests_dse:
         args.extend(["--dirsrv-config-file", ipatests_dse])
 
@@ -1417,8 +1412,7 @@ def double_circle_topo(master, replicas, site_size=6):
 
 def install_topo(topo, master, replicas, clients, domain_level=None,
                  skip_master=False, setup_replica_cas=True,
-                 setup_replica_kras=False, clients_extra_args=(),
-                 random_serial=False):
+                 setup_replica_kras=False, clients_extra_args=()):
     """Install IPA servers and clients in the given topology"""
     if setup_replica_kras and not setup_replica_cas:
         raise ValueError("Option 'setup_replica_kras' requires "
@@ -1429,8 +1423,7 @@ def install_topo(topo, master, replicas, clients, domain_level=None,
         install_master(
             master,
             domain_level=domain_level,
-            setup_kra=setup_replica_kras,
-            random_serial=random_serial,
+            setup_kra=setup_replica_kras
         )
 
     add_a_records_for_hosts_in_master_domain(master)
@@ -1682,16 +1675,13 @@ def install_kra(host, domain_level=None,
 
 def install_ca(
         host, domain_level=None, first_instance=False, external_ca=False,
-        cert_files=None, raiseonerr=True, extra_args=(),
-        random_serial=False,
+        cert_files=None, raiseonerr=True, extra_args=()
 ):
     if domain_level is None:
         domain_level = domainlevel(host)
     check_domain_level(domain_level)
     command = ["ipa-ca-install", "-U", "-p", host.config.dirman_password,
                "-P", 'admin', "-w", host.config.admin_password]
-    if random_serial:
-        command.append('--random-serial-numbers')
     if not isinstance(extra_args, (tuple, list)):
         raise TypeError("extra_args must be tuple or list")
     command.extend(extra_args)

ipatests/test_integration/base.py

@@ -39,7 +39,6 @@ class IntegrationTest:
     topology = None
     domain_level = None
     fips_mode = None
-    random_serial = False
 
     @classmethod
     def host_by_role(cls, role):
@@ -88,8 +87,7 @@ class IntegrationTest:
         else:
             tasks.install_topo(cls.topology,
                                cls.master, cls.replicas,
-                               cls.clients, domain_level,
-                               random_serial=cls.random_serial)
+                               cls.clients, domain_level)
     @classmethod
     def uninstall(cls, mh):
         for replica in cls.replicas:

ipatests/test_integration/test_cert.py

@@ -531,14 +531,12 @@ class TestCAShowErrorHandling(IntegrationTest):
         Test to verify if the case of a request
         for /ca/rest/authority/{id}/cert (or .../chain)
         where {id} is an unknown authority ID.
-
         Test Steps:
         1. Setup a freeipa server and a replica
         2. Stop ipa-custodia service on replica
         3. Create a LWCA on the replica
         4. Verify LWCA is recognized on the server
         5. Run `ipa ca-show <LWCA>`
-
         PKI Github Link: https://github.com/dogtagpki/pki/pull/3605/
         """
         self.replicas[0].run_command(['systemctl', 'stop', 'ipa-custodia'])

ipatests/test_integration/test_commands.py

@@ -719,13 +719,9 @@ class TestIPACommand(IntegrationTest):
 
     def test_certificate_out_write_to_file(self):
         # commands to test; name of temporary file will be appended
-        result = self.master.run_command([
-            'openssl', 'x509', '-serial', '-noout', '-in', paths.IPA_CA_CRT
-        ])
-        serial = result.stdout_text.strip().split('=', maxsplit=1)[1]
         commands = [
-            ['ipa', 'cert-show', serial, '--certificate-out'],
-            ['ipa', 'cert-show', serial, '--chain', '--certificate-out'],
+            ['ipa', 'cert-show', '1', '--certificate-out'],
+            ['ipa', 'cert-show', '1', '--chain', '--certificate-out'],
             ['ipa', 'ca-show', 'ipa', '--certificate-out'],
             ['ipa', 'ca-show', 'ipa', '--chain', '--certificate-out'],
         ]
@@ -1473,29 +1469,6 @@ class TestIPACommand(IntegrationTest):
             assert 'This account is currently not available' in \
                 result.stdout_text
 
-    def test_ipa_cacert_manage_prune(self):
-        """Test for ipa-cacert-manage prune"""
-
-        certfile = os.path.join(self.master.config.test_dir, 'cert.pem')
-        self.master.put_file_contents(certfile, isrgrootx1)
-        result = self.master.run_command(
-            [paths.IPA_CACERT_MANAGE, 'install', certfile])
-
-        certs_before_prune = self.master.run_command(
-            [paths.IPA_CACERT_MANAGE, 'list'], raiseonerr=False
-        ).stdout_text
-
-        assert isrgrootx1_nick in certs_before_prune
-
-        # Jump in time to make sure the cert is expired
-        self.master.run_command(['date', '-s', '+15Years'])
-        result = self.master.run_command(
-            [paths.IPA_CACERT_MANAGE, 'prune'], raiseonerr=False
-        ).stdout_text
-        self.master.run_command(['date', '-s', '-15Years'])
-
-        assert isrgrootx1_nick in result
-
     def test_ipa_getkeytab_server(self):
         """
         Exercise the ipa-getkeytab server options

ipatests/test_integration/test_installation.py

@@ -516,8 +516,7 @@ class TestInstallWithCA_KRA1(InstallTestBase1):
     @classmethod
     def install(cls, mh):
         tasks.install_master(cls.master, setup_dns=cls.master_with_dns,
-                             setup_kra=True,
-                             random_serial=cls.random_serial)
+                             setup_kra=True)
 
     def test_replica0_ipa_kra_install(self):
         tasks.install_kra(self.replicas[0], first_instance=False)
@@ -537,8 +536,7 @@ class TestInstallWithCA_DNS1(InstallTestBase1):
 
     @classmethod
     def install(cls, mh):
-        tasks.install_master(cls.master, setup_dns=cls.master_with_dns,
-                             random_serial=cls.random_serial)
+        tasks.install_master(cls.master, setup_dns=cls.master_with_dns)
 
     @pytest.mark.skipif(config.domain_level == DOMAIN_LEVEL_0,
                         reason='does not work on DOMAIN_LEVEL_0 by design')
@@ -883,7 +881,7 @@ class TestInstallMaster(IntegrationTest):
         """
         # check process count in httpd conf file i.e expected string
         exp = b'WSGIDaemonProcess ipa processes=%d' % constants.WSGI_PROCESSES
-        httpd_conf = self.master.get_file_contents(paths.HTTPD_IPA_CONF)
+        httpd_conf = self.master.get_file_contents(paths.HTTPD_IPA_WSGI_CONF)
         assert exp in httpd_conf
 
         # check the process count

ipatests/test_integration/test_ipahealthcheck.py

@@ -340,6 +340,31 @@ class TestIpaHealthCheck(IntegrationTest):
         assert returncode == 0
         assert output == "No issues found."
 
+    def test_ipa_healthcheck_fips_enabled(self):
+        """
+        Test if FIPS is enabled and the check exists.
+
+        https://pagure.io/freeipa/issue/8951
+        """
+        returncode, check = run_healthcheck(self.master,
+                                            source="ipahealthcheck.meta.core",
+                                            check="MetaCheck",
+                                            output_type="json",
+                                            failures_only=False)
+        assert returncode == 0
+
+        cmd = self.master.run_command(['fips-mode-setup', '--is-enabled'],
+                                      raiseonerr=False)
+        returncode = cmd.returncode
+
+        # If this produces IndexError, the check does not exist
+        if check[0]["kw"]["fips"] == "disabled":
+            assert returncode == 2
+        elif check[0]["kw"]["fips"] == "enabled":
+            assert returncode == 0
+        else:
+            assert returncode == 1
+
     def test_ipa_healthcheck_after_certupdate(self):
         """
         Verify that ipa-certupdate hasn't messed up tracking
@@ -2856,11 +2881,6 @@ class TestIpaHealthCheckWithExternalCA(IntegrationTest):
         error_reason = (
             "RA agent description does not match"
         )
-        ldap = self.master.ldap_connect()
-        dn = DN(("uid", "ipara"), ("ou", "People"), ("o", "ipaca"))
-        entry = ldap.get_entry(dn)
-        ldap_cert_desc = entry.single_value.get("description")
-
         update_ra_cert_desc(
             '2;16;CN=Certificate Authority,O=%s;CN=IPA RA,O=%s' %
             (self.master.domain.realm, self.master.domain.realm)
@@ -2874,7 +2894,9 @@ class TestIpaHealthCheckWithExternalCA(IntegrationTest):
         for check in data:
             assert check["result"] == "ERROR"
             assert (
-                check["kw"]["expected"] == ldap_cert_desc
+                check["kw"]["expected"] == "2;6;"
+                "CN=Certificate Authority,O=%s;CN=IPA RA,"
+                "O=%s" % (self.master.domain.realm, self.master.domain.realm)
             )
             assert (
                 check["kw"]["got"] == "2;16;"

ipatests/test_integration/test_pwpolicy.py

@@ -36,7 +36,7 @@ class TestPWPolicy(IntegrationTest):
         cls.master.run_command(['ipa', 'group-add-member', POLICY,
                                 '--users', USER])
         cls.master.run_command(['ipa', 'pwpolicy-add', POLICY,
-                                '--priority', '1'])
+                                '--priority', '1', '--gracelimit', '-1'])
         cls.master.run_command(['ipa', 'passwd', USER],
                                stdin_text='{password}\n{password}\n'.format(
                                password=PASSWORD
@@ -265,7 +265,6 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_expired(self):
         """Test the LDAP bind grace period"""
-        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -308,7 +307,6 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_not_replicated(self):
         """Test that the grace period is reset on password reset"""
-        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -341,3 +339,54 @@ class TestPWPolicy(IntegrationTest):
         )
         assert 'passwordgraceusertime: 0' in result.stdout_text.lower()
         self.reset_password(self.master)
+
+    def test_graceperiod_zero(self):
+        """Test the LDAP bind with zero grace period"""
+        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
+             user=USER, base_dn=str(self.master.domain.basedn))
+
+        self.master.run_command(
+            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "0", ],
+        )
+
+        # Resetting the password will mark it as expired
+        self.reset_password(self.master)
+
+        # Now grace is done and binds should fail.
+        result = self.master.run_command(
+            ["ldapsearch", "-e", "ppolicy", "-D", dn,
+             "-w", PASSWORD, "-b", dn], raiseonerr=False
+        )
+        assert result.returncode == 49
+
+        assert 'Password is expired' in result.stderr_text
+        assert 'Password expired, 0 grace logins remain' in result.stderr_text
+
+    def test_graceperiod_disabled(self):
+        """Test the LDAP bind with grace period disabled (-1)"""
+        str(self.master.domain.basedn)
+        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
+             user=USER, base_dn=str(self.master.domain.basedn))
+
+        # This can fail if gracelimit is already -1 so ignore it
+        self.master.run_command(
+            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "-1",],
+            raiseonerr=False,
+        )
+
+        # Ensure the password is expired
+        self.reset_password(self.master)
+
+        result = self.kinit_as_user(self.master, PASSWORD, PASSWORD)
+
+        for _i in range(0, 10):
+            result = self.master.run_command(
+                ["ldapsearch", "-e", "ppolicy", "-D", dn,
+                 "-w", PASSWORD, "-b", dn]
+            )
+
+        # With graceperiod disabled it should not increment
+        result = tasks.ldapsearch_dm(
+            self.master, dn, ['passwordgraceusertime',],
+        )
+        assert 'passwordgraceusertime: 0' in result.stdout_text.lower()