WebUI: update favicon.ico

I noticed that FreeIPA favicon is a bit squished. I would like to unsquish it. And resize it to 32x32 pixels as it would look a bit better on HiDPI screens. Fixes: https://pagure.io/freeipa/issue/9449 Signed-off-by: Viktor Ashirov <vashirov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Carla Martinez <carlmart@redhat.com>
ipatests: fix test_ipactl_scenario_check
2023-10-05 07:38:05 +02:00 · 2023-10-04 09:20:44 -04:00 · 2023-10-04 09:17:52 -04:00 · 2023-10-04 09:15:29 -04:00 · 2023-10-04 08:37:28 -04:00 · 2023-10-04 08:37:28 -04:00
17 changed files with 79 additions and 166 deletions
@@ -20,7 +20,7 @@
 #  ->  "1.0.0"                                         #
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
-define(IPA_VERSION_MINOR, 11)
+define(IPA_VERSION_MINOR, 12)
 define(IPA_VERSION_RELEASE, 0)

 ########################################################
@@ -49,7 +49,7 @@ define(IPA_VERSION_PRE_RELEASE, )
 # This option works only with GNU m4:                  #
 # it requires esyscmd m4 macro.                        #
 ########################################################
-define(IPA_VERSION_IS_GIT_SNAPSHOT, no)
+define(IPA_VERSION_IS_GIT_SNAPSHOT, yes)

 ########################################################
 # git development branch:                              #
@@ -1555,11 +1555,10 @@ fi
 %dir %{_sysconfdir}/ipa/html
 %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
 %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
-%dir %{_sysconfdir}/ipa/http
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-rewrite.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-kdc-proxy.conf
-%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-pki-proxy.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
+%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
 %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf
@@ -101,7 +101,6 @@ dist_app_DATA =				\
 	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf.template	\
 	ipa-rewrite.conf.template	\
-	ipa-vhost.conf.template		\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\
@@ -1,50 +0,0 @@
-#
-# VERSION 32 - DO NOT REMOVE THIS LINE
-#
-# This file may be overwritten on upgrades.
-#
-
-# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
-# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
-WSGISocketPrefix $WSGI_PREFIX_DIR
-
-# Configure mod_wsgi handler for /ipa
-WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
-  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
-  lang=C.UTF-8 locale=C.UTF-8
-
-<VirtualHost *:80>
-    ServerName $FQDN
-    ServerAlias ipa-ca.$DOMAIN
-
-    # Logging
-    CustomLog /var/log/httpd/ipa-access.log combined
-    ErrorLog /var/log/httpd/ipa-error.log
-
-    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
-    Include $HTTPD_IPA_REWRITE_CONF
-    Include $HTTPD_IPA_CONF
-</VirtualHost>
-
-# the below section is only need if you have above 3 lines and want SSL
-<VirtualHost *:443>
-    ServerName $FQDN
-    ServerAlias ipa-ca.$DOMAIN
-
-    # Logging
-    CustomLog /var/log/httpd/ipa-access.log combined
-    ErrorLog /var/log/httpd/ipa-error.log
-
-    # SSL
-    SSLEngine on
-    SSLCertificateFile $HTTPD_CERT_FILE
-    SSLCertificateKeyFile $HTTPD_KEY_FILE
-    SSLCACertificateFile $IPA_CA_CRT
-    SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH
-
-    # FreeIPA
-    IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
-    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
-    Include $HTTPD_IPA_REWRITE_CONF
-    Include $HTTPD_IPA_CONF
-</VirtualHost>
@@ -35,11 +35,19 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml \
 application/javascript application/json text/css \
 application/x-font-ttf

+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
 # Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \
  application-group=%{GLOBAL}
 WSGIScriptReloading Off

+
 # Turn off mod_msgi handler for errors, config, crl:
 <Location "/ipa/errors">
  SetHandler None
@@ -45,13 +45,11 @@ class BasePathNamespace:
    GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
    OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
    HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd"
    HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
-    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
    HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
    HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"
@@ -20,12 +20,10 @@ class DebianPathNamespace(BasePathNamespace):
    ETC_HTTPD_DIR = "/etc/apache2"
    HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
    HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
-    HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
    HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
    HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"
@@ -17,12 +17,10 @@ class SusePathNamespace(BasePathNamespace):
    HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
    GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
    HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
-    HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
    HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
    HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
    HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"
@@ -111,14 +111,6 @@ class HTTPInstance(service.Service):
            IPA_CCACHES=paths.IPA_CCACHES,
            WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
            WSGI_PROCESSES=constants.WSGI_PROCESSES,
-            HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
-            HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
-            HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
-            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
-            HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
-            HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
-            IPA_CA_CRT=paths.IPA_CA_CRT,
-            MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
        )
        self.ca_file = ca_file
        if ca_is_configured is not None:
@@ -136,6 +128,7 @@ class HTTPInstance(service.Service):
        self.step("configuring mod_ssl log directory",
                  self.set_mod_ssl_logdir)
        self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp)
+        self.step("adding URL rewriting rules", self.__add_include)
        self.step("configuring httpd", self.__configure_http)
        self.step("setting up httpd keytab", self.request_service_keytab)
        self.step("configuring Gssproxy", self.configure_gssproxy)
@@ -204,14 +197,6 @@ class HTTPInstance(service.Service):
        # https://pagure.io/freeipa/issue/7662
        tasks.restore_context(session_dir)

-        # create /etc/httpd/ipa
-        if not os.path.isdir(paths.HTTPD_IPA_DIR):
-            os.makedirs(paths.HTTPD_IPA_DIR)
-        # Must be world-readable / executable
-        os.chmod(paths.HTTPD_IPA_DIR, 0o755)
-        # Restore SELinux context of /etc/httpd/ipa
-        tasks.restore_context(paths.HTTPD_IPA_DIR)
-
        target_fname = paths.HTTPD_IPA_CONF
        http_txt = ipautil.template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -223,17 +208,6 @@ class HTTPInstance(service.Service):
        http_fd.close()
        os.chmod(target_fname, 0o644)

-        target_fname = paths.HTTPD_IPA_SITE_CONF
-        http_txt = ipautil.template_file(
-            os.path.join(paths.USR_SHARE_IPA_DIR,
-                         "ipa-vhost.conf.template"),
-            self.sub_dict)
-        self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
-        http_fd = open(target_fname, "w")
-        http_fd.write(http_txt)
-        http_fd.close()
-        os.chmod(target_fname, 0o644)
-
        target_fname = paths.HTTPD_IPA_REWRITE_CONF
        http_txt = ipautil.template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -311,6 +285,17 @@ class HTTPInstance(service.Service):
            aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
            aug.save()

+    def __add_include(self):
+        """This should run after __set_mod_nss_port so is already backed up"""
+        if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
+                                    '</VirtualHost>',
+                                    'Include {path}\n'
+                                    '</VirtualHost>'.format(
+                                        path=paths.HTTPD_IPA_REWRITE_CONF)
+                                    ) != 0:
+            self.print_msg("Adding Include conf.d/ipa-rewrite to "
+                           "%s failed." % paths.HTTPD_SSL_SITE_CONF)
+
    def configure_certmonger_renewal_guard(self):
        certmonger = services.knownservices.certmonger
        certmonger_stopped = not certmonger.is_running()
@@ -568,14 +553,13 @@ class HTTPInstance(service.Service):
            paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host),
            paths.HTTPD_IPA_REWRITE_CONF,
            paths.HTTPD_IPA_CONF,
-            paths.HTTPD_IPA_SITE_CONF,
            paths.HTTPD_IPA_PKI_PROXY_CONF,
            paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
            paths.HTTPD_IPA_KDCPROXY_CONF,
            paths.GSSPROXY_CONF,
            paths.GSSAPI_SESSION_KEY,
            paths.HTTPD_PASSWORD_CONF,
-            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF
+            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
        ]
        # NSS DB backups
        remove_files.extend(
@@ -687,6 +671,7 @@ class HTTPInstance(service.Service):
        self.configure_mod_ssl_certs()
        self.set_mod_ssl_protocol()
        self.set_mod_ssl_logdir()
+        self.__add_include()

        self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE)

@@ -154,7 +154,6 @@ class Backup(admintool.AdminTool):
        paths.HTTPD_CERT_FILE,
        paths.HTTPD_KEY_FILE,
        paths.HTTPD_IPA_CONF,
-        paths.HTTPD_IPA_SITE_CONF,
        paths.SSHD_CONFIG,
        paths.SSHD_IPA_CONFIG,
        paths.SSH_CONFIG,
@@ -22,7 +22,7 @@ import six

 from ipaclient.install.client import check_ldap_conf, sssd_enable_ifp
 import ipaclient.install.timeconf
-from ipalib.install import certstore, sysrestore
+from ipalib.install import sysrestore
 from ipalib.install.kinit import kinit_keytab
 from ipapython import ipaldap, ipautil
 from ipapython.dn import DN
@@ -32,7 +32,7 @@ from ipapython.ipachangeconf import IPAChangeConf
 from ipaplatform import services
 from ipaplatform.tasks import tasks
 from ipaplatform.paths import paths
-from ipalib import api, constants, create_api, errors, rpc, x509
+from ipalib import api, constants, create_api, errors, rpc
 from ipalib.config import Env
 from ipalib.facts import is_ipa_configured, is_ipa_client_configured
 from ipalib.util import no_matching_interface_for_ip_address_warning
@@ -132,24 +132,6 @@ def install_krb(config, setup_pkinit=False, pkcs12_info=None, fstore=None):
    return krb


-def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
-    try:
-        try:
-            certs = certstore.get_ca_certs(ldap, base_dn, realm, False)
-        except errors.NotFound:
-            try:
-                shutil.copy(cafile, destfile)
-            except shutil.Error:
-                # cafile == IPA_CA_CRT
-                pass
-        else:
-            certs = [c[0] for c in certs if c[2] is not False]
-            x509.write_certificate_list(certs, destfile, mode=0o644)
-    except Exception as e:
-        raise ScriptError("error copying files: " + str(e))
-    return destfile
-
-
 def install_http(config, auto_redirect, ca_is_configured, ca_file,
                 pkcs12_info=None, fstore=None):
    # if we have a pkcs12 file, create the cert db from
@@ -811,7 +793,8 @@ def promote_check(installer):
        raise ScriptError("--setup-ca and --*-cert-file options are "
                          "mutually exclusive")

-    if not is_ipa_client_configured(on_master=True):
+    ipa_client_installed = is_ipa_client_configured(on_master=True)
+    if not ipa_client_installed:
        # One-step replica installation
        if options.password and options.admin_password:
            raise ScriptError("--password and --admin-password options are "
@@ -952,10 +935,13 @@ def promote_check(installer):
                 paths.KRB5_KEYTAB,
                 ccache)

-    cafile = paths.IPA_CA_CRT
-    if not os.path.isfile(cafile):
-        raise RuntimeError("CA cert file is not available! Please reinstall"
-                           "the client and try again.")
+    if ipa_client_installed:
+        # host was already an IPA client, refresh client cert stores to
+        # ensure we have up to date CA certs.
+        try:
+            ipautil.run([paths.IPA_CERTUPDATE])
+        except ipautil.CalledProcessError:
+            raise RuntimeError("ipa-certupdate failed to refresh certs.")

    remote_api = remote_connection(config)
    installer._remote_api = remote_api
@@ -1220,14 +1206,14 @@ def promote_check(installer):
                config.master_host_name, config.host_name, config.realm_name,
                options.setup_ca, 389,
                options.admin_password, principal=options.principal,
-                ca_cert_file=cafile)
+                ca_cert_file=paths.IPA_CA_CRT)
        finally:
            if add_to_ipaservers:
                os.environ['KRB5CCNAME'] = ccache

    installer._ca_enabled = ca_enabled
    installer._kra_enabled = kra_enabled
-    installer._ca_file = cafile
+    installer._ca_file = paths.IPA_CA_CRT
    installer._fstore = fstore
    installer._sstore = sstore
    installer._config = config
@@ -1248,7 +1234,6 @@ def install(installer):
    fstore = installer._fstore
    sstore = installer._sstore
    config = installer._config
-    cafile = installer._ca_file
    dirsrv_pkcs12_info = installer._dirsrv_pkcs12_info
    http_pkcs12_info = installer._http_pkcs12_info
    pkinit_pkcs12_info = installer._pkinit_pkcs12_info
@@ -1300,18 +1285,10 @@ def install(installer):

    try:
        conn.connect(ccache=ccache)
-
-        # Update and istall updated CA file
-        cafile = install_ca_cert(conn, api.env.basedn, api.env.realm, cafile)
-        install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
-                        destfile=paths.KDC_CA_BUNDLE_PEM)
-        install_ca_cert(conn, api.env.basedn, api.env.realm, cafile,
-                        destfile=paths.CA_BUNDLE_PEM)
-
        # Configure dirsrv
        ds = install_replica_ds(config, options, ca_enabled,
                                remote_api,
-                                ca_file=cafile,
+                                ca_file=paths.IPA_CA_CRT,
                                pkcs12_info=dirsrv_pkcs12_info,
                                fstore=fstore)

@@ -1362,7 +1339,7 @@ def install(installer):
        auto_redirect=not options.no_ui_redirect,
        pkcs12_info=http_pkcs12_info,
        ca_is_configured=ca_enabled,
-        ca_file=cafile,
+        ca_file=paths.IPA_CA_CRT,
        fstore=fstore)

    # Need to point back to ourself after the cert for HTTP is obtained
@@ -20,7 +20,7 @@ from augeas import Augeas
 from pkg_resources import parse_version

 from ipalib import api, x509
-from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH
+from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD
 from ipalib.install import certmonger
 from ipalib import sysrestore
 from ipalib.facts import is_ipa_configured
@@ -1698,14 +1698,6 @@ def upgrade_configuration():
        IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
        KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
        DOMAIN=api.env.domain,
-        HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
-        HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
-        HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
-        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
-        HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
-        HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
-        IPA_CA_CRT=paths.IPA_CA_CRT,
-        MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
    )

    subject_base = find_subject_base()
@@ -1742,9 +1734,6 @@ def upgrade_configuration():
        upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                     os.path.join(paths.USR_SHARE_IPA_DIR,
                                  "ipa.conf.template"))
-        upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
-                     os.path.join(paths.USR_SHARE_IPA_DIR,
-                                  "ipa-vhost.conf.template"))
        upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF,
                     os.path.join(paths.USR_SHARE_IPA_DIR,
                                  "ipa-rewrite.conf.template"))
@@ -32,10 +32,10 @@ vms:
      clients: 1
      resources:
        replica:
-          mem_limit: "2200m"
+          mem_limit: "2300m"
          memswap_limit: "3300m"
        client:
-          mem_limit: "768m"
+          mem_limit: "805m"
          memswap_limit: "1024m"
    tests:
    - test_integration/test_forced_client_reenrollment.py
@@ -187,7 +187,7 @@ vms:
    containers:
      resources:
        server:
-          mem_limit: "2200m"
+          mem_limit: "2450m"
          memswap_limit: "3300m"
    tests:
    - test_integration/test_upgrade.py
@@ -695,7 +695,7 @@ def get_pki_tomcatd_pid(host):
 def get_ipa_services_pids(host):
    ipa_services_name = [
        "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia",
-        "pki_tomcatd", "ipa-dnskeysyncd"
+        "pki_tomcatd"
    ]
    pids_of_ipa_services = {}
    for name in ipa_services_name:
@@ -1640,13 +1640,19 @@ class TestIpaHealthCheckWithoutDNS(IntegrationTest):
                "Got {count} ipa-ca AAAA records, expected {expected}",
                "Expected URI record missing",
            }
-        else:
+        elif (parse_version(version) < parse_version('0.13')):
            expected_msgs = {
                "Expected SRV record missing",
                "Unexpected ipa-ca address {ipaddr}",
                "expected ipa-ca to contain {ipaddr} for {server}",
                "Expected URI record missing",
            }
+        else:
+            expected_msgs = {
+                "Expected SRV record missing",
+                "Expected URI record missing",
+                "missing IP address for ipa-ca server {server}",
+            }

        tasks.install_packages(self.master, HEALTHCHECK_PKG)
        returncode, data = run_healthcheck(
@@ -2406,12 +2412,19 @@ class TestIpaHealthCLI(IntegrationTest):
            cmd = self.base_cmd + ["--indent", option]
            result = self.master.run_command(cmd, raiseonerr=False)
            assert result.returncode == 2
-            assert 'invalid int value' in result.stderr_text
+            assert ('invalid int value' in result.stderr_text
+                    or 'is not an integer' in result.stderr_text)

-        # unusual success, arguably odd but not invalid :-)
+        version = tasks.get_healthcheck_version(self.master)
        for option in ('-1', '5000'):
            cmd = self.base_cmd + ["--indent", option]
-            result = self.master.run_command(cmd)
+            result = self.master.run_command(cmd, raiseonerr=False)
+            if parse_version(version) >= parse_version('0.13'):
+                assert result.returncode == 2
+                assert 'is not in the range 0-32' in result.stderr_text
+            else:
+                # Older versions did not check for a given allowed range
+                assert result.returncode == 0

    def test_severity(self):
        """
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: freeipa 4.11.1.dev202310031238+gitfd01b234e\n"
+"Project-Id-Version: freeipa 4.12.0.dev202310031255+git1a2cd7f40\n"
 "Report-Msgid-Bugs-To: https://pagure.io/freeipa/new_issue\n"
-"POT-Creation-Date: 2023-10-03 14:39+0200\n"
+"POT-Creation-Date: 2023-10-03 14:56+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
Author	SHA1	Message	Date
Viktor Ashirov	fe005dd388	WebUI: update favicon.ico I noticed that FreeIPA favicon is a bit squished. I would like to unsquish it. And resize it to 32x32 pixels as it would look a bit better on HiDPI screens. Fixes: https://pagure.io/freeipa/issue/9449 Signed-off-by: Viktor Ashirov <vashirov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Carla Martinez <carlmart@redhat.com>	2023-10-05 07:38:05 +02:00
Florence Blanc-Renaud	430054db41	ipatests: fix test_ipactl_scenario_check The test is comparing the PID of services before and after calling ipactl start, expecting to have the same value. It should not compare the pid for ipa-dnskeysyncd as this service is automatically restarted upon failure. Fixes: https://pagure.io/freeipa/issue/9415 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-04 09:20:44 -04:00
Florence Blanc-Renaud	e459e5b8bc	ipatests: fix healthcheck test for --indent option ipa-healthcheck --indent option expects an integer. The error message changed with ipa-healthcheck 0.13. Recent versions also check that the value is in the range 0-32. The test must be compatible with old and new versions. Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-04 09:17:52 -04:00
Florence Blanc-Renaud	f9075f9f77	ipatests: fix healthcheck test without DNS ipa-healthcheck has added a new check for ipa-ca record missing. The test needs to be adapted to handle the new check. Fixes: https://pagure.io/freeipa/issue/9459 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-04 09:15:29 -04:00
Alexander Bokovoy	b22605ee54	Azure CI: increase memory for forced reenrollment test Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-04 08:37:28 -04:00
Alexander Bokovoy	48cfe6848c	Increase memory usage for Azure CI upgrade test The test often fails when running in parallel to other tests as very little memory is left. 389-ds memory autotuning causes database backend to refuse working in such cases. 389-ds team suggested more memory has to be made available. Increate RAM for this test to 2.5GB instead of 2.2GB. Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-10-04 08:37:28 -04:00
Antonio Torres	fe223cde95	Update list of contributors Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-03 14:57:20 +02:00
Antonio Torres	843f4a7458	Update translations to FreeIPA master state Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-10-03 14:56:42 +02:00
Alexander Bokovoy	1a2cd7f408	Use datetime.timezone.utc instead of newer datetime.UTC alias datetime.UTC alias was added in Python 3.11: https://docs.python.org/3/library/datetime.html#datetime.UTC datetime.timezone.utc was present since Python 3.2. Since RHEL 9 is using Python 3.9, use more compatible variant. Fixes: https://pagure.io/freeipa/issue/9454 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-09-29 15:06:33 -04:00
Christian Heimes	6aebfe74fb	Add context manager to ipalib.API `ipalib.API` instances like `ipalib.api` now provide a context manager that connects and disconnects the API object. Users no longer have to deal with different types of backends or finalize the API correctly. ```python import ipalib with ipalib.api as api: api.Commands.ping() ``` See: https://pagure.io/freeipa/issue/9443 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-09-29 12:57:06 +02:00
Florence Blanc-Renaud	8b70ee1ea8	Covscan issues: deadcode and Use after free Covscan detected an unused value in ipa_kdb_principals.c and a use-after-free in ipa-print-pac.c. Fixes: https://pagure.io/freeipa/issue/9431 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-09-29 12:05:48 +02:00
Francisco Trivino	4af05dde48	Workshop: fix broken Sphinx cross-references. Many of the workshop pages links are directing to URLs that end with ".rst" instead of ".html", as a result, these links are broken. This commit introduces explicit targets and references to ensure that the pages are correctly linked. Signed-off-by: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-26 11:30:33 +02:00
Mohammad Rizwan	496e3ace85	ipatests: restart ipa services after moving date When system date is moved into future, it have unprecedented behavior i.e CA becomes irresponsive or unexpected certificcate state. Hence restart the ipa service after moving the date to gracefully serve the request. Fixes: https://pagure.io/freeipa/issue/9379 Signed-off-by: Mohammad Rizwan <myusuf@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-18 17:51:30 +02:00
Christian Heimes	7ddf7711f3	Use find_spec() in meta importer The `find_module()` method of meta importers has been deprecated for a long time. Python 3.12 no longer falls back to `find_module()`. See: https://docs.python.org/3.12/whatsnew/3.12.html#removed Related: https://pagure.io/freeipa/issue/9437 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>	2023-09-18 17:46:24 +02:00
Alexander Bokovoy	32721c4132	Allow ipa-otpd to access USB devices for passkeys Main SELinux policy will allow transition of passkey_child (SSSD) to ipa_otpd_t context to perform FIDO2 operations with USB devices. This means ipa-otpd will need to be able to read data from sysfs and connect to USB devices. Add required permissions to IPA subpolicy as well. See rhbz#2238224 for discussion. Related: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Zdenek Pytela <zpytela@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-18 17:36:40 +02:00
Rob Crittenden	f248b22ef4	Don't assume KRB5CCNAME is in the environment in replica install The replica install was unilaterally removing KRB5CCNAME from os.environ in some cases. Instead check first to see if it is present and only remove in that case. Fixes: https://pagure.io/freeipa/issue/9446 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>	2023-09-14 07:59:44 +02:00
Alexandra Nikandrova	dade02d5bb	doc: typo in basic_usage.md Reviewed-By: Antonio Torres <antorres@redhat.com>	2023-09-12 21:41:57 +02:00
Alexander Bokovoy	6aa3c3b628	Restore selinux states if they exist at uninstall time Related: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-09-12 14:32:00 -04:00
Alexander Bokovoy	f123b01d81	updates: add ACIs for RBCD self-management Fixes: https://pagure.io/freeipa/issue/9354 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com>	2023-09-11 09:51:51 +02:00
Alexander Bokovoy	d355761f23	ipa-client-install: enable SELinux for SSSD For passkeys (FIDO2) support, SSSD uses libfido2 library which needs access to USB devices. Add SELinux booleans handling to ipa-client-install so that correct SELinux booleans can be enabled and disabled during install and uninstall. Ignore and record a warning when SELinux policy does not support the boolean. Fixes: https://pagure.io/freeipa/issue/9434 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-09-11 09:24:31 +02:00
Antonio Torres	2bc247d831	ipatests: rename 'ipatuura' directory to 'scim' in bridge tests A recent commit [1] in ipa-tuura project renamed the 'ipatuura' django app to 'scim'. Change it in IPA side as well to fix tests. [1]: https://github.com/freeipa/ipa-tuura/commit/f12592cea496818af782f953e0e9643c9ea440b5 Fixes: https://pagure.io/freeipa/issue/9447 Signed-off-by: Antonio Torres <antorres@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com>	2023-09-11 09:12:51 +02:00
Viktor Ashirov	953c7cc076	BDB tuning should be applied only when BDB backend is used 389DS supports BDB and LMDB backends. FreeIPA installation fails with LMDB backend since it tries to apply tuning for BDB backend. Instead, tuning for BDB should be applied only when 389DS uses BDB backend. Fixes: https://pagure.io/freeipa/issue/9435 Signed-off-by: Viktor Ashirov <vashirov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-09-01 13:16:15 -04:00
Rob Crittenden	45fa43540f	Configure affinity during server installation Write a new krb5.conf in case any values changed finding the right server to configure against (e.g. for CA, KRA) and ensure the API connection is to the remote server that will be installed against. When finding a CA or KRA during initial replica installation set the remote master as well. The order is: - existing server value in /etc/ipa/default.conf - the chosen CA host if the server doesn't provide one - the chosen KRA host if the server doesn't provide one This is more or less heirarchical. If a server is provided then that is considered first. If it provides all the optional services needed (CA and/or KRA) then it will be used. Otherwise it will fall back to a server that provides all the required services. In short, providing --server either at client install or with ipa-replica-install is no guarantee that it will define all topology. This may be unexpected behavior. For the case of adding a CA or KRA things are effectively unchanged. This type of install does not appear to be impacted by affinity issues. Fixes: https://pagure.io/freeipa/issue/9289 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-09-01 13:13:02 -04:00
Christian Heimes	8f25b2a74a	Refactor CA file handling in replica installer Clean up and remove obsolete code from ipa-replica-install. For several versions replica installer first ensures that a host is an IPA client, then promotes the client to a replica. The client installer code sets up CA stores like IPA_CA_CRT already. Related: https://pagure.io/freeipa/issue/9272 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>	2023-08-30 09:18:17 -04:00
Florence Blanc-Renaud	0654fb3737	idp: add the ipaidpuser objectclass when needed The ipaidpuser objectclass is required for the attribute ipaidpsub. When a user is created or modified with --idp-user-id, the operation must ensure that the objectclass is added if missing. Add a test for user creation and user modification with --idp-user-id. Fixes: https://pagure.io/freeipa/issue/9433 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>	2023-08-30 09:13:23 -04:00
Rob Crittenden	317e7061d0	Adjust test to handle revocation reason REMOVE_FROM_CRL The dogtag REST API has a change of behavior regarding revocation reason 8, REMOVE_FROM_CRL. The XML interface accepts it blindly and marks the certifiate as revoked. This is complicated within RFC 5280 but the jist is that it only affects a certificate on hold and only for delta CRLs. So this modifies the behavior of revocation 8 so that the certificate is put on hold (6) first. Fixes: https://pagure.io/freeipa/issue/9345 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-08-28 10:21:48 -04:00
Rob Crittenden	ed52142c40	Use the PKI REST API wherever possible instead of XML The XML API is already deprecated and will be removed in some future release. All but the updateCRL API has an equivalent in REST. The upstream dogtag project documents most of the API at https://github.com/dogtagpki/pki/wiki/REST-API . I say most because not every API includes sample input/output. The pki ca-cert command is a good substitute for seeing how the API is used by their own tooling. This changes no pre-existing conventions. All serial numbers are converted to decimal prior to transmission and are treated as strings to avoid previous limitations with sizing (which would have been exacerbated by random serial numbers). Fixes: https://pagure.io/freeipa/issue/9345 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>	2023-08-28 10:21:48 -04:00
Mohammad Rizwan	8d081ce894	ipatests: accommodate DST in ACME cert expiry There is one hour time difference between expiry of ACME cert if the certificate is issued while daylight saving is start and expires after DST ends. For 2023 daylight saving time start at Sunday 12 March and ends at Sunday 5 November. Every certificate which is expiring after November 5th will have 1 hour difference in expiry. Fix is to use 90days+2hours to expire the cert. Fixes: https://pagure.io/freeipa/issue/9428 Signed-off-by: Mohammad Rizwan <myusuf@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>	2023-08-23 13:10:02 -04:00
Antonio Torres	1251c15fae	Bump to IPA 4.12 Signed-off-by: Antonio Torres <antorres@redhat.com>	2023-08-21 16:39:16 +02:00