July 2017 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#919][opened] client.py: Using Augeas to configure krb5.conf
by Tiboris 02 Jul '19

02 Jul '19

URL: https://github.com/freeipa/freeipa/pull/919 Author: Tiboris Title: #919: client.py: Using Augeas to configure krb5.conf Action: opened PR body: """ Using Augeas should avoid issues like https://pagure.io/freeipa/issue/5912. Resolves: https://pagure.io/freeipa/issue/5913 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/919/head:pr919 git checkout pr919

1 1

[freeipa PR#920][opened] fix ods-ksmutil for 2.0.x
by tduehr 15 May '18

15 May '18

URL: https://github.com/freeipa/freeipa/pull/920 Author: tduehr Title: #920: fix ods-ksmutil for 2.0.x Action: opened PR body: """ It became ods-enforcer and its behavior changed. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/920/head:pr920 git checkout pr920

2 3

[freeipa PR#927][opened] WebUI: Cockpit integration
by pvomacka 07 Feb '18

07 Feb '18

URL: https://github.com/freeipa/freeipa/pull/927 Author: pvomacka Title: #927: WebUI: Cockpit integration Action: opened PR body: """ Link to the cockpit is placed to each host details page in case the Cockpit is installed on the server. Showing or hiding cockpit link is possible because of Cockpit's API which provides public URL for check whether Cockpit is the software which listen on given port. https://pagure.io/freeipa/issue/4891 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/927/head:pr927 git checkout pr927

2 1

[freeipa PR#837][opened] ca-add: fix permission issue
by frasertweedale 04 Feb '18

04 Feb '18

URL: https://github.com/freeipa/freeipa/pull/837 Author: frasertweedale Title: #837: ca-add: fix permission issue Action: opened PR body: """ The ca-add command pre_callback uses ldap.can_add() to check whether the user has permission to add CAs. Alas, the GetEffectiveRights control used by ldap.can_add() doesn't correctly interpret ACIs with 'targetfilter' constraints, and returns a false-negative for non-admin users, even when they have the 'System: Add CA' permission. To work around this, add the CA object to FreeIPA before attempting to create the CA in Dogtag. If the CA creation in Dogtag succeds, the user then updates the FreeIPA object with the Authority ID and other authoritative data returned by Dogtag. If the CA creation in Dogtag fails, the user cleans up by deleting the newly-created CA object from FreeIPA. This modified procedure ensures that the user certainly has the 'System: Add CA' permission before the CA creation in Dogtag is attempted. But it also means that the user must have 'write' and 'delete' permission on 'ipaca' objects in FreeIPA, so that it can complete the object after CA creation in Dogtag, or clean up if that step fails. Therefore, update the 'System: Add CA' permission to confer 'write' and 'delete' access on 'ipaca' objects, as well as 'add' access. Fixes: https://pagure.io/freeipa/issue/6609 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/837/head:pr837 git checkout pr837

2 7

[freeipa PR#846][opened] Travis: Add tox tests
by MartinBasti 19 Nov '17

19 Nov '17

URL: https://github.com/freeipa/freeipa/pull/846 Author: MartinBasti Title: #846: Travis: Add tox tests Action: opened PR body: """ Tox tests contain various testcases for PyPI wheel builds """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/846/head:pr846 git checkout pr846

4 7

[freeipa PR#903][opened] Warning the user when using a loopback IP as forwarder
by felipevolpone 09 Nov '17

09 Nov '17

URL: https://github.com/freeipa/freeipa/pull/903 Author: felipevolpone Title: #903: Warning the user when using a loopback IP as forwarder Action: opened PR body: """ Now, the user can pass a loopback IP in the --forwarder option. Previously, an error would be raised, now we just show a warning message. Fixes: https://pagure.io/freeipa/issue/5801 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/903/head:pr903 git checkout pr903

1 1

[freeipa PR#930][opened] install: allow specifying external CA template
by frasertweedale 04 Oct '17

04 Oct '17

URL: https://github.com/freeipa/freeipa/pull/930 Author: frasertweedale Title: #930: install: allow specifying external CA template Action: opened PR body: """ This PR allow an admin to specify an AD-CS target certificate template by name or OID, via the new option --external-ca-profile. The profile may be specified by name (string) or OID + version + optional minor version. https://pagure.io/freeipa/issue/6858 The approach is: 1. preliminary refactor to the IPAOptionParser to allow easily specifying a custom data constructor (this is used for the data type that holds the template specifier). 2. refactor to reduce duplication of external CA type enum values. 3. the main thing: - add data type for template specifier - add ipa-server-install `--external-ca-profile` CLI option - update CA installation to add the appropriate *pkispawn* config based on the template specifier - update *ipa-server-install* man page 4. add the `external-ca-profile` option to *ipa-ca-install* and update man page. **NOTE FOR TESTERS** *python-cryptography* has a bug parsing long OIDs. It is fixed as of v1.9 (f27). AD-CS creates and uses OIDs long enough to trigger the bug as a matter of course. Apply the following small diff to your *python-cryptography* lib to avoid the bug: https://github.com/frasertweedale/cryptography/blob/effeb600057a93f7cb95df1… **HOW TO TEST** 1. Install AD-CS in a Windows machine and create a custom profile by copying the *SubCA* profile. 2. Two-step external CA ipa-server-install: ``` $ ipa-server-install \ --external-ca --external-ca-type=ms-cs \ --external-ca-profile=1.3.6.1.4.1.311.21.8.8950086.10656446.2706058.12775672.480128.147.7130143.4405632:1 ``` (Use the actual OID of the custom profile). If everything works, hooray! 3. Start over with ca-less deployment. Then add CA via ``ipa-ca-install --external-ca-... # as before``. If everything works, hooray. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/930/head:pr930 git checkout pr930

2 1

[freeipa PR#894][opened] Fixing ipa-replica-install --setup-kra if it's the first KRA in topology
by felipevolpone 02 Oct '17

02 Oct '17

URL: https://github.com/freeipa/freeipa/pull/894 Author: felipevolpone Title: #894: Fixing ipa-replica-install --setup-kra if it's the first KRA in topology Action: opened PR body: """ I'm trying to fix the ticket, but I'm not quite sure of how to do it. Until now, I removed the exception and called the api in kra to install it. However, I'm getting an exception: ``` bash-4.3$ sudo python /usr/sbin/ipa-replica-install -r DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM --setup-kra --setup-ca WARNING: conflicting time&date synchronization service 'chronyd' will be disabled in favor of ntpd IPA client is already configured on this system, ignoring the --domain, --server, --realm, --hostname, --password and --keytab options. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR Timed out trying to obtain keys. ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information ``` from /var/log/ipareplica-install.log ``` 2017-06-23T18:38:44Z DEBUG stderr= 2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG raw: hostgroup_show(u'ipaservers', rights=True, all=True, version=u'2.228') 2017-06-23T18:38:44Z DEBUG hostgroup_show(u'ipaservers', rights=True, all=True, raw=False, version=u'2.228', no_members=False) 2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache 2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769f38> 2017-06-23T18:38:44Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG Created connection context.ldap2_140135237350736 2017-06-23T18:38:44Z DEBUG flushing ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com from SchemaCache 2017-06-23T18:38:44Z DEBUG retrieving schema for SchemaCache url=ldaps://vm-116.abc.idm.lab.eng.brq.redhat.com conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f73c6769c20> 2017-06-23T18:38:44Z DEBUG No IPA DNS servers, skipping forward/reverse resolution check 2017-06-23T18:38:44Z DEBUG Initializing principal host/vm-058-064.abc.idm.lab.eng.brq.redhat.com(a)DOM-116.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM using keytab /etc/krb5.keytab 2017-06-23T18:38:44Z DEBUG using ccache /tmp/krbcc9omA2g/ccache 2017-06-23T18:38:44Z DEBUG Attempt 1/1: success 2017-06-23T18:38:44Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state' 2017-06-23T18:38:44Z DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index' 2017-06-23T18:38:44Z INFO Waiting up to 300 seconds to see our keys appear on host: None 2017-06-23T18:38:45Z DEBUG Transient error getting keys: '{'desc': "Can't contact LDAP server"}' 2017-06-23T18:43:45Z DEBUG Destroyed connection context.ldap2_140135237350736 2017-06-23T18:43:45Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 333, in run cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 366, in run self.validate() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 375, in validate for _nothing in self._validator(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure next(validator) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 63, in _install for _nothing in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaserver/install/server/__init__.py", line 613, in main replica_promote_check(self) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 386, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 408, in decorated func(installer) File "/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py", line 1270, in promote_check raise ScriptError(e) 2017-06-23T18:43:45Z DEBUG The ipa-replica-install command failed, exception: ScriptError: Timed out trying to obtain keys. 2017-06-23T18:43:45Z ERROR Timed out trying to obtain keys. 2017-06-23T18:43:45Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information ``` There is a high chance that I'm getting the wrong path here, so if there is someone able to help me (pointing to some docs or explaining more details of it), it would be great. Ticket https://pagure.io/freeipa/issue/7008 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/894/head:pr894 git checkout pr894

2 1

[freeipa PR#937][opened] Configuring log handlers during the input parameters validation phase
by felipevolpone 02 Oct '17

02 Oct '17

URL: https://github.com/freeipa/freeipa/pull/937 Author: felipevolpone Title: #937: Configuring log handlers during the input parameters validation phase Action: opened PR body: """ Previously, a log handler would be configured only after all the input parameters be validated, as can be checked in `ipapython/admintool.py::AdminTool::main`. So, any call to `logger.[warning,info,error,debug]`, during that phase, doesn't work and it also raises an exception. Now, log handlers are setup before the input parameters validation phase. Fixes: https://pagure.io/freeipa/issue/7071 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/937/head:pr937 git checkout pr937

2 1

[freeipa PR#933][opened] Checks if Directory Server is installed and running before installation
by felipevolpone 21 Sep '17

21 Sep '17

URL: https://github.com/freeipa/freeipa/pull/933 Author: felipevolpone Title: #933: Checks if Directory Server is installed and running before installation Action: opened PR body: """ In cases when IPA is installed in two steps (external CA), it's necessary to check (in the second step) if Directory Server is running and if it's installed before continue with the IPA installation. Fixes: https://pagure.io/freeipa/issue/6611 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/933/head:pr933 git checkout pr933

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel July 2017