[freeipa PR#1036][opened] Fixing tox and pylint errors
by felipevolpone
URL: https://github.com/freeipa/freeipa/pull/1036
Author: felipevolpone
Title: #1036: Fixing tox and pylint errors
Action: opened
PR body:
"""
Fixing import errors introduced by commit cac3475a0454b730d6e5b2093c2e63d395acd387.
https://pagure.io/freeipa/issue/7132
Output of tox commands:
<details>
<summary>tox -e py27</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e py27
py27 recreate: /home/fbarreto/projects/freeipa/.tox/py27
py27 installdeps: ipaclient[csrgen], ipatests
py27 installed: asn1crypto==0.22.0,cffi==1.10.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,enum34==1.1.6,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipaddress==1.0.18,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,ipatests==4.6.90.dev201709041448+gitac6e4cb61,Jinja2==2.9.6,MarkupSafe==1.0,netaddr==0.7.19,netifaces==0.10.6,nose==1.3.7,polib==1.0.8,py==1.4.34,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pytest==3.2.1,pytest-multihost==1.1.1,python-ldap==2.4.42,qrcode==5.3,six==1.10.0
py27 runtests: PYTHONHASHSEED='3471542700'
py27 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/py27/bin/ipa --help
Usage: ipa [global-options] COMMAND [command-options]
Manage an IPA domain
Options:
--version show program's version number and exit
-h, --help Show this help message and exit
-e KEY=VAL Set environment variable KEY to VAL
-c FILE Load configuration from FILE.
-d, --debug Produce full debuging output
--delegate Delegate the TGT to the IPA server
-v, --verbose Produce more verbose output. A second -v displays the
XML-RPC request
-a, --prompt-all Prompt for ALL values (even if optional)
-n, --no-prompt Prompt for NO values (even if required)
-f, --no-fallback Only use the server configured in /etc/ipa/default.conf
See "ipa help topics" for available help topics.
See "ipa help <TOPIC>" for more information on a specific topic.
See "ipa help commands" for the full list of commands.
See "ipa <COMMAND> --help" for more information on a specific command.
py27 runtests: commands[1] | /home/fbarreto/projects/freeipa/.tox/py27/bin/python -bb /home/fbarreto/projects/freeipa/.tox/py27/bin/ipa-run-tests --ipaclient-unittests
========================================== test session starts ==========================================
platform linux2 -- Python 2.7.13, pytest-3.2.1, py-1.4.34, pluggy-0.4.0
rootdir: /home/fbarreto/projects/freeipa/.tox/py27/lib/python2.7/site-packages/ipatests, inifile:
plugins: multihost-1.1.1
collected 451 items / 285 skipped
test_util.py ........
util.py ..
test_ipaclient/test_csrgen.py .................
test_ipalib/test_aci.py ...................
test_ipalib/test_backend.py ........
test_ipalib/test_base.py ...............
test_ipalib/test_capabilities.py .
test_ipalib/test_cli.py ...
test_ipalib/test_config.py ...............
test_ipalib/test_crud.py ...............
test_ipalib/test_errors.py .......
test_ipalib/test_frontend.py ........................................
test_ipalib/test_messages.py ....
test_ipalib/test_output.py ...
test_ipalib/test_parameters.py .............................................................
test_ipalib/test_plugable.py ........
test_ipalib/test_rpc.py ......ssssssss
test_ipalib/test_text.py .............................
test_ipalib/test_x509.py ...
test_ipapython/test_cookie.py ............
test_ipapython/test_dn.py ............................
test_ipapython/test_ipautil.py ..................................................................
test_ipapython/test_ipavalidate.py ..........
test_ipapython/test_kerberos.py ..............
test_ipapython/test_keyring.py ..........
test_ipapython/test_session_storage.py sss
test_ipapython/test_ssh.py ...............................
test_pkcs10/test_pkcs10.py .....
=============================== 440 passed, 296 skipped in 14.63 seconds ================================
________________________________________________ summary ________________________________________________
py27: commands succeeded
congratulations :)
```
</p>
</details>
<details>
<summary>tox -e pylint2</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e pylint2
pylint2 recreate: /home/fbarreto/projects/freeipa/.tox/pylint2
pylint2 installdeps: ipaclient[csrgen,otptoken_yubikey], pylint
pylint2 installed: asn1crypto==0.22.0,astroid==1.4.9,backports.functools-lru-cache==1.4,cffi==1.10.0,configparser==3.5.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,enum34==1.1.6,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipaddress==1.0.18,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,isort==4.2.15,Jinja2==2.9.6,lazy-object-proxy==1.3.1,MarkupSafe==1.0,mccabe==0.6.1,netaddr==0.7.19,netifaces==0.10.6,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pylint==1.6.5,python-ldap==2.4.42,python-yubico==1.3.2,pyusb==1.0.0,qrcode==5.3,six==1.10.0,wrapt==1.10.11
pylint2 runtests: PYTHONHASHSEED='2133013788'
pylint2 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/pylint2/bin/python -m pylint --rcfile=/home/fbarreto/projects/freeipa/pylintrc --load-plugins pylint_plugins /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipaclient /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipalib /home/fbarreto/projects/freeipa/.tox/pylint2/lib/python2.7/site-packages/ipapython
________________________________________________ summary ________________________________________________
pylint2: commands succeeded
congratulations :)
```
</p>
</details>
<details>
<summary>tox -e py35</summary>
<p>
```
fbarreto@freeipa (fix-tox-imports) tox -e py35
py35 create: /home/fbarreto/projects/freeipa/.tox/py35
py35 installdeps: ipaclient[csrgen], ipatests
py35 installed: asn1crypto==0.22.0,cffi==1.10.0,cryptography==2.0.3,decorator==4.1.2,dnspython==1.15.0,gssapi==1.2.0,idna==2.6,ipaclient==4.6.90.dev201709041448+gitac6e4cb61,ipalib==4.6.90.dev201709041448+gitac6e4cb61,ipapython==4.6.90.dev201709041448+gitac6e4cb61,ipatests==4.6.90.dev201709041448+gitac6e4cb61,Jinja2==2.9.6,MarkupSafe==1.0,netaddr==0.7.19,netifaces==0.10.6,nose==1.3.7,polib==1.0.8,py==1.4.34,pyasn1==0.3.3,pyasn1-modules==0.1.1,pycparser==2.18,pyldap==2.4.37,pytest==3.2.1,pytest-multihost==1.1.1,qrcode==5.3,six==1.10.0
py35 runtests: PYTHONHASHSEED='3317488747'
py35 runtests: commands[0] | /home/fbarreto/projects/freeipa/.tox/py35/bin/ipa --help
Usage: ipa [global-options] COMMAND [command-options]
Manage an IPA domain
Options:
--version show program's version number and exit
-h, --help Show this help message and exit
-e KEY=VAL Set environment variable KEY to VAL
-c FILE Load configuration from FILE.
-d, --debug Produce full debuging output
--delegate Delegate the TGT to the IPA server
-v, --verbose Produce more verbose output. A second -v displays the
XML-RPC request
-a, --prompt-all Prompt for ALL values (even if optional)
-n, --no-prompt Prompt for NO values (even if required)
-f, --no-fallback Only use the server configured in /etc/ipa/default.conf
See "ipa help topics" for available help topics.
See "ipa help <TOPIC>" for more information on a specific topic.
See "ipa help commands" for the full list of commands.
See "ipa <COMMAND> --help" for more information on a specific command.
py35 runtests: commands[1] | /home/fbarreto/projects/freeipa/.tox/py35/bin/python -bb /home/fbarreto/projects/freeipa/.tox/py35/bin/ipa-run-tests --ipaclient-unittests
========================================== test session starts ==========================================
platform linux -- Python 3.5.3, pytest-3.2.1, py-1.4.34, pluggy-0.4.0
rootdir: /home/fbarreto/projects/freeipa/.tox/py35/lib/python3.5/site-packages/ipatests, inifile:
plugins: multihost-1.1.1
collected 451 items / 285 skipped
test_util.py ........
util.py ..
test_ipaclient/test_csrgen.py .................
test_ipalib/test_aci.py ...................
test_ipalib/test_backend.py ........
test_ipalib/test_base.py ...............
test_ipalib/test_capabilities.py .
test_ipalib/test_cli.py ...
test_ipalib/test_config.py ...............
test_ipalib/test_crud.py ...............
test_ipalib/test_errors.py .......
test_ipalib/test_frontend.py ........................................
test_ipalib/test_messages.py ....
test_ipalib/test_output.py ...
test_ipalib/test_parameters.py .............................................................
test_ipalib/test_plugable.py ........
test_ipalib/test_rpc.py ......ssssssss
test_ipalib/test_text.py .............................
test_ipalib/test_x509.py ...
test_ipapython/test_cookie.py ............
test_ipapython/test_dn.py ............................
test_ipapython/test_ipautil.py ....................................s.............................
test_ipapython/test_ipavalidate.py ..........
test_ipapython/test_kerberos.py ..............
test_ipapython/test_keyring.py ..........
test_ipapython/test_session_storage.py sss
test_ipapython/test_ssh.py ...............................
test_pkcs10/test_pkcs10.py .....
=============================== 439 passed, 297 skipped in 15.41 seconds ================================
________________________________________________ summary ________________________________________________
py35: commands succeeded
congratulations :)
```
</p>
</details>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1036/head:pr1036
git checkout pr1036
6 years, 7 months
[freeipa PR#1035][opened] WebUI: ID user override causes traceback in httpd/error_log
by pvomacka
URL: https://github.com/freeipa/freeipa/pull/1035
Author: pvomacka
Title: #1035: WebUI: ID user override causes traceback in httpd/error_log
Action: opened
PR body:
"""
The 'ipaanchoruuid' is link widget and it had set 'other_entity'
attribute to 'user'. That means that WebUI automatically checks
whether the created link is available (whether there is an existing
user with the name set as value of the 'ipaanchoruuid' field).
The user with that name is not obviously found because it tries to
find a user while the value is ipaanchoruuid (AD user).
Removing 'other_entity' from specification tells WebUI to not
check the link.
The link widget is even set to non-clicable state. So the check does not
makes sense now.
https://pagure.io/freeipa/issue/7139
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1035/head:pr1035
git checkout pr1035
6 years, 7 months
Announcing FreeIPA 4.6.0
by Tomas Krizek
The FreeIPA team would like to announce FreeIPA 4.6.0 release!
It can be downloaded from https://releases.pagure.org/freeipa/. Builds for
Fedora 25 and 26 will be available in the officialCOPR repository
https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/ .
== Highlights in 4.6.0 ==
=== Enhancements ===
* Python 3 is now supported.
=== Known Issues ===
* WebUI doesn't work [#7126, #7127]
* Attempting un-installation if IPA isn't installed prints confusing
strings [#7063]
=== Bug fixes ===
Contains all bugfixes and enhancements of 4.5.1, 4.5.2 and 4.5.3 releases.
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users
mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7123 External CA renewal fails when IPA CA subject DN does not match
"CN=Certificate Authority, {subject-base}"
* 7116 dnssec: fix localhsm.py with openhsm >= 2.2.0
* 7108 ipa-backup broken because of cyclic import
* 7086 [ipatests] - add caless to cafull tests
* 7066 WebUI: All columns of user in group table are clickable
* 7035 ipa-otptoken-import - XML file is missing PBKDF2 parameters!
* 7017 NULL LDAP context in call to ldap_search_ext_s during search in
cn=ad,cn=trusts,dc=example,dc=com
* 6605 make lint + make modifies PO files in place
* 6582 Web UI: Change "Host Based" and "Role Based" to "Host-Based" and
"Role-Based"
* 6447 [WebUI] Remove offline version of WebUI
* 6261 Replace ERROR: cannot connect to
'http://localhost:8888/ipa/json': [Errno 111] Connection refused with
'IPA is not configured on this system'
* 6176 Updating of dns system records rapidly slowdown uninstallation
* 7121 ipa otptoken-add-yubikey fails with python3
* 7118 Fix CA-less installation due to incorrect with statement
* 7110 Missing requirement in freeipa 4.5.90.dev201708161122+git799551892-0
* 7100 test_caless: add SAN dNSName extensions for wildcard tests
* 7088 Use X509v3 Basic Constraints "CA:TRUE" instead of "CA:FALSE" IPA
CA CSR
* 7076 Adjust to CURL whichs started to use OpenSSL -
ipa-server-install fails to obtain RA certificate from CA (CA_UNREACHABLE)
* 7053 Replica install fails to configure IPA-specific temporary
files/directories
* 7052 WebUI: search facet spec actions contains 'undefined' item
* 7051 ipapython/graph.py complexity optimization
* 7050 Type error when running tests for whoami command.
* 7046 missing default basedn causes failure during initialization of
multi host tests
* 7030 tests: CA-less test suite broken due to missing subject key
identifier extension
* 7011 --force-join option is not mentioned in ipa-replica-install man page
* 7010 ipa-backup fails silently
* 7002 adtrustinstance: broken ID range assessment
* 6987 ca-add: invalid X.509 DN fails ungracefully
* 6986 make pylint is not working on F26
* 6980 Pagination Size under Customization in IPA WebUI accepts negative
values
* 6976 External CA: check that IPA CA certificate contains Subject Key
Identifier
* 6974 WebUI: Fix unit webUI tests
* 6971 ipatests: collect systemd journal
* 6956 Backup and restore tests faliling
* 6946 ipa-replica-manage del (dl 0) doesn't remove server from
defaultServerList
* 6945 Bring back error messages from certificate validation
* 6943 server-del doesn't remove server from defaultServerList in
cn=default,ou=profile,$BASE
* 6940 installer should indicate that it is waiting for keys
* 6939 ipaserver.plugins.host.get_dn timeout due to unindexed search
* 6928 ipa-managed-entries incorrectly states server not installed
* 6865 minor spelling mistake in ipa-adtrust-install.1
* 6863 minor spelling mistake
* 6852 [RFE] Create client enrollment role
* 6849 Priority field missing in required field incicator - *
* 6845 ipa-otpd.socket.in has wrong kdc service name for Debian
* 6834 ipa-kdc-proxy.conf.template hardcodes python module directory
* 6822 git-commit-template: update ticket URL to use pagure.io instead
of fedorahosted.org
* 6818 Update asn1c code in /asn1/asn1c
* 6809 Failed to write schema: b'sudo/1' is not JSON serializable
* 6745 [test] ipa whoami command
* 6725 No page for information on build from source
* 6642 Py3: test_serverroles: use ldap2/ldapclient instead of MockLDAP
* 6591 pytest 3.0: yield tests are deprecated
* 5990 Py3: zonemgr_callback: expected unicode, got bytes
* 5919 cert-request rfc822Name check compares whole email address
case-sensitively
* 4985 [RFE] Support Python 3
== Detailed changelog since 4.5.3 ==
=== Alexander Bokovoy (13) ===
* csrgen: support openssl 1.0 and 1.1
* dcerpc: support Python 3
* ipa-sam: use smbldap_set_bind_callback for Samba 4.7 or later
* ipa-sam: use own private structure, not ldapsam_privates
* trust-mod: allow modifying list of UPNs of a trusted forest
* ipa-kdb: add pkinit authentication indicator in case of a successful
certauth
* Fix index definition for ipaAnchorUUID
* krb5: make sure KDC certificate is readable
* trust: always use oddjobd helper for fetching trust information
* ipaserver/dcerpc: unify error processing
* adtrust: make sure that runtime hostname result is consistent with the
configuration
* server: make sure we test for sss_nss_getlistbycert
* ldap2: use LDAP whoami operation to retrieve bind DN for current
connection
=== Abhijeet Kasurde (6) ===
* Vault testcase improvement
* Minor typo fixes
* Minor typo in details.js
* Hide request_type doc string in cert-request help
* Hide PKI Client database password in log file
* Use with statement for opening file
=== Alex Zeleznikov (1) ===
* Sort SRV records by priority
=== Aleksei Slaikovskii (3) ===
* ipapython/graph.py redundant variable fix
* ipapython/graph.py String formatting
* ipapython/graph.py complexity optimization
=== Ben Lipton (4) ===
* csrgen: Beginnings of NSS database support
* csrgen: Modify cert_get_requestdata to return a CertificationRequestInfo
* csrgen: Change to pure openssl config format (no script)
* csrgen: Remove helper abstraction
=== Christian Heimes (40) ===
* Misc Python 3 fixes for ipaserver.secrets
* Reimplement yield tests are parametrized tests
* Silence pytest.yield_fixture deprecation warning
* Slim down dependencies
* Vault: Explicitly default to 3DES CBC
* Band-aid for pip dependency bug
* Correct PyPI package dependencies
* tox: use pylint 1.6.x for now
* Replace _BSD_SOURCE with _DEFAULT_SOURCE
* Regenerate ASN.1 code with asn1c 0.9.28
* tox testing support for client wheel packages
* Stabilize make pypi_packages
* Replace hard-coded kdcproxy path with WSGI script
* Use entry_points for ipa CLI
* Don't hard-code with_wheels
* Add an option to build ipaserver wheels
* Add extra_requires for additional dependencies
* Conditionally import pyhbac
* Skip test_session_storage in ipaclient unittest mode
* Add make devcheck for developers
* session storage parameters must be bytes
* Fix ipatests.util doc tests
* Use Custodia 0.3.1 features
* Simplify KRA transport cert cache
* pytest 3.x compatibility
* Constrain wheel package versions
* Move remaining util functions to tasks module
* Ship ipatests.pytest_plugins.integration
* Move function run_repeatedly to tasks module
* Move hosts module to ipatests.pytest_plugins.integration.hosts
* Move tasks module to ipatests.pytest_plugins.integration.tasks
* Move env_config module to ipatests.pytest_plugins.integration.env_config
* Move config module to ipatests.pytest_plugins.integration.config
* Move helper code for integration plugin
* Increase Apache HTTPD's default keep alive timeout
* Add debug logging for keep-alive
* Use connection keep-alive
* Add options to run only ipaclient unittests
* Python 3: Fix session storage
* Fix Python 3 pylint errors
=== David Kreitschmann (4) ===
* Disable pylint in get_help function because of type confusion.
* Store help in Schema before writing to disk
* Use os.fsync instead of os.fdatasync because macOS doesn't support
fdatasync
* Fix libkrb5 filename for macOS
=== David Kupka (22) ===
* tests: certmap: Add test for user-{add,remove}-certmap
* tests: tracker: Add CertmapdataMixin tracker
* tests: certmap: Add test for certmapconfig-{mod,show}
* tests: tracker: Add CertmapconfigTracker to tests certmapconfig-* commands
* tests: certmap: Test permissions for certmap
* tests: certmap: Add basic tests for certmaprule commands
* tests: tracker: Add CertmapTracker for testing certmap-* commands
* tests: tracker: Add ConfigurationTracker to test *config-{mod,show}
commands
* tests: tracker: Add EnableTracker to test *-{enable,disable} commands
* tests: tracker: Split Tracker into one-purpose Trackers
* install: replica: Show message about key synchronization
* kra: promote: Get ticket before calling custodia
* ipapython.ipautil.run: Add option to set umask before executing command
* otptoken-add-yubikey: When --digits not provided use default value
* Bump version of ipa.conf file
* Create system users for FreeIPA services during package installation
* WebUI: cert login: Configure name of parameter used to pass username
* httpinstance.disable_system_trust: Don't fail if module 'Root Certs'
is not available
* spec file: Bump requires to make Certificate Login in WebUI work
* rpcserver.login_x509: Actually return reply from __call__ method
* Create temporaty directories at the begining of uninstall
* ipapython.ipautil.nolog_replace: Do not replace empty value
=== felipe (1) ===
* Fixing replica install: fix ldap connection in domlvl 0
=== Felipe Volpone (3) ===
* Removing part of circular dependency of ipalib in ipaplaform
* Changing how commands handles error when it can't connect to IPA server
* py3: fixing zonemgr_callback
=== Felipe Volpone (5) ===
* Adding section "Building FreeIPA from source" on README
* Changing cert-find to go through the proxy instead of using the port 8080
* Changing cert-find to do not use only primary key to search in LDAP.
* Fixing adding authenticator indicators to host
* Fixing the cert-request comparing whole email address case-sensitively.
=== Fabiano Fidêncio (1) ===
* Allow erasing ipaDomainResolutionOrder attribute
=== Florence Blanc-Renaud (22) ===
* Fix Certificate renewal (with ext ca)
* Fix ipa-server-upgrade: This entry already exists
* ipa-replica-conncheck: handle ssh not installed
* ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
* ipa-replica-manage del (dl 0): remove server from defaultServerList
* server-del: update defaultServerList in cn=default,ou=profile,$BASE
* ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname
* ipa-server-install: fix uninstall
* ipa-kra-install manpage: document domain-level 1
* ipa-kra-install: fix check_host_keys
* ipa-server-install with external CA: fix pkinit cert issuance
* ipa-client-install: remove extra space in pkinit_anchors definition
* vault: piped input for ipa vault-add fails
* upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is
installed
* tests: add non-reg for idrange-add
* Upgrade: add gidnumber to trusted domain entry
* ipa-sam: create the gidNumber attribute in the trusted domain entry
* idrange-add: properly handle empty --dom-name option
* ipa-ca-install man page: Add domain level 1 help
* git-commit-template: update ticket url to use pagure.io instead of
fedorahosted.org
* dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function
* man ipa-cacert-manage install needs clarification
=== Fraser Tweedale (14) ===
* Fix external renewal for CA with non-default subject DN
* py3: handle bytes in schema response
* py3: fix vault public key decoding
* cert: fix application of 'str' to bytes when formatting otherName
* py3: fix schema response for py2 server with py3 client
* Fix incorrect 'with' statement in CA-less installation
* Restore old version of caIPAserviceCert for upgrade only
* cert-request: simplify request processing
* Add CommonNameToSANDefault to default cert profile
* Add a README to certificate profile templates directory
* py3: fix regression in schemaupdate
* ca-add: validate Subject DN name attributes
* Add Subject Key Identifier to CA cert validity check
* Support 8192-bit RSA keys in default cert profile
=== Jan Cholasta (61) ===
* pylint: enable logging checks
* logging: do not use `ipa_log_manager` to create module-level loggers
* logging: do not log into the root logger
* logging: do not reference loggers in arguments and attributes
* doc: sync guide.org with cli.py
* logging: remove object-specific loggers
* logging: use the actual root logger as the root logger
* logging: port to standard Python logging
* logging: do not configure any handlers by default
* wsgi, oddjob: remove needless uses of Env
* config: provide defaults for `xmlrpc_uri`, `ldap_uri` and `basedn`
* ldap2: remove URI argument from ldap2 constructor
* test_ldap: drop redundant URI argument
* {ca,kra}instance: drop redundant URI argument from ad-hoc ldap2
connections
* user, migration: use LDAPClient for ad-hoc LDAP connections
* install: do not assume /etc/krb5.conf.d exists
* server upgrade: do not enable PKINIT by default
* pkinit manage: introduce ipa-pkinit-manage
* server certinstall: update KDC master entry
* httpinstance: wait until the service entry is replicated
* server certinstall: support PKINIT
* cacert manage: support PKINIT
* replica install: respect --pkinit-cert-file
* server install: fix KDC certificate validation in CA-less
* certs: do not export CA certs in install_pem_from_p12
* certs: do not export keys world-readable in install_key_from_p12
* server install: fix KDC PKINIT configuration
* install: introduce generic Kerberos Augeas lens
* client install: fix client PKINIT configuration
* install: trust IPA CA for PKINIT
* certdb: use custom object for trust flags
* certdb, certs: make trust flags argument mandatory
* certdb: add named trust flag constants
* ipa-cacert-manage: add --external-ca-type
* renew agent: get rid of virtual profiles
* renew agent: always export CSR on IPA CA certificate renewal
* renew agent: allow reusing existing certs
* cainstance: use correct profile for lightweight CA certificates
* server upgrade: always fix certmonger tracking request
* renew agent: respect CA renewal master setting
* spec file: bump krb5 Requires for certauth fixes
* spec file: bump python-netaddr Requires
* configure: fix AC_CHECK_LIB usage
* cert: defer cert-find result post-processing
* renew agent, restart scripts: connect to LDAP after kinit
* renew agent: revert to host keytab authentication
* install: request service certs after host keytab is set up
* dsinstance, httpinstance: consolidate certificate request code
* httpinstance: avoid httpd restart during certificate request
* dsinstance: reconnect ldap2 after DS is restarted by certmonger
* httpinstance: make sure NSS database is backed up
* certdb: fix `AttributeError` in `verify_ca_cert_validity`
* setup, pylint, spec file: drop python-nss dependency
* certdb: use certutil and match_hostname for cert verification
* spec file: bump libsss_nss_idmap-devel BuildRequires
* spec file: bump krb5-devel BuildRequires for certauth
* cert: do not limit internal searches in cert-find
* replica prepare: fix wrong IPA CA nickname in replica file
* httpinstance: clean up /etc/httpd/alias on uninstall
* certs: do not implicitly create DS pin.txt
* tasks: run `systemctl daemon-reload` after httpd.service.d updates
=== René Genz (3) ===
* fix minor spelling mistakes
* fix spelling mistake; minor rewording
* fix minor typos in ipa-adtrust-install.1
=== Martin Babinsky (45) ===
* Move tmpfiles.d configuration handling back to spec file
* Do not remove the old masters when setting the attribute fails
* *config-show: Do not show empty roles/attributes
* smart-card-advises: ensure that krb5-pkinit is installed on client
* smart card advise: use password when changing trust flags on HTTP cert
* smart card advises: use a wrapper around Bash `for` loops
* Use the compound statement formatting API for configuring PKINIT
* Fix indentation of statements in Smart card advises
* delegate formatting of compound Bash statements to dedicated classes
* advise: add an infrastructure for formatting Bash compound statements
* delegate the indentation handling in advises to dedicated class
* add a class that tracks the indentation in the generated advises
* Allow to pass in multiple CA cert paths to the smart card advises
* smart-card advises: add steps to store smart card signing CA cert
* smart-card advises: configure systemwide NSS DB also on master
* Prepare advise plugin for smart card auth configuration
* Extend the advice printing code by some useful abstractions
* fix incorrect suffix handling in topology checks
* Do not delete DS and PKI users during backup/restore tests
* test_backup_restore: do not fail on missing KrbLastSuccessfulAuth
* only stop/disable simple service if it is installed
* test_serverroles: Get rid of MockLDAP and use ldap2 instead
* Add `pkinit-status` command
* Add the list of PKINIT servers as a virtual attribute to global config
* Add an attribute reporting client PKINIT-capable servers
* Refactor the role/attribute member reporting code
* Allow for multivalued server attributes
* Travis CI: Add the server uninstaller as a last step of tests
* Travis CI: explicitly update pip before running the builds
* Do not test anonymous PKINIT after install/upgrade
* Upgrade: configure local/full PKINIT depending on the master status
* Use local anchor when armoring password requests
* Stop requesting anonymous keytab and purge all references of it
* Use only anonymous PKINIT to fetch armor ccache
* API for retrieval of master's PKINIT status and publishing it in LDAP
* Allow for configuration of all three PKINIT variants when deploying KDC
* separate function to set ipaConfigString values on service entry
* Revert "Store GSSAPI session key in /var/run/ipa"
* Remove duplicate functionality in upgrade
* Always check and create anonymous principal during KDC install
* Ensure KDC is propery configured after upgrade
* Split out anonymous PKINIT test to a separate method
* Remove unused variable from failed anonymous PKINIT handling
* Upgrade: configure PKINIT after adding anonymous principal
* Travis CI: invoke integration test helper scripts before test execution
=== Martin Basti (63) ===
* DNS update: reduce timeout for CA records
* baseldap: fix format string
* IPAOptionParser: fix dict comprehension
* py3: run already ported scripts under py3 by default
* py3: temporary set dependencies to both py2 and py3 packages
* py3: test_otptoken_import: fix bytes usage
* py3: ipa_otptoken_import: fix hex decoding
* py3: ipa_otptoken_import: fix calling unicode on bytes
* py3: ipa_otptoken_import: fix lamba code inspection
* py3: Remove comparison >=2 of debnug log level
* py3: vault: data must be bytes
* py3: test_location_plugin: fix iteration over changed dict
* py3: test_kerberos_principal_aliases: fix code scope
* py3: dogtag.py: fix bytes warnings
* py3: travis: enable tests for plugins that are aleready working
* py3: secrets: remove iteritems usage
* Travis: check for BytesWarnings in httpd error_log
* py3: ipaldap: fix encoding of datetime objects
* py3: LDAPClient: remove __del__ method
* LDAPEntry: rename _orig to _orig_raw
* python-netifaces: update to reflect upstream changes
* Travis: enable temporary Py3 testing
* Travis: build only py2 packages for py2 testing
* Build: allow to build only py2 rpms for fedora
* Remove network and broadcast address warnings
* replica install: add missing check for non-local IP address
* Remove ip_netmask from option parser
* CheckedIPAddress: remove match_local param
* refactor CheckedIPAddress class
* ipa-dns-install: remove check for local ip address
* Fix local IP address validation
* Explicitly ask for py2 dependencies in py2 packages
* Only warn when specified server IP addresses don't match intf
* pylint: explicitly depends on python2-pylint
* py3: update_mod_nss_cipher_suite: ordering doesn't work with None
* py3: urlfetch: use "file://" prefix with filenames
* py3: cainstance: fix BytesWarning
* py3: schemaupdate: fix BytesWarning
* py3: LDAP updates: use only bytes/raw values
* py3: softhsm key_id must be bytes
* py3: ipaldap: encode Boolean as bytes
* py3: ConfigParser: replace deprecated readfd with read
* py3: use ConfigParser instead of SafeConfigParser
* Add remote_plugins subdirectories to RPM
* custodia dep: require explictly python2 version
* pylint: ignore new checks added in 1.7
* Pylint: fix ipa_forbidden_import checker
* travis: fix pylint execution with py3
* py3: add missing py3 pylint depedencies
* adtrust: move SELinux settings to constants
* httpd: move SELinux settings to constants
* ipasetup: fix dependencies handling based on python version
* ipaclient: fix missing RPM ownership
* tests: add missing dependency iptables
* ca_status: add HTTP timeout 30 seconds
* http_request: add timeout option
* Use proper SELinux context with http.keytab
* Store GSSAPI session key in /var/run/ipa
* Fix PKCS11 helper
* Remove surplus 'the' in output of ipa-adtrust-install
* collect audit.log for easier selinux investigation
* Set "KDC:Disable Last Success" by default
* Set development version to 4.5.90
=== Lewis Eason (1) ===
* Correct typo estabilish->establish in the install scripts
=== Michal Reznik (9) ===
* test_caless: add SAN dNSName extensions for wildcard tests
* test_caless: add replica ca-less to ca-full test (master caless)
* test_caless: add server_replica ca-less to ca-full test
* tests: fix external_ca test suite failing due to missing SKI
* test_caless: remove xfail in wildcard certificate tests
* test_caless: introduce new python makepki + fix SKI extension issue
* test_caless: mark TestCertinstall intermediate CA tests as xfail
* test_caless: add pkinit option and test it
* - added krb5kdc.log to pytest logging
=== Nathaniel McCallum (1) ===
* ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
=== Oliver Gutierrez (1) ===
* Added plugins directory to paclient subpackages
=== Petr Spacek (1) ===
* ipalib.constants: Remove default domain, realm, basedn, xmlrpc_uri,
ldap_uri
=== Petr Vobornik (5) ===
* log progress of wait_for_open_ports
* control logging of host_port_open from caller
* kerberos session: use CA cert with full cert chain for obtaining cookie
* restore: restart/reload gssproxy after restore
* automount install: fix checking of SSSD functionality on uninstall
=== Pavel Vomacka (34) ===
* Fixes bug in actions creating for search facet
* WebUI: fix showing required asterisk '*'
* WebUI: Update unit test README
* Fixes details_test.js
* Fixes for widget_tests.js
* Fixes for aci_tests.js
* Fixes for entity_tests.js
* Fixes for ipa_test.js
* Add up to date JSON files
* Add loader.js into requirements of all HTML unit test files
* WebUI: remove creating js/libs symlink from makefile
* WebUI: Remove plugins symlink as it is unused
* Remove all old JSON files
* Revert "Web UI: Remove offline version of Web UI"
* WebUI: Add hyphenate versions of Host(Role) Based strings
* WebUI: fix incorrectly shown links in association tables
* WebUI: fix jslint error
* WebUI: change validator of page size settings
* WebUI: Add positive number validator
* WebUI: add support for changing trust UPN suffixes
* Bump version of python-gssapi
* Turn off OCSP check
* Change python-cryptography to python2-cryptography
* Turn on NSSOCSP check in mod_nss conf
* WebUI - Coverity: fix identical branches of if statement
* WebUI - Coverity: fixed null pointer exception
* WebUI: Coverity - add explicit window object to alert methods
* WebUI: Allow to add certs to certmapping with CERT LINES around
* WebUI: Fix showing vault in selfservice view
* WebUI: suppress truncation warning in select widget
* WebUI: Add support for suppressing warnings
* WebUI: Add support for login for AD users
* WebUI: add method for disabling item in user dropdown menu
* WebUI: check principals in lowercase
=== Rob Crittenden (2) ===
* Include the CA basic constraint in CSRs when renewing a CA
* Pass ipa-ca-agent credentials as PEM files
=== Gabe (2) ===
* Update get_attr_filter in LDAPSearch to handle nsaccountlock user searches
* Add --password-expiration to allow admin to force user password expiration
=== Sumit Bose (11) ===
* ipa_pwd_extop: do not generate NT hashes in FIPS mode
* ipa-sam: replace encode_nt_key() with E_md4hash()
* ipa-kdb: use canonical principal in certauth plugin
* ipa-kdb: reload certificate mapping rules periodically
* IPA-KDB: use relative path in ipa-certmap config snippet
* extdom: improve cert request
* extdom: do reverse search for domain separator
* ipa-kdb: do not depend on certauth_plugin.h
* configure: fix --disable-server with certauth plugin
* IPA certauth plugin
* ipa-kdb: add ipadb_fetch_principals_with_extra_filter()
=== Simo Sorce (12) ===
* Always check peer has keys before connecting
* Make sure we check ccaches in all rpcserver paths
* Revert setting sessionMaxAge for old clients
* Add code to be able to set default kinit lifetime
* Fix rare race condition with missing ccache file
* Make sure remote hosts have our keys
* Fix s4u2self with adtrust
* Prevent churn on ccaches
* Work around issues fetching session data
* Handle failed authentication via cookie
* Avoid growing FILE ccaches unnecessarily
* Add options to allow ticket caching
=== Stanislav Laznicka (97) ===
* spec: remove strict options from shebangs
* spec: have the scripts depend on py3 packages
* spec: remove python3 workaround
* Remove unused variable
* certmonger: remove temporary workaround
* cert: fix wrong assumption of cert-show result type
* rpc: don't encode bytes
* py3: Fix searching for yubikeys
* py3: remove relative import
* py3: remove Exception.message appearances
* Fix cert file creation during CA-less installation
* Uninstall: fix BytesWarning exception
* Unify storing certificates in LDAP
* py3: fix caless to CA promotion on replica
* cacert_manage: fix CA cert renewal
* python3: port certmonger requests script
* crtmgr: fix bug if CERTMONGER_CERTIFICATE not set
* certmonger: finish refactoring for request script
* certmonger: fix storing retrieved certificates
* Make the IPA server run under Python 3 by default
* Turn IPA scripts to python3 -bb for testing
* py3: Depend on newer pyldap for server-upgrade
* ipautil: port host_port_open() to python 3
* conncheck: fix progression on failure
* kerberos: fix sorting Principal objects
* host, service: fix adding host/svc with a cert
* server plugin: pass bytes to ldap.modify_s
* replica: fix SetuptoolsVersion comparison
* replica-prepare: run the script in py3 by default
* certs: write and read bytes as such
* client: make ipa-client-install py3 compatible
* cainstance: read cert file as bytes
* ca: TypeError fix
* krainstance: fix writing str to file
* replica-conncheck: log when failed to RPC connect
* Fixup of not-so-good PEM certs
* x509,certdb: handle certificates as bytes
* Create a Certificate parameter
* parameters: relax type checks
* tests: fix failing HTTPS connection
* Introduce load_unknown_x509_certificate()
* x509: Make certificates represented as objects
* Split x509.load_certificate() into PEM/DER functions
* README: Fix trailing whitespace
* Ensure network is online prior to an upgrade
* rpcserver: remove addition of str and bytes
* wsgi plugins: mod_wsgi expects bytes as an output
* adtrustinstance: write the conf as a string
* adtrustinstance: pep8 fix
* More verbose error message on kdc cert validation
* cert-validate: keep all messages in cert validation
* adtrustinstance: fix ID range comparison
* Docstring+refactor of IPADiscovery.ipadnssearchkrbrealm()
* ipadiscovery: Return realm as a string
* session_storage: Correctly handle string/byte types
* rpc: avoid possible recursion in create_connection
* rpc: preparations for recursion fix
* Avoid possible endless recursion in RPC call
* kdc.key should not be visible to all
* Change ConfigParser to RawConfigParser
* ca/cert-show: check certificate_out in options
* Remove pkinit-anonymous command
* Make a doctext more clear
* Provide useful messages during cert validation
* cert-show: writable files does not mean dirs
* fix managed-entries printing IPA not installed
* Fix wrong message on Dogtag instances stop
* Make CA/KRA fail when they don't start
* Remove the cachedproperty class
* Refresh Dogtag RestClient.ca_host property
* compat plugin: Update link to slapi-nis project
* compat: ignore cn=topology,cn=ipa,cn=etc subtree
* Move the compat plugin setup at the end of install
* compat-manage: behave the same for all users
* Fix CAInstance.import_ra_cert for empty passwords
* Fix RA cert import during DL0 replication
* ext. CA: correctly write the cert chain
* server-install: No double Kerberos install
* Fix CA-less to CA-full upgrade
* replicainstall: better client install exception handling
* Add the force-join option to replica install
* server-install: remove broken no-pkinit check
* Add pki_pin only when needed
* Remove publish_ca_cert() method from NSSDatabase
* Get correct CA cert nickname in CA-less
* Remove redundant option check for cert files
* replica-prepare man: remove pkinit option refs
* Don't allow setting pkinit-related options on DL0
* Fix the order of cert-files check
* Generate PIN for PKI to help Dogtag in FIPS
* Backup CA cert from kerberos folder
* Allow renaming of the sudorule objects
* Allow renaming of the HBAC rule objects
* Reworked the renaming mechanism
* Bump samba version for FIPS and priv. separation
* Backup ipa-specific httpd unit-file
* Add debug log in case cookie retrieval went wrong
=== Thierry Bordaz (1) ===
* NULL LDAP context in call to ldap_search_ext_s during search
=== Tibor Dudlák (11) ===
* otptoken_yubikey.py: Removed traceback when package missing.
* topology.py: Removes error message from dictionary.
* Add test: test_xmlrpc/test_whoami_plugin.py
* whoami.py: Type error when running tests
* Create indexes for 'serverhostname' attribute
* Add --force-join into ipa-replica-install manpage
* dnsserver.py: dnsserver-find no longer returns internal server error
* Add Role 'Enrollment Administrator'
* server.py: Removes dns-server configuration from ldap
* sssd.py: Deprecating no-sssd option.
* client.py: Replace hardcoded 'admin' with options.principal
=== Tibor Dudlák (2) ===
* user.py: replace user_mod with ldap.update_entry()
* Add 'TIP' to enable copr repo.
=== Timo Aaltonen (2) ===
* ipa-otpd.socket.in: Use a platform specific value for KDC service file
* configure: Use ODS_USER and NAMED_GROUP in daemons/dnssec/*.service.in
=== Tomas Krizek (25) ===
* Become IPA 4.6.0
* Contributors.txt: update
* zanata: update translations for ipa-4-6
* zanata: set project version to ipa-4-6
* dnssec: keep dnssec daemons in Python2
* ipatests: collect log after ipa-ca-install
* dnssec: fix localhsm.py utility script
* prci: add caless tests
* makerpms.sh: make git checkout optional
* build: checkout *.po files at the end of makerpms.sh
* freeipa-pr-ci: enable pull-request CI
* ipactl: log check_version exception
* logging: make sure logging level is set to proper value
* ipatests: do not finalize api when IPA is not configured
* ipatests: do not collect systemd journal when logfile_dir is missing
* ipatests: add systemd journal collection for multihost tests
* ipatests: change logdir naming pattern for multihost tests
* named.conf template: add modification warning
* ca, kra install: validate DM password
* installutils: add DM password validator
* ca install: merge duplicated code for DM password
* upgrade: add missing suffix to http instance
* installer service: fix typo in service entry
* python2-ipalib: add missing python dependency
* kra install: update installation failure message
=== Thorsten Scherf (2) ===
* Changed ownership of ldiffile to DS_USER
* Fixed typo in ipa-client-install output
6 years, 7 months