[Pkg-freeipa-devel] [Git][freeipa-team/freeipa][master] 1131 commits: Set development version to 4.7.90

Wed Sep 11 22:32:10 BST 2019

Timo Aaltonen pushed to branch master at FreeIPA packaging / freeipa

Commits:
d9b8fa3f by Rob Crittenden at 2018-07-19T15:30:46Z
Set development version to 4.7.90

- - - - -
f3faecbb by Thomas Woerner at 2018-07-20T16:53:38Z
Fix $-style format string in ipa_ldap_init (util/ipa_ldap.c)

The second argument was not used, but the first one was used twice.

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
fd348773 by Ganna Kaihorodova at 2018-07-20T17:03:59Z
Add check for occuring traceback during uninstallation ipa master

Modified master uninstall task for traceback check
That approach give us wide coverage and multiple scenarious
to catch traceback during uninstallation process
Add verbose option to uninstall server and set to False

Related to: https://bugzilla.redhat.com/show_bug.cgi?id=1480502

Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>
Reviewed-By: Petr Cech <pcech at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
0e9fb8ac by Petr Vobornik at 2018-07-23T12:26:50Z
webui: change indentation of freeipa/_base/debug.js

Change to use spaces for indentation as it was the the only file
which uses tabs and not spaces.

Signed-off-by: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
78cefe09 by Petr Vobornik at 2018-07-23T12:26:50Z
webui: remove mixed indentation in App and LoginScreen

Only spaces should be used for indentation.

It was introduced in commits:

* 7f9f59bae2a362ce945c49ad8342393b7a5c024f
* 5d8fde0ac1a43c8f3dbc53b44d69f3663a8b36fb

Related to: https://pagure.io/freeipa/issue/7559

Signed-off-by: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
94bcd938 by Orion Poplawski at 2018-07-25T16:38:52Z
ipaclient-install: chmod needs octal permissions

Fixes incorrect usage introduced in 792adebfabb456d154164387fb7e60acb30f4325

https://pagure.io/freeipa/issue/7650

Signed-off-by: Orion Poplawski <orion at nwra.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
8f202bbd by Felipe Barreto at 2018-07-27T07:50:06Z
Making nigthly test definition editable by FreeIPA's contributors

Now the test definition of nightly tests will be on freeipa repo. The
definition that's used on every PR (previously as .freeipa-pr-ci.yaml)
is in ipatests/prci_definitions/gating and the .freeipa-pr-ci.yaml file
is just a symlink to the real file.

In the same dir there is also nightly_master and nightly_rawhide, both
to be used in nightly tests.

Divided test_topology.py into 3 subtests.

Bumped vagrant template to version 0.1.6

This PR is the result of discussion on freeipa-devel mailing list [1].

[1] https://lists.fedoraproject.org/archives/list/freeipa-devel@lists.fedorahosted.org/message/4VAWJ4SFKKBFFICDLQCTXJWRRQHIYJLL/

Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
6212423c by Christian Heimes at 2018-07-27T07:50:06Z
Fix topology configuration of nightly runs

Some nightly runs didn't have enough resources configured.

See: https://pagure.io/freeipa/issue/7638
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
8edde14e by Christian Heimes at 2018-07-27T07:50:06Z
Add convenient template for temp commits

Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
71ba408d by Thomas Woerner at 2018-07-30T15:26:23Z
ipaserver/plugins/cert.py: Added reason to raise of errors.NotFound

In the case that enabledService is not found ipaConfigString kdc entry, a
NotFound error was raised without setting the reason. This resulted in a
traceback.

Fixes: https://pagure.io/freeipa/issue/7652
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
64145093 by Christian Heimes at 2018-08-02T15:07:43Z
Rename pytest_plugins to ipatests.pytest_ipa

pytest 3.7.0 doesn't like ipatests.pytest_plugins package. The string
"pytest_plugins" is used as marker to load plugins. By populare vote and
to avoid future conflicts, we decided to rename the directory to pytest_ipa.

Fixes: https://pagure.io/freeipa/issue/7663
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
f7516979 by Thomas Woerner at 2018-08-03T11:23:21Z
httpinstance: Restore SELinux context of session_dir /etc/httpd/alias

The session directory /etc/httpd/alias/ could be created with the wrong
SELinux context. Therefore httpd was not able to write to this directory.

Fixes: https://pagure.io/freeipa/issue/7662

Related-to: 49b4a057f1b0459331bcec2c8d760627d00e4571 (Create missing
            /etc/httpd/alias for ipasession.key)

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
354d7297 by Thomas Woerner at 2018-08-03T11:23:21Z
ipa_restore: Restore SELinux context of template_dir /var/log/dirsrv/slapd-X

The template directory /var/log/dirsrv/slapd-X could be created with the
wrong SELinux context.

Related to: https://pagure.io/freeipa/issue/7662

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
a71729cc by Thierry Bordaz at 2018-08-03T12:39:11Z
In IPA 4.4 when updating userpassword with ldapmodify does not update krbPasswordExpiration nor krbLastPwdChange

When making ipa-pwd-extop TXN aware, some callbacks are call twice.
Particularily
	ipapwd_pre_add is called during PRE_ADD and TXN_PRE_ADD
	ipapwd_pre_mod is called during PRE_MOD and TXN_PRE_MOD
	ipapwd_post_modadd is called during POST_ADD and TXN_POST_ADD
	ipapwd_post_modadd is called during POST_MOD and TXN_POST_MOD
It is not the expected behavior and it results on some skipped updates krbPasswordExpiration
and krbLastPwdChange

https://pagure.io/freeipa/issue/7601

Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
11ec43a5 by Michal Reznik at 2018-08-03T13:14:57Z
prci_definitions: fix wrong indentation in the nightly yaml

TestLineTopologyWithoutCA definition has wrong indentation.

Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
c1a0c3c5 by Florence Blanc-Renaud at 2018-08-06T14:51:56Z
Tests: add integration test for password changes by dir mgr

Add a test for issue 7601:
- add a user, perform kinit user to modify the password, read krblastpwdchange
and krbpasswordexpiration.
- perform a ldapmodify on the password as dir mgr
- make sure that krblastpwdchange and krbpasswordexpiration have been modified
- perform the same check with ldappasswd

Related to:
https://pagure.io/freeipa/issue/7601

Reviewed-By: Thierry Bordaz <tbordaz at redhat.com>

- - - - -
016df47d by Pavel Picka at 2018-08-07T14:31:03Z
WebUI Tests stabilize

- close notifications
- add wait in cert test case

Signed-off-by: Pavel Picka <ppicka at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
b5fa64ed by Pavel Picka at 2018-08-07T21:46:10Z
PR-CI extend timeouts

extend timeout with one hour as timed out many times in PRCI nightly
- test_dnssec
- test_replication_layouts_TestLineTopologyWithCA
- test_replication_layouts_TestLineTopologyWithCAKRA
- test_replication_layouts_TestStarTopologyWithCAKRA
- test_server_del
- test_webui

Signed-off-by: Pavel Picka <ppicka at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
2a9f5eaa by Florence Blanc-Renaud at 2018-08-08T11:03:47Z
PRCI: extend timeouts for gating

Some tests have been identified as frequently failing on timeouts. While
we are investigating PRCI potential issues, increase the timeouts to
make PRCI usable. The rule is to add 30min if the test involves CA/KRA
installation or 20min otherwise for the most problematic tests.

test_forced_client_enrolment: from 1h to 1h20
test_vault: from 1h15 to 1h45
external_ca_1: from 1h to 1h20
test_sudo: from 1h to 1h20
test_authconfig: from 1h to 1h20
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
0aeccc08 by Michal Reznik at 2018-08-10T15:01:45Z
ipa_tests: test ssh keys login

Integration test for:

https://pagure.io/SSSD/sssd/issue/3747

IPA ticket: https://pagure.io/freeipa/issue/7664

Reviewed-By: Armando Neto <abiagion at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
c5cdd5a5 by Thomas Woerner at 2018-08-13T10:23:53Z
ipaclient: Remove --no-sssd and --no-ac options

Client installation with --no-sssd option has already beeen deprecated
with https://pagure.io/freeipa/issue/5860. Authconfig support has been
removed, therefore --no-ac option can be removed also.

ipatests/test_integration/test_authselect.py: Skip no_sssd and no_ac tests.

See: https://pagure.io/freeipa/issue/7671
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
f6fa2e94 by Thomas Woerner at 2018-08-13T10:35:06Z
Do not install ipa-replica-prepare

ipa-replica-prepare (script and man page) is only needed for DL0 support.
The script and man page are not installed anymore and also removed from
the spec file.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
38936817 by Thomas Woerner at 2018-08-13T10:35:06Z
Increase MIN_DOMAIN_LEVEL to DOMAIN_LEVEL_1

With increasing the minimal domain level to 1 ipa-replica-install will
refuse to install if the domain has domain level 0.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
0ce79ec6 by Thomas Woerner at 2018-08-13T10:35:06Z
Mark replica_file option as deprecated

The replica_file option is only supported for DL0. The option will be
marked deprecated for now.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
03776457 by Thomas Woerner at 2018-08-13T10:35:06Z
Raise error if DL is set to 0 or DL0 options are used

In the case that the domain level is set to 0 or replica_file is set (not
None) an error will be raised.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
a170b284 by Thomas Woerner at 2018-08-13T10:35:06Z
Remove support for replica_file option from ipa-ca-install

Raise "Domain level 0 is not supported anymore" error if there are
remainaing args after parsing. Remove all "DOMAIN LEVEL 0" and
"DOMAIN LEVEL 1" prefixes from the man page.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
5f5180b8 by Thomas Woerner at 2018-08-13T10:35:06Z
Remove support for replica_file option from ipa-kra-install

Raise "Domain level 0 is not supported anymore" error if there are
remainaing args after parsing. Remove all "DOMAIN LEVEL 0" and
"DOMAIN LEVEL 1" prefixes from the man page.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
9c2b0ce7 by Thomas Woerner at 2018-08-13T10:35:06Z
Remove DL0 specific sections from ipa-replica-install man page

Remove replica_file option and all "DOMAIN LEVEL 0" and "DOMAIN LEVEL 1"
prefixes and also sections specific to DL0 form the man page.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
7e172e3b by Thomas Woerner at 2018-08-13T10:35:06Z
Remove "at DL1" from ipa-replica-manage man page

As there is currently only DL1, there is no need to have extra
sentences for "at domain level 1".

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
0eb140ea by Thomas Woerner at 2018-08-13T10:35:06Z
Remove "at DL1" from ipa-server-install man page

As there is currently only DL1, there is no need to have extra
sentences for "at domain level 1".

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
b99dc46a by Thomas Woerner at 2018-08-13T10:35:06Z
Move DL0 raises outside if existing conditionals to calm down pylint

This pull should not remove code, therefore it is needed to add addtional
conditionals to calm down pylint beacuse of unreachable code.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
2a788f1a by Thomas Woerner at 2018-08-13T10:35:06Z
ipatests: Drop test_password_option_DL0

DL0 is not supported anymore therefore this test is failing.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
3b8c38ec by Thomas Woerner at 2018-08-13T10:35:06Z
ipatests/test_ipaserver/test_install/test_installer.py: Drop tempfile import

This is not needed anymore due to the removal of the DL0 test

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
c33cbe13 by Thomas Woerner at 2018-08-13T10:35:06Z
ipaserver/install/adtrust.py: Do not use DOMAIN_LEVEL_0 for minimum

As there is the minimal domain level setting MIN_DOMAIN_LEVEL, it should
be used instead of DOMAIN_LEVEL_0.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
94159bbe by Thomas Woerner at 2018-08-13T10:35:06Z
ipatests/test_xmlrpc/tracker/server_plugin.py: Increase hard coded mindomainlevel

The hard coded mindomainlevel needs to be increased to 1.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
cb7f6b7b by Thomas Woerner at 2018-08-13T10:35:06Z
replicainstall: Make sure that domain fulfills minimal domain level requirement

The old domain level check to suggest to use ipa-replica-prepare has been
converted to make sure that domain fulfills minimal domain level
requirement (no DL0).

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
1a0b0d2f by Alexander Bokovoy at 2018-08-13T11:03:13Z
ipa-extdom-extop: Update licenses to GPLv3 or later with exceptions

The code in question was supposed to have the same license as the
rest of the plugin. Fix it by updating the comment header.

Signed-off-by: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Thomas Woerner <twoerner at redhat.com>

- - - - -
c2e1cdf8 by Serhii Tsymbaliuk at 2018-08-13T12:25:06Z
Replace logo images with new one (version 4.7)

Resolves: https://pagure.io/freeipa/issue/7362
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
de8f969f by Alexander Bokovoy at 2018-08-13T12:42:16Z
Move fips_enabled to a common library to share across different plugins

Related: https://pagure.io/freeipa/issue/7659
Reviewed-By: Robbie Harwood <rharwood at redhat.com>

- - - - -
6907a0ce by Alexander Bokovoy at 2018-08-13T12:42:16Z
ipasam: do not use RC4 in FIPS mode

When creating Kerberos keys for trusted domain object account, ipasam
module requests to generate keys using a series of well-known encryption
types. In FIPS mode it is not possible to generate RC4-HMAC key:
MIT Kerberos is using openssl crypto backend and openssl does not allow
use of RC4 in FIPS mode.

Thus, we have to filter out RC4-HMAC encryption type when running in
FIPS mode. A side-effect is that a trust to Active Directory running
with Windows Server 2003 will not be possible anymore in FIPS mode.

Resolves: https://pagure.io/freeipa/issue/7659
Reviewed-By: Robbie Harwood <rharwood at redhat.com>

- - - - -
13000e2f by Christian Heimes at 2018-08-13T16:49:05Z
Disable DL0 specific tests

Disable tests that use domain level 0. Fail early to catch additional
tests that depend on DL0.

See: https://pagure.io/freeipa/issue/7669
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Thomas Woerner <twoerner at redhat.com>

- - - - -
adfd82ee by Stanislav Levin at 2018-08-14T12:07:38Z
Replace the direct URL with config's one

To be customizable URL should be placed to "config"

Fixes: https://pagure.io/freeipa/issue/7621
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
1721356d by Stanislav Levin at 2018-08-14T12:07:38Z
Fix translation of "sync_otp" plugin

To be translatable messages should be marked with '@i18n' and
present in "i18n_messages" dictionary.

Fixes: https://pagure.io/freeipa/issue/7621
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
14e21047 by Stanislav Levin at 2018-08-14T12:07:38Z
Fix translation of "SyncOTPScreen" widget

To be translatable messages should be marked with '@i18n' and
present in "i18n_messages" dictionary.

Fixes: https://pagure.io/freeipa/issue/7621
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
f68dca24 by Rob Crittenden at 2018-08-15T10:52:52Z
Convert members into types in sudorule-*-option

The indirect members need to be calculated and the member
attributes converted. This is normally done in
baseldap::LDAPRetrieve but these methods provide their
own execute() in order to handle the option values.

Update sudorule_add|remove_option tests to include check
that converted user/group exists in the proper format.

https://pagure.io/freeipa/issue/7649

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
6fa1e6f1 by Tibor Dudlák at 2018-08-16T10:45:00Z
Re-open the ldif file to prevent error message

There was an issue with ipa-server-upgrade and it was
showing an error while upgrading:
DN... does not exists or haven't been updated, caused
by not moving pointer to file begining when re-reading.

Resolves: https://pagure.io/freeipa/issue/7644
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
89799a14 by Tibor Dudlák at 2018-08-16T10:45:00Z
Add assert to check output of upgrade

Ckeck the output of ipa-server-upgrade script for error.

Related to: https://pagure.io/freeipa/issue/7644

Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
51240f35 by Mohammad Rizwan Yusuf at 2018-08-16T12:23:32Z
Check if user permssions and umask 0022 is set when executing ipa-restore

This test checks if the access rights for user/group
is set to 644 on /var/lib/dirsrv/slapd-TESTRELM-TEST/ldif/*
and umask 0022 set while restoring.

related ticket: https://pagure.io/freeipa/issue/6844

Signed-off-by: Mohammad Rizwan Yusuf <myusuf at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
3322aad7 by Alexander Scheel at 2018-08-20T21:58:16Z
Add docstring to verify_kdc_cert_validity

Signed-off-by: Alexander Scheel <ascheel at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
fc0f6b43 by Alexander Scheel at 2018-08-20T21:58:16Z
Add missing docstrings to kernel_keyring.py

Signed-off-by: Alexander Scheel <ascheel at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
77286f52 by Serhii Tsymbaliuk at 2018-08-21T15:38:32Z
Replace old login screen logo with new one

Related: https://pagure.io/freeipa/issue/7362
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
6a1409ec by Michal Reznik at 2018-08-23T06:21:22Z
test: client uninstall fails when installed using non-existing hostname

https://pagure.io/freeipa/issue/7620

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
df8bffd9 by Rob Crittenden at 2018-08-23T09:53:30Z
Honor no-host-dns when creating client host in replica install

--no-host-dns is supposed to avoid all DNS lookups so pass
this as the force value when creating the host in a replica
installation.

https://pagure.io/freeipa/issue/7656

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
f0228fa6 by Florence Blanc-Renaud at 2018-08-23T10:06:45Z
uninstall -v: remove Tracebacks

ipa-server-install --uninstall -v -U prints Traceback in its log file.
This issue happens because it calls subprocess.Popen with close_fds=True
(which closes all file descriptors in the child process)
but it is trying to use the file logger in the child process
(preexec_fn is called in the child just before the child is executed).
The fix is using the logger only in the parent process.

Fixes: https://pagure.io/freeipa/issue/7681
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
79fb0cc6 by Florence Blanc-Renaud at 2018-08-23T10:06:45Z
ipautil.run: add test for runas parameter

Add a test for ipautil.run() method called with runas parameter.
The test is using ipautil.run() to execute /usr/bin/id and
checks that the uid/gid are consistent with the runas parameter.

Note that the test needs to be launched by the root user
(non-privileged user may not have the rights to execute ipautil.run()
with runas parameter).

Related to: https://pagure.io/freeipa/issue/7681

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
a5a619ab by Florence Blanc-Renaud at 2018-08-23T10:08:45Z
ipa commands: print 'IPA is not configured' when ipa is not setup

Some commands print tracebacks or unclear error message when
they are called on a machine where ipa packages are installed but
IPA is not configured.
Consistently report 'IPA is not configured on this system' in this
case.

Related to https://pagure.io/freeipa/issue/6261

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
10c62589 by Florence Blanc-Renaud at 2018-08-23T10:08:45Z
Test: test ipa-* commands when IPA is not configured

Add a test checking that ipa-* commands properly display
'IPA is not configured on this system' when called on a
system without IPA.

Related to: https://pagure.io/freeipa/issue/6261

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
e4a3942e by Christian Heimes at 2018-08-23T12:49:06Z
Detect and prefer platform Python

A platform Python interpreter is a special variant of the interpreter,
that is only used for system software. It's located at
/usr/libexec/platform-python.

Fixes: https://pagure.io/freeipa/issue/7680
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
a347c116 by Christian Heimes at 2018-08-23T12:49:06Z
Rename Python scripts and add dynamic shebang

All Python scripts are now generated from a template with a dynamic
shebang.

ipatests/i18n.py is no longer an executable script with shebang. The
module is not executed as script directly, but rather as

    $(PYTHON) ipatests/i18n.py

Fixes: https://pagure.io/freeipa/issue/7680
All Python scripts are now template files with a dynamic shebang line.

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
c8da61b9 by Christian Heimes at 2018-08-23T12:49:06Z
Generate scripts from templates

Python scripts are now generated from templates. The scripts are marked
as nodist (no distribution) but install targets. The templates for the
scripts are extra distribution data, no installation (noinst).

Fixes: https://pagure.io/freeipa/issue/7680
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
02f4a7a2 by Florence Blanc-Renaud at 2018-08-24T14:50:30Z
DS replication settings: fix regression with <3.3 master

Commit 811b0fdb4620938963f1a29d3fdd22257327562c introduced a regression
when configuring replication with a master < 3.3
Even if 389-ds schema is extended with nsds5ReplicaReleaseTimeout,
nsds5ReplicaBackoffMax and nsDS5ReplicaBindDnGroupCheckInterval
attributes, it will return UNWILLING_TO_PERFORM when a mod
operation is performed on the cn=replica entry.

This patch ignores the error and logs a debug msg.

See: https://pagure.io/freeipa/issue/7617
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
79cb8ffb by Stanislav Levin at 2018-08-27T15:10:32Z
Add MigrateScreen widget

This widget is intended to integrate password migrate page into the
entire IPA Web framework. The functionality is the same as mentioned
standalone "ipa/migration/index.html".

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
13f1471c by Stanislav Levin at 2018-08-27T15:10:32Z
Add "migrate" Web UI plugin

This plugin creates and registers a facet with password migrate page.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
9bc93d30 by Stanislav Levin at 2018-08-27T15:10:32Z
Return the result of "password migration" procedure

So far "migration" end point redirected to "error"/"invalid" page as
a result of the client request. To use ajax requests and to not
reload/load the whole page the response should include the result of
request.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
05d7162b by Stanislav Levin at 2018-08-27T15:10:32Z
Integrate "migration" page to IPA Web framework.

To use all advantages of entire Web framework the "migration" page
should use "migrate" plugin. As well this allows to use IPA
translations.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
8a22c652 by Stanislav Levin at 2018-08-27T15:10:32Z
Provide translatable messages for MigrateScreen widget

Translatable messages should be marked with @i18n. Also
these messages should be presented in "i18n_messages" dictionary.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
9f6d5322 by Stanislav Levin at 2018-08-27T15:10:32Z
Clean up migration "error" and "invalid" pages from project

Migration error/invalid html pages are no longer needed as their
functionality was moved to "migrate" plugin.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
4088b283 by Stanislav Levin at 2018-08-27T15:10:32Z
Add basic tests for "migration" end point

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
28f4e0e0 by Petr Vobornik at 2018-08-27T15:10:32Z
webui: redable color of invalid fields on login-screen-like pages

Pages with widgets like LoginScreen, MigrateScreen use login-pf styling.
This page has dark background instead of light. Thus styling for labels
for fields with error has color which makes the label hard to read or
almost invisible.

Change it to white so it is still readable.

Fixes: https://pagure.io/freeipa/issue/7641
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at localhost.localdomain>

- - - - -
f0c3a359 by Mohammad Rizwan Yusuf at 2018-08-27T18:31:32Z
Test if WSGI worker process count is set to 4

related ticket : https://pagure.io/freeipa/issue/7587

Signed-off-by: Mohammad Rizwan Yusuf <myusuf at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
6175672e by Tibor Dudlák at 2018-08-28T07:32:45Z
Do not set ca_host when --setup-ca is used

Setting ca_host caused replication failures on DL0
because it was trying to connect to wrong CA host.
Trying to avoid corner-case in ipaserver/plugins/dogtag.py
when api.env.host nor api.env.ca_host had not CA configured
and there was ca_host set to api.env.ca_host variable.

See: https://pagure.io/freeipa/issue/7566
Resolves: https://pagure.io/freeipa/issue/7629
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
c3f23da4 by Stanislav Levin at 2018-08-28T08:17:26Z
Fix "get_key_index" to fit caller's expectations

The clients of "get_key_index" expect index of key in matching case
otherwise -1. But instead of this function returns the "undefined"
value.

Fixes: https://pagure.io/freeipa/issue/7678
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
0dcce426 by Stanislav Levin at 2018-08-28T08:17:26Z
Reindex 'key_indicies' after item delete

The "keys.splice(i, 1)" removes one item at the specified position
from an array. Thus hashes which are stored at "that._key_indicies"
are no longer valid and should be reindexed.

Fixes: https://pagure.io/freeipa/issue/7678
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
ad85cc8e by Pavel Picka at 2018-08-28T08:32:30Z
PRCI failures fix

test_installation.py
- ticket 7008 closed so removing xfail
  - TestInstallWithCA1
  - TestInstallWithCA
  - TestInstallWithCA_DNS1
  - TestInstallWithCA_DNS2

nightly_master
- test_backup_and_restore_TestUser[r>R]ootFilesOwnership[Permission]

Signed-off-by: Pavel Picka <ppicka at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
8af6accf by Rob Crittenden at 2018-08-29T07:03:18Z
Retrieve certificate subject base directly instead of ipa-join

The subject base is used as a fallback to find the available
CA certificates during client enrollment if the LDAP connection
fails (e.g. due to new client connecting to very old server) and
for constructing the subject if a certificate is requested.

raw=True is passed to config-show in order to avoid parsing
the server roles which will fail because the services aren't
marked as enabled until after the client installation is
successful on a master.

ipa-join providing the subject base via stderr was fragile and
would cause client enrollment to fail if any other output was
included in stderr.

https://pagure.io/freeipa/issue/7674

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
b8528da5 by Christian Heimes at 2018-08-30T09:37:21Z
Refactor os-release and platform information

Move the /etc/os-release parser and platform detection code out of the
private _importhook module. The ipaplatform module now contains an
osinfo module that provides distribution, os, and vendor information.

See: https://www.freedesktop.org/software/systemd/man/os-release.html
See: https://pagure.io/freeipa/issue/7661
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
1c03181e by Christian Heimes at 2018-08-30T09:37:21Z
Don't check for systemd service

ipaplatform no longer checks for the presence of a systemd service file
to detect the name of the domainname service. Instead it uses osinfo's
version to use the old name on Fedora 28 and the new name on Fedora 29.

This fixes a SELinux violation that prevented httpd from listing systemd
service files.

Fixes: https://pagure.io/freeipa/issue/7661
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
90203fb0 by Michal Reznik at 2018-08-31T10:30:46Z
Add "389-ds-base-legacy-tools" to requires.

"389-ds-base-legacy-tools" needs to be added to requires until
the switch to python installer is completed.

Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
fe650087 by Robbie Harwood at 2018-08-31T19:01:46Z
Clear next field when returnining list elements in queue.c

The ipa-otpd code occasionally removes elements from one queue,
inspects and modifies them, and then inserts them into
another (possibly identical, possibly different) queue.  When the next
pointer isn't cleared, this can result in element membership in both
queues, leading to double frees, or even self-referential elements,
causing infinite loops at traversal time.

Rather than eliminating the pattern, make it safe by clearing the next
field any time an element enters or exits a queue.

Related https://pagure.io/freeipa/issue/7262

Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
ab636682 by Robbie Harwood at 2018-08-31T19:01:46Z
Add cmocka unit tests for ipa otpd queue code

Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
59df37ad by Michal Reznik at 2018-09-03T11:31:28Z
bump PRCI template version to 0.1.8

Reviewed-By: Florence Blanc-Renaud <flo at redhat.com>

- - - - -
911416e4 by Florence Blanc-Renaud at 2018-09-03T11:56:39Z
ipa-server-install: do not perform forwarder validation with --no-dnssec-validation

ipa-server-install is checking if the forwarder(s) specified with
--forwarder argument support DNSSEC. When the --no-dnssec-validation
option is added, the installer should not perform the check.

Fixes: https://pagure.io/freeipa/issue/7666
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
739ddce6 by Florence Blanc-Renaud at 2018-09-03T11:56:39Z
tests: add test for server install with --no-dnssec-validation

Add 2 tests related to the checks performed by ipa-server-install
when --forwarder is specified:
- if the forwarder is not reachable and we require dnssec validation,
the installer must refuse to go on and exit on error.
- if the forwarder is not reachable but --no-dnssec-validation is
provided, the installer must continue.

Related to https://pagure.io/freeipa/issue/7666

Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
1d3c308b by Thomas Woerner at 2018-09-05T09:46:31Z
Adapt freeipa.spec.in for latest Fedora, fix python2 ipatests packaging bug

New autoreconf -ivf call before configure

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
cf1301fb by Armando Neto at 2018-09-05T13:14:32Z
Delete empty keytab during client installation

Client installation fails if '/etc/krb5.keytab' exists as a zero-length
file. Deleting empty keytab before proceeding with the installation
fixes the problem.

https://pagure.io/freeipa/issue/7625

Signed-off-by: Armando Neto <abiagion at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
1857dc9d by Stanislav Levin at 2018-09-06T06:22:57Z
Fix render validation items on keypress event at login form

There are many no needed render callings which are performed
on each keypress event at login form. It is enough to update
validation items on "CapsLock" state change.

Fixes: https://pagure.io/freeipa/issue/7679
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
2a227c24 by Florence Blanc-Renaud at 2018-09-06T09:49:53Z
ipa-replica-install: fix pkinit setup

commit 7284097 (Delay enabling services until end of installer)
introduced a regression in replica installation.
When the replica requests a cert for PKINIT, a check is done
to ensure that the hostname corresponds to a machine with a
KDC service enabled (ipaconfigstring attribute of
cn=KDC,cn=<hostname>,cn=masters,cn=ipa,cn=etc,$BASEDN must contain
'enabledService').
With the commit mentioned above, the service is set to enabled only
at the end of the installation.

The fix makes a less strict check, ensuring that 'enabledService'
or 'configuredService' is in ipaconfigstring.

Fixes: https://pagure.io/freeipa/issue/7566
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
bcfd18f3 by Florence Blanc-Renaud at 2018-09-06T09:49:53Z
Tests: test successful PKINIT install on replica

Add a test checking that ipa-replica-install successfully configures
PKINIT on the replica

Related to https://pagure.io/freeipa/issue/7566

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
31a92c16 by Michal Reznik at 2018-09-06T11:49:34Z
tests: sssd_ssh fd leaks when user cert converted into SSH key

https://pagure.io/freeipa/issue/7687

Reviewed-By: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
c29581c9 by Michal Reznik at 2018-09-06T11:49:34Z
add strip_cert_header() to tasks.py

https://pagure.io/freeipa/issue/7687

Reviewed-By: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
c7064494 by Armando Neto at 2018-09-06T12:36:15Z
Fix certificate type error when exporting to file

Commands `ipa ca-show` and `ipa cert-show` share the same code,
this commit updates the former, closing the gap between them.

Reflecting the changes done in 5a44ca638310913ab6b0c239374f4b0ddeeedeb3.

https://pagure.io/freeipa/issue/7628

Signed-off-by: Armando Neto <abiagion at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
6ad11d86 by Florence Blanc-Renaud at 2018-09-06T15:32:48Z
ipa-replica-install: properly use the file store

In ipa-replica-install, many components use their own instance
of the FileStore to backup configuration files to the pre-install
state. This causes issues when the calls are mixed, like for
instance:
ds.do_task1_that_backups_file (using ds.filestore)
http.do_task2_that_backups_file (using http.filestore)
ds.do_task3_that_backups_file (using ds.filestore)

because the list of files managed by ds.filestore does not include
the files managed by http.filestore, and the 3rd call would remove
any file added on 2nd call.

The symptom of this bug is that ipa-replica-install does not save
/etc/httpd/conf.d/ssl.conf and subsequent uninstallation does not
restore the file, leading to a line referring to ipa-rewrite.conf
that prevents httpd startup.

The installer should consistently use the same filestore.

Fixes https://pagure.io/freeipa/issue/7684

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
b2ce20c6 by Florence Blanc-Renaud at 2018-09-06T15:32:48Z
Test: scenario replica install/uninstall should restore ssl.conf

Test that the scenario ipa-replica-install/ uninstall correctly
restores the file /etc/httpd/conf.d/ssl.conf

Related to https://pagure.io/freeipa/issue/7684

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
21f14e98 by Christian Heimes at 2018-09-06T15:39:00Z
Remove Python 2 support and packages

Remove Python 2 related code and configuration from spec file, autoconf
and CI infrastructure. From now on, FreeIPA 4.8 requires at least Python
3.6. Python 2 packages like python2-ipaserver or python2-ipaclient are
no longer available. PR-CI, lint, and tox aren't testing Python 2
compatibility either.

See: https://fedoraproject.org/wiki/Changes/FreeIPA_Python_2_Removal
Fixes: https://pagure.io/freeipa/issue/7568
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
c049992c by Armando Neto at 2018-09-06T15:40:58Z
Add test for client installation with empty keytab file

Missing test case for cf1301fb064fc230c780c4bc5eeccb723899f7b6.

https://pagure.io/freeipa/issue/7625

Signed-off-by: Armando Neto <abiagion at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
fe0cc945 by Michal Reznik at 2018-09-11T13:20:11Z
bump PRCI template version to 0.1.9

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
7da50cf4 by Rob Crittenden at 2018-09-12T08:37:57Z
Update required version of dogtag to detect when FIPS is available

When it was checking for FIPS it assumed that /proc/sys/crypto
existed which it doesn't in some containers and on Ubuntu.

This was updated in dogtag, this change is just to pull in the
fix.

https://pagure.io/freeipa/issue/7608

Reviewed-By: Florence Blanc-Renaud <flo at redhat.com>

- - - - -
6f386f2e by Stanislav Levin at 2018-09-12T08:44:37Z
Fix translation of "unauthorized.html" Web page

Make this page message translatable as other parts of IPA framework.

Fixes: https://pagure.io/freeipa/issue/7640
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c66cdf0b by Stanislav Levin at 2018-09-12T08:44:37Z
Fix translation of "ssbrowser.html" Web page

Make this page message translatable as other parts of IPA framework.

Fixes: https://pagure.io/freeipa/issue/7640
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
4b83227a by Stanislav Levin at 2018-09-12T08:44:37Z
Add basic tests to web pages which are located at /ipa/config/

The goal of these tests is to ensure that the translated text is
synced against a 'noscript' one.

Fixes: https://pagure.io/freeipa/issue/7640
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
0ed3dfb4 by Stanislav Levin at 2018-09-12T10:41:19Z
Replace the direct URL with config's one

To be customizable URL should be placed to "config"

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
4da736e7 by Stanislav Levin at 2018-09-12T10:41:19Z
Add "reset_and_login" view to LoginScreen widget

Previous "reset" view is splitted to "reset" and "reset_and_login"
ones. "reset" is used to render "just reset password" logic. And
"reset_and_login" - "reset password and then log in".

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
3a43bf88 by Stanislav Levin at 2018-09-12T10:41:19Z
Use "login" plugin instead of standalone JS file

Plugin "login" already has the same functionality as a JS code in
separated javascript file. There is no need to duplicate it.

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
30bcad4c by Stanislav Levin at 2018-09-12T10:41:19Z
Clean up reset_password.js file from project

reset_password.js is no longer needed as it's functionality is moved
to "login" plugin.

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
d5c0bae9 by Stanislav Levin at 2018-09-12T10:41:19Z
Fix translations of messages in LoginScreen widget

To be translatable messages should be marked with '@i18n' and
present in "i18n_messages" dictionary.

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
5c32ac3e by Stanislav Levin at 2018-09-12T10:41:19Z
Add "bounce" logic from "reset_password.js"

This should add support for https://pagure.io/freeipa/issue/4440

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
b4885d3e by Stanislav Levin at 2018-09-12T10:41:19Z
Add tests for LoginScreen widget

Add some basic tests for different aspects of LoginScreen such as
'login', 'reset_and_login', 'reset' views.

Fixes: https://pagure.io/freeipa/issue/7619
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
167791f3 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove ipa-replica-prepare script and man page

This is part of the DL0 code removal. As ipa-replica-prepare is only needed
and useful for domain level 0, the script can be removed.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
418da605 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from ipa-ca-install

Replica files are DL0 specific therefore all the code that is related to
replica files have been removed. An additional check for the new minimal
domain level has been added.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
9af0b094 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from cainstance and ca in ipaserver/install

cainstance.replica_ca_install_check is only used in ca.install_check if
replica_config is not None (replica installation). As it is immediately
stopped if promote is not set, therefore it can be removed.

The check for cafile in ca.install_check has been dropped. promote is set
to True in ca.install_step_0 if replica_config is not None for
cainstance.configure_instance.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
db5bff14 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from ipa_kra_install in ipaserver/install

Replica files are DL0 specific therefore all the code that is related to
replica files have been removed An additional check for the new minimal
domain level has been added. The use of extra args results in an error as
this was only needed for the replica file.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
eaae9935 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from dsinstance ipaserver/install

Promote is now hard set to True in create_replica for later use in
_get_replication_manager.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
71e19f11 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from kra in ipaserver/install

The code to add missing KRA certificates has been removed from install_check
as it was only reached if replica_config is not None and promote was False
for DL0 replica installations. Also the other places.

Promote is now hard set to True if replica_config is not None in install
for later use in krainstance.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
ecf80900 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove unused promote arg in krbinstance.create_replica in ipaserver/install

The argument was not used at all.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
ae94aae4 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from ipa_replica_install in ipaserver/install

Replica files are DL0 specific therefore the knob extension for
replica_file has been removed. Also the code that is only executed if
replica_file is not None.

The new variable replica_install has been added which is used in
ServerInstallInterface.__init__

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
f7e1d18d by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from __init__ in ipaserver/install/server

The methods _is_promote has been removed from all classes as this has only
been used internally to check if the domain level is correct.

The check if the installer object has the attribute replica_file has been
modified to use the new variable replica_install defined in
CompatServerReplicaInstall instead.

The DL0 specific code from ServerInstallInterface.__init__ has been removed

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
2738c5c1 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from replicainstall in ipaserver/install/server

create_replica_config is not imported anymore from
ipaserver.install.installutils.

The promote argument has been removed from these functions and function
calls:
- install_replica_ds
- ds.create_replica
- install_krb
- krbinstance.create_replica
- install_http
- httpinstance.create_instance

The function install_check has been removed completely as it is only used
to prepare the DL0 installation.

All DL0 specific code has been removed from the install function.

The varaibles promote, installer.promote/options.promote  and config.promote
have bene removed.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
a42a7113 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove create_replica_config from installutils in ipaserver/install

This function is used to load the replica file. Without DL0 support this
is not needed at all anymore.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
15bf647e by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from custodiainstance in ipaserver/install

iWithout DL0 support the custodia mode can be used to determine if a
server or replica will be installed. Therefore the use of config.promote
can be removed.

A new check has been added to make sure the mode known in
get_custodia_instance.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
842cb5f2 by Thomas Woerner at 2018-09-12T11:11:21Z
Rename CustodiaModes.STANDALONE to CustodiaModes.FIRST_MASTER

This is related to the DL0 code removal. FIRST_MASTER describes this
mode a lot better.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
fbe003f5 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove options.promote from install in ipaserver/install/server/install

There is no need to set options.promote to false anymore for a server
installation in the install function.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
2f50d249 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove replica_file from ClientInstall class in ipaclient/install/client.py

There is no need to set replica_file to None for client installations.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
374138d0 by Thomas Woerner at 2018-09-12T11:11:21Z
Remove replica_file knob from ipalib/install/service.py

The replica_file option is not needed anymore. Threfore the option can
be removed.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
fca1167a by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific tests from ipatests/test_integration/test_replica_promotion.py

These tests have been skipped already before. Therefore they can be removed.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
7eb8695e by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from ipatests/pytest_ipa/integration/tasks.py

The functions get_replica_filename and replica_prepare are not needed anymore
with the DL0 removal. The DL0 specific code has been removed from the
functions install_replica, install_kra and install_ca.

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
b689ba7e by Thomas Woerner at 2018-09-12T11:11:21Z
Remove DL0 specific code from ipatests/test_integration/test_caless.py

See: https://pagure.io/freeipa/issue/7689
Signed-off-by: Thomas Woerner <twoerner at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
c6b3cf6d by Rob Crittenden at 2018-09-12T14:43:06Z
Advise plugin for enabling sudo for members of the admins group

Create HBAC and a sudo rule for allowing members of the admins
group to run sudo on all enrolled hosts.

https://pagure.io/freeipa/issue/7538

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
09750589 by Stanislav Levin at 2018-09-18T11:51:51Z
Drop concatenated title of remove dialog

As for now the default title of remove dialogs is set to
'Remove ${entity}', where 'entity' is also translatable text.
This construction is used via method 'create_remove_dialog'
of Search facet for the all association 'Delete' actions of
entities.

The such concatenation leads to a bad quality translation and
should be changed to an entire sentence.

>From now a mentioned title is taken from a spec and should be
specified explicitly.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
5eea5354 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Users' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
3921210d by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Hosts' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
3c26a3b8 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Services' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
d06f4984 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Groups' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
d23376f5 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'ID Views' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
2d9cdd92 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Automember' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
46018680 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'HBAC' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
b5073e96 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Sudo' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
772e096d by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'SELinux User Maps' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
8d13d4ef by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Password Policies' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
dfd22e74 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Certificates' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
93eebdb5 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'OTP Tokens' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
36bfd1f8 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'RADIUS Servers' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
dcd90343 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Certificate Identity Mapping Rules' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
a863cec3 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Automount Locations' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
d5979fb2 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'DNS' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
855e138a by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'RBAC' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
1f391b7c by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'ID Ranges' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
291ea453 by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Topology' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
3e1a4a1d by Stanislav Levin at 2018-09-18T11:51:51Z
Add title to remove dialog of 'Trusts' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7699
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
7729bb73 by Florence Blanc-Renaud at 2018-09-19T08:13:15Z
ipa-advise: configure pam_cert_auth=True for smart card on client

ipa-advise config-client-for-smart-card-auth is now using authselect
instead of authconfig, but authselect enable-feature with-smartcard
does not set pam_cert_auth=True in /etc/sssd/sssd.conf.
As a result, smart card auth on a client fails.
The fix adds a step in ipa-advise to configure pam_cert_auth=True.

The fix also forces the use of python3 interpreter, and handles
newer versions of SSSD which use OpenSSL instead of NSS (the trusted
CA certs must be put into /etc/sssd/pki/sssd_auth_ca_db.pem

Fixes https://pagure.io/freeipa/issue/7532

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
d0173c95 by Florence Blanc-Renaud at 2018-09-19T08:18:45Z
authselect: harden uninstallation of ipa client

When ipa client is uninstalled, the content of sysrestore.state
is read to restore the previous authselect profile and features.
The code should properly handle the case where sysrestore.state
contains the header for the authselect section, but the key=value
for profile and features are missing.

Fixes https://pagure.io/freeipa/issue/7657

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
1a7e4b0e by Florence Blanc-Renaud at 2018-09-19T08:18:45Z
tests: add test for uninstall with incomplete sysrestore.state

Add a test that performs client uninstallation when sysrestore.state
contains the header for the [authselect] section but does not
contain a value for profile and features.

Related to https://pagure.io/freeipa/issue/7657

Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
2b3fd701 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Fix hardcoded CSR in test_webui/test_cert.py

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
95928f62 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Use random IPs and domains in test_webui/test_host.py

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
1212402a by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Increase request timeout for WebUI tests

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
d582484b by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Fix test_realmdomains::test_add_single_labeled_domain (Web UI test)

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
1f04c481 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Use random realmdomains in test_webui/test_realmdomains.py

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
685cef55 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Fix test_user::test_login_without_username (Web UI test)

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
41258d81 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Fix unpermitted user session in test_selfservice (Web UI test)

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
2b739701 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Add SAN extension for CSR generation in test_cert (Web UI tests)

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
b58bc750 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Generate CSR for test_host::test_certificates (Web UI test)

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
93eafaec by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Add cookies clearing for all Web UI tests

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
970af640 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Remove unnecessary session clearing in some Web UI tests

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
1affddaa by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Increase some timeouts in Web UI tests

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
46eb9a38 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Fix UI_driver.has_class exception. Handle situation when element has no class attribute

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
d020fc49 by Serhii Tsymbaliuk at 2018-09-19T11:32:51Z
Change Web UI tests setup flow

Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>
Reviewed-By: Petr Vobornik <pvoborni at redhat.com>

- - - - -
e3820682 by Rob Crittenden at 2018-09-19T15:42:49Z
Try to resolve the name passed into the password reader to a file

Rather than comparing the value passed in by Apache to a
hostname value just see if there is a file of that name in
/var/lib/ipa/passwds.

Use realpath to see if path information was passed in as one of
the options so that someone can't try to return random files from
the filesystem.

https://pagure.io/freeipa/issue/7528

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
2064c72b by Rob Crittenden at 2018-09-21T08:21:14Z
Fix uninstallation test, use different method to stop dirsrv

The API may not be initialized so using ds.is_running() may fail.
Call systemctl directly to ensure the dirsrv instance is stopped.

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
11b3cdff by Rob Crittenden at 2018-09-21T08:21:14Z
Add uninstallation tests to night master and rawhide

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>
Reviewed-By: Michal Reznik <mreznik at redhat.com>

- - - - -
24888132 by Florence Blanc-Renaud at 2018-09-24T06:42:40Z
ipatests: mark known failures as xfail

The tests in test_integration/test_installation.py
that inherit from InstallTestBase2 all fail in
test_replica2_ipa_kra_install because of ticket
7654: ipa-kra-install fails on DL1

This is an issue linked to dogtag (see
https://pagure.io/dogtagpki/issue/3055), where the
installation of a KRA clone creates a range depletion
when multiple clones are created from the same master.

Marking the tests as known failure, waiting for dogtag's
fix.

Related to https://pagure.io/freeipa/issue/7654

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
288fe328 by Florence Blanc-Renaud at 2018-09-24T10:55:48Z
Tests: remove dl0 tests from nightly definition

Commit fca1167af48651c3454c33c77ef28ec333220040 removed the following tests
from ipatests/test_integration/test_replica_promotion.py:
TestReplicaPromotionLevel0
TestKRAInstall
TestCAInstall
TestReplicaManageCommands
TestOldReplicaWorksAfterDomainUpgrade
but the nightly definition was not updated accordingly.
The fix removes the unexisting tests from nightly.

Related to https://pagure.io/freeipa/issue/7689

Reviewed-By: Tibor Dudlak <tdudlak at redhat.com>

- - - - -
ca68848e by Stanislav Levin at 2018-09-25T13:16:05Z
Drop concatenated title of remove dialog

As for now the default title of remove dialogs, which are
initialized from 'association' facet, is set to something like
'Remove ${other_entity} from ${entity} ${primary_key}', where
'other_entity' and 'entity' are also translatable texts.
This construction is used via method 'show_remove_dialog'
of 'association' facet for the all 'Delete' actions within details
of entities.

Such concatenation leads to a bad quality translation and
should be changed to an entire sentence.

>From now a mentioned title is taken from a spec and should be
specified explicitly.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
35fa528c by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Users' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
d97ff69e by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Hosts' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c4729e11 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Services' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
6e839f91 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Groups' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
ea0e6a36 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'HBAC' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
db6462b8 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Sudo' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
f741c62f by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'OTP Tokens' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
71594466 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'RBAC' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
9cbf16a7 by Stanislav Levin at 2018-09-25T13:16:05Z
Add a title to 'remove' dialog for details of 'Trusts' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7702
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
70349753 by Alexander Bokovoy at 2018-09-26T09:40:19Z
Support Samba 4.9

Samba 4.9 became a bit more strict about creating a local NT token and a
failure to resolve or create BUILTIN\Guests group will cause a rejection
of the connection for a successfully authenticated one.

Add a default mapping of the nobody group to BUILTIN\Guests.

BUILTIN\Guests is a special group SID that is added to the NT token for
authenticated users.

For real guests there is 'guest account' option in smb.conf which
defaults to 'nobody' user.

This was implicit behavior before as 'guest account = nobody' by
default would pick up 'nobody' group as well.

Fixes: https://pagure.io/freeipa/issue/7705
Reviewed-By: Rob Crittenden <rcritten at redhat.com>

- - - - -
0659ed35 by Florence Blanc-Renaud at 2018-09-26T09:44:21Z
ipa-server-upgrade: fix inconsistency in setup_lightweight_ca_key_retrieval

The method setup_lightweight_ca_key_retrieval is called on
server upgrade and checks first if it needs to be executed or if
a previous upgrade already did the required steps.
The issue is that it looks for setup_lwca_key_retrieval in sysupgrade.state
but writes setup_lwca_key_retieval (with a missing r).

The fix consistently uses setup_lwca_key_retieval (as older installations
may already contain this key in sysupgrade.state).

Fixes https://pagure.io/freeipa/issue/7688

Reviewed-By: Fraser Tweedale <ftweedal at redhat.com>

- - - - -
4460cc5e by Rob Crittenden at 2018-09-26T11:26:42Z
Fix identifier typo in UI

Signed-off-by: Rob Crittenden <rcritten at redhat.com>
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
f658a3d1 by Stanislav Levin at 2018-09-26T11:50:11Z
Fix loading 'freeipa/text' at production mode

As for now 'ssbrowser.html' and 'unauthorized.html' pages are
loaded without JS error at development mode only.

There is no standalone 'freeipa/text' module as source at
production mode. Thus 'core' one have to be loaded first and
then 'text'.

Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
43d9eda9 by Stanislav Levin at 2018-09-26T11:56:53Z
Drop concatenated title of remove dialog

As for now the default title of remove dialogs, which are
initialized from 'association_table' facet, is set to something
like 'Remove ${other_entity} from ${entity} ${primary_key}',
where 'other_entity' and 'entity' are also translatable texts.
This construction is used via method 'show_remove_dialog'
of 'association_table' widget for the all 'Delete' actions within
details of entities.

Such concatenation leads to a bad quality translation and
should be changed to an entire sentence.

>From now a mentioned title is taken from a spec and should be
specified explicitly.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
4b8509f9 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'remove' dialog for 'association_table' widget of 'Hosts' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
0825170a by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'remove' dialog for 'association_table' widget of 'Services' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
79aa5920 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'remove' dialog for 'association_table' widget of 'Groups' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c2e6e010 by Stanislav Levin at 2018-09-26T11:56:53Z
Allow having a custom title of 'Remove' dialog for 'attribute_table' widget

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
8657b57a by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'Automember' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
1fd6817b by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'HBAC' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c2eebee3 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'Sudo' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c115efd1 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'SELinux' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
ea115bf8 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'CA' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
6eed6776 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'Topology' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
57e65a5c by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'Remove' dialog for 'association_table' widget of 'Vault' entity

To improve translation quality the title of 'Remove' dialog,
which is initialized within details table of the entity, should be
specified explicitly in the spec and should be an entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
6b27c203 by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to 'unprovision' dialog

To improve translation quality the title of 'unprovision' dialog
should be specified explicitly in the spec and should be an entire
sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
5052641a by Stanislav Levin at 2018-09-26T11:56:53Z
Add title to remove dialog of 'DNS' entity

To improve translation quality the title of Remove dialog
should be specified explicitly in the spec and should be an
entire sentence.

Fixes: https://pagure.io/freeipa/issue/7704
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
e1a30d3c by Christian Heimes at 2018-09-27T04:55:34Z
Workaround for pyasn1 0.4

pyasn1 0.4 changed handling of ANY containers in a backwards
incompatible way. For 0.3.x, keep explicit wrap and unwrap in octet
strings for ANY container members. For >= 0.4, let pyasn1 do the job.

This patch also makes sorting of extended_key_usage_bytes() stable and
adds tests.

Tested with pyasn1 0.3.7 and 0.4.4.

Fixes: https://pagure.io/freeipa/issue/7685
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal at redhat.com>

- - - - -
4a58adf7 by Christian Heimes at 2018-09-27T08:23:03Z
Sprinkle raw strings across the code base

tox / pytest is complaining about lots and lots of invalid escape
sequences in our code base. Sprinkle raw strings or backslash escapes
across the code base to fix most occurences of:

  DeprecationWarning: invalid escape sequence

There is still one warning that keeps repeating, though:

  source:264: DeprecationWarning: invalid escape sequence \d

Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
b431e9b6 by Christian Heimes at 2018-09-27T09:49:04Z
Py3: Remove subclassing from object

Python 2 had old style and new style classes. Python 3 has only new
style classes. There is no point to subclass from object any more.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
78c722d4 by Christian Heimes at 2018-09-27T13:35:35Z
Require sssd-ipa instead of sssd meta pkg

The sssd meta package pulls in additional dependencies that are not
required by IPA clients. Only depend on sssd-ipa.

Also update SSSD to 1.16.3-2 with fixes with support for One-Way Trust
authenticated by trust secret.

See: https://bugzilla.redhat.com/show_bug.cgi?id=1345975
See: https://pagure.io/freeipa/issue/7710
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy at redhat.com>

- - - - -
964a9bdc by Christian Heimes at 2018-09-27T14:11:18Z
Py3: Replace six.string_types with str

In Python 3, six.string_types is just an alias for str.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
ea396528 by Christian Heimes at 2018-09-27T14:11:18Z
Py3: Replace six.integer_types with int

In Python 3, six.integer_types is (int,). In most places, the alias can
be simply replaced with int. In other places, it was possible to
simplify the code by unpacking the tuple.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
61156b0a by Christian Heimes at 2018-09-27T14:11:18Z
Py3: Replace six.text_type with str

On Python 3, six.text_type (singular) is an alias for str.

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
ed967ec2 by Christian Heimes at 2018-09-27T14:11:18Z
Py3: Replace six.bytes_type with bytes

See: https://pagure.io/freeipa/issue/7715
Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
54765474 by Stanislav Levin at 2018-09-27T14:33:25Z
Fix javascript 'errors' found by jslint

There are several JavaScript errors, which have come with PRs:
2362, 2371, 2372.

JavaScript code have to follow jsl requires.

Fixes: https://pagure.io/freeipa/issue/7717
Fixes: https://pagure.io/freeipa/issue/7718
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
54a0e9e9 by Stanislav Levin at 2018-09-27T14:33:25Z
Add jslint check to PR CI tests

For now, from all possible lint checks, pylint applies only.
jslint can prevent JavaScript errors at WebUI.

Fixes: https://pagure.io/freeipa/issue/7717
Fixes: https://pagure.io/freeipa/issue/7718
Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
5dbcc1a9 by Florence Blanc-Renaud at 2018-09-28T08:27:18Z
ipatests: mark known failure for installation_TestInstallWithCA2

The test TestInstallWithCA2 and TestInstallWithCA_DNS2 fail in
test_replica0_with_ca_kra_dns_install because they both try to
install a (first instance of) KRA.

This is a known issue, thus marking as xfail.

Related to https://pagure.io/freeipa/issue/7651

Reviewed-By: Christian Heimes <cheimes at redhat.com>

- - - - -
4b60bc38 by Christian Heimes at 2018-10-01T06:30:10Z
Lint yaml and RPM spec

Let's catch broken YAML files (Travis, PR-CI) and spec file early.

- Use rpmlint to detect syntax errors in spec file early
- Attempt to parse all YAML files with PyYAML

Signed-off-by: Christian Heimes <cheimes at redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud at redhat.com>

- - - - -
234c71ca by Stanislav Levin at 2018-10-01T08:28:14Z
Drop concatenated title of 'add' dialog

As for now the default title of 'add' dialog is set to something
like 'Add ${entity}', where 'entity' is also translatable text.
Such construction is used via method 'adder_dialog' of Entity
for the all 'Add' actions.

This leads to a bad quality translation and should be changed to
an entire sentence.

>From now a mentioned title is taken from a spec and should be
specified explicitly.

Fixes: https://pagure.io/freeipa/issue/7707
Reviewed-By: Serhii Tsymbaliuk <stsymbal at redhat.com>

- - - - -
c6221a51 by Stanislav Levin at 2018-10-01T08:28:14Z
Add title to 'add' dialog for 'Users' entity