pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone
99b6f7
# Define ONLY_CLIENT to only make the ipa-client and ipa-python subpackages
99b6f7
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
99b6f7
99b6f7
%ifarch x86_64 %{ix86}
99b6f7
# Nothing, we want to force just building client on non-Intel
99b6f7
%else
99b6f7
%global ONLY_CLIENT 1
99b6f7
%endif
99b6f7
99b6f7
%global plugin_dir %{_libdir}/dirsrv/plugins
99b6f7
%global POLICYCOREUTILSVER 2.1.14-37
99b6f7
%global gettext_domain ipa
99b6f7
%global VERSION 3.3.3
99b6f7
9991ea
%if (0%{?fedora} > 15 || 0%{?rhel} >= 7)
9991ea
%define _hardened_build 1
9991ea
%endif
9991ea
99b6f7
Name:           ipa
99b6f7
Version:        3.3.3
031d60
Release:        28%{?dist}.1
99b6f7
Summary:        The Identity, Policy and Audit system
99b6f7
99b6f7
Group:          System Environment/Base
99b6f7
License:        GPLv3+
99b6f7
URL:            http://www.freeipa.org/
99b6f7
Source0:        http://www.freeipa.org/downloads/src/freeipa-%{VERSION}.tar.gz
99b6f7
Source1:        rh-ipabanner.png
99b6f7
BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
99b6f7
99b6f7
Patch0001:      0001-Guard-import-of-adtrustinstance-for-case-without-tru.patch
99b6f7
Patch0002:      0002-Server-does-not-detect-different-server-and-IPA-doma.patch
99b6f7
Patch0003:      0003-Allow-kernel-keyring-CCACHE-when-supported.patch
99b6f7
Patch0004:      0004-Fix-regression-which-prevents-creating-a-winsync-agr.patch
99b6f7
Patch0005:      0005-trusts-Do-not-pass-base-id-to-the-subdomain-ranges.patch
99b6f7
Patch0006:      0006-Map-NT_STATUS_INVALID_PARAMETER-to-most-likely-error.patch
9991ea
Patch0007:      0007-Remove-mod_ssl-port-workaround.patch
9991ea
Patch0008:      0008-subdomains-Use-AD-admin-credentials-when-trust-is-be.patch
9991ea
Patch0009:      0009-trusts-Always-stop-and-disable-smb-service-on-uninst.patch
9991ea
Patch0010:      0010-Use-hardening-flags-for-ipa-optd.patch
9991ea
Patch0011:      0011-test_integration-Support-external-names-for-hosts.patch
9991ea
Patch0012:      0012-ipa-client-install-Always-pass-hostname-to-the-ipa-j.patch
9991ea
Patch0013:      0013-trust-fix-get_dn-to-distinguish-creating-and-re-addi.patch
9991ea
Patch0014:      0014-ipa-cldap-Cut-NetBIOS-name-after-15-characters.patch
9991ea
Patch0015:      0015-Prevent-garbage-from-readline-on-standard-output-of-.patch
9991ea
Patch0016:      0016-Do-not-build-tests.patch
9991ea
Patch0017:      0017-PKI-service-restart-after-CA-renewal-failed.patch
9991ea
Patch0018:      0018-hbactest-does-not-work-for-external-users.patch
9991ea
Patch0019:      0019-Change-the-way-we-determine-if-the-host-has-a-passwo.patch
9991ea
Patch0020:      0020-sudoOrder-missing-in-sudoers.patch
9991ea
Patch0021:      0021-Add-missing-example-to-sudorule.patch
9991ea
Patch0022:      0022-Fix-ipa-client-automount-uninstall-when-fstore-is-em.patch
9991ea
Patch0023:      0023-trust-fetch-domains-create-ranges-for-new-child-doma.patch
9991ea
Patch0024:      0024-trustdomain-find-report-status-of-the-sub-domain.patch
9991ea
Patch0025:      0025-CLDAP-do-not-prepend.patch
9991ea
Patch0026:      0026-ipaserver-install-installutils-clean-up-properly-aft.patch
9991ea
Patch0027:      0027-Do-not-start-the-service-in-stopped_service-if-it-wa.patch
9991ea
Patch0028:      0028-Harmonize-policy-discovery-to-kdb-driver.patch
9991ea
Patch0029:      0029-Stop-adding-a-default-password-policy-reference.patch
9991ea
Patch0030:      0030-Increase-service-startup-timeout-default.patch
9991ea
Patch0031:      0031-cli.print_attribute-Convert-values-to-strings.patch
9991ea
Patch0032:      0032-group-show-resolve-external-members-of-the-groups.patch
9991ea
Patch0033:      0033-Remove-SID-resolve-call-from-Web-UI.patch
9991ea
Patch0034:      0034-ipa-adtrust-install-configure-host-netbios-name-by-d.patch
9991ea
Patch0035:      0035-Remove-missing-VERSION-warning-in-dnsrecord-mod.patch
9991ea
Patch0036:      0036-Hide-trust-resolve-command.patch
9991ea
Patch0037:      0037-Trust-domains-Web-UI.patch
9991ea
Patch0038:      0038-ipasam-delete-trusted-child-domains-before-removing-.patch
9991ea
Patch0039:      0039-CLDAP-generate-NetBIOS-name-like-ipa-adtrust-install.patch
9991ea
Patch0040:      0040-Fallback-to-global-policy-in-ipa-lockout-plugin.patch
9991ea
Patch0041:      0041-Migration-does-not-add-users-to-default-group.patch
9991ea
Patch0042:      0042-ipa-lockout-do-not-fail-when-default-realm-cannot-be.patch
9991ea
Patch0043:      0043-ipa-tool-Print-the-name-of-the-server-we-are-connect.patch
9991ea
Patch0044:      0044-Remove-sourcehostcategory-from-the-default-HBAC-rule.patch
9991ea
Patch0045:      0045-DNS-classless-support-for-reverse-domains.patch
9991ea
Patch0046:      0046-Move-ipa-otpd-socket-directory.patch
9991ea
Patch0047:      0047-bindinstance-make-sure-zone-manager-is-initialized-i.patch
9991ea
Patch0048:      0048-trustdomain_find-make-sure-we-skip-short-entries-whe.patch
9991ea
Patch0049:      0049-ipa-kdb-in-case-of-delegation-use-original-client-s-.patch
9991ea
Patch0050:      0050-ipa-kdb-make-sure-we-don-t-produce-MS-PAC-in-case-of.patch
9991ea
Patch0051:      0051-Too-big-font-in-input-fields.patch
9991ea
Patch0052:      0052-trust-make-sure-we-always-discover-topology-of-the-f.patch
9991ea
Patch0053:      0053-ipaserver-dcerpc-catch-the-case-of-insuffient-permis.patch
9991ea
Patch0054:      0054-fix-filtering-of-subdomain-based-trust-users.patch
9991ea
Patch0055:      0055-ipa-kdb-do-not-fetch-client-principal-if-it-is-the-s.patch
9991ea
Patch0056:      0056-ipa-replica-install-never-checks-for-7389-port.patch
9991ea
Patch0057:      0057-Avoid-passing-non-terminated-string-to-is_master_hos.patch
9991ea
Patch0058:      0058-ipa-sam-cache-gid-to-sid-and-uid-to-sid-requests-in-.patch
9991ea
Patch0059:      0059-ipaserver-dcerpc-make-sure-to-always-return-unicode-.patch
9991ea
Patch0060:      0060-trust-do-not-fetch-subdomains-in-case-shared-secret-.patch
9991ea
Patch0061:      0061-Update-Dogtag-9-database-during-replica-installation.patch
9991ea
Patch0062:      0062-Prohibit-deletion-of-active-subdomain-range.patch
9991ea
Patch0063:      0063-extdom-do-not-return-results-from-the-wrong-domain.patch
9991ea
Patch0064:      0064-Proxy-PKI-clone-ca-ee-ca-profileSubmit-URI.patch
9991ea
Patch0065:      0065-Make-ipa-client-automount-backwards-compatible.patch
031d60
Patch0066:      0066-Convert-external-CA-chain-to-PKCS-7-before-passing-i.patch
99b6f7
99b6f7
Patch1001:      1001-Hide-pkinit-functionality-from-production-version.patch
99b6f7
Patch1002:      1002-Remove-pkinit-plugin.patch
99b6f7
Patch1003:      1003-Remove-pkinit-references-from-tool-man-pages.patch
99b6f7
Patch1004:      1004-Change-branding-to-IPA-and-Identity-Management.patch
99b6f7
Patch1005:      1005-Remove-pylint-from-build-process.patch
99b6f7
Patch1006:      1006-Remove-i18test-from-build-process.patch
9991ea
Patch1007:      1007-Remove-ipa-backup-and-ipa-restore-functionality.patch
3f6981
Patch1008:      ipa-centos-branding.patch
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
BuildRequires:  389-ds-base-devel >= 1.3.1
99b6f7
BuildRequires:  svrcore-devel
99b6f7
BuildRequires:  policycoreutils >= %{POLICYCOREUTILSVER}
99b6f7
BuildRequires:  systemd-units
99b6f7
BuildRequires:  samba-devel >= 4.0.5-1
99b6f7
BuildRequires:  samba-python
99b6f7
BuildRequires:  libwbclient-devel
99b6f7
BuildRequires:  libtalloc-devel
99b6f7
BuildRequires:  libtevent-devel
99b6f7
%endif # ONLY_CLIENT
99b6f7
BuildRequires:  nspr-devel
99b6f7
BuildRequires:  nss-devel
99b6f7
BuildRequires:  openssl-devel
99b6f7
BuildRequires:  openldap-devel
99b6f7
BuildRequires:  krb5-devel >= 1.11
99b6f7
BuildRequires:  krb5-workstation
99b6f7
BuildRequires:  libuuid-devel
99b6f7
BuildRequires:  libcurl-devel >= 7.21.7-2
99b6f7
BuildRequires:  xmlrpc-c-devel >= 1.27.4
99b6f7
BuildRequires:  popt-devel
99b6f7
BuildRequires:  autoconf
99b6f7
BuildRequires:  automake
99b6f7
BuildRequires:  m4
99b6f7
BuildRequires:  libtool
99b6f7
BuildRequires:  gettext
99b6f7
BuildRequires:  python-devel
99b6f7
BuildRequires:  python-ldap
99b6f7
BuildRequires:  python-setuptools
99b6f7
BuildRequires:  python-krbV
99b6f7
BuildRequires:  python-nss
99b6f7
BuildRequires:  python-netaddr
99b6f7
BuildRequires:  python-kerberos
99b6f7
BuildRequires:  python-rhsm
99b6f7
BuildRequires:  pyOpenSSL
99b6f7
BuildRequires:  libipa_hbac-python
99b6f7
BuildRequires:  python-memcached
99b6f7
BuildRequires:  sssd >= 1.9.2
99b6f7
BuildRequires:  python-lxml
99b6f7
BuildRequires:  python-pyasn1 >= 0.0.9a
99b6f7
BuildRequires:  python-dns
99b6f7
BuildRequires:  m2crypto
99b6f7
BuildRequires:  check
99b6f7
BuildRequires:  libsss_idmap-devel
99b6f7
BuildRequires:  libsss_nss_idmap-devel
99b6f7
BuildRequires:  java-1.7.0-openjdk
031d60
BuildRequires:  rhino
99b6f7
BuildRequires:  libverto-devel
99b6f7
BuildRequires:  systemd
99b6f7
BuildRequires:  libunistring-devel
99b6f7
BuildRequires:  diffstat
99b6f7
99b6f7
# Find out Kerberos middle version to infer ABI changes in DAL driver
99b6f7
# We cannot load DAL driver into KDC with wrong ABI.
99b6f7
# This is also needed to support ipa-devel repository where krb5 1.11 is available for F18
99b6f7
%global krb5_dal_version %{expand:%(echo "#include <kdb.h>"|cpp -dM|grep KRB5_KDB_DAL_MAJOR_VERSION|cut -d' ' -f3)}
99b6f7
99b6f7
%description
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof).
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%package server
99b6f7
Summary: The IPA authentication server
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: %{name}-client = %{version}-%{release}
99b6f7
Requires: %{name}-admintools = %{version}-%{release}
99b6f7
Requires: 389-ds-base >= 1.3.1.3
99b6f7
Requires: openldap-clients > 2.4.35-4
99b6f7
Requires: nss >= 3.14.3-12.0
99b6f7
Requires: nss-tools >= 3.14.3-12.0
99b6f7
%if 0%{?krb5_dal_version} >= 4
9991ea
Requires: krb5-server >= 1.11.3-46
99b6f7
%else
99b6f7
%if 0%{krb5_dal_version} == 3
99b6f7
# krb5 1.11 bumped DAL interface major version, a rebuild is needed
99b6f7
Requires: krb5-server < 1.11
99b6f7
Requires: krb5-server >= 1.10
99b6f7
%else
99b6f7
Requires: krb5-server >= 1.10
99b6f7
%endif
99b6f7
%endif
99b6f7
Requires: krb5-pkinit-openssl
99b6f7
Requires: cyrus-sasl-gssapi%{?_isa}
99b6f7
Requires: ntp
9991ea
Requires: httpd >= 2.4.6-7
99b6f7
Requires: mod_wsgi
99b6f7
Requires: mod_auth_kerb >= 5.4-16
9991ea
Requires: mod_nss >= 1.0.8-26
99b6f7
Requires: python-ldap
99b6f7
Requires: python-krbV
99b6f7
Requires: acl
99b6f7
Requires: python-pyasn1
99b6f7
Requires: memcached
99b6f7
Requires: python-memcached
99b6f7
Requires: systemd-units >= 38
99b6f7
Requires(pre): systemd-units
99b6f7
Requires(post): systemd-units
99b6f7
Requires: selinux-policy >= 3.12.1-65
99b6f7
Requires(post): selinux-policy-base
99b6f7
Requires: slapi-nis >= 0.47.7
99b6f7
Requires: pki-ca >= 10.0.4
99b6f7
Requires(preun): python systemd-units
99b6f7
Requires(postun): python systemd-units
99b6f7
Requires: python-dns
99b6f7
Requires: zip
99b6f7
Requires: policycoreutils >= %{POLICYCOREUTILSVER}
99b6f7
Requires: tar
99b6f7
Requires(pre): certmonger >= 0.65
99b6f7
Requires(pre): 389-ds-base >= 1.3.1.3
99b6f7
99b6f7
# We have a soft-requires on bind. It is an optional part of
99b6f7
# IPA but if it is configured we need a way to require versions
99b6f7
# that work for us.
99b6f7
Conflicts: bind-dyndb-ldap < 3.5
99b6f7
Conflicts: bind < 9.8.2-0.4.rc2
99b6f7
99b6f7
# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to
99b6f7
# member.
99b6f7
Conflicts: nss-pam-ldapd < 0.8.4
99b6f7
9991ea
# ipa-tests subpackage was moved to separate srpm
9991ea
Conflicts: ipa-tests < 3.3.3-9
9991ea
99b6f7
%description server
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If you are installing an IPA server you need
99b6f7
to install this package (in other words, most people should NOT install
99b6f7
this package).
99b6f7
99b6f7
99b6f7
%package server-trust-ad
99b6f7
Summary: Virtual package to install packages required for Active Directory trusts
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-server = %version-%release
99b6f7
Requires: m2crypto
99b6f7
Requires: samba-python
99b6f7
Requires: samba >= 4.0.5-1
99b6f7
Requires: samba-winbind
99b6f7
Requires: libsss_idmap
99b6f7
Requires: libsss_nss_idmap-python
99b6f7
# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5
99b6f7
# on the installes where server-trust-ad subpackage is installed because
99b6f7
# IPA AD trusts cannot be used at the same time with the locator plugin
99b6f7
# since Winbindd will be configured in a different mode
99b6f7
Requires(post): %{_sbindir}/update-alternatives
99b6f7
Requires(post): python
99b6f7
Requires(postun): %{_sbindir}/update-alternatives
99b6f7
Requires(preun): %{_sbindir}/update-alternatives
99b6f7
99b6f7
%description server-trust-ad
99b6f7
Cross-realm trusts with Active Directory in IPA require working Samba 4
99b6f7
installation. This package is provided for convenience to install all required
99b6f7
dependencies at once.
99b6f7
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
99b6f7
%package client
99b6f7
Summary: IPA authentication for use on clients
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: python-ldap
99b6f7
Requires: cyrus-sasl-gssapi%{?_isa}
99b6f7
Requires: ntp
99b6f7
Requires: krb5-workstation
99b6f7
Requires: authconfig
99b6f7
Requires: pam_krb5
99b6f7
Requires: wget
99b6f7
Requires: libcurl >= 7.21.7-2
99b6f7
Requires: xmlrpc-c >= 1.27.4
99b6f7
Requires: sssd >= 1.11.1
99b6f7
Requires: certmonger >= 0.65
99b6f7
Requires: nss-tools
99b6f7
Requires: bind-utils
99b6f7
Requires: oddjob-mkhomedir
99b6f7
Requires: python-krbV
99b6f7
Requires: python-dns
99b6f7
Requires: libsss_autofs
99b6f7
Requires: autofs
99b6f7
Requires: libnfsidmap
99b6f7
Requires: nfs-utils
99b6f7
Requires(post): policycoreutils
99b6f7
99b6f7
%description client
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If your network uses IPA for authentication,
99b6f7
this package should be installed on every client machine.
99b6f7
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%package admintools
99b6f7
Summary: IPA administrative tools
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: %{name}-client = %{version}-%{release}
99b6f7
Requires: python-krbV
99b6f7
Requires: python-ldap
99b6f7
99b6f7
%description admintools
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). This package provides command-line tools for
99b6f7
IPA administrators.
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%package python
99b6f7
Summary: Python libraries used by IPA
99b6f7
Group: System Environment/Libraries
99b6f7
Requires: python-kerberos
99b6f7
Requires: gnupg
99b6f7
Requires: iproute
99b6f7
Requires: keyutils
99b6f7
Requires: pyOpenSSL
99b6f7
Requires: python-nss
99b6f7
Requires: python-lxml
99b6f7
Requires: python-netaddr
99b6f7
Requires: libipa_hbac-python
99b6f7
99b6f7
%description python
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If you are using IPA you need to install this
99b6f7
package.
99b6f7
99b6f7
%prep
99b6f7
# RHEL spec file only: START
99b6f7
# Update timestamps on the files touched by a patch, to avoid non-equal
99b6f7
# .pyc/.pyo files across the multilib peers within a build, where "Level"
99b6f7
# is the patch prefix option (e.g. -p1)
99b6f7
# Taken from specfile for sssd and python-simplejson
99b6f7
UpdateTimestamps() {
99b6f7
  Level=$1
99b6f7
  PatchFile=$2
99b6f7
99b6f7
  # Locate the affected files:
99b6f7
  for f in $(diffstat $Level -l $PatchFile); do
99b6f7
    # Set the files to have the same timestamp as that of the patch:
99b6f7
    touch -r $PatchFile $f
99b6f7
  done
99b6f7
}
99b6f7
99b6f7
%setup -n freeipa-%{VERSION} -q
99b6f7
99b6f7
for p in %patches ; do
99b6f7
    %__patch -p1 -i $p
99b6f7
    UpdateTimestamps -p1 $p
99b6f7
done
99b6f7
# RHEL spec file only: END
99b6f7
99b6f7
%build
9991ea
export CFLAGS="%{optflags} $CFLAGS"
9991ea
export LDFLAGS="%{__global_ldflags} $LDFLAGS"
99b6f7
# use fedora18 platform which is based on fedora16 platform with systemd
99b6f7
# support + fedora18 changes
99b6f7
export SUPPORTED_PLATFORM=fedora18
99b6f7
# Force re-generate of platform support
99b6f7
rm -f ipapython/services.py
99b6f7
make version-update
99b6f7
cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..
99b6f7
cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
99b6f7
%else
99b6f7
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%install
99b6f7
rm -rf %{buildroot}
99b6f7
# use fedora18 platform which is based on fedora16 platform with systemd
99b6f7
# support + fedora18 changes
99b6f7
export SUPPORTED_PLATFORM=fedora18
99b6f7
# Force re-generate of platform support
99b6f7
rm -f ipapython/services.py
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
make install DESTDIR=%{buildroot}
99b6f7
# Start RHEL-7.0: Red Hat's Identity Management branding
99b6f7
cp %SOURCE1 %{buildroot}%{_usr}/share/ipa/ui/images/ipa-banner.png
99b6f7
# End RHEL-7.0
99b6f7
%else
99b6f7
make client-install DESTDIR=%{buildroot}
99b6f7
%endif # ONLY_CLIENT
99b6f7
%find_lang %{gettext_domain}
99b6f7
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
# Remove .la files from libtool - we don't want to package
99b6f7
# these files
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_range_check.la
99b6f7
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
99b6f7
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
99b6f7
99b6f7
# Some user-modifiable HTML files are provided. Move these to /etc
99b6f7
# and link back.
99b6f7
mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysupgrade
99b6f7
mkdir %{buildroot}%{_usr}/share/ipa/html/
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig.js \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ffconfig.js
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig_page.js \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ffconfig_page.js
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ssbrowser.html
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/unauthorized.html
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/browserconfig.html
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ipa_error.css \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ipa_error.css
99b6f7
99b6f7
# So we can own our Apache configuration
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
99b6f7
mkdir -p %{buildroot}%{_usr}/share/ipa/html/
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/configure.jar
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/preferences.html
99b6f7
mkdir -p %{buildroot}%{_initrddir}
99b6f7
mkdir %{buildroot}%{_sysconfdir}/sysconfig/
99b6f7
install -m 644 init/ipa_memcached.conf %{buildroot}%{_sysconfdir}/sysconfig/ipa_memcached
99b6f7
99b6f7
# Web UI plugin dir
99b6f7
mkdir -p %{buildroot}%{_usr}/share/ipa/ui/js/plugins
99b6f7
99b6f7
# NOTE: systemd specific section
99b6f7
mkdir -p %{buildroot}%{_prefix}/lib/tmpfiles.d
99b6f7
install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_prefix}/lib/tmpfiles.d/%{name}.conf
99b6f7
# END
99b6f7
99b6f7
mkdir -p %{buildroot}%{_localstatedir}/run/
99b6f7
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/
99b6f7
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/
99b6f7
99b6f7
mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
99b6f7
touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
99b6f7
99b6f7
# NOTE: systemd specific section
99b6f7
mkdir -p %{buildroot}%{_unitdir}
99b6f7
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
99b6f7
install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
99b6f7
# END
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/ipa/
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
99b6f7
install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
99b6f7
99b6f7
(cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f  | \
99b6f7
    grep -v dcerpc | grep -v adtrustinstance | \
99b6f7
    sed -e 's,\.py.*$,.*,g' | sort -u | \
99b6f7
    sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%clean
99b6f7
rm -rf %{buildroot}
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%post server
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl --system daemon-reload 2>&1 || :
99b6f7
# END
99b6f7
if [ $1 -gt 1 ] ; then
99b6f7
    /bin/systemctl condrestart certmonger.service 2>&1 || :
99b6f7
fi
99b6f7
99b6f7
%posttrans server
99b6f7
# This must be run in posttrans so that updates from previous
99b6f7
# execution that may no longer be shipped are not applied.
99b6f7
/usr/sbin/ipa-ldap-updater --upgrade --quiet >/dev/null || :
99b6f7
/usr/sbin/ipa-upgradeconfig --quiet >/dev/null || :
99b6f7
99b6f7
# Restart IPA processes. This must be also run in postrans so that plugins
99b6f7
# and software is in consistent state
99b6f7
python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
99b6f7
# NOTE: systemd specific section
99b6f7
if [  $? -eq 0 ]; then
99b6f7
    /bin/systemctl try-restart ipa.service >/dev/null 2>&1 || :
99b6f7
fi
99b6f7
# END
99b6f7
99b6f7
%preun server
99b6f7
if [ $1 = 0 ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl --quiet stop ipa.service || :
99b6f7
    /bin/systemctl --quiet disable ipa.service || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%pre server
99b6f7
# Stop ipa_kpasswd if it exists before upgrading so we don't have a
99b6f7
# zombie process when we're done.
99b6f7
if [ -e /usr/sbin/ipa_kpasswd ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%postun server-trust-ad
99b6f7
if [ "$1" -ge "1" ]; then
99b6f7
    if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
99b6f7
        %{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null
99b6f7
    fi
99b6f7
fi
99b6f7
99b6f7
%post server-trust-ad
99b6f7
%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
99b6f7
        winbind_krb5_locator.so /dev/null 90
99b6f7
99b6f7
%posttrans server-trust-ad
99b6f7
python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
99b6f7
if [  $? -eq 0 ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%preun server-trust-ad
99b6f7
if [ $1 -eq 0 ]; then
99b6f7
    %{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
99b6f7
fi
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%post client
99b6f7
if [ $1 -gt 1 ] ; then
99b6f7
    # Has the client been configured?
99b6f7
    restore=0
99b6f7
    test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
99b6f7
99b6f7
    if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
99b6f7
        if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf  2>/dev/null ; then
99b6f7
            echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
99b6f7
            cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
99b6f7
            mv /etc/krb5.conf.ipanew /etc/krb5.conf
99b6f7
            /sbin/restorecon /etc/krb5.conf
99b6f7
        fi
99b6f7
    fi
99b6f7
fi
99b6f7
99b6f7
%triggerin -n ipa-client -- openssh-server
99b6f7
# Has the client been configured?
99b6f7
restore=0
99b6f7
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
99b6f7
99b6f7
if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
99b6f7
    if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
99b6f7
        sed -r '
99b6f7
            /^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
99b6f7
        ' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
99b6f7
99b6f7
        if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
99b6f7
                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
99b6f7
                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
99b6f7
                s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        fi
99b6f7
99b6f7
        mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
99b6f7
        /sbin/restorecon /etc/ssh/sshd_config
99b6f7
        chmod 600 /etc/ssh/sshd_config
99b6f7
99b6f7
        /bin/systemctl condrestart sshd.service 2>&1 || :
99b6f7
    fi
99b6f7
fi
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%files server -f server-python.list
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%{_sbindir}/ipa-ca-install
99b6f7
%{_sbindir}/ipa-dns-install
99b6f7
%{_sbindir}/ipa-server-install
99b6f7
%{_sbindir}/ipa-replica-conncheck
99b6f7
%{_sbindir}/ipa-replica-install
99b6f7
%{_sbindir}/ipa-replica-prepare
99b6f7
%{_sbindir}/ipa-replica-manage
99b6f7
%{_sbindir}/ipa-csreplica-manage
99b6f7
%{_sbindir}/ipa-server-certinstall
99b6f7
%{_sbindir}/ipa-ldap-updater
99b6f7
%{_sbindir}/ipa-compat-manage
99b6f7
%{_sbindir}/ipa-nis-manage
99b6f7
%{_sbindir}/ipa-managed-entries
99b6f7
%{_sbindir}/ipactl
99b6f7
%{_sbindir}/ipa-upgradeconfig
99b6f7
%{_sbindir}/ipa-advise
99b6f7
%{_libexecdir}/certmonger/dogtag-ipa-retrieve-agent-submit
99b6f7
%{_libexecdir}/ipa-otpd
99b6f7
%config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
99b6f7
%dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
99b6f7
%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/
99b6f7
# NOTE: systemd specific section
99b6f7
%{_prefix}/lib/tmpfiles.d/%{name}.conf
99b6f7
%attr(644,root,root) %{_unitdir}/ipa.service
99b6f7
%attr(644,root,root) %{_unitdir}/ipa_memcached.service
99b6f7
# END
99b6f7
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
99b6f7
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
99b6f7
%dir %{python_sitelib}/ipaserver
99b6f7
%dir %{python_sitelib}/ipaserver/install
99b6f7
%dir %{python_sitelib}/ipaserver/install/plugins
99b6f7
%dir %{python_sitelib}/ipaserver/advise
99b6f7
%dir %{python_sitelib}/ipaserver/advise/plugins
99b6f7
%dir %{python_sitelib}/ipaserver/plugins
99b6f7
%dir %{_libdir}/ipa/certmonger
99b6f7
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
99b6f7
%dir %{_usr}/share/ipa
99b6f7
%{_usr}/share/ipa/wsgi.py*
99b6f7
%{_usr}/share/ipa/copy-schema-to-ca.py*
99b6f7
%{_usr}/share/ipa/*.ldif
99b6f7
%{_usr}/share/ipa/*.uldif
99b6f7
%{_usr}/share/ipa/*.template
99b6f7
%dir %{_usr}/share/ipa/advise
99b6f7
%dir %{_usr}/share/ipa/advise/legacy
99b6f7
%{_usr}/share/ipa/advise/legacy/*.template
99b6f7
%dir %{_usr}/share/ipa/ffextension
99b6f7
%{_usr}/share/ipa/ffextension/bootstrap.js
99b6f7
%{_usr}/share/ipa/ffextension/install.rdf
99b6f7
%{_usr}/share/ipa/ffextension/chrome.manifest
99b6f7
%dir %{_usr}/share/ipa/ffextension/chrome
99b6f7
%dir %{_usr}/share/ipa/ffextension/chrome/content
99b6f7
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth.js
99b6f7
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth_overlay.xul
99b6f7
%dir %{_usr}/share/ipa/ffextension/locale
99b6f7
%dir %{_usr}/share/ipa/ffextension/locale/en-US
99b6f7
%{_usr}/share/ipa/ffextension/locale/en-US/kerberosauth.properties
99b6f7
%dir %{_usr}/share/ipa/html
99b6f7
%{_usr}/share/ipa/html/ffconfig.js
99b6f7
%{_usr}/share/ipa/html/ffconfig_page.js
99b6f7
%{_usr}/share/ipa/html/ssbrowser.html
99b6f7
%{_usr}/share/ipa/html/browserconfig.html
99b6f7
%{_usr}/share/ipa/html/unauthorized.html
99b6f7
%{_usr}/share/ipa/html/ipa_error.css
99b6f7
%dir %{_usr}/share/ipa/migration
99b6f7
%{_usr}/share/ipa/migration/error.html
99b6f7
%{_usr}/share/ipa/migration/index.html
99b6f7
%{_usr}/share/ipa/migration/invalid.html
99b6f7
%{_usr}/share/ipa/migration/migration.py*
99b6f7
%dir %{_usr}/share/ipa/ui
99b6f7
%{_usr}/share/ipa/ui/index.html
99b6f7
%{_usr}/share/ipa/ui/login.html
99b6f7
%{_usr}/share/ipa/ui/logout.html
99b6f7
%{_usr}/share/ipa/ui/reset_password.html
99b6f7
%{_usr}/share/ipa/ui/*.ico
99b6f7
%{_usr}/share/ipa/ui/*.css
99b6f7
%{_usr}/share/ipa/ui/*.js
99b6f7
%{_usr}/share/ipa/ui/*.eot
99b6f7
%{_usr}/share/ipa/ui/*.svg
99b6f7
%{_usr}/share/ipa/ui/*.ttf
99b6f7
%{_usr}/share/ipa/ui/*.woff
9991ea
%dir %{_usr}/share/ipa/ui/js
99b6f7
%dir %{_usr}/share/ipa/ui/js/dojo
99b6f7
%{_usr}/share/ipa/ui/js/dojo/dojo.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/libs
99b6f7
%{_usr}/share/ipa/ui/js/libs/*.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/freeipa
99b6f7
%{_usr}/share/ipa/ui/js/freeipa/app.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/plugins
99b6f7
%dir %{_usr}/share/ipa/ui/images
99b6f7
%{_usr}/share/ipa/ui/images/*.png
99b6f7
%{_usr}/share/ipa/ui/images/*.gif
99b6f7
%dir %{_usr}/share/ipa/wsgi
99b6f7
%{_usr}/share/ipa/wsgi/plugins.py*
99b6f7
%dir %{_sysconfdir}/ipa
99b6f7
%dir %{_sysconfdir}/ipa/html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ipa_error.css
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
99b6f7
%{_usr}/share/ipa/ca_renewal
99b6f7
%{_usr}/share/ipa/ipa.conf
99b6f7
%{_usr}/share/ipa/ipa-rewrite.conf
99b6f7
%{_usr}/share/ipa/ipa-pki-proxy.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/configure.jar
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/preferences.html
99b6f7
%dir %{_usr}/share/ipa/updates/
99b6f7
%{_usr}/share/ipa/updates/*
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
99b6f7
%dir %{_localstatedir}/lib/ipa
99b6f7
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
99b6f7
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysupgrade
99b6f7
%attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
99b6f7
%ghost %{_localstatedir}/lib/ipa/pki-ca/publish
99b6f7
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
99b6f7
%{_mandir}/man1/ipa-replica-conncheck.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-install.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-csreplica-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-prepare.1.gz
99b6f7
%{_mandir}/man1/ipa-server-certinstall.1.gz
99b6f7
%{_mandir}/man1/ipa-server-install.1.gz
99b6f7
%{_mandir}/man1/ipa-dns-install.1.gz
99b6f7
%{_mandir}/man1/ipa-ca-install.1.gz
99b6f7
%{_mandir}/man1/ipa-compat-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-nis-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-managed-entries.1.gz
99b6f7
%{_mandir}/man1/ipa-ldap-updater.1.gz
99b6f7
%{_mandir}/man8/ipactl.8.gz
99b6f7
%{_mandir}/man8/ipa-upgradeconfig.8.gz
99b6f7
%{_mandir}/man1/ipa-advise.1.gz
99b6f7
99b6f7
%files server-trust-ad
99b6f7
%{_sbindir}/ipa-adtrust-install
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
99b6f7
%{_usr}/share/ipa/smb.conf.empty
99b6f7
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
99b6f7
%{_mandir}/man1/ipa-adtrust-install.1.gz
99b6f7
%{python_sitelib}/ipaserver/dcerpc*
99b6f7
%{python_sitelib}/ipaserver/install/adtrustinstance*
99b6f7
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
99b6f7
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%files client
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%{_sbindir}/ipa-client-install
99b6f7
%{_sbindir}/ipa-client-automount
99b6f7
%{_sbindir}/ipa-getkeytab
99b6f7
%{_sbindir}/ipa-rmkeytab
99b6f7
%{_sbindir}/ipa-join
99b6f7
%dir %{_usr}/share/ipa
99b6f7
%dir %{_usr}/share/ipa/ipaclient
99b6f7
%dir %{_localstatedir}/lib/ipa-client
99b6f7
%dir %{_localstatedir}/lib/ipa-client/sysrestore
99b6f7
%{_usr}/share/ipa/ipaclient/ipa.cfg
99b6f7
%{_usr}/share/ipa/ipaclient/ipa.js
99b6f7
%dir %{python_sitelib}/ipaclient
99b6f7
%{python_sitelib}/ipaclient/*.py*
99b6f7
%{_mandir}/man1/ipa-getkeytab.1.gz
99b6f7
%{_mandir}/man1/ipa-rmkeytab.1.gz
99b6f7
%{_mandir}/man1/ipa-client-install.1.gz
99b6f7
%{_mandir}/man1/ipa-client-automount.1.gz
99b6f7
%{_mandir}/man1/ipa-join.1.gz
99b6f7
%{_mandir}/man5/default.conf.5.gz
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%files admintools
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%{_bindir}/ipa
99b6f7
%config %{_sysconfdir}/bash_completion.d
99b6f7
%{_mandir}/man1/ipa.1.gz
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%files python -f %{gettext_domain}.lang
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%dir %{python_sitelib}/ipapython
99b6f7
%dir %{python_sitelib}/ipapython/platform
99b6f7
%dir %{python_sitelib}/ipapython/platform/base
99b6f7
%dir %{python_sitelib}/ipapython/platform/fedora16
99b6f7
%dir %{python_sitelib}/ipapython/platform/fedora18
99b6f7
%dir %{python_sitelib}/ipapython/platform/redhat
99b6f7
%{python_sitelib}/ipapython/*.py*
99b6f7
%{python_sitelib}/ipapython/platform/*.py*
99b6f7
%{python_sitelib}/ipapython/platform/base/*.py*
99b6f7
%{python_sitelib}/ipapython/platform/fedora16/*.py*
99b6f7
%{python_sitelib}/ipapython/platform/fedora18/*.py*
99b6f7
%{python_sitelib}/ipapython/platform/redhat/*.py*
99b6f7
%dir %{python_sitelib}/ipalib
99b6f7
%{python_sitelib}/ipalib/*
99b6f7
%attr(0644,root,root) %{python_sitearch}/default_encoding_utf8.so
99b6f7
%{python_sitelib}/ipapython-*.egg-info
99b6f7
%{python_sitelib}/freeipa-*.egg-info
99b6f7
%{python_sitearch}/python_default_encoding-*.egg-info
99b6f7
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
99b6f7
99b6f7
%changelog
3f6981
* Tue Sep 02 2014 CentOS Sources <bugs@centos.org> - 3.3.3-28.el7.centos.1
3f6981
- Roll in CentOS Branding
3f6981
031d60
* Thu Aug 14 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-28.1
031d60
- Server installation fails using external signed certificates with
031d60
  "IndexError: list index out of range" (#1130031)
031d60
- Add rhino to BuildRequires to fix Web UI build error
10ca37
9991ea
* Tue Apr  1 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-28
9991ea
- ipa-client-automount fails with incompatibility error when installed against
9991ea
  older IPA server (#1083108)
9991ea
9991ea
* Wed Mar 26 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-27
9991ea
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
9991ea
  PKI versions (#1080865)
9991ea
9991ea
* Tue Mar 25 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-26
9991ea
- When IdM server trusts multiple AD forests, IPA client returns invalid group
9991ea
  membership info (#1079498)
9991ea
9991ea
* Thu Mar 13 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-25
9991ea
- Deletion of active subdomain range should not be allowed (#1075615)
9991ea
9991ea
* Thu Mar 13 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-24
9991ea
- PKI database is ugraded during replica installation (#1075118)
9991ea
9991ea
* Wed Mar 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-23
9991ea
- Unable to add trust successfully with --trust-secret (#1075704)
9991ea
9991ea
* Wed Mar 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-22
9991ea
- ipa-replica-install never checks for 7389 port (#1075165)
9991ea
- Non-terminated string may be passed to LDAP search (#1075091)
9991ea
- ipa-sam may fail to translate group SID into GID (#1073829)
9991ea
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
9991ea
9991ea
* Thu Mar  6 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-21
9991ea
- Do not fetch a principal two times, remove potential memory leak (#1070924)
9991ea
9991ea
* Wed Mar  5 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-20
9991ea
- trustdomain-find with pkey-only fails (#1068611)
9991ea
- Invalid credential cache in trust-add (#1069182)
9991ea
- ipa-replica-install prints unexpected error (#1069722)
9991ea
- Too big font in input fields in details facet in Firefox (#1069720)
9991ea
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
9991ea
- Misleading trust-add error message in some cases (#1070926)
9991ea
- Access is not rejected for disabled domain (#1070924)
9991ea
9991ea
* Wed Feb 26 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-19
9991ea
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
9991ea
9991ea
* Wed Feb 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-18
9991ea
- Display server name in ipa command's verbose mode (#1061703)
9991ea
- Remove sourcehostcategory from default HBAC rule (#1061187)
9991ea
- dnszone-add cannot add classless PTR zones (#1058688)
9991ea
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
9991ea
9991ea
* Tue Feb  4 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-17
9991ea
- Lockout plugin crashed during ipa-server-install (#912725)
9991ea
9991ea
* Fri Jan 31 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-16
9991ea
- Fallback to global policy in ipa lockout plugin (#912725)
9991ea
- Migration does not add users to default group (#903232)
9991ea
9991ea
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 3.3.3-15
9991ea
- Mass rebuild 2014-01-24
9991ea
9991ea
* Thu Jan 23 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-14
9991ea
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
9991ea
9991ea
* Mon Jan 20 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-13
9991ea
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
9991ea
- Increase default timeout for IPA services (#1033273)
9991ea
- Error while running trustdomain-find (#1054376)
9991ea
- group-show lists SID instead of name for external groups (#1054391)
9991ea
- Fix IPA server NetBIOS name in samba configuration (#1030517)
9991ea
- dnsrecord-mod produces missing API version warning (#1054869)
9991ea
- Hide trust-resolve command as internal (#1052860)
9991ea
- Add Trust domain Web UI (#1054870)
9991ea
- ipasam cannot delete multiple child trusted domains (#1056120)
9991ea
9991ea
* Wed Jan 15 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-12
9991ea
- Missing objectclasses when empty password passed to host-add (#1052979)
9991ea
- sudoOrder missing in sudoers (#1052983)
9991ea
- Missing examples in sudorule help (#1049464)
9991ea
- Client automount does not uninstall when fstore is empty (#910899)
9991ea
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
9991ea
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
9991ea
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
9991ea
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
9991ea
- Error not clear for invalid relam given to trustdomain-find (#1049455)
9991ea
- renewed client cert not recognized during IPA CA renewal (#1033273)
9991ea
9991ea
* Fri Jan 10 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-11
9991ea
- hbactest does not work for external users (#848531)
9991ea
9991ea
* Wed Jan 08 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-10
9991ea
- PKI service restart after CA renewal failed (#1040018)
9991ea
9991ea
* Mon Jan 06 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-9
9991ea
- Move ipa-tests package to separate srpm (#1032668)
9991ea
9991ea
* Fri Jan  3 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-8
9991ea
- Fix status trust-add command status message (#910453)
9991ea
- NetBIOS was not trimmed at 15 characters (#1030517)
9991ea
- Harden CA subsystem certificate renewal on CA clones (#1040018)
9991ea
9991ea
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.3.3-7
9991ea
- Mass rebuild 2013-12-27
9991ea
9991ea
* Mon Dec  2 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-6
9991ea
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
9991ea
- Re-adding existing trust fails (#1033216)
9991ea
- IPA uninstall exits with a samba error (#1033075)
9991ea
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
9991ea
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
9991ea
- ipa-tests: support external names for hosts (#1032668)
9991ea
- ipa-client-install fail due fail to obtain host TGT (#1029354)
9991ea
99b6f7
* Fri Nov 22 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-5
99b6f7
- Trust add tries to add same value of --base-id for sub domain,
99b6f7
  causing an error (#1033068)
99b6f7
- Improved error reporting for adding trust case (#1029856)
99b6f7
99b6f7
* Wed Nov 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-4
99b6f7
- Winsync agreement cannot be created (#1023085)
99b6f7
99b6f7
* Wed Nov  6 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-3
99b6f7
- Installer did not detect different server and IPA domain (#1026845)
99b6f7
- Allow kernel keyring CCACHE when supported (#1026861)
99b6f7
99b6f7
* Tue Nov  5 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-2
99b6f7
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
99b6f7
99b6f7
* Fri Nov  1 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-1
99b6f7
- Update to upstream 3.3.3 (#991064)
99b6f7
99b6f7
* Tue Oct 29 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-5
99b6f7
- Temporarily move ipa-backup and ipa-restore functionality
99b6f7
  back to make them available in public Beta (#1003933)
99b6f7
99b6f7
* Tue Oct 29 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-4
99b6f7
- Server install failure during client enrollment shouldn't
99b6f7
  roll back (#1023086)
99b6f7
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
99b6f7
- ipa-server conflicts with mod_ssl (#1018172)
99b6f7
99b6f7
* Wed Oct 16 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-3
99b6f7
- Reinstalling ipa server hangs when configuring certificate
99b6f7
  server (#1018804)
99b6f7
99b6f7
* Fri Oct 11 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-2
99b6f7
- Deprecate --serial-autoincrement option (#1016645)
99b6f7
- CA installation always failed on replica (#1005446)
99b6f7
- Re-initializing a winsync connection exited with error (#994980)
99b6f7
99b6f7
* Fri Oct  4 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-1
99b6f7
- Update to upstream 3.3.2 (#991064)
99b6f7
- Add delegation info to MS-PAC (#915799)
99b6f7
- Warn about incompatibility with AD when IPA realm and domain
99b6f7
  differs (#1009044)
99b6f7
- Allow PKCS#12 files with empty password in install tools (#1002639)
99b6f7
- Privilege "SELinux User Map Administrators" did not list
99b6f7
  permissions (#997085)
99b6f7
- SSH key upload broken when client joins an older server (#1009024)
99b6f7
99b6f7
* Mon Sep 23 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-5
99b6f7
- Remove dependency on python-paramiko (#1002884)
99b6f7
- Broken redirection when deleting last entry of DNS resource
99b6f7
  record (#1006360)
99b6f7
99b6f7
* Tue Sep 10 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-4
99b6f7
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
99b6f7
99b6f7
* Mon Sep  9 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-3
99b6f7
- Replica installation fails for RHEL 6.4 master (#1004680)
99b6f7
- Server uninstallation crashes if DS is not available (#998069)
99b6f7
99b6f7
* Thu Sep  5 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-2
99b6f7
- Unable to remove replica by ipa-replica-manage (#1001662)
99b6f7
- Before uninstalling a server, warn about active replicas (#998069)
99b6f7
99b6f7
* Thu Aug 29 2013 Rob Crittenden <rcritten@redhat.com> - 3.3.1-1
99b6f7
- Update to upstream 3.3.1 (#991064)
99b6f7
- Update minimum version of bind-dyndb-ldap to 3.5
99b6f7
99b6f7
* Tue Aug 20 2013 Rob Crittenden <rcritten@redhat.com> - 3.3.0-7
99b6f7
- Fix replica installation failing on certificate subject (#983075)
99b6f7
99b6f7
* Tue Aug 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-6
99b6f7
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
99b6f7
99b6f7
* Tue Aug 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-5
99b6f7
- Prevent multilib failures in *.pyo and *.pyc files
99b6f7
99b6f7
* Mon Aug 12 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-4
99b6f7
- ipa-server-install fails if --subject parameter is other than default
99b6f7
  realm (#983075)
99b6f7
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
99b6f7
99b6f7
* Mon Aug 12 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-3
99b6f7
- diffstat was missing as a build dependency causing multilib problems
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-2
99b6f7
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
99b6f7
  3.3.0 are not allowed
99b6f7
- Wrap server-trust-ad subpackage description better
9991ea
- Add (noreplace) flag for %%{_sysconfdir}/tmpfiles.d/ipa.conf
99b6f7
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-1
99b6f7
- Update to upstream 3.3.0 (#991064)
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-0.2.beta2
99b6f7
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
99b6f7
99b6f7
* Wed Aug  7 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-0.1.beta2
99b6f7
- Update to upstream 3.3.0 Beta 2 (#991064)
99b6f7
99b6f7
* Thu Jul 18 2013 Martin Kosek <mkosek@redhat.com> - 3.2.2-1
99b6f7
- Update to upstream 3.2.2
99b6f7
- Drop ipa-server-selinux subpackage
99b6f7
- Drop redundant directory /var/cache/ipa/sessions
99b6f7
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
99b6f7
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
99b6f7
  issues when there are still old parts of software (like entitlements plugin)
99b6f7
99b6f7
* Fri Jun 14 2013 Martin Kosek <mkosek@redhat.com> - 3.2.1-1
99b6f7
- Update to upstream 3.2.1
99b6f7
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
99b6f7
99b6f7
* Tue May 14 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-2
99b6f7
- Add OTP patches
99b6f7
- Add patch to set KRB5CCNAME for 389-ds-base
99b6f7
99b6f7
* Fri May 10 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
99b6f7
- Update to upstream 3.2.0 GA
99b6f7
- ipa-client-install fails if /etc/ipa does not exist (#961483)
99b6f7
- Certificate status is not visible in Service and Host page (#956718)
99b6f7
- ipa-client-install removes needed options from ldap.conf (#953991)
99b6f7
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
99b6f7
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
99b6f7
- Require nss 3.14.3-12.0 to address certutil certificate import
99b6f7
  errors (#953485)
99b6f7
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
99b6f7
  environments. (#953464)
99b6f7
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
99b6f7
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
99b6f7
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
99b6f7
  socket based connections (#960222)
99b6f7
- Require libsss_nss_idmap-python
99b6f7
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
99b6f7
  member is now done automatically and having it in the config file raises
99b6f7
  an error.
99b6f7
- Add backup and restore tools, directory.
99b6f7
- require at least systemd 38 which provides the journal (we no longer
99b6f7
  need to require syslog.target)
99b6f7
- Update Requires on policycoreutils to 2.1.14-37
99b6f7
- Update Requires on selinux-policy to 3.12.1-42
99b6f7
- Update Requires on 389-ds-base to 1.3.1.0
99b6f7
- Remove a Requires for java-atk-wrapper
99b6f7
99b6f7
* Tue Apr 23 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.4.beta1
99b6f7
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
99b6f7
99b6f7
* Mon Apr 22 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
99b6f7
- Add a Requires for java-atk-wrapper until we can determine which package
99b6f7
  should be pulling it in, dogtag or tomcat.
99b6f7
99b6f7
* Tue Apr 16 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.2.beta1
99b6f7
- Update to upstream 3.2.0 Beta 1
99b6f7
99b6f7
* Tue Apr  2 2013 Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
99b6f7
- Update to upstream 3.2.0 Prerelease 1
99b6f7
- Use upstream reference spec file as a base for Fedora spec file
99b6f7
99b6f7
* Sat Mar 30 2013 Kevin Fenzi <kevin@scrye.com> 3.1.2-4
99b6f7
- Rebuild for broken deps
99b6f7
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
99b6f7
99b6f7
* Sat Feb 23 2013 Kevin Fenzi <kevin@scrye.com> - 3.1.2-3
99b6f7
- Rebuild for broken deps in rawhide
99b6f7
- Fix 389-ds-base strict dep to be 1.3.0.3
99b6f7
99b6f7
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.1.2-2
99b6f7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
99b6f7
99b6f7
* Wed Jan 23 2013 Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
99b6f7
- Update to upstream 3.1.2
99b6f7
- CVE-2012-4546: Incorrect CRLs publishing
99b6f7
- CVE-2012-5484: MITM Attack during Join process
99b6f7
- CVE-2013-0199: Cross-Realm Trust key leak
99b6f7
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
99b6f7
  pki-ca = 10.0.1
99b6f7
99b6f7
* Thu Dec 20 2012 Martin Kosek <mkosek@redhat.com> - 3.1.0-2
99b6f7
- Remove redundat Requires versions that are already in Fedora 17
99b6f7
- Replace python-crypto Requires with m2crypto
99b6f7
- Add missing Requires(post) for client and server-trust-ad subpackages
99b6f7
- Restart httpd service when server-trust-ad subpackage is installed
99b6f7
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
99b6f7
99b6f7
* Mon Dec 10 2012 Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
99b6f7
- Updated to upstream 3.1.0 GA
99b6f7
- Set minimum for sssd to 1.9.2
99b6f7
- Set minimum for pki-ca to 10.0.0-1
99b6f7
- Set minimum for 389-ds-base to 1.3.0
99b6f7
- Set minimum for selinux-policy to 3.11.1-60
99b6f7
- Remove unneeded dogtag package requires
99b6f7
99b6f7
* Tue Oct 23 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-3
99b6f7
- Update Requires on krb5-server to 1.11
99b6f7
99b6f7
* Fri Oct 12 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-2
99b6f7
- Configure CA replication to use TLS instead of SSL
99b6f7
99b6f7
* Fri Oct 12 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
99b6f7
- Updated to upstream 3.0.0 GA
99b6f7
- Set minimum for samba to 4.0.0-153.
99b6f7
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
99b6f7
  plugin to /dev/null since they cannot be used when trusts are configured
99b6f7
- Restrict krb5-server to 1.10.
99b6f7
- Update BR for 389-ds-base to 1.3.0
99b6f7
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
99b6f7
- Add Requires on zip for generating FF browser extension
99b6f7
99b6f7
* Fri Oct  5 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
99b6f7
- Updated to upstream 3.0.0 rc 2
99b6f7
- Include new FF configuration extension
99b6f7
- Set minimum Requires of selinux-policy to 3.11.1-33
99b6f7
- Set minimum Requires dogtag to 10.0.0-0.43.b1
99b6f7
- Add new optional strict sub-package to allow users to limit other
99b6f7
  package upgrades.
99b6f7
99b6f7
* Tue Oct  2 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-0.9
99b6f7
- Require samba packages instead of obsoleted samba4 packages
99b6f7
99b6f7
* Fri Sep 21 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
99b6f7
- Updated to upstream 3.0.0 rc 1
99b6f7
- Update BR for 389-ds-base to 1.2.11.14
99b6f7
- Update BR for krb5 to 1.10
99b6f7
- Update BR for samba4-devel to 4.0.0-139 (rc1)
99b6f7
- Add BR for python-polib
99b6f7
- Update BR and Requires on sssd to 1.9.0
99b6f7
- Update Requires on policycoreutils to 2.1.12-5
99b6f7
- Update Requires on 389-ds-base to 1.2.11.14
99b6f7
- Update Requires on selinux-policy to 3.11.1-21
99b6f7
- Update Requires on dogtag to 10.0.0-0.33.a1
99b6f7
- Update Requires on certmonger to 0.60
99b6f7
- Update Requires on tomcat to 7.0.29
99b6f7
- Update minimum version of bind to 9.9.1-10.P3
99b6f7
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
99b6f7
- Remove Requires on authconfig from python sub-package
99b6f7
99b6f7
* Wed Sep  5 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.7
99b6f7
- Rebuild against samba4 beta8
99b6f7
99b6f7
* Fri Aug 31 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.6
99b6f7
- Rebuild against samba4 beta7
99b6f7
99b6f7
* Wed Aug 22 2012 Alexander Bokovoy <abokovoy@redhat.com> - 3.0.0-0.5
99b6f7
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
99b6f7
- Add dependency to samba4-winbind
99b6f7
99b6f7
* Fri Aug 17 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.4
99b6f7
- Updated to upstream 3.0.0 beta 2
99b6f7
99b6f7
* Mon Aug  6 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-0.3
99b6f7
- Updated to current upstream state of 3.0.0 beta 2 development
99b6f7
99b6f7
* Mon Jul 23 2012 Alexander Bokovoy <abokovy@redhat.com> - 3.0.0-0.2
99b6f7
- Rebuild against samba4 beta4
99b6f7
99b6f7
* Mon Jul  2 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.1
99b6f7
- Updated to upstream 3.0.0 beta 1
99b6f7
99b6f7
* Thu May  3 2012 Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
99b6f7
- Updated to upstream 2.2.0 GA
99b6f7
- Update minimum n-v-r of certmonger to 0.53
99b6f7
- Update minimum n-v-r of slapi-nis to 0.40
99b6f7
- Add Requires in client to oddjob-mkhomedir and python-krbV
99b6f7
- Update minimum selinux-policy to 3.10.0-110
99b6f7
99b6f7
* Mon Mar 19 2012 Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
99b6f7
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
99b6f7
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
99b6f7
- Add Conflicts on mod_ssl
99b6f7
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
99b6f7
- Update minimum n-v-r of sssd to 1.8.0
99b6f7
- Update minimum n-v-r of slapi-nis to 0.38
99b6f7
- Update minimum n-v-r of pki-* to 9.0.18
99b6f7
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
99b6f7
- Update conflicts on bind to < 9.9.0-1
99b6f7
- Drop requires on krb5-server-ldap
99b6f7
- Add patch to remove escaping arguments to pkisilent
99b6f7
99b6f7
* Mon Feb 06 2012 Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.1
99b6f7
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
99b6f7
99b6f7
* Wed Feb 01 2012 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
99b6f7
- Force to use 389-ds 1.2.10-0.8.a7 or above
99b6f7
- Improve upgrade script to handle systemd 389-ds change
99b6f7
- Fix freeipa to work with python-ldap 2.4.6
99b6f7
99b6f7
* Wed Jan 11 2012 Martin Kosek <mkosek@redhat.com> - 2.1.4-4
99b6f7
- Fix ipa-replica-install crashes
99b6f7
- Fix ipa-server-install and ipa-dns-install logging
99b6f7
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
99b6f7
  caused by FEDORA-2011-17400 update (#771357)
99b6f7
99b6f7
* Wed Dec 21 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
99b6f7
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
99b6f7
- Rebuild slapi plugins against re-enterant version of libldap
99b6f7
99b6f7
* Sun Dec 11 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
99b6f7
- Allow longer dirsrv startup with systemd:
99b6f7
  - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
99b6f7
  - Helps with restarts during upgrade for ipa-ldap-updater
99b6f7
- Fix pylint warnings from F16 and Rawhide
99b6f7
99b6f7
* Tue Dec  6 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.4-1
99b6f7
- Update to upstream 2.1.4 (CVE-2011-3636)
99b6f7
99b6f7
* Mon Dec  5 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.3-8
99b6f7
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
99b6f7
  read /dev/urandom. (#759679)
99b6f7
99b6f7
* Wed Nov 30 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-7
99b6f7
- Fix wrong path in packaging freeipa-systemd-upgrade
99b6f7
99b6f7
* Wed Nov 30 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
99b6f7
- Introduce upgrade script to recover existing configuration after systemd migration
99b6f7
  as user has no means to recover FreeIPA from systemd migration
99b6f7
- Upgrade script:
99b6f7
  - recovers symlinks in Dogtag instance install
99b6f7
  - recovers systemd configuration for FreeIPA's directory server instances
99b6f7
  - recovers freeipa.service
99b6f7
  - migrates directory server and KDC configs to use proper keytabs for systemd services
99b6f7
99b6f7
* Wed Oct 26 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.3-5
99b6f7
- Rebuilt for glibc bug#747377
99b6f7
99b6f7
* Wed Oct 19 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-4
99b6f7
- clean up spec 
99b6f7
- Depend on sssd >= 1.6.2 for better user experience
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-3
99b6f7
- Fix Fedora package changelog after merging systemd changes
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-2
99b6f7
- Fix postin scriplet for F-15/F-16
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-1
99b6f7
- 2.1.3
99b6f7
99b6f7
* Mon Oct 17 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.2-1
99b6f7
- Default to systemd for Fedora 16 and onwards
99b6f7
99b6f7
* Tue Aug 16 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.0-1
99b6f7
- Update to upstream 2.1.0
99b6f7
99b6f7
* Fri May  6 2011 Simo Sorce <ssorce@redhat.com> - 2.0.1-2
99b6f7
- Fix bug #702633
99b6f7
99b6f7
* Mon May  2 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
99b6f7
- Update minimum selinux-policy to 3.9.16-18
99b6f7
- Update minimum pki-ca and pki-selinux to 9.0.7
99b6f7
- Update minimum 389-ds-base to 1.2.8.0-1
99b6f7
- Update to upstream 2.0.1
99b6f7
99b6f7
* Thu Mar 24 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-1
99b6f7
- Update to upstream GA release
99b6f7
- Automatically apply updates when the package is upgraded
99b6f7
99b6f7
* Fri Feb 25 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
99b6f7
- Update to upstream freeipa-2.0.0.rc2
99b6f7
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
99b6f7
- Set minimum version of sssd to 1.5.1
99b6f7
- Patch to include SuiteSpotGroup when setting up 389-ds instances
99b6f7
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
99b6f7
99b6f7
* Tue Feb 15 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.3.rc1
99b6f7
- Set the N-V-R so rc1 is an update to beta2.
99b6f7
99b6f7
* Mon Feb 14 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
99b6f7
- Set minimum version of sssd to 1.5.1
99b6f7
- Update to upstream freeipa-2.0.0.rc1
99b6f7
- Move server-only binaries from admintools subpackage to server
99b6f7
99b6f7
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.0-0.2.beta2
99b6f7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
99b6f7
99b6f7
* Thu Feb  3 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
99b6f7
- Set min version of 389-ds-base to 1.2.8
99b6f7
- Set min version of mod_nss 1.0.8-10
99b6f7
- Set min version of selinux-policy to 3.9.7-27
99b6f7
- Add dogtag themes to Requires
99b6f7
- Update to upstream freeipa-2.0.0.pre2
99b6f7
99b6f7
* Thu Jan 27 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
99b6f7
- Remove unnecessary moving of v1 CA serial number file in post script
99b6f7
- Add Obsoletes for server-selinxu subpackage
99b6f7
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
99b6f7
99b6f7
* Wed Jan 26 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta.git80e87e7
99b6f7
- Prepare spec file for release
99b6f7
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
99b6f7
99b6f7
* Tue Jan 25 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-41
99b6f7
- Re-arrange doc and defattr to clean up rpmlint warnings
99b6f7
- Remove conditionals on older releases
99b6f7
- Move some man pages into admintools subpackage
99b6f7
- Remove some explicit Requires in client that aren't needed
99b6f7
- Consistent use of buildroot vs RPM_BUILD_ROOT
99b6f7
99b6f7
* Wed Jan 19 2011 Adam Young <ayoung@redhat.com> - 1.99-40
99b6f7
- Moved directory install/static to install/ui
99b6f7
99b6f7
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-39
99b6f7
- Remove dependency on nss_ldap/nss-pam-ldapd
99b6f7
- The official client is sssd and that's what we use by default.
99b6f7
99b6f7
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-38
99b6f7
- Remove radius subpackages
99b6f7
99b6f7
* Thu Jan 13 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-37
99b6f7
- Set minimum pki-ca and pki-silent versions to 9.0.0
99b6f7
99b6f7
* Wed Jan 12 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-36
99b6f7
- Drop BuildRequires on mozldap-devel
99b6f7
99b6f7
* Mon Dec 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-35
99b6f7
- Add Requires on krb5-pkinit-openssl
99b6f7
99b6f7
* Fri Dec 10 2010 Jr Aquino <jr.aquino@citrix.com> - 1.99-34
99b6f7
- Add ipa-host-net-manage script
99b6f7
99b6f7
* Tue Dec  7 2010 Simo Sorce <ssorce@redhat.com> - 1.99-33
99b6f7
- Add ipa init script
99b6f7
99b6f7
* Fri Nov 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-32
99b6f7
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
99b6f7
99b6f7
* Wed Nov  3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-31
99b6f7
- remove ipa-fix-CVE-2008-3274
99b6f7
99b6f7
* Wed Oct  6 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-30
99b6f7
- Remove duplicate %%files entries on share/ipa/static
99b6f7
- Add python default encoding shared library
99b6f7
99b6f7
* Mon Sep 20 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-29
99b6f7
- Drop requires on python-configobj (not used any more)
99b6f7
- Drop ipa-ldap-updater message, upgrades are done differently now
99b6f7
99b6f7
* Wed Sep  8 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-28
99b6f7
- Drop conflicts on mod_nss
99b6f7
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
99b6f7
- Drop a slew of conditionals on older Fedora releases (< 12)
99b6f7
- Add a few conditionals against RHEL 6
99b6f7
- Add Requires of nss-tools on ipa-client
99b6f7
99b6f7
* Fri Aug 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-27
99b6f7
- Set minimum version of certmonger to 0.26 (to pck up #621670)
99b6f7
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
99b6f7
- Set minimum version of pki-ca to 1.3.6
99b6f7
- Set minimum version of sssd to 1.2.1
99b6f7
99b6f7
* Tue Aug 10 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-26
99b6f7
- Add BuildRequires for authconfig
99b6f7
99b6f7
* Mon Jul 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-25
99b6f7
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
99b6f7
99b6f7
* Thu Jun 24 2010 Adam Young <ayoung@redhat.com> - 1.99-24
99b6f7
- Removed python-asset based webui
99b6f7
99b6f7
* Thu Jun 24 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-23
99b6f7
- Change Requires from fedora-ds-base to 389-ds-base
99b6f7
- Set minimum level of 389-ds-base to 1.2.6 for the replication
99b6f7
  version plugin.
99b6f7
99b6f7
* Tue Jun  1 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-22
99b6f7
- Drop Requires of python-krbV on ipa-client
99b6f7
99b6f7
* Mon May 17 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-21
99b6f7
- Load ipa_dogtag.pp in post install
99b6f7
99b6f7
* Mon Apr 26 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-20
99b6f7
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
99b6f7
99b6f7
* Thu Mar  4 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-19
99b6f7
- No need to create /var/log/ipa_error.log since we aren't using
99b6f7
  TurboGears any more.
99b6f7
99b6f7
* Mon Mar 1 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-18
99b6f7
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
99b6f7
99b6f7
* Wed Feb 24 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-17
99b6f7
- Added Require mod_wsgi, added share/ipa/wsgi.py
99b6f7
99b6f7
* Thu Feb 11 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-16
99b6f7
- Require python-wehjit >= 0.2.2
99b6f7
99b6f7
* Wed Feb  3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-15
99b6f7
- Add sssd and certmonger as a Requires on ipa-client
99b6f7
99b6f7
* Wed Jan 27 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-14
99b6f7
- Require python-wehjit >= 0.2.0
99b6f7
99b6f7
* Fri Dec  4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-13
99b6f7
- Add ipa-rmkeytab tool
99b6f7
99b6f7
* Tue Dec  1 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-12
99b6f7
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
99b6f7
  Any type
99b6f7
99b6f7
* Wed Nov 25 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-11
99b6f7
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
99b6f7
99b6f7
* Fri Nov 13 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-10
99b6f7
- Add bash completion script and own /etc/bash_completion.d in case it
99b6f7
  doesn't already exist
99b6f7
99b6f7
* Tue Nov  3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-9
99b6f7
- Remove ipa_webgui, its functions rolled into ipa_httpd
99b6f7
99b6f7
* Mon Oct 12 2009 Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
99b6f7
- Removed python-cherrypy from BuildRequires and Requires
99b6f7
- Added Requires python-assets, python-wehjit
99b6f7
99b6f7
* Mon Aug 24 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-7
99b6f7
- Added httpd SELinux policy so CRLs can be read
99b6f7
99b6f7
* Thu May 21 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-6
99b6f7
- Move ipalib to ipa-python subpackage
99b6f7
- Bump minimum version of slapi-nis to 0.15
99b6f7
99b6f7
* Wed May  6 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-5
99b6f7
- Set 0.14 as minimum version for slapi-nis
99b6f7
99b6f7
* Wed Apr 22 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-4
99b6f7
- Add Requires: python-nss to ipa-python sub-package
99b6f7
99b6f7
* Thu Mar  5 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-3
99b6f7
- Remove the IPA DNA plugin, use the DS one
99b6f7
99b6f7
* Wed Mar  4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-2
99b6f7
- Build radius separately
99b6f7
- Fix a few minor issues
99b6f7
99b6f7
* Tue Feb  3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-1
99b6f7
- Replace TurboGears requirement with python-cherrypy
99b6f7
99b6f7
* Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.1-3
99b6f7
- rebuild with new openssl
99b6f7
99b6f7
* Fri Dec 19 2008 Dan Walsh <dwalsh@redhat.com> - 1.2.1-2
99b6f7
- Fix SELinux code
99b6f7
99b6f7
* Mon Dec 15 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-1
99b6f7
- Fix breakage caused by python-kerberos update to 1.1
99b6f7
99b6f7
* Fri Dec 5 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-0
99b6f7
- New upstream release 1.2.1
99b6f7
99b6f7
* Sat Nov 29 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 1.2.0-4
99b6f7
- Rebuild for Python 2.6
99b6f7
99b6f7
* Fri Nov 14 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-3
99b6f7
- Respin after the tarball has been re-released upstream
99b6f7
  New hash is 506c9c92dcaf9f227cba5030e999f177
99b6f7
99b6f7
* Thu Nov 13 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-2
99b6f7
- Conditionally restart also dirsrv and httpd when upgrading
99b6f7
99b6f7
* Wed Oct 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
99b6f7
- Update to upstream version 1.2.0
99b6f7
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
99b6f7
- Set the minimum version for SELinux policy
99b6f7
- Remove references to Fedora 7
99b6f7
99b6f7
* Wed Jul 23 2008 Simo Sorce <ssorce@redhat.com> - 1.1.0-3
99b6f7
- Fix for CVE-2008-3274
99b6f7
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
99b6f7
- Add fix for bug #453185
99b6f7
- Rebuild against openldap libraries, mozldap ones do not work properly
99b6f7
- TurboGears is currently broken in rawhide. Added patch to not build
99b6f7
  the UI locales and removed them from the ipa-server files section.
99b6f7
99b6f7
* Wed Jun 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-2
99b6f7
- Add call to /usr/sbin/upgradeconfig to post install
99b6f7
99b6f7
* Wed Jun 11 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
99b6f7
- Update to upstream version 1.1.0
99b6f7
- Patch for indexing memberof attribute
99b6f7
- Patch for indexing uidnumber and gidnumber
99b6f7
- Patch to change DNA default values for replicas
99b6f7
- Patch to fix uninitialized variable in ipa-getkeytab
99b6f7
99b6f7
* Fri May 16 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
99b6f7
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
99b6f7
  version to 1.0.7-4 so we pick up the NSS fixes.
99b6f7
- Add selinux-policy-base(post) to Requires (446496)
99b6f7
99b6f7
* Tue Apr 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
99b6f7
- Add missing entry for /var/cache/ipa/kpasswd (444624)
99b6f7
- Added patch to fix permissions problems with the Apache NSS database.
99b6f7
- Added patch to fix problem with DNS querying where the query could be
99b6f7
  returned as the answer.
99b6f7
- Fix spec error where patch1 was in the wrong section
99b6f7
99b6f7
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-3
99b6f7
- Added patch to fix problem reported by ldapmodify
99b6f7
99b6f7
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
99b6f7
- Fix Requires for krb5-server that was missing for Fedora versions > 9
99b6f7
- Remove quotes around test for fedora version to package egg-info
99b6f7
99b6f7
* Fri Apr 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-1
99b6f7
- Update to upstream version 1.0.0
99b6f7
99b6f7
* Tue Mar 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-12
99b6f7
- Pull upstream changelog 722
99b6f7
- Add Conflicts mod_ssl (435360)
99b6f7
99b6f7
* Fri Feb 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-11
99b6f7
- Pull upstream changelog 698
99b6f7
- Fix ownership of /var/log/ipa_error.log during install (435119)
99b6f7
- Add pwpolicy command and man page
99b6f7
99b6f7
* Thu Feb 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-10
99b6f7
- Pull upstream changelog 678
99b6f7
- Add new subpackage, ipa-server-selinux
99b6f7
- Add Requires: authconfig to ipa-python (bz #433747)
99b6f7
- Package i18n files
99b6f7
99b6f7
* Mon Feb 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-9
99b6f7
- Pull upstream changelog 641
99b6f7
- Require minimum version of krb5-server on F-7 and F-8
99b6f7
- Package some new files
99b6f7
99b6f7
* Thu Jan 31 2008 Rob Crittenden <rcritten@redhat.com> 0.99-8
99b6f7
- Marked with wrong license. IPA is GPLv2.
99b6f7
99b6f7
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-7
99b6f7
- Ensure that /etc/ipa exists before moving user-modifiable html files there
99b6f7
- Put html files into /etc/ipa/html instead of /etc/ipa
99b6f7
99b6f7
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-6
99b6f7
- Pull upstream changelog 608 which renamed several files
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-5
99b6f7
- package the sessions dir /var/cache/ipa/sessions
99b6f7
- Pull upstream changelog 597
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-4
99b6f7
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
99b6f7
  UI to not start.
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-3
99b6f7
- Included LICENSE and README in all packages for documentation
99b6f7
- Move user-modifiable content to /etc/ipa and linked back to
99b6f7
  /usr/share/ipa/html
99b6f7
- Changed some references to /usr to the {_usr} macro and /etc
99b6f7
  to {_sysconfdir}
99b6f7
- Added popt-devel to BuildRequires for Fedora 8 and higher and
99b6f7
  popt for Fedora 7
99b6f7
- Package the egg-info for Fedora 9 and higher for ipa-python
99b6f7
99b6f7
* Tue Jan 22 2008 Rob Crittenden <rcritten@redhat.com> 0.99-2
99b6f7
- Added auto* BuildRequires
99b6f7
99b6f7
* Mon Jan 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-1
99b6f7
- Unified spec file
99b6f7
99b6f7
* Thu Jan 17 2008 Rob Crittenden <rcritten@redhat.com> - 0.6.0-2
99b6f7
- Fixed License in specfile
99b6f7
- Include files from /usr/lib/python*/site-packages/ipaserver
99b6f7
99b6f7
* Fri Dec 21 2007 Karl MacMillan <kmacmill@redhat.com> - 0.6.0-1
99b6f7
- Version bump for release
99b6f7
99b6f7
* Wed Nov 21 2007 Karl MacMillan <kmacmill@mentalrootkit.com> - 0.5.0-1
99b6f7
- Preverse mode on ipa-keytab-util
99b6f7
- Version bump for relase and rpm name change
99b6f7
99b6f7
* Thu Nov 15 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
99b6f7
- Broke invididual Requires and BuildRequires onto separate lines and
99b6f7
  reordered them
99b6f7
- Added python-tgexpandingformwidget as a dependency
99b6f7
- Require at least fedora-ds-base 1.1
99b6f7
99b6f7
* Thu Nov  1 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.1-1
99b6f7
- Version bump for release
99b6f7
99b6f7
* Wed Oct 31 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-6
99b6f7
- Add dep for freeipa-admintools and acl
99b6f7
99b6f7
* Wed Oct 24 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-5
99b6f7
- Add dependency for python-krbV
99b6f7
99b6f7
* Fri Oct 19 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-4
99b6f7
- Require mod_nss-1.0.7-2 for mod_proxy fixes
99b6f7
99b6f7
* Thu Oct 18 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-3
99b6f7
- Convert to autotools-based build
99b6f7
99b6f7
* Tue Sep 25 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
99b6f7
99b6f7
* Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
99b6f7
- Added support for libipa-dna-plugin
99b6f7
99b6f7
* Fri Aug 10 2007 Karl MacMillan <kmacmill@redhat.com> - 0.2.0-1
99b6f7
- Added support for ipa_kpasswd and ipa_pwd_extop
99b6f7
99b6f7
* Sun Aug  5 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-3
99b6f7
- Abstracted client class to work directly or over RPC
99b6f7
99b6f7
* Wed Aug  1 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
99b6f7
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
99b6f7
- Remove references to admin server in ipa-server-setupssl
99b6f7
- Generate a client certificate for the XML-RPC server to connect to LDAP with
99b6f7
- Create a keytab for Apache
99b6f7
- Create an ldif with a test user
99b6f7
- Provide a certmap.conf for doing SSL client authentication
99b6f7
99b6f7
* Fri Jul 27 2007 Karl MacMillan <kmacmill@redhat.com> - 0.1.0-1
99b6f7
- Initial rpm version