# Define ONLY_CLIENT to only make the ipa-client and ipa-python subpackages

%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}

%ifarch x86_64 %{ix86}

# Nothing, we want to force just building client on non-Intel

%else

%global ONLY_CLIENT 1

%endif

%global plugin_dir %{_libdir}/dirsrv/plugins

%global POLICYCOREUTILSVER 2.1.14-37

%global gettext_domain ipa

%global VERSION 3.3.3

%if (0%{?fedora} > 15 || 0%{?rhel} >= 7)

%define _hardened_build 1

%endif

Name:           ipa

Version:        3.3.3

Release:        28%{?dist}.1

Summary:        The Identity, Policy and Audit system

Group:          System Environment/Base

License:        GPLv3+

URL:            http://www.freeipa.org/

Source0:        http://www.freeipa.org/downloads/src/freeipa-%{VERSION}.tar.gz

Source1:        rh-ipabanner.png

BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

Patch0001:      0001-Guard-import-of-adtrustinstance-for-case-without-tru.patch

Patch0002:      0002-Server-does-not-detect-different-server-and-IPA-doma.patch

Patch0003:      0003-Allow-kernel-keyring-CCACHE-when-supported.patch

Patch0004:      0004-Fix-regression-which-prevents-creating-a-winsync-agr.patch

Patch0005:      0005-trusts-Do-not-pass-base-id-to-the-subdomain-ranges.patch

Patch0006:      0006-Map-NT_STATUS_INVALID_PARAMETER-to-most-likely-error.patch

Patch0007:      0007-Remove-mod_ssl-port-workaround.patch

Patch0008:      0008-subdomains-Use-AD-admin-credentials-when-trust-is-be.patch

Patch0009:      0009-trusts-Always-stop-and-disable-smb-service-on-uninst.patch

Patch0010:      0010-Use-hardening-flags-for-ipa-optd.patch

Patch0011:      0011-test_integration-Support-external-names-for-hosts.patch

Patch0012:      0012-ipa-client-install-Always-pass-hostname-to-the-ipa-j.patch

Patch0013:      0013-trust-fix-get_dn-to-distinguish-creating-and-re-addi.patch

Patch0014:      0014-ipa-cldap-Cut-NetBIOS-name-after-15-characters.patch

Patch0015:      0015-Prevent-garbage-from-readline-on-standard-output-of-.patch

Patch0016:      0016-Do-not-build-tests.patch

Patch0017:      0017-PKI-service-restart-after-CA-renewal-failed.patch

Patch0018:      0018-hbactest-does-not-work-for-external-users.patch

Patch0019:      0019-Change-the-way-we-determine-if-the-host-has-a-passwo.patch

Patch0020:      0020-sudoOrder-missing-in-sudoers.patch

Patch0021:      0021-Add-missing-example-to-sudorule.patch

Patch0022:      0022-Fix-ipa-client-automount-uninstall-when-fstore-is-em.patch

Patch0023:      0023-trust-fetch-domains-create-ranges-for-new-child-doma.patch

Patch0024:      0024-trustdomain-find-report-status-of-the-sub-domain.patch

Patch0025:      0025-CLDAP-do-not-prepend.patch

Patch0026:      0026-ipaserver-install-installutils-clean-up-properly-aft.patch

Patch0027:      0027-Do-not-start-the-service-in-stopped_service-if-it-wa.patch

Patch0028:      0028-Harmonize-policy-discovery-to-kdb-driver.patch

Patch0029:      0029-Stop-adding-a-default-password-policy-reference.patch

Patch0030:      0030-Increase-service-startup-timeout-default.patch

Patch0031:      0031-cli.print_attribute-Convert-values-to-strings.patch

Patch0032:      0032-group-show-resolve-external-members-of-the-groups.patch

Patch0033:      0033-Remove-SID-resolve-call-from-Web-UI.patch

Patch0034:      0034-ipa-adtrust-install-configure-host-netbios-name-by-d.patch

Patch0035:      0035-Remove-missing-VERSION-warning-in-dnsrecord-mod.patch

Patch0036:      0036-Hide-trust-resolve-command.patch

Patch0037:      0037-Trust-domains-Web-UI.patch

Patch0038:      0038-ipasam-delete-trusted-child-domains-before-removing-.patch

Patch0039:      0039-CLDAP-generate-NetBIOS-name-like-ipa-adtrust-install.patch

Patch0040:      0040-Fallback-to-global-policy-in-ipa-lockout-plugin.patch

Patch0041:      0041-Migration-does-not-add-users-to-default-group.patch

Patch0042:      0042-ipa-lockout-do-not-fail-when-default-realm-cannot-be.patch

Patch0043:      0043-ipa-tool-Print-the-name-of-the-server-we-are-connect.patch

Patch0044:      0044-Remove-sourcehostcategory-from-the-default-HBAC-rule.patch

Patch0045:      0045-DNS-classless-support-for-reverse-domains.patch

Patch0046:      0046-Move-ipa-otpd-socket-directory.patch

Patch0047:      0047-bindinstance-make-sure-zone-manager-is-initialized-i.patch

Patch0048:      0048-trustdomain_find-make-sure-we-skip-short-entries-whe.patch

Patch0049:      0049-ipa-kdb-in-case-of-delegation-use-original-client-s-.patch

Patch0050:      0050-ipa-kdb-make-sure-we-don-t-produce-MS-PAC-in-case-of.patch

Patch0051:      0051-Too-big-font-in-input-fields.patch

Patch0052:      0052-trust-make-sure-we-always-discover-topology-of-the-f.patch

Patch0053:      0053-ipaserver-dcerpc-catch-the-case-of-insuffient-permis.patch

Patch0054:      0054-fix-filtering-of-subdomain-based-trust-users.patch

Patch0055:      0055-ipa-kdb-do-not-fetch-client-principal-if-it-is-the-s.patch

Patch0056:      0056-ipa-replica-install-never-checks-for-7389-port.patch

Patch0057:      0057-Avoid-passing-non-terminated-string-to-is_master_hos.patch

Patch0058:      0058-ipa-sam-cache-gid-to-sid-and-uid-to-sid-requests-in-.patch

Patch0059:      0059-ipaserver-dcerpc-make-sure-to-always-return-unicode-.patch

Patch0060:      0060-trust-do-not-fetch-subdomains-in-case-shared-secret-.patch

Patch0061:      0061-Update-Dogtag-9-database-during-replica-installation.patch

Patch0062:      0062-Prohibit-deletion-of-active-subdomain-range.patch

Patch0063:      0063-extdom-do-not-return-results-from-the-wrong-domain.patch

Patch0064:      0064-Proxy-PKI-clone-ca-ee-ca-profileSubmit-URI.patch

Patch0065:      0065-Make-ipa-client-automount-backwards-compatible.patch

Patch0066:      0066-Convert-external-CA-chain-to-PKCS-7-before-passing-i.patch

Patch1001:      1001-Hide-pkinit-functionality-from-production-version.patch

Patch1002:      1002-Remove-pkinit-plugin.patch

Patch1003:      1003-Remove-pkinit-references-from-tool-man-pages.patch

Patch1004:      1004-Change-branding-to-IPA-and-Identity-Management.patch

Patch1005:      1005-Remove-pylint-from-build-process.patch

Patch1006:      1006-Remove-i18test-from-build-process.patch

Patch1007:      1007-Remove-ipa-backup-and-ipa-restore-functionality.patch

Patch1008:      ipa-centos-branding.patch

%if ! %{ONLY_CLIENT}

BuildRequires:  389-ds-base-devel >= 1.3.1

BuildRequires:  svrcore-devel

BuildRequires:  policycoreutils >= %{POLICYCOREUTILSVER}

BuildRequires:  systemd-units

BuildRequires:  samba-devel >= 4.0.5-1

BuildRequires:  samba-python

BuildRequires:  libwbclient-devel

BuildRequires:  libtalloc-devel

BuildRequires:  libtevent-devel

%endif # ONLY_CLIENT

BuildRequires:  nspr-devel

BuildRequires:  nss-devel

BuildRequires:  openssl-devel

BuildRequires:  openldap-devel

BuildRequires:  krb5-devel >= 1.11

BuildRequires:  krb5-workstation

BuildRequires:  libuuid-devel

BuildRequires:  libcurl-devel >= 7.21.7-2

BuildRequires:  xmlrpc-c-devel >= 1.27.4

BuildRequires:  popt-devel

BuildRequires:  autoconf

BuildRequires:  automake

BuildRequires:  m4

BuildRequires:  libtool

BuildRequires:  gettext

BuildRequires:  python-devel

BuildRequires:  python-ldap

BuildRequires:  python-setuptools

BuildRequires:  python-krbV

BuildRequires:  python-nss

BuildRequires:  python-netaddr

BuildRequires:  python-kerberos

BuildRequires:  python-rhsm

BuildRequires:  pyOpenSSL

BuildRequires:  libipa_hbac-python

BuildRequires:  python-memcached

BuildRequires:  sssd >= 1.9.2

BuildRequires:  python-lxml

BuildRequires:  python-pyasn1 >= 0.0.9a

BuildRequires:  python-dns

BuildRequires:  m2crypto

BuildRequires:  check

BuildRequires:  libsss_idmap-devel

BuildRequires:  libsss_nss_idmap-devel

BuildRequires:  java-1.7.0-openjdk

BuildRequires:  rhino

BuildRequires:  libverto-devel

BuildRequires:  systemd

BuildRequires:  libunistring-devel

BuildRequires:  diffstat

# Find out Kerberos middle version to infer ABI changes in DAL driver

# We cannot load DAL driver into KDC with wrong ABI.

# This is also needed to support ipa-devel repository where krb5 1.11 is available for F18

%global krb5_dal_version %{expand:%(echo "#include <kdb.h>"|cpp -dM|grep KRB5_KDB_DAL_MAJOR_VERSION|cut -d' ' -f3)}

%description

IPA is an integrated solution to provide centrally managed Identity (machine,

user, virtual machines, groups, authentication credentials), Policy

(configuration settings, access control information) and Audit (events,

logs, analysis thereof).

%if ! %{ONLY_CLIENT}

%package server

Summary: The IPA authentication server

Group: System Environment/Base

Requires: %{name}-python = %{version}-%{release}

Requires: %{name}-client = %{version}-%{release}

Requires: %{name}-admintools = %{version}-%{release}

Requires: 389-ds-base >= 1.3.1.3

Requires: openldap-clients > 2.4.35-4

Requires: nss >= 3.14.3-12.0

Requires: nss-tools >= 3.14.3-12.0

%if 0%{?krb5_dal_version} >= 4

Requires: krb5-server >= 1.11.3-46

%else

%if 0%{krb5_dal_version} == 3

# krb5 1.11 bumped DAL interface major version, a rebuild is needed

Requires: krb5-server < 1.11

Requires: krb5-server >= 1.10

%else

Requires: krb5-server >= 1.10

%endif

%endif

Requires: krb5-pkinit-openssl

Requires: cyrus-sasl-gssapi%{?_isa}

Requires: ntp

Requires: httpd >= 2.4.6-7

Requires: mod_wsgi

Requires: mod_auth_kerb >= 5.4-16

Requires: mod_nss >= 1.0.8-26

Requires: python-ldap

Requires: python-krbV

Requires: acl

Requires: python-pyasn1

Requires: memcached

Requires: python-memcached

Requires: systemd-units >= 38

Requires(pre): systemd-units

Requires(post): systemd-units

Requires: selinux-policy >= 3.12.1-65

Requires(post): selinux-policy-base

Requires: slapi-nis >= 0.47.7

Requires: pki-ca >= 10.0.4

Requires(preun): python systemd-units

Requires(postun): python systemd-units

Requires: python-dns

Requires: zip

Requires: policycoreutils >= %{POLICYCOREUTILSVER}

Requires: tar

Requires(pre): certmonger >= 0.65

Requires(pre): 389-ds-base >= 1.3.1.3

# We have a soft-requires on bind. It is an optional part of

# IPA but if it is configured we need a way to require versions

# that work for us.

Conflicts: bind-dyndb-ldap < 3.5

Conflicts: bind < 9.8.2-0.4.rc2

# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to

# member.

Conflicts: nss-pam-ldapd < 0.8.4

# ipa-tests subpackage was moved to separate srpm

Conflicts: ipa-tests < 3.3.3-9

%description server

IPA is an integrated solution to provide centrally managed Identity (machine,

user, virtual machines, groups, authentication credentials), Policy

(configuration settings, access control information) and Audit (events,

logs, analysis thereof). If you are installing an IPA server you need

to install this package (in other words, most people should NOT install

this package).

%package server-trust-ad

Summary: Virtual package to install packages required for Active Directory trusts

Group: System Environment/Base

Requires: %{name}-server = %version-%release

Requires: m2crypto

Requires: samba-python

Requires: samba >= 4.0.5-1

Requires: samba-winbind

Requires: libsss_idmap

Requires: libsss_nss_idmap-python

# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5

# on the installes where server-trust-ad subpackage is installed because

# IPA AD trusts cannot be used at the same time with the locator plugin

# since Winbindd will be configured in a different mode

Requires(post): %{_sbindir}/update-alternatives

Requires(post): python

Requires(postun): %{_sbindir}/update-alternatives

Requires(preun): %{_sbindir}/update-alternatives

%description server-trust-ad

Cross-realm trusts with Active Directory in IPA require working Samba 4

installation. This package is provided for convenience to install all required

dependencies at once.

%endif # ONLY_CLIENT

%package client

Summary: IPA authentication for use on clients

Group: System Environment/Base

Requires: %{name}-python = %{version}-%{release}

Requires: python-ldap

Requires: cyrus-sasl-gssapi%{?_isa}

Requires: ntp

Requires: krb5-workstation

Requires: authconfig

Requires: pam_krb5

Requires: wget

Requires: libcurl >= 7.21.7-2

Requires: xmlrpc-c >= 1.27.4

Requires: sssd >= 1.11.1

Requires: certmonger >= 0.65

Requires: nss-tools

Requires: bind-utils

Requires: oddjob-mkhomedir

Requires: python-krbV

Requires: python-dns

Requires: libsss_autofs

Requires: autofs

Requires: libnfsidmap

Requires: nfs-utils

Requires(post): policycoreutils

%description client

IPA is an integrated solution to provide centrally managed Identity (machine,

user, virtual machines, groups, authentication credentials), Policy

(configuration settings, access control information) and Audit (events,

logs, analysis thereof). If your network uses IPA for authentication,

this package should be installed on every client machine.

%if ! %{ONLY_CLIENT}

%package admintools

Summary: IPA administrative tools

Group: System Environment/Base

Requires: %{name}-python = %{version}-%{release}

Requires: %{name}-client = %{version}-%{release}

Requires: python-krbV

Requires: python-ldap

%description admintools

IPA is an integrated solution to provide centrally managed Identity (machine,

user, virtual machines, groups, authentication credentials), Policy

(configuration settings, access control information) and Audit (events,

logs, analysis thereof). This package provides command-line tools for

IPA administrators.

%endif # ONLY_CLIENT

%package python

Summary: Python libraries used by IPA

Group: System Environment/Libraries

Requires: python-kerberos

Requires: gnupg

Requires: iproute

Requires: keyutils

Requires: pyOpenSSL

Requires: python-nss

Requires: python-lxml

Requires: python-netaddr

Requires: libipa_hbac-python

%description python

IPA is an integrated solution to provide centrally managed Identity (machine,

user, virtual machines, groups, authentication credentials), Policy

(configuration settings, access control information) and Audit (events,

logs, analysis thereof). If you are using IPA you need to install this

package.

%prep

# RHEL spec file only: START

# Update timestamps on the files touched by a patch, to avoid non-equal

# .pyc/.pyo files across the multilib peers within a build, where "Level"

# is the patch prefix option (e.g. -p1)

# Taken from specfile for sssd and python-simplejson

UpdateTimestamps() {

  Level=$1

  PatchFile=$2

  # Locate the affected files:

  for f in $(diffstat $Level -l $PatchFile); do

    # Set the files to have the same timestamp as that of the patch:

    touch -r $PatchFile $f

  done

}

%setup -n freeipa-%{VERSION} -q

for p in %patches ; do

    %__patch -p1 -i $p

    UpdateTimestamps -p1 $p

done

# RHEL spec file only: END

%build

export CFLAGS="%{optflags} $CFLAGS"

export LDFLAGS="%{__global_ldflags} $LDFLAGS"

# use fedora18 platform which is based on fedora16 platform with systemd

# support + fedora18 changes

export SUPPORTED_PLATFORM=fedora18

# Force re-generate of platform support

rm -f ipapython/services.py

make version-update

cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..

%if ! %{ONLY_CLIENT}

cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..

cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..

%endif # ONLY_CLIENT

%if ! %{ONLY_CLIENT}

make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all

%else

make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client

%endif # ONLY_CLIENT

%install

rm -rf %{buildroot}

# use fedora18 platform which is based on fedora16 platform with systemd

# support + fedora18 changes

export SUPPORTED_PLATFORM=fedora18

# Force re-generate of platform support

rm -f ipapython/services.py

%if ! %{ONLY_CLIENT}

make install DESTDIR=%{buildroot}

# Start RHEL-7.0: Red Hat's Identity Management branding

cp %SOURCE1 %{buildroot}%{_usr}/share/ipa/ui/images/ipa-banner.png

# End RHEL-7.0

%else

make client-install DESTDIR=%{buildroot}

%endif # ONLY_CLIENT

%find_lang %{gettext_domain}

%if ! %{ONLY_CLIENT}

# Remove .la files from libtool - we don't want to package

# these files

rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la

rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la

rm %{buildroot}/%{plugin_dir}/libipa_winsync.la

rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la

rm %{buildroot}/%{plugin_dir}/libipa_uuid.la

rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la

rm %{buildroot}/%{plugin_dir}/libipa_lockout.la

rm %{buildroot}/%{plugin_dir}/libipa_cldap.la

rm %{buildroot}/%{plugin_dir}/libipa_dns.la

rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la

rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la

rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la

rm %{buildroot}/%{plugin_dir}/libipa_range_check.la

rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la

rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la

# Some user-modifiable HTML files are provided. Move these to /etc

# and link back.

mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html

mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore

mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysupgrade

mkdir %{buildroot}%{_usr}/share/ipa/html/

ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig.js \

    %{buildroot}%{_usr}/share/ipa/html/ffconfig.js

ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig_page.js \

    %{buildroot}%{_usr}/share/ipa/html/ffconfig_page.js

ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \

    %{buildroot}%{_usr}/share/ipa/html/ssbrowser.html

ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \

    %{buildroot}%{_usr}/share/ipa/html/unauthorized.html

ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \

    %{buildroot}%{_usr}/share/ipa/html/browserconfig.html

ln -s ../../../..%{_sysconfdir}/ipa/html/ipa_error.css \

    %{buildroot}%{_usr}/share/ipa/html/ipa_error.css

# So we can own our Apache configuration

mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/

/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf

/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf

/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf

mkdir -p %{buildroot}%{_usr}/share/ipa/html/

/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt

/bin/touch %{buildroot}%{_usr}/share/ipa/html/configure.jar

/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi

/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con

/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js

/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini

/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con

/bin/touch %{buildroot}%{_usr}/share/ipa/html/preferences.html

mkdir -p %{buildroot}%{_initrddir}

mkdir %{buildroot}%{_sysconfdir}/sysconfig/

install -m 644 init/ipa_memcached.conf %{buildroot}%{_sysconfdir}/sysconfig/ipa_memcached

# Web UI plugin dir

mkdir -p %{buildroot}%{_usr}/share/ipa/ui/js/plugins

# NOTE: systemd specific section

mkdir -p %{buildroot}%{_prefix}/lib/tmpfiles.d

install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_prefix}/lib/tmpfiles.d/%{name}.conf

# END

mkdir -p %{buildroot}%{_localstatedir}/run/

install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/

install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/

mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5

touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so

# NOTE: systemd specific section

mkdir -p %{buildroot}%{_unitdir}

install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service

install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service

# END

%endif # ONLY_CLIENT

mkdir -p %{buildroot}%{_sysconfdir}/ipa/

/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf

/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt

mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore

%if ! %{ONLY_CLIENT}

mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d

install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa

mkdir -p %{buildroot}%{_sysconfdir}/cron.d

(cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f  | \

    grep -v dcerpc | grep -v adtrustinstance | \

    sed -e 's,\.py.*$,.*,g' | sort -u | \

    sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list

%endif # ONLY_CLIENT

%clean

rm -rf %{buildroot}

%if ! %{ONLY_CLIENT}

%post server

# NOTE: systemd specific section

    /bin/systemctl --system daemon-reload 2>&1 || :

# END

if [ $1 -gt 1 ] ; then

    /bin/systemctl condrestart certmonger.service 2>&1 || :

fi

%posttrans server

# This must be run in posttrans so that updates from previous

# execution that may no longer be shipped are not applied.

/usr/sbin/ipa-ldap-updater --upgrade --quiet >/dev/null || :

/usr/sbin/ipa-upgradeconfig --quiet >/dev/null || :

# Restart IPA processes. This must be also run in postrans so that plugins

# and software is in consistent state

python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1

# NOTE: systemd specific section

if [  $? -eq 0 ]; then

    /bin/systemctl try-restart ipa.service >/dev/null 2>&1 || :

fi

# END

%preun server

if [ $1 = 0 ]; then

# NOTE: systemd specific section

    /bin/systemctl --quiet stop ipa.service || :

    /bin/systemctl --quiet disable ipa.service || :

# END

fi

%pre server

# Stop ipa_kpasswd if it exists before upgrading so we don't have a

# zombie process when we're done.

if [ -e /usr/sbin/ipa_kpasswd ]; then

# NOTE: systemd specific section

    /bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :

# END

fi

%postun server-trust-ad

if [ "$1" -ge "1" ]; then

    if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then

        %{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null

    fi

fi

%post server-trust-ad

%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \

        winbind_krb5_locator.so /dev/null 90

%posttrans server-trust-ad

python -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1

if [  $? -eq 0 ]; then

# NOTE: systemd specific section

    /bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :

# END

fi

%preun server-trust-ad

if [ $1 -eq 0 ]; then

    %{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null

fi

%endif # ONLY_CLIENT

%post client

if [ $1 -gt 1 ] ; then

    # Has the client been configured?

    restore=0

    test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')

    if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then

        if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf  2>/dev/null ; then

            echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew

            cat /etc/krb5.conf >> /etc/krb5.conf.ipanew

            mv /etc/krb5.conf.ipanew /etc/krb5.conf

            /sbin/restorecon /etc/krb5.conf

        fi

    fi

fi

%triggerin -n ipa-client -- openssh-server

# Has the client been configured?

restore=0

test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')

if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then

    if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then

        sed -r '

            /^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d

        ' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew

        if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then

            sed -ri '

                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/

                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/

            ' /etc/ssh/sshd_config.ipanew

        elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then

            sed -ri '

                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/

                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/

            ' /etc/ssh/sshd_config.ipanew

        elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then

            sed -ri '

                s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/

                s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/

            ' /etc/ssh/sshd_config.ipanew

        fi

        mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config

        /sbin/restorecon /etc/ssh/sshd_config

        chmod 600 /etc/ssh/sshd_config

        /bin/systemctl condrestart sshd.service 2>&1 || :

    fi

fi

%if ! %{ONLY_CLIENT}

%files server -f server-python.list

%defattr(-,root,root,-)

%doc COPYING README Contributors.txt

%{_sbindir}/ipa-ca-install

%{_sbindir}/ipa-dns-install

%{_sbindir}/ipa-server-install

%{_sbindir}/ipa-replica-conncheck

%{_sbindir}/ipa-replica-install

%{_sbindir}/ipa-replica-prepare

%{_sbindir}/ipa-replica-manage

%{_sbindir}/ipa-csreplica-manage

%{_sbindir}/ipa-server-certinstall

%{_sbindir}/ipa-ldap-updater

%{_sbindir}/ipa-compat-manage

%{_sbindir}/ipa-nis-manage

%{_sbindir}/ipa-managed-entries

%{_sbindir}/ipactl

%{_sbindir}/ipa-upgradeconfig

%{_sbindir}/ipa-advise

%{_libexecdir}/certmonger/dogtag-ipa-retrieve-agent-submit

%{_libexecdir}/ipa-otpd

%config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached

%dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/

%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/

# NOTE: systemd specific section

%{_prefix}/lib/tmpfiles.d/%{name}.conf

%attr(644,root,root) %{_unitdir}/ipa.service

%attr(644,root,root) %{_unitdir}/ipa_memcached.service

# END

%attr(644,root,root) %{_unitdir}/ipa-otpd.socket

%attr(644,root,root) %{_unitdir}/ipa-otpd@.service

%dir %{python_sitelib}/ipaserver

%dir %{python_sitelib}/ipaserver/install

%dir %{python_sitelib}/ipaserver/install/plugins

%dir %{python_sitelib}/ipaserver/advise

%dir %{python_sitelib}/ipaserver/advise/plugins

%dir %{python_sitelib}/ipaserver/plugins

%dir %{_libdir}/ipa/certmonger

%attr(755,root,root) %{_libdir}/ipa/certmonger/*

%dir %{_usr}/share/ipa

%{_usr}/share/ipa/wsgi.py*

%{_usr}/share/ipa/copy-schema-to-ca.py*

%{_usr}/share/ipa/*.ldif

%{_usr}/share/ipa/*.uldif

%{_usr}/share/ipa/*.template

%dir %{_usr}/share/ipa/advise

%dir %{_usr}/share/ipa/advise/legacy

%{_usr}/share/ipa/advise/legacy/*.template

%dir %{_usr}/share/ipa/ffextension

%{_usr}/share/ipa/ffextension/bootstrap.js

%{_usr}/share/ipa/ffextension/install.rdf

%{_usr}/share/ipa/ffextension/chrome.manifest

%dir %{_usr}/share/ipa/ffextension/chrome

%dir %{_usr}/share/ipa/ffextension/chrome/content

%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth.js

%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth_overlay.xul

%dir %{_usr}/share/ipa/ffextension/locale

%dir %{_usr}/share/ipa/ffextension/locale/en-US

%{_usr}/share/ipa/ffextension/locale/en-US/kerberosauth.properties

%dir %{_usr}/share/ipa/html

%{_usr}/share/ipa/html/ffconfig.js

%{_usr}/share/ipa/html/ffconfig_page.js

%{_usr}/share/ipa/html/ssbrowser.html

%{_usr}/share/ipa/html/browserconfig.html

%{_usr}/share/ipa/html/unauthorized.html

%{_usr}/share/ipa/html/ipa_error.css

%dir %{_usr}/share/ipa/migration

%{_usr}/share/ipa/migration/error.html

%{_usr}/share/ipa/migration/index.html

%{_usr}/share/ipa/migration/invalid.html

%{_usr}/share/ipa/migration/migration.py*

%dir %{_usr}/share/ipa/ui

%{_usr}/share/ipa/ui/index.html

%{_usr}/share/ipa/ui/login.html

%{_usr}/share/ipa/ui/logout.html

%{_usr}/share/ipa/ui/reset_password.html

%{_usr}/share/ipa/ui/*.ico

%{_usr}/share/ipa/ui/*.css

%{_usr}/share/ipa/ui/*.js

%{_usr}/share/ipa/ui/*.eot

%{_usr}/share/ipa/ui/*.svg

%{_usr}/share/ipa/ui/*.ttf

%{_usr}/share/ipa/ui/*.woff

%dir %{_usr}/share/ipa/ui/js

%dir %{_usr}/share/ipa/ui/js/dojo

%{_usr}/share/ipa/ui/js/dojo/dojo.js

%dir %{_usr}/share/ipa/ui/js/libs

%{_usr}/share/ipa/ui/js/libs/*.js

%dir %{_usr}/share/ipa/ui/js/freeipa

%{_usr}/share/ipa/ui/js/freeipa/app.js

%dir %{_usr}/share/ipa/ui/js/plugins

%dir %{_usr}/share/ipa/ui/images

%{_usr}/share/ipa/ui/images/*.png

%{_usr}/share/ipa/ui/images/*.gif

%dir %{_usr}/share/ipa/wsgi

%{_usr}/share/ipa/wsgi/plugins.py*

%dir %{_sysconfdir}/ipa

%dir %{_sysconfdir}/ipa/html

%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js