e3ffab
# Define ONLY_CLIENT to only make the ipa-admintools, ipa-client and ipa-python
e3ffab
# subpackages
99b6f7
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
99b6f7
e3ffab
# RHEL spec file only: START
99b6f7
%ifarch x86_64 %{ix86}
99b6f7
# Nothing, we want to force just building client on non-Intel
99b6f7
%else
99b6f7
%global ONLY_CLIENT 1
99b6f7
%endif
e3ffab
%global VERSION 4.1.0
e3ffab
# RHEL spec file only: END
e3ffab
e3ffab
%global alt_name freeipa
e3ffab
%if 0%{?rhel}
e3ffab
%global samba_version 4.0.5-1
e3ffab
%global selinux_policy_version 3.13.1-4
e3ffab
%else
e3ffab
%global samba_version 2:4.0.5-1
e3ffab
%global selinux_policy_version 3.12.1-179
e3ffab
%endif
99b6f7
99b6f7
%global plugin_dir %{_libdir}/dirsrv/plugins
99b6f7
%global gettext_domain ipa
e3ffab
%if 0%{?rhel}
e3ffab
%global platform_module rhel
e3ffab
%else
e3ffab
%global platform_module fedora
e3ffab
%endif
99b6f7
9991ea
%define _hardened_build 1
9991ea
99b6f7
Name:           ipa
e3ffab
Version:        4.1.0
e3ffab
Release:        18%{?dist}
99b6f7
Summary:        The Identity, Policy and Audit system
99b6f7
99b6f7
Group:          System Environment/Base
99b6f7
License:        GPLv3+
99b6f7
URL:            http://www.freeipa.org/
99b6f7
Source0:        http://www.freeipa.org/downloads/src/freeipa-%{VERSION}.tar.gz
e3ffab
# RHEL spec file only: START: Change branding to IPA and Identity-Management
e3ffab
Source1:        header-logo.png
e3ffab
Source2:        login-screen-background.jpg
e3ffab
Source3:        login-screen-logo.png
e3ffab
Source4:        product-name.png
e3ffab
# RHEL spec file only: END: Change branding to IPA and Identity-Management
99b6f7
BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
99b6f7
e3ffab
# RHEL spec file only: START
e3ffab
Patch0001:      0001-Do-not-check-if-port-8443-is-available-in-step-2-of-.patch
e3ffab
Patch0002:      0002-Add-ipaSshPubkey-and-gidNumber-to-the-ACI-to-read-ID.patch
e3ffab
Patch0003:      0003-Fix-dns-zonemgr-validation-regression.patch
e3ffab
Patch0004:      0004-Handle-profile-changes-in-dogtag-ipa-ca-renew-agent.patch
e3ffab
Patch0005:      0005-Do-not-wait-for-new-CA-certificate-to-appear-in-LDAP.patch
e3ffab
Patch0006:      0006-Fail-if-certmonger-can-t-see-new-CA-certificate-in-L.patch
e3ffab
Patch0007:      0007-Fix-possible-NULL-dereference-in-ipa-kdb.patch
e3ffab
Patch0008:      0008-Fix-memory-leaks-in-ipa-extdom-extop.patch
e3ffab
Patch0009:      0009-Fix-various-bugs-in-ipa-opt-counter-and-ipa-otp-last.patch
e3ffab
Patch0010:      0010-Fix-memory-leak-in-ipa-pwd-extop.patch
e3ffab
Patch0011:      0011-Fix-memory-leaks-in-ipa-join.patch
e3ffab
Patch0012:      0012-Fix-various-bugs-in-ipap11helper.patch
e3ffab
Patch0013:      0013-Deadlock-in-schema-compat-plugin-between-automember_.patch
e3ffab
Patch0014:      0014-Stop-dirsrv-last-in-ipactl-stop.patch
e3ffab
Patch0015:      0015-Fix-upgrade-do-not-use-invalid-ldap-connection.patch
e3ffab
Patch0016:      0016-Ensure-that-a-password-exists-after-OTP-validation.patch
e3ffab
Patch0017:      0017-ipa-restore-Don-t-crash-if-AD-trust-is-not-installed.patch
e3ffab
Patch0018:      0018-ranges-prohibit-setting-rid-base-with-ipa-trust-ad-p.patch
e3ffab
Patch0019:      0019-ldapupdater-set-baserid-to-0-for-ipa-ad-trust-posix-.patch
e3ffab
Patch0020:      0020-idrange-include-raw-range-type-in-output.patch
e3ffab
Patch0021:      0021-webui-prohibit-setting-rid-base-with-ipa-trust-ad-po.patch
e3ffab
Patch0022:      0022-Fix-CA-certificate-backup-and-restore.patch
e3ffab
Patch0023:      0023-Fix-DNS-installer-adds-invalid-zonemgr-email.patch
e3ffab
Patch0024:      0024-ipaplatform-Use-the-dirsrv-service-not-target.patch
e3ffab
Patch0025:      0025-Fix-DNS-policy-upgrade-raises-asertion-error.patch
e3ffab
Patch0026:      0026-Fix-upgrade-referint-plugin.patch
e3ffab
Patch0027:      0027-Upgrade-fix-trusts-objectclass-violationi.patch
e3ffab
Patch0028:      0028-Produce-better-error-in-group-add-command.patch
e3ffab
Patch0029:      0029-Search-using-proper-scope-when-connecting-CA-instanc.patch
e3ffab
Patch0030:      0030-Fix-zonemgr-must-be-unicode-value.patch
e3ffab
Patch0031:      0031-Fix-warning-message-should-not-contain-CLI-commands.patch
e3ffab
Patch0032:      0032-Fix-wrong-expiration-date-on-renewed-IPA-CA-certific.patch
e3ffab
Patch0033:      0033-Do-not-restore-SELinux-settings-that-were-not-backed.patch
e3ffab
Patch0034:      0034-Improve-otptoken-help-messages.patch
e3ffab
Patch0035:      0035-Ensure-users-exist-when-assigning-tokens-to-them.patch
e3ffab
Patch0036:      0036-Enable-QR-code-display-by-default-in-otptoken-add.patch
e3ffab
Patch0037:      0037-Show-warning-instead-of-error-if-CA-did-not-start.patch
e3ffab
Patch0038:      0038-webui-fix-potential-XSS-vulnerabilities.patch
e3ffab
Patch0039:      0039-Raise-right-exception-if-domain-name-is-not-valid.patch
e3ffab
Patch0040:      0040-Restore-file-extended-attributes-and-SELinux-context.patch
e3ffab
Patch0041:      0041-restore-clear-httpd-ccache-after-restore.patch
e3ffab
Patch0042:      0042-Fix-user-group-ignore-attribute-in-migration-plugin.patch
e3ffab
Patch0043:      0043-Fix-filtering-of-enctypes-in-server-code.patch
e3ffab
Patch0044:      0044-Add-asn1c-generated-code-for-keytab-controls.patch
e3ffab
Patch0045:      0045-Use-asn1c-helpers-to-encode-decode-the-getkeytab-con.patch
e3ffab
Patch0046:      0046-Fix-read_ip_addresses-should-return-ipaddr-object.patch
e3ffab
Patch0047:      0047-Use-correct-service-name-in-cainstance.backup_config.patch
e3ffab
Patch0048:      0048-ipa-restore-Check-if-directory-is-provided-better-er.patch
e3ffab
Patch0049:      0049-Stop-tracking-certificates-before-restoring-them-in-.patch
e3ffab
Patch0050:      0050-Fix-detection-of-encoding-in-zonemgr-option.patch
e3ffab
Patch0051:      0051-webui-use-domain-name-instead-of-domain-SID-in-idran.patch
e3ffab
Patch0052:      0052-webui-normalize-idview-tab-labels.patch
e3ffab
Patch0053:      0053-copy_schema_to_ca-Fallback-to-old-import-location-fo.patch
e3ffab
Patch0054:      0054-Remove-redefinition-of-LOG-from-ipa-otp-lasttoken.patch
e3ffab
Patch0055:      0055-Unload-P11_Helper-object-s-library-when-it-is-finali.patch
e3ffab
Patch0056:      0056-Fix-Kerberos-error-handling-in-ipa-sam.patch
e3ffab
Patch0057:      0057-Fix-unchecked-return-value-in-ipa-kdb.patch
e3ffab
Patch0058:      0058-Fix-unchecked-return-values-in-ipa-winsync.patch
e3ffab
Patch0059:      0059-Fix-unchecked-return-value-in-ipa-join.patch
e3ffab
Patch0060:      0060-Fix-unchecked-return-value-in-krb5-common-utils.patch
e3ffab
Patch0061:      0061-Fix-memory-leak-in-GetKeytabControl-asn1-code.patch
e3ffab
Patch0062:      0062-AD-trust-improve-trust-validation.patch
e3ffab
Patch0063:      0063-Add-TLS-1.2-to-the-protocol-list-in-mod_nss-config.patch
e3ffab
Patch0064:      0064-webui-add-radius-fields-to-user-page.patch
e3ffab
Patch0065:      0065-Fix-zonemgr-option-encoding-detection.patch
e3ffab
Patch0066:      0066-Catch-USBError-during-YubiKey-location.patch
e3ffab
Patch0067:      0067-Use-NSS-protocol-range-API-to-set-available-TLS-prot.patch
e3ffab
Patch0068:      0068-Throw-zonemgr-error-message-before-installation-proc.patch
e3ffab
Patch0069:      0069-certs-Fix-incorrect-flag-handling-in-load_cacert.patch
e3ffab
Patch0070:      0070-Preliminary-refactoring-of-libotp-files.patch
e3ffab
Patch0071:      0071-Move-authentication-configuration-cache-into-libotp.patch
e3ffab
Patch0072:      0072-Enable-last-token-deletion-when-password-auth-type-i.patch
e3ffab
Patch0073:      0073-add-hosts-and-hostgroup-options-to-allow-retrieve-ke.patch
e3ffab
Patch0074:      0074-hosts-Display-assigned-ID-view-by-default-in-host-fi.patch
e3ffab
Patch0075:      0075-Prefer-TCP-connections-to-UDP-in-krb5-clients.patch
e3ffab
Patch0076:      0076-webui-fix-service-unprovisioning.patch
e3ffab
Patch0077:      0077-webui-increase-duration-of-notification-messages.patch
e3ffab
Patch0078:      0078-Fix-automatic-CA-cert-renewal-endless-loop-in-dogtag.patch
e3ffab
Patch0079:      0079-Do-not-renew-the-IPA-CA-cert-by-serial-number-in-dog.patch
e3ffab
Patch0080:      0080-Improve-validation-of-instance-and-backend-options-i.patch
e3ffab
Patch0081:      0081-revert-removal-of-cn-attribute-from-idnsRecord.patch
e3ffab
Patch0082:      0082-Check-subject-name-encoding-in-ipa-cacert-manage-ren.patch
e3ffab
Patch0083:      0083-Refer-the-user-to-freeipa.org-when-something-goes-wr.patch
e3ffab
Patch0084:      0084-Show-SSHFP-record-containing-space-in-fingerprint.patch
e3ffab
Patch0085:      0085-Always-add-etc-hosts-record-when-DNS-is-being-config.patch
e3ffab
Patch0086:      0086-Avoid-calling-ldap-functions-without-a-context.patch
e3ffab
Patch0087:      0087-Remove-the-removal-of-the-ccache.patch
e3ffab
Patch0088:      0088-Fix-Upgrade-forwardzones-zones-after-adding-newer-re.patch
e3ffab
Patch0089:      0089-Fix-zone-find-during-forwardzone-upgrade.patch
e3ffab
Patch0090:      0090-migrate-ds-fix-compat-plugin-check.patch
e3ffab
Patch0091:      0091-rpcclient-use-json_encode_binary-for-verbose-output.patch
e3ffab
Patch0092:      0092-Remove-ipanttrustauthincoming-ipanttrustauthoutgoing.patch
e3ffab
Patch0093:      0093-Abort-backup-restoration-on-not-matching-host.patch
e3ffab
Patch0094:      0094-Fix-ipa-restore-on-systems-without-IPA-installed.patch
e3ffab
Patch0095:      0095-Remove-RUV-from-LDIF-files-before-using-them-in-ipa-.patch
e3ffab
Patch0096:      0096-Fix-CA-certificate-renewal-syslog-alert.patch
e3ffab
Patch0097:      0097-Do-not-crash-on-unknown-services-in-installutils.sto.patch
e3ffab
Patch0098:      0098-Restart-dogtag-when-its-server-certificate-is-renewe.patch
e3ffab
Patch0099:      0099-Make-certificate-renewal-process-synchronized.patch
e3ffab
Patch0100:      0100-Fix-validation-of-ipa-restore-options.patch
e3ffab
Patch0101:      0101-Allow-PassSync-user-to-locate-and-update-NT-users.patch
e3ffab
Patch0102:      0102-Allow-Replication-Administrators-manipulate-Winsync-.patch
e3ffab
Patch0103:      0103-Do-not-assume-certmonger-is-running-in-httpinstance.patch
e3ffab
Patch0104:      0104-Replication-Administrators-cannot-remove-replication.patch
e3ffab
Patch0105:      0105-Put-LDIF-files-to-their-original-location-in-ipa-res.patch
e3ffab
Patch0106:      0106-Add-anonymous-read-ACI-for-DUA-profile.patch
e3ffab
Patch0107:      0107-Revert-Make-all-ipatokenTOTP-attributes-mandatory.patch
e3ffab
Patch0108:      0108-Create-correct-log-directories-during-full-restore-i.patch
e3ffab
Patch0109:      0109-Do-not-crash-when-replica-is-unreachable-in-ipa-rest.patch
e3ffab
Patch0110:      0110-idviews-Allow-setting-ssh-public-key-on-ipauseroverr.patch
e3ffab
Patch0111:      0111-Fix-ipa-pwd-extop-global-configuration-caching.patch
e3ffab
Patch0112:      0112-group-detach-does-not-add-correct-objectclasses.patch
99b6f7
99b6f7
Patch1001:      1001-Hide-pkinit-functionality-from-production-version.patch
99b6f7
Patch1002:      1002-Remove-pkinit-plugin.patch
99b6f7
Patch1003:      1003-Remove-pkinit-references-from-tool-man-pages.patch
99b6f7
Patch1004:      1004-Change-branding-to-IPA-and-Identity-Management.patch
99b6f7
Patch1005:      1005-Remove-pylint-from-build-process.patch
99b6f7
Patch1006:      1006-Remove-i18test-from-build-process.patch
e3ffab
Patch1007:      1007-Do-not-build-tests.patch
e3ffab
Patch1008:      1008-RCUE.patch
e3ffab
Patch1009:      1009-Do-not-allow-installation-in-FIPS-mode.patch
e3ffab
Patch1010:      1010-Disable-DNSSEC-support.patch
e3ffab
Patch1011:      1011-Disable-TLS-1.2-in-nss.conf-until-mod_nss-supports-i.patch
e3ffab
Patch1012:      1012-Expand-the-token-auth-sync-windows.patch
e3ffab
Patch1013:      1013-ipa-kdb-reject-principals-from-disabled-domains-as-a.patch
f4fe3d
Patch1014:      ipa-centos-branding.patch
e3ffab
# RHEL spec file only: END
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
e3ffab
BuildRequires:  389-ds-base-devel >= 1.3.3.1-10
99b6f7
BuildRequires:  svrcore-devel
e3ffab
BuildRequires:  policycoreutils >= 2.1.14-37
99b6f7
BuildRequires:  systemd-units
e3ffab
BuildRequires:  samba-devel >= %{samba_version}
99b6f7
BuildRequires:  samba-python
99b6f7
BuildRequires:  libwbclient-devel
99b6f7
BuildRequires:  libtalloc-devel
99b6f7
BuildRequires:  libtevent-devel
99b6f7
%endif # ONLY_CLIENT
99b6f7
BuildRequires:  nspr-devel
99b6f7
BuildRequires:  nss-devel
99b6f7
BuildRequires:  openssl-devel
99b6f7
BuildRequires:  openldap-devel
99b6f7
BuildRequires:  krb5-devel >= 1.11
99b6f7
BuildRequires:  krb5-workstation
99b6f7
BuildRequires:  libuuid-devel
99b6f7
BuildRequires:  libcurl-devel >= 7.21.7-2
99b6f7
BuildRequires:  xmlrpc-c-devel >= 1.27.4
99b6f7
BuildRequires:  popt-devel
99b6f7
BuildRequires:  autoconf
99b6f7
BuildRequires:  automake
99b6f7
BuildRequires:  m4
99b6f7
BuildRequires:  libtool
99b6f7
BuildRequires:  gettext
99b6f7
BuildRequires:  python-devel
99b6f7
BuildRequires:  python-ldap
99b6f7
BuildRequires:  python-setuptools
99b6f7
BuildRequires:  python-krbV
99b6f7
BuildRequires:  python-nss
99b6f7
BuildRequires:  python-netaddr
e3ffab
BuildRequires:  python-kerberos >= 1.1-15
99b6f7
BuildRequires:  python-rhsm
99b6f7
BuildRequires:  pyOpenSSL
e3ffab
# RHEL spec file only: DELETED: Remove pylint from build process
e3ffab
# RHEL spec file only: DELETED: Remove i18test from build process
99b6f7
BuildRequires:  libipa_hbac-python
99b6f7
BuildRequires:  python-memcached
99b6f7
BuildRequires:  sssd >= 1.9.2
99b6f7
BuildRequires:  python-lxml
99b6f7
BuildRequires:  python-pyasn1 >= 0.0.9a
e3ffab
BuildRequires:  python-qrcode-core >= 5.0.0
e3ffab
BuildRequires:  python-dns >= 1.11.1-2
99b6f7
BuildRequires:  m2crypto
99b6f7
BuildRequires:  check
99b6f7
BuildRequires:  libsss_idmap-devel
e3ffab
BuildRequires:  libsss_nss_idmap-devel >= 1.12.2
e3ffab
BuildRequires:  java-headless
031d60
BuildRequires:  rhino
99b6f7
BuildRequires:  libverto-devel
99b6f7
BuildRequires:  systemd
99b6f7
BuildRequires:  libunistring-devel
e3ffab
# RHEL spec file only: START
99b6f7
BuildRequires:  diffstat
e3ffab
# RHEL spec file only: END
e3ffab
BuildRequires:  python-lesscpy
e3ffab
BuildRequires:  python-yubico
e3ffab
BuildRequires:  python-backports-ssl_match_hostname
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
99b6f7
%description
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof).
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%package server
99b6f7
Summary: The IPA authentication server
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: %{name}-client = %{version}-%{release}
99b6f7
Requires: %{name}-admintools = %{version}-%{release}
e3ffab
Requires: 389-ds-base >= 1.3.3.1-10
99b6f7
Requires: openldap-clients > 2.4.35-4
99b6f7
Requires: nss >= 3.14.3-12.0
99b6f7
Requires: nss-tools >= 3.14.3-12.0
e3ffab
Requires: krb5-server >= 1.11.5-5
99b6f7
Requires: krb5-pkinit-openssl
99b6f7
Requires: cyrus-sasl-gssapi%{?_isa}
99b6f7
Requires: ntp
9991ea
Requires: httpd >= 2.4.6-7
99b6f7
Requires: mod_wsgi
99b6f7
Requires: mod_auth_kerb >= 5.4-16
9991ea
Requires: mod_nss >= 1.0.8-26
e3ffab
Requires: python-ldap >= 2.4.15
99b6f7
Requires: python-krbV
99b6f7
Requires: acl
99b6f7
Requires: python-pyasn1
99b6f7
Requires: memcached
99b6f7
Requires: python-memcached
e3ffab
Requires: dbus-python
99b6f7
Requires: systemd-units >= 38
99b6f7
Requires(pre): systemd-units
99b6f7
Requires(post): systemd-units
e3ffab
Requires: selinux-policy >= %{selinux_policy_version}
99b6f7
Requires(post): selinux-policy-base
e3ffab
Requires: slapi-nis >= 0.54-2
e3ffab
Requires: pki-ca >= 10.1.2-5
99b6f7
Requires(preun): python systemd-units
99b6f7
Requires(postun): python systemd-units
e3ffab
Requires: python-dns >= 1.11.1-2
99b6f7
Requires: zip
e3ffab
Requires: policycoreutils >= 2.1.14-37
99b6f7
Requires: tar
e3ffab
Requires(pre): certmonger >= 0.75.14-2
e3ffab
Requires(pre): 389-ds-base >= 1.3.3.1-10
e3ffab
Requires: fontawesome-fonts
e3ffab
Requires: open-sans-fonts
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
e3ffab
# RHEL spec file only: START
e3ffab
Requires: redhat-access-plugin-ipa
e3ffab
# RHEL spec file only: END
e3ffab
e3ffab
Conflicts: %{alt_name}-server
e3ffab
Obsoletes: %{alt_name}-server < %{version}
e3ffab
e3ffab
# RHEL spec file only: DELETED
99b6f7
99b6f7
# We have a soft-requires on bind. It is an optional part of
99b6f7
# IPA but if it is configured we need a way to require versions
99b6f7
# that work for us.
e3ffab
Conflicts: bind-dyndb-ldap < 5.0
99b6f7
Conflicts: bind < 9.8.2-0.4.rc2
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
99b6f7
# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to
99b6f7
# member.
99b6f7
Conflicts: nss-pam-ldapd < 0.8.4
99b6f7
e3ffab
# RHEL spec file only: START: Do not build tests
9991ea
# ipa-tests subpackage was moved to separate srpm
9991ea
Conflicts: ipa-tests < 3.3.3-9
e3ffab
# RHEL spec file only: END: Do not build tests
9991ea
99b6f7
%description server
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If you are installing an IPA server you need
99b6f7
to install this package (in other words, most people should NOT install
99b6f7
this package).
99b6f7
99b6f7
99b6f7
%package server-trust-ad
99b6f7
Summary: Virtual package to install packages required for Active Directory trusts
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-server = %version-%release
99b6f7
Requires: m2crypto
99b6f7
Requires: samba-python
e3ffab
Requires: samba >= %{samba_version}
99b6f7
Requires: samba-winbind
99b6f7
Requires: libsss_idmap
99b6f7
Requires: libsss_nss_idmap-python
99b6f7
# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5
99b6f7
# on the installes where server-trust-ad subpackage is installed because
99b6f7
# IPA AD trusts cannot be used at the same time with the locator plugin
99b6f7
# since Winbindd will be configured in a different mode
99b6f7
Requires(post): %{_sbindir}/update-alternatives
99b6f7
Requires(post): python
99b6f7
Requires(postun): %{_sbindir}/update-alternatives
99b6f7
Requires(preun): %{_sbindir}/update-alternatives
99b6f7
e3ffab
Conflicts: %{alt_name}-server-trust-ad
e3ffab
Obsoletes: %{alt_name}-server-trust-ad < %{version}
e3ffab
99b6f7
%description server-trust-ad
99b6f7
Cross-realm trusts with Active Directory in IPA require working Samba 4
99b6f7
installation. This package is provided for convenience to install all required
99b6f7
dependencies at once.
99b6f7
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
99b6f7
%package client
99b6f7
Summary: IPA authentication for use on clients
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: python-ldap
99b6f7
Requires: cyrus-sasl-gssapi%{?_isa}
99b6f7
Requires: ntp
99b6f7
Requires: krb5-workstation
99b6f7
Requires: authconfig
99b6f7
Requires: pam_krb5
99b6f7
Requires: wget
99b6f7
Requires: libcurl >= 7.21.7-2
99b6f7
Requires: xmlrpc-c >= 1.27.4
e3ffab
Requires: sssd >= 1.12.2-38
e3ffab
Requires: certmonger >= 0.75.14-2
99b6f7
Requires: nss-tools
99b6f7
Requires: bind-utils
99b6f7
Requires: oddjob-mkhomedir
99b6f7
Requires: python-krbV
e3ffab
Requires: python-dns >= 1.11.1
99b6f7
Requires: libsss_autofs
99b6f7
Requires: autofs
99b6f7
Requires: libnfsidmap
99b6f7
Requires: nfs-utils
e3ffab
Requires: python-backports-ssl_match_hostname
99b6f7
Requires(post): policycoreutils
99b6f7
e3ffab
Conflicts: %{alt_name}-client
e3ffab
Obsoletes: %{alt_name}-client < %{version}
e3ffab
99b6f7
%description client
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If your network uses IPA for authentication,
99b6f7
this package should be installed on every client machine.
99b6f7
99b6f7
99b6f7
%package admintools
99b6f7
Summary: IPA administrative tools
99b6f7
Group: System Environment/Base
99b6f7
Requires: %{name}-python = %{version}-%{release}
99b6f7
Requires: %{name}-client = %{version}-%{release}
99b6f7
Requires: python-krbV
99b6f7
Requires: python-ldap
99b6f7
e3ffab
Conflicts: %{alt_name}-admintools
e3ffab
Obsoletes: %{alt_name}-admintools < %{version}
e3ffab
99b6f7
%description admintools
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). This package provides command-line tools for
99b6f7
IPA administrators.
99b6f7
99b6f7
%package python
99b6f7
Summary: Python libraries used by IPA
99b6f7
Group: System Environment/Libraries
e3ffab
Requires: python-kerberos >= 1.1-15
99b6f7
Requires: gnupg
99b6f7
Requires: iproute
99b6f7
Requires: keyutils
99b6f7
Requires: pyOpenSSL
e3ffab
Requires: python-nss >= 0.16
99b6f7
Requires: python-lxml
99b6f7
Requires: python-netaddr
99b6f7
Requires: libipa_hbac-python
e3ffab
Requires: python-qrcode-core >= 5.0.0
e3ffab
Requires: python-pyasn1
e3ffab
Requires: python-dateutil
e3ffab
Requires: python-yubico
e3ffab
e3ffab
Conflicts: %{alt_name}-python
e3ffab
Obsoletes: %{alt_name}-python < %{version}
99b6f7
99b6f7
%description python
99b6f7
IPA is an integrated solution to provide centrally managed Identity (machine,
99b6f7
user, virtual machines, groups, authentication credentials), Policy
99b6f7
(configuration settings, access control information) and Audit (events,
99b6f7
logs, analysis thereof). If you are using IPA you need to install this
99b6f7
package.
99b6f7
e3ffab
# RHEL spec file only: DELETED: Do not build tests
e3ffab
e3ffab
99b6f7
%prep
99b6f7
# RHEL spec file only: START
99b6f7
# Update timestamps on the files touched by a patch, to avoid non-equal
99b6f7
# .pyc/.pyo files across the multilib peers within a build, where "Level"
99b6f7
# is the patch prefix option (e.g. -p1)
99b6f7
# Taken from specfile for sssd and python-simplejson
99b6f7
UpdateTimestamps() {
99b6f7
  Level=$1
99b6f7
  PatchFile=$2
99b6f7
99b6f7
  # Locate the affected files:
99b6f7
  for f in $(diffstat $Level -l $PatchFile); do
99b6f7
    # Set the files to have the same timestamp as that of the patch:
99b6f7
    touch -r $PatchFile $f
99b6f7
  done
99b6f7
}
99b6f7
99b6f7
%setup -n freeipa-%{VERSION} -q
99b6f7
99b6f7
for p in %patches ; do
99b6f7
    %__patch -p1 -i $p
99b6f7
    UpdateTimestamps -p1 $p
99b6f7
done
e3ffab
e3ffab
# Red Hat's Identity Management branding
e3ffab
cp %SOURCE1 install/ui/images/header-logo.png
e3ffab
cp %SOURCE2 install/ui/images/login-screen-background.jpg
e3ffab
cp %SOURCE3 install/ui/images/login-screen-logo.png
e3ffab
cp %SOURCE4 install/ui/images/product-name.png
99b6f7
# RHEL spec file only: END
99b6f7
99b6f7
%build
e3ffab
# UI compilation segfaulted on some arches when the stack was lower (#1040576)
e3ffab
export JAVA_STACK_SIZE="8m"
e3ffab
9991ea
export CFLAGS="%{optflags} $CFLAGS"
9991ea
export LDFLAGS="%{__global_ldflags} $LDFLAGS"
e3ffab
export SUPPORTED_PLATFORM=%{platform_module}
e3ffab
99b6f7
# Force re-generate of platform support
e3ffab
export IPA_VENDOR_VERSION_SUFFIX=-%{release}
e3ffab
rm -f ipapython/version.py
e3ffab
rm -f ipaplatform/services.py
e3ffab
rm -f ipaplatform/tasks.py
e3ffab
rm -f ipaplatform/paths.py
e3ffab
# RHEL spec file only: START: Disable DNSSEC support
e3ffab
rm -f ipapython/p11helper.py
e3ffab
rm -f ipaserver/install/dnskeysyncinstance.py
e3ffab
rm -f ipaserver/install/odsexporterinstance.py
e3ffab
rm -f ipaserver/install/opendnssecinstance.py
e3ffab
# RHEL spec file only: END: Disable DNSSEC support
99b6f7
make version-update
99b6f7
cd ipa-client; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
cd daemons; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir} --with-openldap; cd ..
99b6f7
cd install; ../autogen.sh --prefix=%{_usr} --sysconfdir=%{_sysconfdir} --localstatedir=%{_localstatedir} --libdir=%{_libdir} --mandir=%{_mandir}; cd ..
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} all
99b6f7
%else
99b6f7
make IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} client
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%install
99b6f7
rm -rf %{buildroot}
e3ffab
export SUPPORTED_PLATFORM=%{platform_module}
99b6f7
# Force re-generate of platform support
e3ffab
export IPA_VENDOR_VERSION_SUFFIX=-%{release}
e3ffab
rm -f ipapython/version.py
e3ffab
rm -f ipaplatform/services.py
e3ffab
rm -f ipaplatform/tasks.py
e3ffab
rm -f ipaplatform/paths.py
e3ffab
make version-update
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
make install DESTDIR=%{buildroot}
99b6f7
%else
99b6f7
make client-install DESTDIR=%{buildroot}
99b6f7
%endif # ONLY_CLIENT
99b6f7
%find_lang %{gettext_domain}
99b6f7
99b6f7
e3ffab
mkdir -p %{buildroot}%{_usr}/share/ipa
e3ffab
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
# Remove .la files from libtool - we don't want to package
99b6f7
# these files
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_pwd_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_enrollment_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_winsync.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_repl_version.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_uuid.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_modrdn.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_lockout.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_cldap.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_dns.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_sidgen.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_sidgen_task.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la
99b6f7
rm %{buildroot}/%{plugin_dir}/libipa_range_check.la
e3ffab
rm %{buildroot}/%{plugin_dir}/libipa_otp_counter.la
e3ffab
rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la
99b6f7
rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la
99b6f7
rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la
99b6f7
99b6f7
# Some user-modifiable HTML files are provided. Move these to /etc
99b6f7
# and link back.
99b6f7
mkdir -p %{buildroot}/%{_sysconfdir}/ipa/html
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysrestore
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/cache/ipa/sysupgrade
99b6f7
mkdir %{buildroot}%{_usr}/share/ipa/html/
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig.js \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ffconfig.js
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ffconfig_page.js \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ffconfig_page.js
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/ssbrowser.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/ssbrowser.html
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/unauthorized.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/unauthorized.html
99b6f7
ln -s ../../../..%{_sysconfdir}/ipa/html/browserconfig.html \
99b6f7
    %{buildroot}%{_usr}/share/ipa/html/browserconfig.html
99b6f7
99b6f7
# So we can own our Apache configuration
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
99b6f7
mkdir -p %{buildroot}%{_usr}/share/ipa/html/
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/configure.jar
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con
99b6f7
/bin/touch %{buildroot}%{_usr}/share/ipa/html/preferences.html
99b6f7
mkdir -p %{buildroot}%{_initrddir}
99b6f7
mkdir %{buildroot}%{_sysconfdir}/sysconfig/
99b6f7
install -m 644 init/ipa_memcached.conf %{buildroot}%{_sysconfdir}/sysconfig/ipa_memcached
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
e3ffab
e3ffab
# dnssec daemons
e3ffab
mkdir -p %{buildroot}%{_libexecdir}/ipa/
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
99b6f7
# Web UI plugin dir
99b6f7
mkdir -p %{buildroot}%{_usr}/share/ipa/ui/js/plugins
99b6f7
99b6f7
# NOTE: systemd specific section
e3ffab
mkdir -p %{buildroot}%{_tmpfilesdir}
e3ffab
install -m 0644 init/systemd/ipa.conf.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf
99b6f7
# END
99b6f7
99b6f7
mkdir -p %{buildroot}%{_localstatedir}/run/
99b6f7
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa_memcached/
99b6f7
install -d -m 0700 %{buildroot}%{_localstatedir}/run/ipa/
99b6f7
99b6f7
mkdir -p %{buildroot}%{_libdir}/krb5/plugins/libkrb5
99b6f7
touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
99b6f7
99b6f7
# NOTE: systemd specific section
99b6f7
mkdir -p %{buildroot}%{_unitdir}
99b6f7
install -m 644 init/systemd/ipa.service %{buildroot}%{_unitdir}/ipa.service
99b6f7
install -m 644 init/systemd/ipa_memcached.service %{buildroot}%{_unitdir}/ipa_memcached.service
99b6f7
# END
e3ffab
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa/backup
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/ipa/
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/ipa/default.conf
99b6f7
/bin/touch %{buildroot}%{_sysconfdir}/ipa/ca.crt
e3ffab
mkdir -p %{buildroot}%{_sysconfdir}/ipa/dnssec
e3ffab
mkdir -p %{buildroot}%{_sysconfdir}/ipa/nssdb
99b6f7
mkdir -p %{buildroot}/%{_localstatedir}/lib/ipa-client/sysrestore
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
99b6f7
install -pm 644 contrib/completion/ipa.bash_completion %{buildroot}%{_sysconfdir}/bash_completion.d/ipa
e3ffab
e3ffab
%if ! %{ONLY_CLIENT}
99b6f7
mkdir -p %{buildroot}%{_sysconfdir}/cron.d
99b6f7
99b6f7
(cd %{buildroot}/%{python_sitelib}/ipaserver && find . -type f  | \
99b6f7
    grep -v dcerpc | grep -v adtrustinstance | \
99b6f7
    sed -e 's,\.py.*$,.*,g' | sort -u | \
99b6f7
    sed -e 's,\./,%%{python_sitelib}/ipaserver/,g' ) >server-python.list
e3ffab
e3ffab
# RHEL spec file only: DELETED: Do not build tests
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%clean
99b6f7
rm -rf %{buildroot}
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%post server
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl --system daemon-reload 2>&1 || :
99b6f7
# END
99b6f7
if [ $1 -gt 1 ] ; then
99b6f7
    /bin/systemctl condrestart certmonger.service 2>&1 || :
99b6f7
fi
99b6f7
99b6f7
%posttrans server
99b6f7
# This must be run in posttrans so that updates from previous
99b6f7
# execution that may no longer be shipped are not applied.
99b6f7
/usr/sbin/ipa-ldap-updater --upgrade --quiet >/dev/null || :
99b6f7
/usr/sbin/ipa-upgradeconfig --quiet >/dev/null || :
99b6f7
99b6f7
# Restart IPA processes. This must be also run in postrans so that plugins
99b6f7
# and software is in consistent state
e3ffab
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
99b6f7
# NOTE: systemd specific section
99b6f7
if [  $? -eq 0 ]; then
e3ffab
    /bin/systemctl is-enabled ipa.service >/dev/null 2>&1
e3ffab
    if [  $? -eq 0 ]; then
e3ffab
        /bin/systemctl restart ipa.service >/dev/null 2>&1 || :
e3ffab
    fi
99b6f7
fi
99b6f7
# END
99b6f7
99b6f7
%preun server
99b6f7
if [ $1 = 0 ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl --quiet stop ipa.service || :
99b6f7
    /bin/systemctl --quiet disable ipa.service || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%pre server
99b6f7
# Stop ipa_kpasswd if it exists before upgrading so we don't have a
99b6f7
# zombie process when we're done.
99b6f7
if [ -e /usr/sbin/ipa_kpasswd ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl stop ipa_kpasswd.service >/dev/null 2>&1 || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%postun server-trust-ad
99b6f7
if [ "$1" -ge "1" ]; then
99b6f7
    if [ "`readlink %{_sysconfdir}/alternatives/winbind_krb5_locator.so`" == "/dev/null" ]; then
99b6f7
        %{_sbindir}/alternatives --set winbind_krb5_locator.so /dev/null
99b6f7
    fi
99b6f7
fi
99b6f7
99b6f7
%post server-trust-ad
99b6f7
%{_sbindir}/update-alternatives --install %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so \
99b6f7
        winbind_krb5_locator.so /dev/null 90
99b6f7
99b6f7
%posttrans server-trust-ad
e3ffab
python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
99b6f7
if [  $? -eq 0 ]; then
99b6f7
# NOTE: systemd specific section
99b6f7
    /bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
99b6f7
# END
99b6f7
fi
99b6f7
99b6f7
%preun server-trust-ad
99b6f7
if [ $1 -eq 0 ]; then
99b6f7
    %{_sbindir}/update-alternatives --remove winbind_krb5_locator.so /dev/null
99b6f7
fi
e3ffab
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%post client
99b6f7
if [ $1 -gt 1 ] ; then
99b6f7
    # Has the client been configured?
99b6f7
    restore=0
99b6f7
    test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
99b6f7
99b6f7
    if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
99b6f7
        if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf  2>/dev/null ; then
99b6f7
            echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
99b6f7
            cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
99b6f7
            mv /etc/krb5.conf.ipanew /etc/krb5.conf
99b6f7
            /sbin/restorecon /etc/krb5.conf
99b6f7
        fi
99b6f7
    fi
e3ffab
e3ffab
    if [ -f '/etc/sysconfig/ntpd' -a $restore -ge 2 ]; then
e3ffab
        if grep -E -q 'OPTIONS=.*-u ntp:ntp' /etc/sysconfig/ntpd 2>/dev/null; then
e3ffab
            sed -r '/OPTIONS=/ { s/\s+-u ntp:ntp\s+/ /; s/\s*-u ntp:ntp\s*// }' /etc/sysconfig/ntpd >/etc/sysconfig/ntpd.ipanew
e3ffab
            mv /etc/sysconfig/ntpd.ipanew /etc/sysconfig/ntpd
e3ffab
            /sbin/restorecon /etc/sysconfig/ntpd
e3ffab
e3ffab
            /bin/systemctl condrestart ntpd.service 2>&1 || :
e3ffab
        fi
e3ffab
    fi
e3ffab
e3ffab
    if [ ! -f '/etc/ipa/nssdb/cert8.db' -a $restore -ge 2 ]; then
e3ffab
        python2 -c 'from ipapython.certdb import create_ipa_nssdb; create_ipa_nssdb()' >/dev/null 2>&1
e3ffab
        tempfile=$(mktemp)
e3ffab
        if certutil -L -d /etc/pki/nssdb -n 'IPA CA' -a >"$tempfile" 2>/var/log/ipaupgrade.log; then
e3ffab
            certutil -A -d /etc/ipa/nssdb -n 'IPA CA' -t CT,C,C -a -i "$tempfile" >/var/log/ipaupgrade.log 2>&1
e3ffab
        elif certutil -L -d /etc/pki/nssdb -n 'External CA cert' -a >"$tempfile" 2>/var/log/ipaupgrade.log; then
e3ffab
            certutil -A -d /etc/ipa/nssdb -n 'External CA cert' -t C,, -a -i "$tempfile" >/var/log/ipaupgrade.log 2>&1
e3ffab
        fi
e3ffab
        rm -f "$tempfile"
e3ffab
    fi
99b6f7
fi
99b6f7
e3ffab
%triggerin -n %{name}-client -- openssh-server
99b6f7
# Has the client been configured?
99b6f7
restore=0
99b6f7
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
99b6f7
99b6f7
if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
99b6f7
    if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
99b6f7
        sed -r '
99b6f7
            /^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
99b6f7
        ' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
99b6f7
99b6f7
        if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
99b6f7
                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
99b6f7
                s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
99b6f7
            sed -ri '
99b6f7
                s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
99b6f7
                s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
99b6f7
            ' /etc/ssh/sshd_config.ipanew
99b6f7
        fi
99b6f7
99b6f7
        mv /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
99b6f7
        /sbin/restorecon /etc/ssh/sshd_config
99b6f7
        chmod 600 /etc/ssh/sshd_config
99b6f7
99b6f7
        /bin/systemctl condrestart sshd.service 2>&1 || :
99b6f7
    fi
99b6f7
fi
99b6f7
99b6f7
%if ! %{ONLY_CLIENT}
99b6f7
%files server -f server-python.list
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
e3ffab
%{_sbindir}/ipa-backup
e3ffab
%{_sbindir}/ipa-restore
99b6f7
%{_sbindir}/ipa-ca-install
99b6f7
%{_sbindir}/ipa-dns-install
99b6f7
%{_sbindir}/ipa-server-install
99b6f7
%{_sbindir}/ipa-replica-conncheck
99b6f7
%{_sbindir}/ipa-replica-install
99b6f7
%{_sbindir}/ipa-replica-prepare
99b6f7
%{_sbindir}/ipa-replica-manage
99b6f7
%{_sbindir}/ipa-csreplica-manage
99b6f7
%{_sbindir}/ipa-server-certinstall
99b6f7
%{_sbindir}/ipa-ldap-updater
e3ffab
%{_sbindir}/ipa-otptoken-import
99b6f7
%{_sbindir}/ipa-compat-manage
99b6f7
%{_sbindir}/ipa-nis-manage
99b6f7
%{_sbindir}/ipa-managed-entries
99b6f7
%{_sbindir}/ipactl
99b6f7
%{_sbindir}/ipa-upgradeconfig
99b6f7
%{_sbindir}/ipa-advise
e3ffab
%{_sbindir}/ipa-cacert-manage
e3ffab
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
e3ffab
%{_libexecdir}/certmonger/ipa-server-guard
99b6f7
%{_libexecdir}/ipa-otpd
e3ffab
%dir %{_libexecdir}/ipa
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
%config(noreplace) %{_sysconfdir}/sysconfig/ipa_memcached
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
%dir %attr(0700,apache,apache) %{_localstatedir}/run/ipa_memcached/
99b6f7
%dir %attr(0700,root,root) %{_localstatedir}/run/ipa/
99b6f7
# NOTE: systemd specific section
e3ffab
%{_tmpfilesdir}/%{name}.conf
99b6f7
%attr(644,root,root) %{_unitdir}/ipa.service
99b6f7
%attr(644,root,root) %{_unitdir}/ipa_memcached.service
99b6f7
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
99b6f7
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
e3ffab
# END
99b6f7
%dir %{python_sitelib}/ipaserver
99b6f7
%dir %{python_sitelib}/ipaserver/install
99b6f7
%dir %{python_sitelib}/ipaserver/install/plugins
99b6f7
%dir %{python_sitelib}/ipaserver/advise
99b6f7
%dir %{python_sitelib}/ipaserver/advise/plugins
99b6f7
%dir %{python_sitelib}/ipaserver/plugins
99b6f7
%dir %{_libdir}/ipa/certmonger
99b6f7
%attr(755,root,root) %{_libdir}/ipa/certmonger/*
99b6f7
%dir %{_usr}/share/ipa
99b6f7
%{_usr}/share/ipa/wsgi.py*
99b6f7
%{_usr}/share/ipa/copy-schema-to-ca.py*
99b6f7
%{_usr}/share/ipa/*.ldif
99b6f7
%{_usr}/share/ipa/*.uldif
99b6f7
%{_usr}/share/ipa/*.template
99b6f7
%dir %{_usr}/share/ipa/advise
99b6f7
%dir %{_usr}/share/ipa/advise/legacy
99b6f7
%{_usr}/share/ipa/advise/legacy/*.template
99b6f7
%dir %{_usr}/share/ipa/ffextension
99b6f7
%{_usr}/share/ipa/ffextension/bootstrap.js
99b6f7
%{_usr}/share/ipa/ffextension/install.rdf
99b6f7
%{_usr}/share/ipa/ffextension/chrome.manifest
99b6f7
%dir %{_usr}/share/ipa/ffextension/chrome
99b6f7
%dir %{_usr}/share/ipa/ffextension/chrome/content
99b6f7
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth.js
99b6f7
%{_usr}/share/ipa/ffextension/chrome/content/kerberosauth_overlay.xul
99b6f7
%dir %{_usr}/share/ipa/ffextension/locale
99b6f7
%dir %{_usr}/share/ipa/ffextension/locale/en-US
99b6f7
%{_usr}/share/ipa/ffextension/locale/en-US/kerberosauth.properties
99b6f7
%dir %{_usr}/share/ipa/html
99b6f7
%{_usr}/share/ipa/html/ffconfig.js
99b6f7
%{_usr}/share/ipa/html/ffconfig_page.js
99b6f7
%{_usr}/share/ipa/html/ssbrowser.html
99b6f7
%{_usr}/share/ipa/html/browserconfig.html
99b6f7
%{_usr}/share/ipa/html/unauthorized.html
99b6f7
%dir %{_usr}/share/ipa/migration
99b6f7
%{_usr}/share/ipa/migration/error.html
99b6f7
%{_usr}/share/ipa/migration/index.html
99b6f7
%{_usr}/share/ipa/migration/invalid.html
99b6f7
%{_usr}/share/ipa/migration/migration.py*
99b6f7
%dir %{_usr}/share/ipa/ui
99b6f7
%{_usr}/share/ipa/ui/index.html
99b6f7
%{_usr}/share/ipa/ui/reset_password.html
e3ffab
%{_usr}/share/ipa/ui/sync_otp.html
99b6f7
%{_usr}/share/ipa/ui/*.ico
99b6f7
%{_usr}/share/ipa/ui/*.css
99b6f7
%{_usr}/share/ipa/ui/*.js
e3ffab
%dir %{_usr}/share/ipa/ui/css
e3ffab
%{_usr}/share/ipa/ui/css/*.css
9991ea
%dir %{_usr}/share/ipa/ui/js
99b6f7
%dir %{_usr}/share/ipa/ui/js/dojo
99b6f7
%{_usr}/share/ipa/ui/js/dojo/dojo.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/libs
99b6f7
%{_usr}/share/ipa/ui/js/libs/*.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/freeipa
99b6f7
%{_usr}/share/ipa/ui/js/freeipa/app.js
e3ffab
%{_usr}/share/ipa/ui/js/freeipa/core.js
99b6f7
%dir %{_usr}/share/ipa/ui/js/plugins
99b6f7
%dir %{_usr}/share/ipa/ui/images
e3ffab
%{_usr}/share/ipa/ui/images/*.jpg
99b6f7
%{_usr}/share/ipa/ui/images/*.png
99b6f7
%dir %{_usr}/share/ipa/wsgi
99b6f7
%{_usr}/share/ipa/wsgi/plugins.py*
99b6f7
%dir %{_sysconfdir}/ipa
99b6f7
%dir %{_sysconfdir}/ipa/html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
99b6f7
%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
99b6f7
%{_usr}/share/ipa/ipa.conf
99b6f7
%{_usr}/share/ipa/ipa-rewrite.conf
99b6f7
%{_usr}/share/ipa/ipa-pki-proxy.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/configure.jar
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con
99b6f7
%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/preferences.html
99b6f7
%dir %{_usr}/share/ipa/updates/
99b6f7
%{_usr}/share/ipa/updates/*
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_winsync.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_repl_version.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
e3ffab
%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
e3ffab
%attr(755,root,root) %{plugin_dir}/libipa_otp_lasttoken.so
99b6f7
%dir %{_localstatedir}/lib/ipa
e3ffab
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/backup
99b6f7
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysrestore
99b6f7
%attr(700,root,root) %dir %{_localstatedir}/lib/ipa/sysupgrade
99b6f7
%attr(755,root,root) %dir %{_localstatedir}/lib/ipa/pki-ca
99b6f7
%ghost %{_localstatedir}/lib/ipa/pki-ca/publish
e3ffab
%ghost %{_localstatedir}/named/dyndb-ldap/ipa
99b6f7
%attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so
99b6f7
%{_mandir}/man1/ipa-replica-conncheck.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-install.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-csreplica-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-replica-prepare.1.gz
99b6f7
%{_mandir}/man1/ipa-server-certinstall.1.gz
99b6f7
%{_mandir}/man1/ipa-server-install.1.gz
99b6f7
%{_mandir}/man1/ipa-dns-install.1.gz
99b6f7
%{_mandir}/man1/ipa-ca-install.1.gz
99b6f7
%{_mandir}/man1/ipa-compat-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-nis-manage.1.gz
99b6f7
%{_mandir}/man1/ipa-managed-entries.1.gz
99b6f7
%{_mandir}/man1/ipa-ldap-updater.1.gz
99b6f7
%{_mandir}/man8/ipactl.8.gz
99b6f7
%{_mandir}/man8/ipa-upgradeconfig.8.gz
e3ffab
%{_mandir}/man1/ipa-backup.1.gz
e3ffab
%{_mandir}/man1/ipa-restore.1.gz
99b6f7
%{_mandir}/man1/ipa-advise.1.gz
e3ffab
%{_mandir}/man1/ipa-otptoken-import.1.gz
e3ffab
%{_mandir}/man1/ipa-cacert-manage.1.gz
99b6f7
99b6f7
%files server-trust-ad
99b6f7
%{_sbindir}/ipa-adtrust-install
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so
99b6f7
%{_usr}/share/ipa/smb.conf.empty
99b6f7
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_sidgen.so
99b6f7
%attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so
99b6f7
%{_mandir}/man1/ipa-adtrust-install.1.gz
99b6f7
%{python_sitelib}/ipaserver/dcerpc*
99b6f7
%{python_sitelib}/ipaserver/install/adtrustinstance*
99b6f7
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
99b6f7
99b6f7
%endif # ONLY_CLIENT
99b6f7
99b6f7
%files client
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%{_sbindir}/ipa-client-install
99b6f7
%{_sbindir}/ipa-client-automount
e3ffab
%{_sbindir}/ipa-certupdate
99b6f7
%{_sbindir}/ipa-getkeytab
99b6f7
%{_sbindir}/ipa-rmkeytab
99b6f7
%{_sbindir}/ipa-join
99b6f7
%dir %{_usr}/share/ipa
99b6f7
%dir %{_localstatedir}/lib/ipa-client
99b6f7
%dir %{_localstatedir}/lib/ipa-client/sysrestore
99b6f7
%dir %{python_sitelib}/ipaclient
99b6f7
%{python_sitelib}/ipaclient/*.py*
99b6f7
%{_mandir}/man1/ipa-getkeytab.1.gz
99b6f7
%{_mandir}/man1/ipa-rmkeytab.1.gz
99b6f7
%{_mandir}/man1/ipa-client-install.1.gz
99b6f7
%{_mandir}/man1/ipa-client-automount.1.gz
e3ffab
%{_mandir}/man1/ipa-certupdate.1.gz
99b6f7
%{_mandir}/man1/ipa-join.1.gz
99b6f7
%{_mandir}/man5/default.conf.5.gz
99b6f7
99b6f7
%files admintools
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%{_bindir}/ipa
99b6f7
%config %{_sysconfdir}/bash_completion.d
99b6f7
%{_mandir}/man1/ipa.1.gz
99b6f7
99b6f7
%files python -f %{gettext_domain}.lang
99b6f7
%defattr(-,root,root,-)
99b6f7
%doc COPYING README Contributors.txt
99b6f7
%dir %{python_sitelib}/ipapython
99b6f7
%{python_sitelib}/ipapython/*.py*
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
%dir %{python_sitelib}/ipalib
99b6f7
%{python_sitelib}/ipalib/*
e3ffab
%dir %{python_sitelib}/ipaplatform
e3ffab
%{python_sitelib}/ipaplatform/*
99b6f7
%attr(0644,root,root) %{python_sitearch}/default_encoding_utf8.so
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
%{python_sitelib}/ipapython-*.egg-info
99b6f7
%{python_sitelib}/freeipa-*.egg-info
e3ffab
%{python_sitelib}/ipaplatform-*.egg-info
99b6f7
%{python_sitearch}/python_default_encoding-*.egg-info
e3ffab
# RHEL spec file only: DELETED: Disable DNSSEC support
99b6f7
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/default.conf
99b6f7
%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt
e3ffab
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/nssdb
e3ffab
%dir %attr(0755,root,root) %{_sysconfdir}/ipa/dnssec
e3ffab
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/cert8.db
e3ffab
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/key3.db
e3ffab
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/secmod.db
e3ffab
%ghost %config(noreplace) %{_sysconfdir}/ipa/nssdb/pwdfile.txt
e3ffab
%ghost %config(noreplace) %{_sysconfdir}/pki/ca-trust/source/ipa.p11-kit
99b6f7
e3ffab
# RHEL spec file only: DELETED: Do not build tests
69f9f3
e3ffab
%changelog
f4fe3d
* Thu Mar 05 2015 CentOS Sources <bugs@centos.org> - 4.1.0-18.el7.centos
f4fe3d
- Roll in CentOS Branding
e562ad
- Remove supscription-manager requires
f4fe3d
e3ffab
* Thu Jan 29 2015 Martin Kosek <mkosek@redhat.com> 4.1.0-18
e3ffab
- Fix ipa-pwd-extop global configuration caching (#1187342)
e3ffab
- group-detach does not add correct objectclasses (#1187540)
e3ffab
e3ffab
* Tue Jan 27 2015 Jan Cholasta <jcholast@redhat.com> - 4.1.0-17
e3ffab
- Wrong directories created on full restore (#1186398)
e3ffab
- ipa-restore crashes if replica is unreachable (#1186396)
e3ffab
- idoverrideuser-add option --sshpubkey does not work (#1185410)
e3ffab
e3ffab
* Wed Jan 21 2015 Jan Cholasta <jcholast@redhat.com> - 4.1.0-16
e3ffab
- PassSync does not sync passwords due to missing ACIs (#1181093)
e3ffab
- ipa-replica-manage list does not list synced domain (#1181010)
e3ffab
- Do not assume certmonger is running in httpinstance (#1181767)
e3ffab
- ipa-replica-manage disconnect fails without password (#1183279)
e3ffab
- Put LDIF files to their original location in ipa-restore (#1175277)
e3ffab
- DUA profile not available anonymously (#1184149)
e3ffab
- IPA replica missing data after master upgraded (#1176995)
e3ffab
e3ffab
* Wed Jan 14 2015 Jan Cholasta <jcholast@redhat.com> - 4.1.0-15
e3ffab
- Re-add accidentally removed patches for #1170695 and #1164896
e3ffab
e3ffab
* Wed Jan 14 2015 Jan Cholasta <jcholast@redhat.com> - 4.1.0-14
e3ffab
- IPA Replicate creation fails with error "Update failed! Status: [10 Total
e3ffab
  update abortedLDAP error: Referral]" (#1166265)
e3ffab
- running ipa-server-install --setup-dns results in a crash (#1072502)
e3ffab
- DNS zones are not migrated into forward zones if 4.0+ replica is added
e3ffab
  (#1175384)
e3ffab
- gid is overridden by uid in default trust view (#1168904)
e3ffab
- When migrating warn user if compat is enabled (#1177133)
e3ffab
- Clean up debug log for trust-add (#1168376)
e3ffab
- No error message thrown on restore(full kind) on replica from full backup
e3ffab
  taken on master (#1175287)
e3ffab
- ipa-restore proceed even IPA not configured (#1175326)
e3ffab
- Data replication not working as expected after data restore from full backup
e3ffab
  (#1175277)
e3ffab
- IPA externally signed CA cert expiration warning missing from log (#1178128)
e3ffab
- ipa-upgradeconfig fails in CA-less installs (#1181767)
e3ffab
- IPA certs fail to autorenew simultaneouly (#1173207)
e3ffab
- More validation required on ipa-restore's options (#1176034)
e3ffab
e3ffab
* Wed Dec 17 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-13
e3ffab
- Expand the token auth/sync windows (#919228)
e3ffab
- Access is not rejected for disabled domain (#1172598)
e3ffab
- krb5kdc crash in ldap_pvt_search (#1170695)
e3ffab
- RHEL7.1 IPA server httpd avc denials after upgrade (#1164896)
e3ffab
e3ffab
* Wed Dec 10 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-12
e3ffab
- RHEL7.1 ipa-cacert-manage renewed certificate from MS ADCS not compatible
e3ffab
  (#1169591)
e3ffab
- CLI doesn't show SSHFP records with SHA256 added via nsupdate (regression)
e3ffab
  (#1172578)
e3ffab
e3ffab
* Tue Dec  9 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-11
e3ffab
- Throw zonemgr error message before installation proceeds (#1163849)
e3ffab
- Winsync: Setup is broken due to incorrect import of certificate (#1169867)
e3ffab
- Enable last token deletion when password auth type is configured (#919228)
e3ffab
- ipa-otp-lasttoken loads all user's tokens on every mod/del (#1166641)
e3ffab
- add --hosts and --hostgroup options to allow/retrieve keytab methods
e3ffab
  (#1007367)
e3ffab
- Extend host-show to add the view attribute in set of default attributes
e3ffab
  (#1168916)
e3ffab
- Prefer TCP connections to UDP in krb5 clients (#919228)
e3ffab
- [WebUI] Not able to unprovisioning service in IPA 4.1 (#1168214)
e3ffab
- webui: increase notification duration (#1171089)
e3ffab
- RHEL7.1 ipa automatic CA cert renewal stuck in submitting state (#1166931)
e3ffab
- RHEL7.1 ipa-cacert-manage cannot change external to self-signed ca cert
e3ffab
  (#1170003)
e3ffab
- Improve validation of --instance and --backend options in ipa-restore
e3ffab
  (#951581)
e3ffab
- RHEL7.1 ipa replica unable to replicate to rhel6 master (#1167964)
e3ffab
- Disable TLS 1.2 in nss.conf until mod_nss supports it (#1156466)
e3ffab
e3ffab
* Wed Nov 26 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-10
e3ffab
- Use NSS protocol range API to set available TLS protocols (#1156466)
e3ffab
e3ffab
* Tue Nov 25 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-9
e3ffab
- schema update on RHEL-6.6 using latest copy-schema-to-ca.py from RHEL-7.1
e3ffab
  build fails (#1167196)
e3ffab
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
e3ffab
- "ipa trust-add ... " cmd says : (Trust status: Established and verified)
e3ffab
  while in the logs we see "WERR_ACCESS_DENIED" during verification step.
e3ffab
  (#1144121)
e3ffab
- POODLE: force using safe ciphers (non-SSLv3) in IPA client and server
e3ffab
  (#1156466)
e3ffab
- Add support/hooks for a one-time password system like SecureID in IPA
e3ffab
  (#919228)
e3ffab
- Tracebacks with latest build for --zonemgr cli option (#1167270)
e3ffab
- ID Views: Support migration from the sync solution to the trust solution
e3ffab
  (#891984)
e3ffab
e3ffab
* Mon Nov 24 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-8
e3ffab
- Improve otptoken help messages (#919228)
e3ffab
- Ensure users exist when assigning tokens to them (#919228)
e3ffab
- Enable QR code display by default in otptoken-add (#919228)
e3ffab
- Show warning instead of error if CA did not start (#1158410)
e3ffab
- CVE-2014-7850 freeipa: XSS flaw can be used to escalate privileges (#1165774)
e3ffab
- Traceback when adding zone with long name (#1164859)
e3ffab
- Backup & Restore mechanism (#951581)
e3ffab
- ignoring user attributes in migrate-ds does not work if uppercase characters
e3ffab
  are returned by ldap (#1159816)
e3ffab
- Allow ipa-getkeytab to optionally fetch existing keys (#1007367)
e3ffab
- Failure when installing on dual stacked system with external ca (#1128380)
e3ffab
- ipa-server should keep backup of CS.cfg (#1059135)
e3ffab
- Tracebacks with latest build for --zonemgr cli option (#1167270)
e3ffab
- webui: use domain name instead of domain SID in idrange adder dialog
e3ffab
  (#891984)
e3ffab
- webui: normalize idview tab labels (#891984)
e3ffab
e3ffab
* Wed Nov 19 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-7
e3ffab
- ipa-csreplica-manage connect fails (#1157735)
e3ffab
- error message which is not understandable when IDNA2003 characters are
e3ffab
  present in --zonemgr (#1163849)
e3ffab
- Fix warning message should not contain CLI commands (#1114013)
e3ffab
- Renewing the CA signing certificate does not extend its validity period end
e3ffab
  (#1163498)
e3ffab
- RHEL7.1 ipa-server-install --uninstall Could not set SELinux booleans for
e3ffab
  httpd (#1159330)
e3ffab
e3ffab
* Thu Nov 13 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-6
e3ffab
- Fix: DNS installer adds invalid zonemgr email (#1056202)
e3ffab
- ipaplatform: Use the dirsrv service, not target (#951581)
e3ffab
- Fix: DNS policy upgrade raises asertion error (#1161128)
e3ffab
- Fix upgrade referint plugin (#1161128)
e3ffab
- Upgrade: fix trusts objectclass violationi (#1161128)
e3ffab
- group-add doesn't accept gid parameter (#1149124)
e3ffab
e3ffab
* Tue Nov 11 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-5
e3ffab
- Update slapi-nis dependency to pull 0.54-2 (#891984)
e3ffab
- ipa-restore: Don't crash if AD trust is not installed (#951581)
e3ffab
- Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type (#1138791)
e3ffab
- Trust setting not restored for CA cert with ipa-restore command (#1159011)
e3ffab
- ipa-server-install fails when restarting named (#1162340)
e3ffab
e3ffab
* Thu Nov 06 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-4
e3ffab
- Update Requires on pki-ca to 10.1.2-4 (#1129558)
e3ffab
- build: increase java stack size for all arches
e3ffab
- Add ipaSshPubkey and gidNumber to the ACI to read ID user overrides (#891984)
e3ffab
- Fix dns zonemgr validation regression (#1056202)
e3ffab
- Handle profile changes in dogtag-ipa-ca-renew-agent (#886645)
e3ffab
- Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
e3ffab
  (#886645)
e3ffab
- Add bind-dyndb-ldap working dir to IPA specfile
e3ffab
- Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage
e3ffab
  (#886645)
e3ffab
- Investigate & fix Coverity defects in IPA DS/KDC plugins (#1160756)
e3ffab
- Deadlock in schema compat plugin (#1161131)
e3ffab
- ipactl stop should stop dirsrv last (#1161129)
e3ffab
- Upgrade 3.3.5 to 4.1 failed (#1161128)
e3ffab
- CVE-2014-7828 freeipa: password not required when OTP in use (#1160877)
e3ffab
e3ffab
* Wed Oct 22 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-3
e3ffab
- Do not check if port 8443 is available in step 2 of external CA install
e3ffab
  (#1129481)
e3ffab
e3ffab
* Wed Oct 22 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-2
e3ffab
- Update Requires on selinux-policy to 3.13.1-4
e3ffab
e3ffab
* Tue Oct 21 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-1
e3ffab
- Update to upstream 4.1.0 (#1109726)
e3ffab
e3ffab
* Mon Sep 29 2014 Jan Cholasta <jcholast@redhat.com> - 4.1.0-0.1.alpha1
e3ffab
- Update to upstream 4.1.0 Alpha 1 (#1109726)
e3ffab
e3ffab
* Fri Sep 26 2014 Petr Vobornik <pvoborni@redhat.com> - 4.0.3-3
e3ffab
- Add redhat-access-plugin-ipa dependency
e3ffab
e3ffab
* Thu Sep 25 2014 Jan Cholasta <jcholast@redhat.com> - 4.0.3-2
e3ffab
- Re-enable otptoken_yubikey plugin
e3ffab
e3ffab
* Mon Sep 15 2014 Jan Cholasta <jcholast@redhat.com> - 4.0.3-1
e3ffab
- Update to upstream 4.0.3 (#1109726)
e3ffab
e3ffab
* Thu Aug 14 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-29
031d60
- Server installation fails using external signed certificates with
e3ffab
  "IndexError: list index out of range" (#1111320)
031d60
- Add rhino to BuildRequires to fix Web UI build error
10ca37
9991ea
* Tue Apr  1 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-28
9991ea
- ipa-client-automount fails with incompatibility error when installed against
9991ea
  older IPA server (#1083108)
9991ea
9991ea
* Wed Mar 26 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-27
9991ea
- Proxy PKI URI /ca/ee/ca/profileSubmit to enable replication with future
9991ea
  PKI versions (#1080865)
9991ea
9991ea
* Tue Mar 25 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-26
9991ea
- When IdM server trusts multiple AD forests, IPA client returns invalid group
9991ea
  membership info (#1079498)
9991ea
9991ea
* Thu Mar 13 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-25
9991ea
- Deletion of active subdomain range should not be allowed (#1075615)
9991ea
9991ea
* Thu Mar 13 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-24
9991ea
- PKI database is ugraded during replica installation (#1075118)
9991ea
9991ea
* Wed Mar 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-23
9991ea
- Unable to add trust successfully with --trust-secret (#1075704)
9991ea
9991ea
* Wed Mar 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-22
9991ea
- ipa-replica-install never checks for 7389 port (#1075165)
9991ea
- Non-terminated string may be passed to LDAP search (#1075091)
9991ea
- ipa-sam may fail to translate group SID into GID (#1073829)
9991ea
- Excessive LDAP calls by ipa-sam during Samba FS operations (#1075132)
9991ea
9991ea
* Thu Mar  6 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-21
9991ea
- Do not fetch a principal two times, remove potential memory leak (#1070924)
9991ea
9991ea
* Wed Mar  5 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-20
9991ea
- trustdomain-find with pkey-only fails (#1068611)
9991ea
- Invalid credential cache in trust-add (#1069182)
9991ea
- ipa-replica-install prints unexpected error (#1069722)
9991ea
- Too big font in input fields in details facet in Firefox (#1069720)
9991ea
- trust-add for POSIX AD does not fetch trustdomains (#1070925)
9991ea
- Misleading trust-add error message in some cases (#1070926)
9991ea
- Access is not rejected for disabled domain (#1070924)
9991ea
9991ea
* Wed Feb 26 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-19
9991ea
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
9991ea
9991ea
* Wed Feb 12 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-18
9991ea
- Display server name in ipa command's verbose mode (#1061703)
9991ea
- Remove sourcehostcategory from default HBAC rule (#1061187)
9991ea
- dnszone-add cannot add classless PTR zones (#1058688)
9991ea
- Move ipa-otpd socket directory to /var/run/krb5kdc (#1063850)
9991ea
9991ea
* Tue Feb  4 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-17
9991ea
- Lockout plugin crashed during ipa-server-install (#912725)
9991ea
9991ea
* Fri Jan 31 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-16
9991ea
- Fallback to global policy in ipa lockout plugin (#912725)
9991ea
- Migration does not add users to default group (#903232)
9991ea
9991ea
* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 3.3.3-15
9991ea
- Mass rebuild 2014-01-24
9991ea
9991ea
* Thu Jan 23 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-14
9991ea
- Fix NetBIOS name generation in CLDAP plugin (#1030517)
9991ea
9991ea
* Mon Jan 20 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-13
9991ea
- Do not add krbPwdPolicyReference for new accounts, hardcode it (#1045218)
9991ea
- Increase default timeout for IPA services (#1033273)
9991ea
- Error while running trustdomain-find (#1054376)
9991ea
- group-show lists SID instead of name for external groups (#1054391)
9991ea
- Fix IPA server NetBIOS name in samba configuration (#1030517)
9991ea
- dnsrecord-mod produces missing API version warning (#1054869)
9991ea
- Hide trust-resolve command as internal (#1052860)
9991ea
- Add Trust domain Web UI (#1054870)
9991ea
- ipasam cannot delete multiple child trusted domains (#1056120)
9991ea
9991ea
* Wed Jan 15 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-12
9991ea
- Missing objectclasses when empty password passed to host-add (#1052979)
9991ea
- sudoOrder missing in sudoers (#1052983)
9991ea
- Missing examples in sudorule help (#1049464)
9991ea
- Client automount does not uninstall when fstore is empty (#910899)
9991ea
- Error not clear for invalid realm given to trust-fetch-domains (#1052981)
9991ea
- trust-fetch-domains does not add idrange for subdomains found (#1049926)
9991ea
- Add option to show if an AD subdomain is enabled/disabled (#1052973)
9991ea
- ipa-adtrust-install still failed with long NetBIOS names (#1030517)
9991ea
- Error not clear for invalid relam given to trustdomain-find (#1049455)
9991ea
- renewed client cert not recognized during IPA CA renewal (#1033273)
9991ea
9991ea
* Fri Jan 10 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-11
9991ea
- hbactest does not work for external users (#848531)
9991ea
9991ea
* Wed Jan 08 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-10
9991ea
- PKI service restart after CA renewal failed (#1040018)
9991ea
9991ea
* Mon Jan 06 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-9
9991ea
- Move ipa-tests package to separate srpm (#1032668)
9991ea
9991ea
* Fri Jan  3 2014 Martin Kosek <mkosek@redhat.com> - 3.3.3-8
9991ea
- Fix status trust-add command status message (#910453)
9991ea
- NetBIOS was not trimmed at 15 characters (#1030517)
9991ea
- Harden CA subsystem certificate renewal on CA clones (#1040018)
9991ea
9991ea
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.3.3-7
9991ea
- Mass rebuild 2013-12-27
9991ea
9991ea
* Mon Dec  2 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-6
9991ea
- Remove "Listen 443 http" hack from deployed nss.conf (#1029046)
9991ea
- Re-adding existing trust fails (#1033216)
9991ea
- IPA uninstall exits with a samba error (#1033075)
9991ea
- Added RELRO hardening on /usr/libexec/ipa-otpd (#1026260)
9991ea
- Fixed ownership of /usr/share/ipa/ui/js (#1026260)
9991ea
- ipa-tests: support external names for hosts (#1032668)
9991ea
- ipa-client-install fail due fail to obtain host TGT (#1029354)
9991ea
99b6f7
* Fri Nov 22 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-5
99b6f7
- Trust add tries to add same value of --base-id for sub domain,
99b6f7
  causing an error (#1033068)
99b6f7
- Improved error reporting for adding trust case (#1029856)
99b6f7
99b6f7
* Wed Nov 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-4
99b6f7
- Winsync agreement cannot be created (#1023085)
99b6f7
99b6f7
* Wed Nov  6 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-3
99b6f7
- Installer did not detect different server and IPA domain (#1026845)
99b6f7
- Allow kernel keyring CCACHE when supported (#1026861)
99b6f7
99b6f7
* Tue Nov  5 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-2
99b6f7
- ipa-server-install crashes when AD subpackage is not installed (#1026434)
99b6f7
99b6f7
* Fri Nov  1 2013 Martin Kosek <mkosek@redhat.com> - 3.3.3-1
99b6f7
- Update to upstream 3.3.3 (#991064)
99b6f7
99b6f7
* Tue Oct 29 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-5
99b6f7
- Temporarily move ipa-backup and ipa-restore functionality
99b6f7
  back to make them available in public Beta (#1003933)
99b6f7
99b6f7
* Tue Oct 29 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-4
99b6f7
- Server install failure during client enrollment shouldn't
99b6f7
  roll back (#1023086)
99b6f7
- nsds5ReplicaStripAttrs are not set on agreements (#1023085)
99b6f7
- ipa-server conflicts with mod_ssl (#1018172)
99b6f7
99b6f7
* Wed Oct 16 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-3
99b6f7
- Reinstalling ipa server hangs when configuring certificate
99b6f7
  server (#1018804)
99b6f7
99b6f7
* Fri Oct 11 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-2
99b6f7
- Deprecate --serial-autoincrement option (#1016645)
99b6f7
- CA installation always failed on replica (#1005446)
99b6f7
- Re-initializing a winsync connection exited with error (#994980)
99b6f7
99b6f7
* Fri Oct  4 2013 Martin Kosek <mkosek@redhat.com> - 3.3.2-1
99b6f7
- Update to upstream 3.3.2 (#991064)
99b6f7
- Add delegation info to MS-PAC (#915799)
99b6f7
- Warn about incompatibility with AD when IPA realm and domain
99b6f7
  differs (#1009044)
99b6f7
- Allow PKCS#12 files with empty password in install tools (#1002639)
99b6f7
- Privilege "SELinux User Map Administrators" did not list
99b6f7
  permissions (#997085)
99b6f7
- SSH key upload broken when client joins an older server (#1009024)
99b6f7
99b6f7
* Mon Sep 23 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-5
99b6f7
- Remove dependency on python-paramiko (#1002884)
99b6f7
- Broken redirection when deleting last entry of DNS resource
99b6f7
  record (#1006360)
99b6f7
99b6f7
* Tue Sep 10 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-4
99b6f7
- Remove ipa-backup and ipa-restore functionality from RHEL (#1003933)
99b6f7
99b6f7
* Mon Sep  9 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-3
99b6f7
- Replica installation fails for RHEL 6.4 master (#1004680)
99b6f7
- Server uninstallation crashes if DS is not available (#998069)
99b6f7
99b6f7
* Thu Sep  5 2013 Martin Kosek <mkosek@redhat.com> - 3.3.1-2
99b6f7
- Unable to remove replica by ipa-replica-manage (#1001662)
99b6f7
- Before uninstalling a server, warn about active replicas (#998069)
99b6f7
99b6f7
* Thu Aug 29 2013 Rob Crittenden <rcritten@redhat.com> - 3.3.1-1
99b6f7
- Update to upstream 3.3.1 (#991064)
99b6f7
- Update minimum version of bind-dyndb-ldap to 3.5
99b6f7
99b6f7
* Tue Aug 20 2013 Rob Crittenden <rcritten@redhat.com> - 3.3.0-7
99b6f7
- Fix replica installation failing on certificate subject (#983075)
99b6f7
99b6f7
* Tue Aug 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-6
99b6f7
- Allow ipa-tests to work with older version (1.7.7) of python-paramiko
99b6f7
99b6f7
* Tue Aug 13 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-5
99b6f7
- Prevent multilib failures in *.pyo and *.pyc files
99b6f7
99b6f7
* Mon Aug 12 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-4
99b6f7
- ipa-server-install fails if --subject parameter is other than default
99b6f7
  realm (#983075)
99b6f7
- do not allow configuring bind-dyndb-ldap without persistent search (#967876)
99b6f7
99b6f7
* Mon Aug 12 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-3
99b6f7
- diffstat was missing as a build dependency causing multilib problems
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-2
99b6f7
- Remove ipa-server-selinux obsoletes as upgrades from version prior to
99b6f7
  3.3.0 are not allowed
99b6f7
- Wrap server-trust-ad subpackage description better
9991ea
- Add (noreplace) flag for %%{_sysconfdir}/tmpfiles.d/ipa.conf
99b6f7
- Change permissions on default_encoding_utf8.so to fix ipa-python Provides
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-1
99b6f7
- Update to upstream 3.3.0 (#991064)
99b6f7
99b6f7
* Thu Aug  8 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-0.2.beta2
99b6f7
- Require slapi-nis 0.47.7 delivering a core feature of 3.3.0 release
99b6f7
99b6f7
* Wed Aug  7 2013 Martin Kosek <mkosek@redhat.com> - 3.3.0-0.1.beta2
99b6f7
- Update to upstream 3.3.0 Beta 2 (#991064)
99b6f7
99b6f7
* Thu Jul 18 2013 Martin Kosek <mkosek@redhat.com> - 3.2.2-1
99b6f7
- Update to upstream 3.2.2
99b6f7
- Drop ipa-server-selinux subpackage
99b6f7
- Drop redundant directory /var/cache/ipa/sessions
99b6f7
- Do not create /var/lib/ipa/pki-ca/publish, retain reference as ghost
99b6f7
- Run ipa-upgradeconfig and server restart in posttrans to avoid inconsistency
99b6f7
  issues when there are still old parts of software (like entitlements plugin)
99b6f7
99b6f7
* Fri Jun 14 2013 Martin Kosek <mkosek@redhat.com> - 3.2.1-1
99b6f7
- Update to upstream 3.2.1
99b6f7
- Drop dogtag-pki-server-theme requires, it won't be build for RHEL-7.0
99b6f7
99b6f7
* Tue May 14 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-2
99b6f7
- Add OTP patches
99b6f7
- Add patch to set KRB5CCNAME for 389-ds-base
99b6f7
99b6f7
* Fri May 10 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-1
99b6f7
- Update to upstream 3.2.0 GA
99b6f7
- ipa-client-install fails if /etc/ipa does not exist (#961483)
99b6f7
- Certificate status is not visible in Service and Host page (#956718)
99b6f7
- ipa-client-install removes needed options from ldap.conf (#953991)
99b6f7
- Handle socket.gethostbyaddr() exceptions when verifying hostnames (#953957)
99b6f7
- Add triggerin scriptlet to support OpenSSH 6.2 (#953617)
99b6f7
- Require nss 3.14.3-12.0 to address certutil certificate import
99b6f7
  errors (#953485)
99b6f7
- Require pki-ca 10.0.2-3 to pull in fix for sslget and mixed IPv4/6
99b6f7
  environments. (#953464)
99b6f7
- ipa-client-install removes 'sss' from /etc/nsswitch.conf (#953453)
99b6f7
- ipa-server-install --uninstall doesn't stop dirsrv instances (#953432)
99b6f7
- Add requires for openldap-2.4.35-4 to pickup fixed SASL_NOCANON behavior for
99b6f7
  socket based connections (#960222)
99b6f7
- Require libsss_nss_idmap-python
99b6f7
- Add Conflicts on nss-pam-ldapd < 0.8.4. The mapping from uniqueMember to
99b6f7
  member is now done automatically and having it in the config file raises
99b6f7
  an error.
99b6f7
- Add backup and restore tools, directory.
99b6f7
- require at least systemd 38 which provides the journal (we no longer
99b6f7
  need to require syslog.target)
99b6f7
- Update Requires on policycoreutils to 2.1.14-37
99b6f7
- Update Requires on selinux-policy to 3.12.1-42
99b6f7
- Update Requires on 389-ds-base to 1.3.1.0
99b6f7
- Remove a Requires for java-atk-wrapper
99b6f7
99b6f7
* Tue Apr 23 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.4.beta1
99b6f7
- Remove release from krb5-server in strict sub-package to allow for rebuilds.
99b6f7
99b6f7
* Mon Apr 22 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.3.beta1
99b6f7
- Add a Requires for java-atk-wrapper until we can determine which package
99b6f7
  should be pulling it in, dogtag or tomcat.
99b6f7
99b6f7
* Tue Apr 16 2013 Rob Crittenden <rcritten@redhat.com> - 3.2.0-0.2.beta1
99b6f7
- Update to upstream 3.2.0 Beta 1
99b6f7
99b6f7
* Tue Apr  2 2013 Martin Kosek <mkosek@redhat.com> - 3.2.0-0.1.pre1
99b6f7
- Update to upstream 3.2.0 Prerelease 1
99b6f7
- Use upstream reference spec file as a base for Fedora spec file
99b6f7
99b6f7
* Sat Mar 30 2013 Kevin Fenzi <kevin@scrye.com> 3.1.2-4
99b6f7
- Rebuild for broken deps
99b6f7
- Fix 389-ds-base strict dep to be 1.3.0.5 and krb5-server 1.11.1
99b6f7
99b6f7
* Sat Feb 23 2013 Kevin Fenzi <kevin@scrye.com> - 3.1.2-3
99b6f7
- Rebuild for broken deps in rawhide
99b6f7
- Fix 389-ds-base strict dep to be 1.3.0.3
99b6f7
99b6f7
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.1.2-2
99b6f7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
99b6f7
99b6f7
* Wed Jan 23 2013 Rob Crittenden <rcritten@redhat.com> - 3.1.2-1
99b6f7
- Update to upstream 3.1.2
99b6f7
- CVE-2012-4546: Incorrect CRLs publishing
99b6f7
- CVE-2012-5484: MITM Attack during Join process
99b6f7
- CVE-2013-0199: Cross-Realm Trust key leak
99b6f7
- Updated strict dependencies to 389-ds-base = 1.3.0.2 and
99b6f7
  pki-ca = 10.0.1
99b6f7
99b6f7
* Thu Dec 20 2012 Martin Kosek <mkosek@redhat.com> - 3.1.0-2
99b6f7
- Remove redundat Requires versions that are already in Fedora 17
99b6f7
- Replace python-crypto Requires with m2crypto
99b6f7
- Add missing Requires(post) for client and server-trust-ad subpackages
99b6f7
- Restart httpd service when server-trust-ad subpackage is installed
99b6f7
- Bump selinux-policy Requires to pick up PKI/LDAP port labeling fixes
99b6f7
99b6f7
* Mon Dec 10 2012 Rob Crittenden <rcritten@redhat.com> - 3.1.0-1
99b6f7
- Updated to upstream 3.1.0 GA
99b6f7
- Set minimum for sssd to 1.9.2
99b6f7
- Set minimum for pki-ca to 10.0.0-1
99b6f7
- Set minimum for 389-ds-base to 1.3.0
99b6f7
- Set minimum for selinux-policy to 3.11.1-60
99b6f7
- Remove unneeded dogtag package requires
99b6f7
99b6f7
* Tue Oct 23 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-3
99b6f7
- Update Requires on krb5-server to 1.11
99b6f7
99b6f7
* Fri Oct 12 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-2
99b6f7
- Configure CA replication to use TLS instead of SSL
99b6f7
99b6f7
* Fri Oct 12 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-1
99b6f7
- Updated to upstream 3.0.0 GA
99b6f7
- Set minimum for samba to 4.0.0-153.
99b6f7
- Make sure server-trust-ad subpackage alternates winbind_krb5_locator.so
99b6f7
  plugin to /dev/null since they cannot be used when trusts are configured
99b6f7
- Restrict krb5-server to 1.10.
99b6f7
- Update BR for 389-ds-base to 1.3.0
99b6f7
- Add directory /var/lib/ipa/pki-ca/publish for CRL published by pki-ca
99b6f7
- Add Requires on zip for generating FF browser extension
99b6f7
99b6f7
* Fri Oct  5 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.10
99b6f7
- Updated to upstream 3.0.0 rc 2
99b6f7
- Include new FF configuration extension
99b6f7
- Set minimum Requires of selinux-policy to 3.11.1-33
99b6f7
- Set minimum Requires dogtag to 10.0.0-0.43.b1
99b6f7
- Add new optional strict sub-package to allow users to limit other
99b6f7
  package upgrades.
99b6f7
99b6f7
* Tue Oct  2 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-0.9
99b6f7
- Require samba packages instead of obsoleted samba4 packages
99b6f7
99b6f7
* Fri Sep 21 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.8
99b6f7
- Updated to upstream 3.0.0 rc 1
99b6f7
- Update BR for 389-ds-base to 1.2.11.14
99b6f7
- Update BR for krb5 to 1.10
99b6f7
- Update BR for samba4-devel to 4.0.0-139 (rc1)
99b6f7
- Add BR for python-polib
99b6f7
- Update BR and Requires on sssd to 1.9.0
99b6f7
- Update Requires on policycoreutils to 2.1.12-5
99b6f7
- Update Requires on 389-ds-base to 1.2.11.14
99b6f7
- Update Requires on selinux-policy to 3.11.1-21
99b6f7
- Update Requires on dogtag to 10.0.0-0.33.a1
99b6f7
- Update Requires on certmonger to 0.60
99b6f7
- Update Requires on tomcat to 7.0.29
99b6f7
- Update minimum version of bind to 9.9.1-10.P3
99b6f7
- Update minimum version of bind-dyndb-ldap to 1.1.0-0.16.rc1
99b6f7
- Remove Requires on authconfig from python sub-package
99b6f7
99b6f7
* Wed Sep  5 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.7
99b6f7
- Rebuild against samba4 beta8
99b6f7
99b6f7
* Fri Aug 31 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.6
99b6f7
- Rebuild against samba4 beta7
99b6f7
99b6f7
* Wed Aug 22 2012 Alexander Bokovoy <abokovoy@redhat.com> - 3.0.0-0.5
99b6f7
- Adopt to samba4 beta6 (libsecurity -> libsamba-security)
99b6f7
- Add dependency to samba4-winbind
99b6f7
99b6f7
* Fri Aug 17 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.4
99b6f7
- Updated to upstream 3.0.0 beta 2
99b6f7
99b6f7
* Mon Aug  6 2012 Martin Kosek <mkosek@redhat.com> - 3.0.0-0.3
99b6f7
- Updated to current upstream state of 3.0.0 beta 2 development
99b6f7
99b6f7
* Mon Jul 23 2012 Alexander Bokovoy <abokovy@redhat.com> - 3.0.0-0.2
99b6f7
- Rebuild against samba4 beta4
99b6f7
99b6f7
* Mon Jul  2 2012 Rob Crittenden <rcritten@redhat.com> - 3.0.0-0.1
99b6f7
- Updated to upstream 3.0.0 beta 1
99b6f7
99b6f7
* Thu May  3 2012 Rob Crittenden <rcritten@redhat.com> - 2.2.0-1
99b6f7
- Updated to upstream 2.2.0 GA
99b6f7
- Update minimum n-v-r of certmonger to 0.53
99b6f7
- Update minimum n-v-r of slapi-nis to 0.40
99b6f7
- Add Requires in client to oddjob-mkhomedir and python-krbV
99b6f7
- Update minimum selinux-policy to 3.10.0-110
99b6f7
99b6f7
* Mon Mar 19 2012 Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.2
99b6f7
- Update to upstream 2.2.0 beta 1 (2.1.90.rc1)
99b6f7
- Set minimum n-v-r for pki-ca and pki-silent to 9.0.18.
99b6f7
- Add Conflicts on mod_ssl
99b6f7
- Update minimum n-v-r of 389-ds-base to 1.2.10.4
99b6f7
- Update minimum n-v-r of sssd to 1.8.0
99b6f7
- Update minimum n-v-r of slapi-nis to 0.38
99b6f7
- Update minimum n-v-r of pki-* to 9.0.18
99b6f7
- Update conflicts on bind-dyndb-ldap to < 1.1.0-0.9.b1
99b6f7
- Update conflicts on bind to < 9.9.0-1
99b6f7
- Drop requires on krb5-server-ldap
99b6f7
- Add patch to remove escaping arguments to pkisilent
99b6f7
99b6f7
* Mon Feb 06 2012 Rob Crittenden <rcritten@redhat.com> - 2.1.90-0.1
99b6f7
- Update to upstream 2.2.0 alpha 1 (2.1.90.pre1)
99b6f7
99b6f7
* Wed Feb 01 2012 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-5
99b6f7
- Force to use 389-ds 1.2.10-0.8.a7 or above
99b6f7
- Improve upgrade script to handle systemd 389-ds change
99b6f7
- Fix freeipa to work with python-ldap 2.4.6
99b6f7
99b6f7
* Wed Jan 11 2012 Martin Kosek <mkosek@redhat.com> - 2.1.4-4
99b6f7
- Fix ipa-replica-install crashes
99b6f7
- Fix ipa-server-install and ipa-dns-install logging
99b6f7
- Set minimum version of pki-ca to 9.0.17 to fix sslget problem
99b6f7
  caused by FEDORA-2011-17400 update (#771357)
99b6f7
99b6f7
* Wed Dec 21 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-3
99b6f7
- Allow Web-based migration to work with tightened SE Linux policy (#769440)
99b6f7
- Rebuild slapi plugins against re-enterant version of libldap
99b6f7
99b6f7
* Sun Dec 11 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.4-2
99b6f7
- Allow longer dirsrv startup with systemd:
99b6f7
  - IPAdmin class will wait until dirsrv instance is available up to 10 seconds
99b6f7
  - Helps with restarts during upgrade for ipa-ldap-updater
99b6f7
- Fix pylint warnings from F16 and Rawhide
99b6f7
99b6f7
* Tue Dec  6 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.4-1
99b6f7
- Update to upstream 2.1.4 (CVE-2011-3636)
99b6f7
99b6f7
* Mon Dec  5 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.3-8
99b6f7
- Update SELinux policy to allow ipa_kpasswd to connect ldap and
99b6f7
  read /dev/urandom. (#759679)
99b6f7
99b6f7
* Wed Nov 30 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-7
99b6f7
- Fix wrong path in packaging freeipa-systemd-upgrade
99b6f7
99b6f7
* Wed Nov 30 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-6
99b6f7
- Introduce upgrade script to recover existing configuration after systemd migration
99b6f7
  as user has no means to recover FreeIPA from systemd migration
99b6f7
- Upgrade script:
99b6f7
  - recovers symlinks in Dogtag instance install
99b6f7
  - recovers systemd configuration for FreeIPA's directory server instances
99b6f7
  - recovers freeipa.service
99b6f7
  - migrates directory server and KDC configs to use proper keytabs for systemd services
99b6f7
99b6f7
* Wed Oct 26 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.3-5
99b6f7
- Rebuilt for glibc bug#747377
99b6f7
99b6f7
* Wed Oct 19 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-4
e3ffab
- clean up spec
99b6f7
- Depend on sssd >= 1.6.2 for better user experience
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-3
99b6f7
- Fix Fedora package changelog after merging systemd changes
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-2
99b6f7
- Fix postin scriplet for F-15/F-16
99b6f7
99b6f7
* Tue Oct 18 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.3-1
99b6f7
- 2.1.3
99b6f7
99b6f7
* Mon Oct 17 2011 Alexander Bokovoy <abokovoy@redhat.com> - 2.1.2-1
99b6f7
- Default to systemd for Fedora 16 and onwards
99b6f7
99b6f7
* Tue Aug 16 2011 Rob Crittenden <rcritten@redhat.com> - 2.1.0-1
99b6f7
- Update to upstream 2.1.0
99b6f7
99b6f7
* Fri May  6 2011 Simo Sorce <ssorce@redhat.com> - 2.0.1-2
99b6f7
- Fix bug #702633
99b6f7
99b6f7
* Mon May  2 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.1-1
99b6f7
- Update minimum selinux-policy to 3.9.16-18
99b6f7
- Update minimum pki-ca and pki-selinux to 9.0.7
99b6f7
- Update minimum 389-ds-base to 1.2.8.0-1
99b6f7
- Update to upstream 2.0.1
99b6f7
99b6f7
* Thu Mar 24 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-1
99b6f7
- Update to upstream GA release
99b6f7
- Automatically apply updates when the package is upgraded
99b6f7
99b6f7
* Fri Feb 25 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.4.rc2
99b6f7
- Update to upstream freeipa-2.0.0.rc2
99b6f7
- Set minimum version of python-nss to 0.11 to make sure IPv6 support is in
99b6f7
- Set minimum version of sssd to 1.5.1
99b6f7
- Patch to include SuiteSpotGroup when setting up 389-ds instances
99b6f7
- Move a lot of BuildRequires so this will build with ONLY_CLIENT enabled
99b6f7
99b6f7
* Tue Feb 15 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.3.rc1
99b6f7
- Set the N-V-R so rc1 is an update to beta2.
99b6f7
99b6f7
* Mon Feb 14 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.rc1
99b6f7
- Set minimum version of sssd to 1.5.1
99b6f7
- Update to upstream freeipa-2.0.0.rc1
99b6f7
- Move server-only binaries from admintools subpackage to server
99b6f7
99b6f7
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.0-0.2.beta2
99b6f7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
99b6f7
99b6f7
* Thu Feb  3 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta2
99b6f7
- Set min version of 389-ds-base to 1.2.8
99b6f7
- Set min version of mod_nss 1.0.8-10
99b6f7
- Set min version of selinux-policy to 3.9.7-27
99b6f7
- Add dogtag themes to Requires
99b6f7
- Update to upstream freeipa-2.0.0.pre2
99b6f7
99b6f7
* Thu Jan 27 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.2.beta.git80e87e7
99b6f7
- Remove unnecessary moving of v1 CA serial number file in post script
99b6f7
- Add Obsoletes for server-selinxu subpackage
99b6f7
- Using git snapshot 442d6ad30ce1156914e6245aa7502499e50ec0da
99b6f7
99b6f7
* Wed Jan 26 2011 Rob Crittenden <rcritten@redhat.com> - 2.0.0-0.1.beta.git80e87e7
99b6f7
- Prepare spec file for release
99b6f7
- Using git snapshot 80e87e75bd6ab56e3e20c49ece55bd4d52f1a503
99b6f7
99b6f7
* Tue Jan 25 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-41
99b6f7
- Re-arrange doc and defattr to clean up rpmlint warnings
99b6f7
- Remove conditionals on older releases
99b6f7
- Move some man pages into admintools subpackage
99b6f7
- Remove some explicit Requires in client that aren't needed
99b6f7
- Consistent use of buildroot vs RPM_BUILD_ROOT
99b6f7
99b6f7
* Wed Jan 19 2011 Adam Young <ayoung@redhat.com> - 1.99-40
99b6f7
- Moved directory install/static to install/ui
99b6f7
99b6f7
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-39
99b6f7
- Remove dependency on nss_ldap/nss-pam-ldapd
99b6f7
- The official client is sssd and that's what we use by default.
99b6f7
99b6f7
* Thu Jan 13 2011 Simo Sorce <ssorce@redhat.com> - 1.99-38
99b6f7
- Remove radius subpackages
99b6f7
99b6f7
* Thu Jan 13 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-37
99b6f7
- Set minimum pki-ca and pki-silent versions to 9.0.0
99b6f7
99b6f7
* Wed Jan 12 2011 Rob Crittenden <rcritten@redhat.com> - 1.99-36
99b6f7
- Drop BuildRequires on mozldap-devel
99b6f7
99b6f7
* Mon Dec 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-35
99b6f7
- Add Requires on krb5-pkinit-openssl
99b6f7
99b6f7
* Fri Dec 10 2010 Jr Aquino <jr.aquino@citrix.com> - 1.99-34
99b6f7
- Add ipa-host-net-manage script
99b6f7
99b6f7
* Tue Dec  7 2010 Simo Sorce <ssorce@redhat.com> - 1.99-33
99b6f7
- Add ipa init script
99b6f7
99b6f7
* Fri Nov 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-32
99b6f7
- Set minimum level of 389-ds-base to 1.2.7 for enhanced memberof plugin
99b6f7
99b6f7
* Wed Nov  3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-31
99b6f7
- remove ipa-fix-CVE-2008-3274
99b6f7
99b6f7
* Wed Oct  6 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-30
99b6f7
- Remove duplicate %%files entries on share/ipa/static
99b6f7
- Add python default encoding shared library
99b6f7
99b6f7
* Mon Sep 20 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-29
99b6f7
- Drop requires on python-configobj (not used any more)
99b6f7
- Drop ipa-ldap-updater message, upgrades are done differently now
99b6f7
99b6f7
* Wed Sep  8 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-28
99b6f7
- Drop conflicts on mod_nss
99b6f7
- Require nss-pam-ldapd on F-14 or higher instead of nss_ldap (#606847)
99b6f7
- Drop a slew of conditionals on older Fedora releases (< 12)
99b6f7
- Add a few conditionals against RHEL 6
99b6f7
- Add Requires of nss-tools on ipa-client
99b6f7
99b6f7
* Fri Aug 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-27
99b6f7
- Set minimum version of certmonger to 0.26 (to pck up #621670)
99b6f7
- Set minimum version of pki-silent to 1.3.4 (adds -key_algorithm)
99b6f7
- Set minimum version of pki-ca to 1.3.6
99b6f7
- Set minimum version of sssd to 1.2.1
99b6f7
99b6f7
* Tue Aug 10 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-26
99b6f7
- Add BuildRequires for authconfig
99b6f7
99b6f7
* Mon Jul 19 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-25
99b6f7
- Bump up minimum version of python-nss to pick up nss_is_initialize() API
99b6f7
99b6f7
* Thu Jun 24 2010 Adam Young <ayoung@redhat.com> - 1.99-24
99b6f7
- Removed python-asset based webui
99b6f7
99b6f7
* Thu Jun 24 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-23
99b6f7
- Change Requires from fedora-ds-base to 389-ds-base
99b6f7
- Set minimum level of 389-ds-base to 1.2.6 for the replication
99b6f7
  version plugin.
99b6f7
99b6f7
* Tue Jun  1 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-22
99b6f7
- Drop Requires of python-krbV on ipa-client
99b6f7
99b6f7
* Mon May 17 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-21
99b6f7
- Load ipa_dogtag.pp in post install
99b6f7
99b6f7
* Mon Apr 26 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-20
99b6f7
- Set minimum level of sssd to 1.1.1 to pull in required hbac fixes.
99b6f7
99b6f7
* Thu Mar  4 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-19
99b6f7
- No need to create /var/log/ipa_error.log since we aren't using
99b6f7
  TurboGears any more.
99b6f7
99b6f7
* Mon Mar 1 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-18
99b6f7
- Fixed share/ipa/wsgi.py so .pyc, .pyo files are included
99b6f7
99b6f7
* Wed Feb 24 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-17
99b6f7
- Added Require mod_wsgi, added share/ipa/wsgi.py
99b6f7
99b6f7
* Thu Feb 11 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-16
99b6f7
- Require python-wehjit >= 0.2.2
99b6f7
99b6f7
* Wed Feb  3 2010 Rob Crittenden <rcritten@redhat.com> - 1.99-15
99b6f7
- Add sssd and certmonger as a Requires on ipa-client
99b6f7
99b6f7
* Wed Jan 27 2010 Jason Gerard DeRose <jderose@redhat.com> - 1.99-14
99b6f7
- Require python-wehjit >= 0.2.0
99b6f7
99b6f7
* Fri Dec  4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-13
99b6f7
- Add ipa-rmkeytab tool
99b6f7
99b6f7
* Tue Dec  1 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-12
99b6f7
- Set minimum of python-pyasn1 to 0.0.9a so we have support for the ASN.1
99b6f7
  Any type
99b6f7
99b6f7
* Wed Nov 25 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-11
99b6f7
- Remove v1-style /etc/ipa/ipa.conf, replacing with /etc/ipa/default.conf
99b6f7
99b6f7
* Fri Nov 13 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-10
99b6f7
- Add bash completion script and own /etc/bash_completion.d in case it
99b6f7
  doesn't already exist
99b6f7
99b6f7
* Tue Nov  3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-9
99b6f7
- Remove ipa_webgui, its functions rolled into ipa_httpd
99b6f7
99b6f7
* Mon Oct 12 2009 Jason Gerard DeRose <jderose@redhat.com> - 1.99-8
99b6f7
- Removed python-cherrypy from BuildRequires and Requires
99b6f7
- Added Requires python-assets, python-wehjit
99b6f7
99b6f7
* Mon Aug 24 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-7
99b6f7
- Added httpd SELinux policy so CRLs can be read
99b6f7
99b6f7
* Thu May 21 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-6
99b6f7
- Move ipalib to ipa-python subpackage
99b6f7
- Bump minimum version of slapi-nis to 0.15
99b6f7
99b6f7
* Wed May  6 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-5
99b6f7
- Set 0.14 as minimum version for slapi-nis
99b6f7
99b6f7
* Wed Apr 22 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-4
99b6f7
- Add Requires: python-nss to ipa-python sub-package
99b6f7
99b6f7
* Thu Mar  5 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-3
99b6f7
- Remove the IPA DNA plugin, use the DS one
99b6f7
99b6f7
* Wed Mar  4 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-2
99b6f7
- Build radius separately
99b6f7
- Fix a few minor issues
99b6f7
99b6f7
* Tue Feb  3 2009 Rob Crittenden <rcritten@redhat.com> - 1.99-1
99b6f7
- Replace TurboGears requirement with python-cherrypy
99b6f7
99b6f7
* Sat Jan 17 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.1-3
99b6f7
- rebuild with new openssl
99b6f7
99b6f7
* Fri Dec 19 2008 Dan Walsh <dwalsh@redhat.com> - 1.2.1-2
99b6f7
- Fix SELinux code
99b6f7
99b6f7
* Mon Dec 15 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-1
99b6f7
- Fix breakage caused by python-kerberos update to 1.1
99b6f7
99b6f7
* Fri Dec 5 2008 Simo Sorce <ssorce@redhat.com> - 1.2.1-0
99b6f7
- New upstream release 1.2.1
99b6f7
99b6f7
* Sat Nov 29 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 1.2.0-4
99b6f7
- Rebuild for Python 2.6
99b6f7
99b6f7
* Fri Nov 14 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-3
99b6f7
- Respin after the tarball has been re-released upstream
99b6f7
  New hash is 506c9c92dcaf9f227cba5030e999f177
99b6f7
99b6f7
* Thu Nov 13 2008 Simo Sorce <ssorce@redhat.com> - 1.2.0-2
99b6f7
- Conditionally restart also dirsrv and httpd when upgrading
99b6f7
99b6f7
* Wed Oct 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.2.0-1
99b6f7
- Update to upstream version 1.2.0
99b6f7
- Set fedora-ds-base minimum version to 1.1.3 for winsync header
99b6f7
- Set the minimum version for SELinux policy
99b6f7
- Remove references to Fedora 7
99b6f7
99b6f7
* Wed Jul 23 2008 Simo Sorce <ssorce@redhat.com> - 1.1.0-3
99b6f7
- Fix for CVE-2008-3274
99b6f7
- Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface
99b6f7
- Add fix for bug #453185
99b6f7
- Rebuild against openldap libraries, mozldap ones do not work properly
99b6f7
- TurboGears is currently broken in rawhide. Added patch to not build
99b6f7
  the UI locales and removed them from the ipa-server files section.
99b6f7
99b6f7
* Wed Jun 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-2
99b6f7
- Add call to /usr/sbin/upgradeconfig to post install
99b6f7
99b6f7
* Wed Jun 11 2008 Rob Crittenden <rcritten@redhat.com> - 1.1.0-1
99b6f7
- Update to upstream version 1.1.0
99b6f7
- Patch for indexing memberof attribute
99b6f7
- Patch for indexing uidnumber and gidnumber
99b6f7
- Patch to change DNA default values for replicas
99b6f7
- Patch to fix uninitialized variable in ipa-getkeytab
99b6f7
99b6f7
* Fri May 16 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-5
99b6f7
- Set fedora-ds-base minimum version to 1.1.0.1-4 and mod_nss minimum
99b6f7
  version to 1.0.7-4 so we pick up the NSS fixes.
99b6f7
- Add selinux-policy-base(post) to Requires (446496)
99b6f7
99b6f7
* Tue Apr 29 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-4
99b6f7
- Add missing entry for /var/cache/ipa/kpasswd (444624)
99b6f7
- Added patch to fix permissions problems with the Apache NSS database.
99b6f7
- Added patch to fix problem with DNS querying where the query could be
99b6f7
  returned as the answer.
99b6f7
- Fix spec error where patch1 was in the wrong section
99b6f7
99b6f7
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-3
99b6f7
- Added patch to fix problem reported by ldapmodify
99b6f7
99b6f7
* Fri Apr 25 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-2
99b6f7
- Fix Requires for krb5-server that was missing for Fedora versions > 9
99b6f7
- Remove quotes around test for fedora version to package egg-info
99b6f7
99b6f7
* Fri Apr 18 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.0-1
99b6f7
- Update to upstream version 1.0.0
99b6f7
99b6f7
* Tue Mar 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-12
99b6f7
- Pull upstream changelog 722
99b6f7
- Add Conflicts mod_ssl (435360)
99b6f7
99b6f7
* Fri Feb 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-11
99b6f7
- Pull upstream changelog 698
99b6f7
- Fix ownership of /var/log/ipa_error.log during install (435119)
99b6f7
- Add pwpolicy command and man page
99b6f7
99b6f7
* Thu Feb 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-10
99b6f7
- Pull upstream changelog 678
99b6f7
- Add new subpackage, ipa-server-selinux
99b6f7
- Add Requires: authconfig to ipa-python (bz #433747)
99b6f7
- Package i18n files
99b6f7
99b6f7
* Mon Feb 18 2008 Rob Crittenden <rcritten@redhat.com> 0.99-9
99b6f7
- Pull upstream changelog 641
99b6f7
- Require minimum version of krb5-server on F-7 and F-8
99b6f7
- Package some new files
99b6f7
99b6f7
* Thu Jan 31 2008 Rob Crittenden <rcritten@redhat.com> 0.99-8
99b6f7
- Marked with wrong license. IPA is GPLv2.
99b6f7
99b6f7
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-7
99b6f7
- Ensure that /etc/ipa exists before moving user-modifiable html files there
99b6f7
- Put html files into /etc/ipa/html instead of /etc/ipa
99b6f7
99b6f7
* Tue Jan 29 2008 Rob Crittenden <rcritten@redhat.com> 0.99-6
99b6f7
- Pull upstream changelog 608 which renamed several files
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-5
99b6f7
- package the sessions dir /var/cache/ipa/sessions
99b6f7
- Pull upstream changelog 597
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-4
99b6f7
- Updated upstream pull (596) to fix bug in ipa_webgui that was causing the
99b6f7
  UI to not start.
99b6f7
99b6f7
* Thu Jan 24 2008 Rob Crittenden <rcritten@redhat.com> 0.99-3
99b6f7
- Included LICENSE and README in all packages for documentation
99b6f7
- Move user-modifiable content to /etc/ipa and linked back to
99b6f7
  /usr/share/ipa/html
99b6f7
- Changed some references to /usr to the {_usr} macro and /etc
99b6f7
  to {_sysconfdir}
99b6f7
- Added popt-devel to BuildRequires for Fedora 8 and higher and
99b6f7
  popt for Fedora 7
99b6f7
- Package the egg-info for Fedora 9 and higher for ipa-python
99b6f7
99b6f7
* Tue Jan 22 2008 Rob Crittenden <rcritten@redhat.com> 0.99-2
99b6f7
- Added auto* BuildRequires
99b6f7
99b6f7
* Mon Jan 21 2008 Rob Crittenden <rcritten@redhat.com> 0.99-1
99b6f7
- Unified spec file
99b6f7
99b6f7
* Thu Jan 17 2008 Rob Crittenden <rcritten@redhat.com> - 0.6.0-2
99b6f7
- Fixed License in specfile
99b6f7
- Include files from /usr/lib/python*/site-packages/ipaserver
99b6f7
99b6f7
* Fri Dec 21 2007 Karl MacMillan <kmacmill@redhat.com> - 0.6.0-1
99b6f7
- Version bump for release
99b6f7
99b6f7
* Wed Nov 21 2007 Karl MacMillan <kmacmill@mentalrootkit.com> - 0.5.0-1
99b6f7
- Preverse mode on ipa-keytab-util
99b6f7
- Version bump for relase and rpm name change
99b6f7
99b6f7
* Thu Nov 15 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.1-2
99b6f7
- Broke invididual Requires and BuildRequires onto separate lines and
99b6f7
  reordered them
99b6f7
- Added python-tgexpandingformwidget as a dependency
99b6f7
- Require at least fedora-ds-base 1.1
99b6f7
99b6f7
* Thu Nov  1 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.1-1
99b6f7
- Version bump for release
99b6f7
99b6f7
* Wed Oct 31 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-6
99b6f7
- Add dep for freeipa-admintools and acl
99b6f7
99b6f7
* Wed Oct 24 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-5
99b6f7
- Add dependency for python-krbV
99b6f7
99b6f7
* Fri Oct 19 2007 Rob Crittenden <rcritten@redhat.com> - 0.4.0-4
99b6f7
- Require mod_nss-1.0.7-2 for mod_proxy fixes
99b6f7
99b6f7
* Thu Oct 18 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-3
99b6f7
- Convert to autotools-based build
99b6f7
99b6f7
* Tue Sep 25 2007 Karl MacMillan <kmacmill@redhat.com> - 0.4.0-2
99b6f7
99b6f7
* Fri Sep 7 2007 Karl MacMillan <kmacmill@redhat.com> - 0.3.0-1
99b6f7
- Added support for libipa-dna-plugin
99b6f7
99b6f7
* Fri Aug 10 2007 Karl MacMillan <kmacmill@redhat.com> - 0.2.0-1
99b6f7
- Added support for ipa_kpasswd and ipa_pwd_extop
99b6f7
99b6f7
* Sun Aug  5 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-3
99b6f7
- Abstracted client class to work directly or over RPC
99b6f7
99b6f7
* Wed Aug  1 2007 Rob Crittenden <rcritten@redhat.com> - 0.1.0-2
99b6f7
- Add mod_auth_kerb and cyrus-sasl-gssapi to Requires
99b6f7
- Remove references to admin server in ipa-server-setupssl
99b6f7
- Generate a client certificate for the XML-RPC server to connect to LDAP with
99b6f7
- Create a keytab for Apache
99b6f7
- Create an ldif with a test user
99b6f7
- Provide a certmap.conf for doing SSL client authentication
99b6f7
99b6f7
* Fri Jul 27 2007 Karl MacMillan <kmacmill@redhat.com> - 0.1.0-1
99b6f7
- Initial rpm version