URL: https://github.com/freeipa/freeipa/pull/1104 Author: tomaskrizek Title: #1104: [Backport][ipa-4-6] browser config: cleanup after removal of Firefox extension Action: opened
PR body: """ This PR was opened automatically because PR #1034 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1104/head:pr1104 git checkout pr1104
From f5f2a5e152e9a5efb7bb82795101e8948cb5e03e Mon Sep 17 00:00:00 2001 From: Petr Vobornik <pvobo...@redhat.com> Date: Fri, 1 Sep 2017 21:50:44 +0200 Subject: [PATCH] browser config: cleanup after removal of Firefox extension Firefox extension which served for configuring Kerberos auth in Firefox until version which banned self-signed extensions was removed in commit 6c53765ac1746ea3cb82554775a37fe43af062e8. Given that configure.jar, even older Firefox config tool, was removed sometime before that, there is no use for signtool tool. It is good because it is removed from Fedora 27 anyway. So removing last unused function which calls it. The removal of FF extension was not exactly clean so removing also browserconfig.html which only purpose was to use the extension. Therefore also related JS files are removed. This removal requires unauthorized.html to be updated so that it doesn't point to non-existing page. And given that it now points only to single config page, we can change link in UI login page to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html. Btw, commit 6c53765ac1746ea3cb82554775a37fe43af062e8 removed also generation of krb.js. It had one perk - with that info ssbrowser.html could display real Kerberos domain instead of only 'example.com'. I don't have time to revert this change so removing traces of krb.js as well. https://pagure.io/freeipa/issue/7135 --- freeipa.spec.in | 10 -- install/html/Makefile.am | 3 - install/html/browserconfig.html | 128 -------------------- install/html/ffconfig.js | 146 ----------------------- install/html/ffconfig_page.js | 163 -------------------------- install/html/jsl.conf | 2 - install/html/ssbrowser.html | 22 ++-- install/html/unauthorized.html | 4 +- install/ui/src/freeipa/widgets/LoginScreen.js | 2 +- ipaplatform/base/paths.py | 1 - ipaserver/install/certs.py | 8 -- 11 files changed, 11 insertions(+), 478 deletions(-) delete mode 100644 install/html/browserconfig.html delete mode 100644 install/html/ffconfig.js delete mode 100644 install/html/ffconfig_page.js diff --git a/freeipa.spec.in b/freeipa.spec.in index fdb87824fe..6d992ba151 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -1067,9 +1067,7 @@ mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/ /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf /bin/touch %{buildroot}%{_usr}/share/ipa/html/ca.crt -/bin/touch %{buildroot}%{_usr}/share/ipa/html/kerberosauth.xpi /bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.con -/bin/touch %{buildroot}%{_usr}/share/ipa/html/krb.js /bin/touch %{buildroot}%{_usr}/share/ipa/html/krb5.ini /bin/touch %{buildroot}%{_usr}/share/ipa/html/krbrealm.con @@ -1407,10 +1405,7 @@ fi %{_usr}/share/ipa/profiles/README %{_usr}/share/ipa/profiles/*.cfg %dir %{_usr}/share/ipa/html -%{_usr}/share/ipa/html/ffconfig.js -%{_usr}/share/ipa/html/ffconfig_page.js %{_usr}/share/ipa/html/ssbrowser.html -%{_usr}/share/ipa/html/browserconfig.html %{_usr}/share/ipa/html/unauthorized.html %dir %{_usr}/share/ipa/migration %{_usr}/share/ipa/migration/error.html @@ -1442,11 +1437,8 @@ fi %{_usr}/share/ipa/wsgi/plugins.py* %dir %{_sysconfdir}/ipa %dir %{_sysconfdir}/ipa/html -%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig.js -%config(noreplace) %{_sysconfdir}/ipa/html/ffconfig_page.js %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html -%config(noreplace) %{_sysconfdir}/ipa/html/browserconfig.html %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf @@ -1457,9 +1449,7 @@ fi %{_usr}/share/ipa/ipa-rewrite.conf %{_usr}/share/ipa/ipa-pki-proxy.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_usr}/share/ipa/html/ca.crt -%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/kerberosauth.xpi %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.con -%ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb.js %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krb5.ini %ghost %attr(0644,root,apache) %{_usr}/share/ipa/html/krbrealm.con %dir %{_usr}/share/ipa/updates/ diff --git a/install/html/Makefile.am b/install/html/Makefile.am index 3b7a0646bd..49a12fc17d 100644 --- a/install/html/Makefile.am +++ b/install/html/Makefile.am @@ -2,10 +2,7 @@ NULL = appdir = $(IPA_SYSCONF_DIR)/html app_DATA = \ - ffconfig.js \ - ffconfig_page.js \ ssbrowser.html \ - browserconfig.html \ unauthorized.html \ $(NULL) diff --git a/install/html/browserconfig.html b/install/html/browserconfig.html deleted file mode 100644 index f1ab764e7c..0000000000 --- a/install/html/browserconfig.html +++ /dev/null @@ -1,128 +0,0 @@ -<!DOCTYPE html> -<html> -<head> - <meta charset="utf-8"> - <title>IPA: Identity Policy Audit</title> - <script type="text/javascript" src="../ui/js/libs/loader.js"></script> - <script type="text/javascript"> - (function() { - var styles = [ - '../ui/css/patternfly.css', - '../ui/css/ipa.css' - ]; - var scripts = [ - '../ui/js/libs/jquery.js', - 'krb.js', - 'ffconfig.js', - 'ffconfig_page.js' - ]; - ipa_loader.scripts(scripts); - ipa_loader.styles(styles); - })(); - </script> -</head> - -<body class="info-page"> - - <nav class="navbar navbar-default navbar-pf" role="navigation"> - <div class="navbar-header"> - <a class="brand" href="../ui/index.html"><img src="../ui/images/header-logo.png" alt="FreeIPA"></a> - </div> - </nav> - - <div class="container-fluid"> - <div class="row"> - <div class="col-sm-12"> - <div class="browser-config"> - <h1>Firefox configuration</h1> - - <div id="wrongbrowser" style="display:none" class="step"> - <h2>Wrong Browser!</h2> - <p> - <a href="ssbrowser.html" id="notfirefox-link" class="btn btn-default" >Proceed to configuration for other browsers</a> - </p> - <p> - You are not using Firefox. Please use configuration page for other browsers. - </p> - </div> - - <div id="step1" class="step"> - <h2>Step 1</h2> - <p> - <a href="ca.crt" id="ca-link" class="btn btn-default">Import Certificate Authority certificate</a> - </p> - <p> - Make sure you select <b>all three</b> checkboxes. - </p> - </div> - - <div id="step2a" style="display:none" class="step"> - <h2>Step 2a</h2> - <p> - <a href="ssbrowser.html#oldfirefox" id="oldfirefox-link" class="btn btn-default">Proceed to configuration page for older versions of Firefox</a> - </p> - <!--<p id="older-compatible"> - Your version of Firefox can be configured by an older method. You don't have to use the Kerberos Configuration extension. - </p>--> - <p id="older-required"> - Your version of Firefox is not compatible with configuration method on this page. Please use configuration page for older versions of Firefox. - <p> - </div> - - <div id="step2" style="display:none" class="step"> - <h2>Step 2</h2> - <div id="ext-installed"> - <p> - <a href="kerberosauth.xpi" id="reinstall-link" class="btn btn-default">Re-install extension</a> - </p> - <p> - Extension installed. You can proceed to Step 3. - </p> - </div> - <div id="ext-missing"> - <p><a href="kerberosauth.xpi" id="install-link" class="btn btn-default">Install Kerberos Configuration Firefox extension</a></p> - <p>Kerberos Configuration extension is required for Step 3</p> - </div> - </div> - - <div id="step3" style="display:none" class="step"> - <h2>Step 3</h2> - <p><a href="#configure-browser" id="configure-link" class="btn btn-default">Configure browser</a></p> - <p id="config-success" style="display:none">Browser successfully configured</p> - <p id="config-aborted" style="display:none">Configuration aborted</p> - <p id="config-noext" style="display:none">Configuration was not successful, extension isn't installed or is disabled. Please proceed to step 2.</p> - <p id="config-error" style="display:none">Configuration was not successful, unknown error occurred.</p> - </div> - - <div id="step2b" class="step"> - <h2>Step 2</h2> - <ol> - <li> - In the address bar of Firefox, type <code>about:config</code> and press enter to display the list of current configuration options. - </li> - <li> - In the Filter field, type <code>network.negotiate-auth.trusted-uris</code> to restrict the list of options. - </li> - <li> - Double-click the entry to display the "Enter string value" dialog box. - </li> - <li> - Enter the name of the domain against which you want to authenticate, <code class="example-domain">.example.com</code> as an example. - </li> - </ol> - </div> - - <div id="step4" class="step"> - <h2 id="step4header" style="display:none">Step 4</h2> - <h2 id="step3bheader">Step 3</h2> - <p><a href="../ui/index.html" id="return-link" class="btn btn-default">Return to Web UI</a></p> - </div> - </div> - - </div> - </div> - </div> - -</body> - -</html> diff --git a/install/html/ffconfig.js b/install/html/ffconfig.js deleted file mode 100644 index ecb1a635f5..0000000000 --- a/install/html/ffconfig.js +++ /dev/null @@ -1,146 +0,0 @@ -/* Authors: - * Petr Vobornik <pvobo...@redhat.com> - * - * Copyright (C) 2012 Red Hat - * see file 'COPYING' for use and warranty information - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. - */ - -var IPA = IPA || {}; - -IPA.browser_config = { - - configure_firefox: function(domain) { - - var self = this; - - domain = domain || self.get_domain(); - - self.send_message({ - method: 'configure', - predefined: 'ipa', - trusted_uris: domain - }); - }, - - - get_configure_result: function() { - - var self = this; - - var el = self.get_data_element(); - - var answer = el.getAttribute('answer'); - - return answer; - }, - - get_domain: function() { - return "."+IPA_DOMAIN; - }, - - send_message: function(options) { - - options = options || {}; - - var self = this; - - self.clear_data_element(); - var opt_element = self.get_data_element(); - - for (var opt in options) { - opt_element.setAttribute(opt, options[opt]); - } - - var msg_evt = document.createEvent('HTMLEvents'); - msg_evt.initEvent('kerberos-auth-config', true, false); - opt_element.dispatchEvent(msg_evt); - }, - - get_data_element: function() { - - var els = document.getElementsByTagName('kerberosauthdataelement'); - var element; - - if (els.length === 0) { - element = document.createElement('kerberosauthdataelement'); - document.documentElement.appendChild(element); - } else { - element = els[0]; - } - - return element; - }, - - clear_data_element: function() { - - var self = this; - - var el = self.get_data_element(); - var to_remove = []; - - for (var i=0; i<el.attributes.length; i++) { - to_remove.push(el.attributes[i].name); - } - - for (i=0; i<to_remove.length; i++) { - el.removeAttribute(to_remove[i]); - } - }, - - extension_installed: function() { - - var self = this; - - self.send_message({ - method: 'can_configure' - }); - - var element = self.get_data_element(); - var ext_installed = element.getAttribute('answer') === 'true'; - return ext_installed; - }, - - get_browser: function() { - - var ua = window.navigator.userAgent.toLowerCase(); - - var match = (/(chrome)[ \/]([\w.]+)/.exec(ua)) || - (/(webkit)[ \/]([\w.]+)/.exec(ua)) || - (/(opera)(?:.*version|)[ \/]([\w.]+)/.exec(ua)) || - (/(msie) ([\w.]+)/.exec(ua)) || - ua.indexOf("compatible") < 0 && (/(mozilla)(?:.*? rv:([\w.]+)|)/.exec(ua)) || - []; - - var matched = { - browser: match[ 1 ] || "", - version: match[ 2 ] || "0" - }; - var browser = {}; - - if (matched.browser) { - browser[matched.browser] = true; - browser.version = matched.version; - } - - // Chrome is Webkit, but Webkit is also Safari. - if (browser.chrome) { - browser.webkit = true; - } else if ( browser.webkit ) { - browser.safari = true; - } - return browser; - } -}; \ No newline at end of file diff --git a/install/html/ffconfig_page.js b/install/html/ffconfig_page.js deleted file mode 100644 index 536332ee83..0000000000 --- a/install/html/ffconfig_page.js +++ /dev/null @@ -1,163 +0,0 @@ -/* Authors: - * Petr Vobornik <pvobo...@redhat.com> - * - * Copyright (C) 2012 Red Hat - * see file 'COPYING' for use and warranty information - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see <http://www.gnu.org/licenses/>. - */ - - $(document).ready(function() { - - var set_enabled = function(steps, enabled) { - - for (var i=0; i<steps.length; i++) { - $(steps[i]).toggleClass('disabled', !enabled); - $(steps[i]+" .btn").toggleClass('disabled', !enabled); - } - }; - - var show_installed = function(installed) { - - if (installed) { - $('#ext-installed').show(); - $('#ext-missing').hide(); - } else { - $('#ext-installed').hide(); - $('#ext-missing').show(); - } - set_enabled(['#step3'], installed); - }; - - var install = function(event) { - - window.location = $(event.target).attr('href'); - check_until_installed(); - return false; - }; - - var check_until_installed = function() { - - var installed = IPA.browser_config.extension_installed(); - show_installed(installed); - - if (!installed) { - window.setTimeout(function() { - check_until_installed(); - }, 300); - } - }; - - var configure = function() { - IPA.browser_config.configure_firefox(); - var result = IPA.browser_config.get_configure_result(); - var installed = IPA.browser_config.extension_installed(); - - $('#config-success').hide(); - $('#config-aborted').hide(); - $('#config-noext').hide(); - $('#config-error').hide(); - - if (result === 'configured') { - $('#config-success').show(); - } else if (result == 'aborted') { - $('#config-aborted').show(); - } else if (!installed) { - $('#config-noext').show(); - } else { - $('#config-error').show(); - } - return false; - }; - - var check_version = function() { - - var browser = IPA.browser_config.get_browser(); - - if (!browser.mozilla) { - $('#wrongbrowser').show(); - set_enabled(['#step2b'], false); - } else { - // Disable for all version of FF older than 15. Theoretically - // the extension is compatible with version 3.6, 10 and later - // FF 4-9 are not compatible because there is an error in loading - // resource from chrome.manifest - if (compare_version(browser.version, '15') === -1) { - $('#step2a').show(); - $('#step2').show(); - $('#step3').show(); - $('#step4header').show(); - $('#step3bheader').hide(); - set_enabled(['#step2', '#step3', '#step2b'], false); - } else if (compare_version(browser.version, '40') === -1) { - // FF is > 15 < 40 - // show krb extension method - $('#step2').show(); - $('#step3').show(); - $('#step4header').show(); - $('#step3bheader').hide(); - $('#step2b').hide(); - } - // else - // Firefox since version 40 has new extension signing policy - // this policy prevents to use self-signed FF extension and - // thus a manual config is needed - which is the default (step2b) - - // else if (compare_version(version, '15') === -1) { -// $('#step2a').show(); -// $('#older-compatible').show(); -// $('#older-required').hide(); -// } - } - }; - - var compare_version = function(a, b) { - - var only_digits =/[^\d.]/g; - - var a_parts = a.replace(only_digits, '').split('.'); - var b_parts = b.replace(only_digits, '').split('.'); - - for (var i=0; i<a_parts.length && i<b_parts.length; i++) { - var a_num = Number(a_parts[i]); - var b_num = Number(b_parts[i]); - - if (a_num > b_num) return 1; - else if (a_num < b_num) return -1; - } - - if (a_parts.length !== b_parts.length) { - return a_parts.length > b_parts.length ? 1 : -1; - } - - return 0; - }; - - var button_handler = function(handler) { - return function(e) { - if ($(this).hasClass('disabled')) { - e.preventDefault(); - return false; - } - return handler.call(this, e); - }; - }; - - $('#install-link').click(button_handler(install)); - $('#reinstall-link').click(button_handler(install)); - $('#configure-link').click(button_handler(configure)); - - check_version(); - show_installed(IPA.browser_config.extension_installed()); -}); \ No newline at end of file diff --git a/install/html/jsl.conf b/install/html/jsl.conf index b9a8a97801..ad52043d74 100644 --- a/install/html/jsl.conf +++ b/install/html/jsl.conf @@ -127,5 +127,3 @@ # To add a set of files, use "+process FileName", "+process Folder\Path\*.js", # or "+process Folder\Path\*.htm". # -+process ffconfig.js -+process ffconfig_page.js \ No newline at end of file diff --git a/install/html/ssbrowser.html b/install/html/ssbrowser.html index 49d8c5be1a..5ab871d8e3 100644 --- a/install/html/ssbrowser.html +++ b/install/html/ssbrowser.html @@ -6,23 +6,14 @@ <script type="text/javascript" src="../ui/js/libs/loader.js"></script> <script type="text/javascript"> (function() { - function loaded() { - $(document).ready(function() { - var domain = '.' + (IPA_DOMAIN || 'example.com'); - $('.example-domain').text(domain); - }); - } - var styles = [ '../ui/css/patternfly.css', '../ui/css/ipa.css' ]; var scripts = [ - '../ui/js/libs/jquery.js', - 'krb.js', - 'ffconfig.js' + '../ui/js/libs/jquery.js' ]; - ipa_loader.scripts(scripts, loaded); + ipa_loader.scripts(scripts); ipa_loader.styles(styles); })(); </script> @@ -51,7 +42,12 @@ <ol> <li> - Import <a href="ca.crt">CA certificate</a>. Make sure you checked all three checkboxes. + <p> + <a href="ca.crt" id="ca-link" class="btn btn-default">Import Certificate Authority certificate</a> + </p> + <p> + Make sure you select <b>all three</b> checkboxes. + </p> </li> <li> In the address bar of Firefox, type <code>about:config</code> to display the list of current configuration options. @@ -65,7 +61,7 @@ <li> Enter the name of the domain against which you want to authenticate, for example, <code class="example-domain">.example.com.</code> </li> - <li><strong> You are all set. </strong></li> + <li><a href="../ui/index.html" id="return-link" class="btn btn-default">Return to Web UI</a></li> </ol> <h2>Chrome</h2> diff --git a/install/html/unauthorized.html b/install/html/unauthorized.html index 0b4414f55e..8c57ce822b 100644 --- a/install/html/unauthorized.html +++ b/install/html/unauthorized.html @@ -36,9 +36,7 @@ <div id="first-time"> <p> - If this is your first time, please <strong>configure your browser</strong>. - Use <a href="browserconfig.html">Firefox configuration page</a> for Firefox - or <a href="ssbrowser.html">manual configuration page</a> for other browsers. + If this is your first time, please <a href="ssbrowser.html">configure your browser</a>. </p> </div> </div> diff --git a/install/ui/src/freeipa/widgets/LoginScreen.js b/install/ui/src/freeipa/widgets/LoginScreen.js index 66d672e7b6..d7c53d4f79 100644 --- a/install/ui/src/freeipa/widgets/LoginScreen.js +++ b/install/ui/src/freeipa/widgets/LoginScreen.js @@ -55,7 +55,7 @@ define(['dojo/_base/declare', kerberos_msg: "<i class=\"fa fa-info-circle\"></i> To login with <strong>Kerberos</strong>, please make sure you" + " have valid tickets (obtainable via kinit) and " + - "<a href='http://${host}/ipa/config/unauthorized.html'>configured</a>" + + "<a href='http://${host}/ipa/config/ssbrowser.html'>configured</a>" + " the browser correctly, then click Login. ", cert_msg: "<i class=\"fa fa-info-circle\"></i> To login with <strong>certificate</strong>," + " please make sure you have valid personal certificate. ", diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index d48ffca082..2d96dc2efa 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -171,7 +171,6 @@ class BasePathNamespace(object): ODS_SIGNER = "/usr/sbin/ods-signer" OPENSSL = "/usr/bin/openssl" PK12UTIL = "/usr/bin/pk12util" - SIGNTOOL = "/usr/bin/signtool" SOFTHSM2_UTIL = "/usr/bin/softhsm2-util" SSLGET = "/usr/bin/sslget" SSS_SSH_AUTHORIZEDKEYS = "/usr/bin/sss_ssh_authorizedkeys" diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index b12283948e..4215de4029 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -226,14 +226,6 @@ def set_perms(self, fname, write=False): def run_certutil(self, args, stdin=None, **kwargs): return self.nssdb.run_certutil(args, stdin, **kwargs) - def run_signtool(self, args, stdin=None): - with open(self.passwd_fname, "r") as f: - password = f.readline() - new_args = [paths.SIGNTOOL, "-d", self.secdir, "-p", password] - - new_args = new_args + args - ipautil.run(new_args, stdin) - def create_noise_file(self): if ipautil.file_exists(self.noise_fname): os.remove(self.noise_fname)
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org
