%define ipa_requires_gt() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} >= %%{epoch}:%%{version}-%%{release}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")

# ipatests enabled by default, can be disabled with --without ipatests

%bcond_without ipatests

# default to not use XML-RPC in Rawhide, can be turned around with --with ipa_join_xml

# On RHEL 8 we should use --with ipa_join_xml

%bcond_with ipa_join_xml

# Linting is disabled by default, needed for upstream testing

%bcond_with lint

# Build documentation with sphinx

%bcond_with doc

# Build Python wheels

%bcond_with wheels

# 389-ds-base 1.4 no longer supports i686 platform, build only client

# packages, https://bugzilla.redhat.com/show_bug.cgi?id=1544386

%ifarch %{ix86}

%{!?ONLY_CLIENT:%global ONLY_CLIENT 1}

%endif

# Define ONLY_CLIENT to only make the ipa-client and ipa-python

# subpackages

%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}

%if %{ONLY_CLIENT}

%global enable_server_option --disable-server

%else

%global enable_server_option --enable-server

%endif

%if %{ONLY_CLIENT}

%global with_ipatests 0

%endif

# Whether to build ipatests

%if %{with ipatests}

%global with_ipatests_option --with-ipatests

%else

%global with_ipatests_option --without-ipatests

%endif

# Whether to use XML-RPC with ipa-join

%if %{with ipa_join_xml}

%global with_ipa_join_xml_option --with-ipa-join-xml

%else

%global with_ipa_join_xml_option --without-ipa-join-xml

%endif

# lint is not executed during rpmbuild

# %%global with_lint 1

%if %{with lint}

%global linter_options --enable-pylint --without-jslint --enable-rpmlint

%else

%global linter_options --disable-pylint --without-jslint --disable-rpmlint

%endif

# Include SELinux subpackage

%if 0%{?fedora} >= 30 || 0%{?rhel} >= 8

%global with_selinux 1

%global selinuxtype targeted

%global modulename ipa

%endif

%if 0%{?rhel}

%global package_name ipa

%global alt_name freeipa

%global krb5_version 1.20.1-1

%global krb5_kdb_version 9.0

# 0.7.16: https://github.com/drkjam/netaddr/issues/71

%global python_netaddr_version 0.7.19

%global samba_version 4.17.4-101

%global slapi_nis_version 0.56.4

%global python_ldap_version 3.1.0-1

%if 0%{?rhel} < 9

# Bug 1929067 - PKI instance creation failed with new 389-ds-base build

%global ds_version 1.4.3.16-12

%global selinux_policy_version 3.14.3-107

%else

# DNA interval enabled

%global ds_version 2.0.5-1

%global selinux_policy_version 38.1.1-1

%endif

# Fix for TLS 1.3 PHA, RHBZ#1775158

%global httpd_version 2.4.37-21

%global bind_version 9.11.20-6

# support for passkey

%global sssd_version 2.9.0

%else

# Fedora

%global package_name freeipa

%global alt_name ipa

# 0.7.16: https://github.com/drkjam/netaddr/issues/71

%global python_netaddr_version 0.7.16

# Require 4.7.0 which brings Python 3 bindings

# Require 4.12 which has DsRGetForestTrustInformation access rights fixes

%global samba_version 2:4.12.10

# 3.14.5-45 or later includes a number of interfaces fixes for IPA interface

# 36.16-1 fixes BZ#2115691

%if 0%{?fedora} < 36

%global selinux_policy_version 3.14.5-45

%else

%global selinux_policy_version 36.16-1

%endif

%global slapi_nis_version 0.56.5

%if 0%{?fedora} < 38

# Fix for CVE-2020-28196

%global krb5_version 1.18.2-29

%global krb5_kdb_version 8.0

%else

# Fix for CVE-2020-28196

%global krb5_version 1.20.1-3

%global krb5_kdb_version 9.0

%endif

# fix for segfault in python3-ldap, https://pagure.io/freeipa/issue/7324

%global python_ldap_version 3.1.0-1

# Make sure to use 389-ds-base versions that fix https://github.com/389ds/389-ds-base/issues/4700

# and has DNA interval enabled

%if 0%{?fedora} < 34

%global ds_version 1.4.4.16-1

%else

%global ds_version 2.0.7-1

%endif

# Fix for TLS 1.3 PHA, RHBZ#1775146

%global httpd_version 2.4.41-9

# Fix for RHBZ#2117342

%if 0%{?fedora} < 37

%global bind_version 9.11.24-1

%else

%global bind_version 32:9.18.7-1

%endif

# Don't use Fedora's Python dependency generator on Fedora 30/rawhide yet.

# Some packages don't provide new dist aliases.

# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/

%{?python_disable_dependency_generator}

%if 0%{?fedora} < 37

# F35+, adds IdP integration

%global sssd_version 2.7.0

%else

# Support for passkey

%global sssd_version 2.9.0

%endif

# Fedora

%endif

# BIND employs 'pkcs11' OpenSSL engine instead of native PKCS11

# Fedora 31+ uses OpenSSL engine, as well as Fedora ELN (RHEL9)

%if 0%{?fedora} || 0%{?rhel} >= 9

%global openssl_pkcs11_version 0.4.10-6

%global softhsm_version 2.5.0-4

%else

%global with_bind_pkcs11 1

%endif

%if 0%{?rhel} == 8

# Make sure to use PKI versions that work with 389-ds fix for https://github.com/389ds/389-ds-base/issues/4609

%global pki_version 10.10.5

%else

# Make sure to use PKI versions that work with 389-ds fix for https://github.com/389ds/389-ds-base/issues/4609

%global pki_version 10.10.5

%endif

# RHEL 8.3+, F32+ has 0.79.13

%global certmonger_version 0.79.7-3

# RHEL 8.2+, F32+ has 3.58

%global nss_version 3.44.0-4

%define krb5_base_version %(LC_ALL=C /usr/bin/pkgconf --modversion krb5 2>/dev/null | grep -Eo '^[^.]+\.[^.]+' || echo %krb5_version)

%global kdcproxy_version 0.4-3

%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9

# systemd with resolved enabled

# see https://pagure.io/freeipa/issue/8275

%global systemd_version 246.6-3

%else

%global systemd_version 239

%endif

# augeas support for new chrony options

# see https://pagure.io/freeipa/issue/8676

# https://bugzilla.redhat.com/show_bug.cgi?id=1931787

%if 0%{?fedora} >= 33

%global augeas_version 1.12.0-6

%else

%if 0%{?rhel} >= 9

%global augeas_version 1.12.1-0

%else

%global augeas_version 1.12.0-3

%endif

%endif

%global plugin_dir %{_libdir}/dirsrv/plugins

%global etc_systemd_dir %{_sysconfdir}/systemd/system

%global gettext_domain ipa

%define _hardened_build 1

# Work-around fact that RPM SPEC parser does not accept

# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement

%define IPA_VERSION @VERSION@

# Release candidate version -- uncomment with one percent for RC versions

#%%global rc_version rc1

%define AT_SIGN @

# redefine IPA_VERSION only if its value matches the Autoconf placeholder

%if "%{IPA_VERSION}" == "%{AT_SIGN}VERSION%{AT_SIGN}"

%define IPA_VERSION nonsense.to.please.RPM.SPEC.parser

%endif

%define NON_DEVELOPER_BUILD ("%{lua: print(rpm.expand('%{suffix:%IPA_VERSION}'):find('^dev'))}" == "nil")

Name: %{package_name}

Version: %{IPA_VERSION}

Release: 0%{?rc_version:.%rc_version}%{?dist}

Summary: The Identity, Policy and Audit system

License: GPL-3.0-or-later

URL: http://www.freeipa.org/

Source0: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz

# Only use detached signature for the distribution builds. If it is a developer build, skip it

%if %{NON_DEVELOPER_BUILD}

Source1: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz.asc

# https://www.freeipa.org/page/Verify_Release_Signature

#

# The following commands can be used to fetch the signing key via fingerprint

# and extract it:

# fpr=0E63D716D76AC080A4A33513F40800B6298EB963

# gpg --keyserver keys.openpgp.org --receive-keys $fpr

# gpg --armor --export-options export-minimal --export $fpr >gpgkey-$fpr.asc

Source2: gpgkey-0E63D716D76AC080A4A33513F40800B6298EB963.asc

%endif

# RHEL spec file only: START: Change branding to IPA and Identity Management

# Moved branding logos and background to redhat-logos-ipa-80.4:

# header-logo.png, login-screen-background.jpg, login-screen-logo.png,

# product-name.png

# RHEL spec file only: END: Change branding to IPA and Identity Management

# RHEL spec file only: START

%if %{NON_DEVELOPER_BUILD}

%if 0%{?rhel} == 8

Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch

Patch1002: 1002-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch

%endif

%if 0%{?rhel} == 9

Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch

%endif

%endif

# RHEL spec file only: END

BuildRequires: openldap-devel

# For KDB DAL version, make explicit dependency so that increase of version

# will cause the build to fail due to unsatisfied dependencies.

# DAL version change may cause code crash or memory leaks, it is better to fail early.

BuildRequires: krb5-kdb-version = %{krb5_kdb_version}

BuildRequires: krb5-kdb-devel-version = %{krb5_kdb_version}

BuildRequires: krb5-devel >= %{krb5_version}

BuildRequires: pkgconfig(krb5)

%if %{with ipa_join_xml}

# 1.27.4: xmlrpc_curl_xportparms.gssapi_delegation

BuildRequires: xmlrpc-c-devel >= 1.27.4

%else

BuildRequires: libcurl-devel

BuildRequires: jansson-devel

%endif

BuildRequires: popt-devel

BuildRequires: gcc

BuildRequires: gnupg2

BuildRequires: make

BuildRequires: pkgconfig

BuildRequires: pkgconf

BuildRequires: autoconf

BuildRequires: automake

BuildRequires: make

BuildRequires: libtool

BuildRequires: gettext

BuildRequires: gettext-devel

BuildRequires: python3-devel

BuildRequires: python3-setuptools

BuildRequires: systemd >= %{systemd_version}

# systemd-tmpfiles which is executed from make install requires apache user

BuildRequires: httpd

BuildRequires: nspr-devel

BuildRequires: openssl-devel

BuildRequires: libini_config-devel

BuildRequires: cyrus-sasl-devel

%if ! %{ONLY_CLIENT}

BuildRequires: 389-ds-base-devel >= %{ds_version}

BuildRequires: samba-devel >= %{samba_version}

BuildRequires: libtalloc-devel

BuildRequires: libtevent-devel

BuildRequires: libuuid-devel

BuildRequires: libpwquality-devel

BuildRequires: libsss_idmap-devel

BuildRequires: libsss_certmap-devel

BuildRequires: libsss_nss_idmap-devel >= %{sssd_version}

%if 0%{?fedora} >= 39 || 0%{?rhel} >= 10

# Do not use nodejs20 on fedora < 39, https://pagure.io/freeipa/issue/9374

BuildRequires: nodejs(abi)

%else

BuildRequires: nodejs(abi) < 111

%endif

# use old dependency on RHEL 8 for now

%if 0%{?fedora} >= 31 || 0%{?rhel} >= 9

BuildRequires: python3-rjsmin

%else

BuildRequires: uglify-js

%endif

BuildRequires: libverto-devel

BuildRequires: libunistring-devel

# 0.13.0: https://bugzilla.redhat.com/show_bug.cgi?id=1584773

# 0.13.0-2: fix for missing dependency on python-six

BuildRequires: python3-lesscpy >= 0.13.0-2

BuildRequires: cracklib-dicts

# ONLY_CLIENT

%endif

#

# Build dependencies for makeapi/makeaci

#

BuildRequires: python3-cffi

BuildRequires: python3-dns

BuildRequires: python3-ldap >= %{python_ldap_version}

BuildRequires: python3-libsss_nss_idmap

BuildRequires: python3-netaddr >= %{python_netaddr_version}

BuildRequires: python3-pyasn1

BuildRequires: python3-pyasn1-modules

BuildRequires: python3-six

BuildRequires: python3-psutil

#

# Build dependencies for wheel packaging and PyPI upload

#

%if %{with wheels}

BuildRequires: dbus-glib-devel

BuildRequires: libffi-devel

BuildRequires: python3-tox

%if 0%{?fedora} <= 28

BuildRequires: python3-twine

%else

BuildRequires: twine

%endif

BuildRequires: python3-wheel

# with_wheels

%endif

%if %{with doc}

BuildRequires: python3-sphinx

BuildRequires: plantuml

BuildRequires: fontconfig

BuildRequires: google-noto-sans-vf-fonts

%endif

#

# Build dependencies for lint and fastcheck

#

%if %{with lint}

# python3-pexpect might not be available in RHEL9

%if 0%{?fedora} || 0%{?rhel} < 9

BuildRequires: python3-pexpect

%endif

# jsl is orphaned in Fedora 34+

%if 0%{?fedora} < 34

BuildRequires: jsl

%endif

BuildRequires: git

BuildRequires: nss-tools

BuildRequires: rpmlint

BuildRequires: softhsm

BuildRequires: keyutils

BuildRequires: python3-augeas

BuildRequires: python3-cffi

BuildRequires: python3-cryptography >= 1.6

BuildRequires: python3-dateutil

BuildRequires: python3-dbus

BuildRequires: python3-dns >= 1.15

BuildRequires: python3-docker

BuildRequires: python3-gssapi >= 1.2.0

BuildRequires: python3-jinja2

BuildRequires: python3-jwcrypto >= 0.4.2

BuildRequires: python3-ldap >= %{python_ldap_version}

BuildRequires: python3-ldap >= %{python_ldap_version}

BuildRequires: python3-lib389 >= %{ds_version}

BuildRequires: python3-libipa_hbac

BuildRequires: python3-libsss_nss_idmap

BuildRequires: python3-lxml

BuildRequires: python3-netaddr >= %{python_netaddr_version}

BuildRequires: python3-netifaces

BuildRequires: python3-pki >= %{pki_version}

BuildRequires: python3-polib

BuildRequires: python3-pyasn1

BuildRequires: python3-pyasn1-modules

BuildRequires: python3-pycodestyle

# .wheelconstraints.in limits pylint version in Azure and tox tests

BuildRequires: python3-pylint

BuildRequires: python3-pytest-multihost

BuildRequires: python3-pytest-sourceorder

BuildRequires: python3-qrcode-core >= 5.0.0

BuildRequires: python3-samba

BuildRequires: python3-six

BuildRequires: python3-sss

BuildRequires: python3-sss-murmur

BuildRequires: python3-sssdconfig >= %{sssd_version}

BuildRequires: python3-systemd

BuildRequires: python3-yaml

BuildRequires: python3-yubico

# with_lint

%endif

#

# Build dependencies for unit tests

#

%if ! %{ONLY_CLIENT}

BuildRequires: libcmocka-devel

# Required by ipa_kdb_tests

BuildRequires: krb5-server >= %{krb5_version}

# ONLY_CLIENT

%endif

# Build dependencies for SELinux policy

%if %{with selinux}

BuildRequires: selinux-policy-devel >= %{selinux_policy_version}

%endif

%description

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

%if ! %{ONLY_CLIENT}

%package server

Summary: The IPA authentication server

Requires: %{name}-server-common = %{version}-%{release}

Requires: %{name}-client = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

Requires: python3-ipaserver = %{version}-%{release}

Requires: python3-ldap >= %{python_ldap_version}

Requires: 389-ds-base >= %{ds_version}

Requires: openldap-clients > 2.4.35-4

Requires: nss-tools >= %{nss_version}

Requires(post): krb5-server >= %{krb5_version}

Requires(post): krb5-server >= %{krb5_base_version}

Requires: krb5-kdb-version = %{krb5_kdb_version}

Requires: cyrus-sasl-gssapi%{?_isa}

Requires: chrony

Requires: httpd >= %{httpd_version}

Requires(preun): python3

Requires(postun): python3

Requires: python3-gssapi >= 1.2.0-5

Requires: python3-systemd

Requires: python3-mod_wsgi

Requires: mod_auth_gssapi >= 1.5.0

Requires: mod_ssl >= %{httpd_version}

Requires: mod_session >= %{httpd_version}

# 0.9.9: https://github.com/adelton/mod_lookup_identity/pull/3

Requires: mod_lookup_identity >= 0.9.9

Requires: acl

Requires: systemd-units >= %{systemd_version}

Requires(pre): systemd-units >= %{systemd_version}

Requires(post): systemd-units >= %{systemd_version}

Requires(preun): systemd-units >= %{systemd_version}

Requires(postun): systemd-units >= %{systemd_version}

Requires(pre): shadow-utils

Requires: selinux-policy >= %{selinux_policy_version}

Requires(post): selinux-policy-base >= %{selinux_policy_version}

Requires: slapi-nis >= %{slapi_nis_version}

Requires: pki-ca >= %{pki_version}

Requires: pki-kra >= %{pki_version}

# pki-acme package was split out in pki-10.10.0

Requires: (pki-acme >= %{pki_version} if pki-ca >= 10.10.0)

Requires: policycoreutils >= 2.1.12-5

Requires: tar

Requires(pre): certmonger >= %{certmonger_version}

Requires(pre): 389-ds-base >= %{ds_version}

Requires: font(fontawesome)

Requires: open-sans-fonts

%if 0%{?fedora} >= 32 || 0%{?rhel} >= 9

# https://pagure.io/freeipa/issue/8632

Requires: openssl > 1.1.1i

%else

Requires: openssl

%endif

Requires: softhsm >= 2.0.0rc1-1

Requires: p11-kit

Requires: %{etc_systemd_dir}

Requires: gzip

Requires: oddjob

# 0.7.0-2: https://pagure.io/gssproxy/pull-request/172

Requires: gssproxy >= 0.7.0-2

Requires: sssd-dbus >= %{sssd_version}

Requires: libpwquality

Requires: cracklib-dicts

# NDR libraries are internal in Samba and change with version without changing SONAME

%ipa_requires_gt samba-client-libs

Provides: %{alt_name}-server = %{version}

Conflicts: %{alt_name}-server

Obsoletes: %{alt_name}-server < %{version}

# With FreeIPA 3.3, package freeipa-server-selinux was obsoleted as the

# entire SELinux policy is stored in the system policy

Obsoletes: freeipa-server-selinux < 3.3.0

# upgrade path from monolithic -server to -server + -server-dns

Obsoletes: %{name}-server <= 4.2.0

# Versions of nss-pam-ldapd < 0.8.4 require a mapping from uniqueMember to

# member.

Conflicts: nss-pam-ldapd < 0.8.4

# RHEL spec file only: START: Do not build tests

%if 0%{?rhel} == 8

# ipa-tests subpackage was moved to separate srpm

Conflicts: ipa-tests < 3.3.3-9

%endif

# RHEL spec file only: END: Do not build tests

%description server

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If you are installing an IPA server, you need to install this package.

%package -n python3-ipaserver

Summary: Python libraries used by IPA server

BuildArch: noarch

%{?python_provide:%python_provide python3-ipaserver}

Requires: %{name}-server-common = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

# we need pre-requires since earlier versions may break upgrade

Requires(pre): python3-ldap >= %{python_ldap_version}

Requires: python3-augeas

Requires: augeas-libs >= %{augeas_version}

Requires: python3-dbus

Requires: python3-dns >= 1.15

Requires: python3-gssapi >= 1.2.0

Requires: python3-ipaclient = %{version}-%{release}

Requires: python3-kdcproxy >= %{kdcproxy_version}

Requires: python3-lxml

Requires: python3-pki >= %{pki_version}

Requires: python3-pyasn1 >= 0.3.2-2

Requires: python3-sssdconfig >= %{sssd_version}

Requires: python3-psutil

Requires: rpm-libs

%if 0%{?rhel}

Requires: python3-urllib3 >= 1.24.2-3

%else

# For urllib3.util.ssl_match_hostname

Requires: python3-urllib3 >= 1.25.8

%endif

%description -n python3-ipaserver

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If you are installing an IPA server, you need to install this package.

%package server-common

Summary: Common files used by IPA server

BuildArch: noarch

Requires: %{name}-client-common = %{version}-%{release}

Requires: httpd >= %{httpd_version}

Requires: systemd-units >= %{systemd_version}

%if 0%{?rhel} >= 8 && ! 0%{?eln}

Requires: system-logos-ipa >= 80.4

%endif

Provides: %{alt_name}-server-common = %{version}

Conflicts: %{alt_name}-server-common

Obsoletes: %{alt_name}-server-common < %{version}

%description server-common

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If you are installing an IPA server, you need to install this package.

%package server-dns

Summary: IPA integrated DNS server with support for automatic DNSSEC signing

BuildArch: noarch

Requires: %{name}-server = %{version}-%{release}

Requires: bind-dyndb-ldap >= 11.2-2

Requires: bind >= %{bind_version}

Requires: bind-utils >= %{bind_version}

# bind-dnssec-utils is required by the OpenDNSSec integration

# https://pagure.io/freeipa/issue/9026

Requires: bind-dnssec-utils >= %{bind_version}

%if %{with bind_pkcs11}

Requires: bind-pkcs11 >= %{bind_version}

%else

Requires: softhsm >= %{softhsm_version}

Requires: openssl-pkcs11 >= %{openssl_pkcs11_version}

%endif

# See https://bugzilla.redhat.com/show_bug.cgi?id=1825812

# RHEL 8.3+ and Fedora 32+ have 2.1

Requires: opendnssec >= 2.1.6-5

%{?systemd_requires}

Provides: %{alt_name}-server-dns = %{version}

Conflicts: %{alt_name}-server-dns

Obsoletes: %{alt_name}-server-dns < %{version}

# upgrade path from monolithic -server to -server + -server-dns

Obsoletes: %{name}-server <= 4.2.0

%description server-dns

IPA integrated DNS server with support for automatic DNSSEC signing.

Integrated DNS server is BIND 9. OpenDNSSEC provides key management.

%package server-trust-ad

Summary: Virtual package to install packages required for Active Directory trusts

Requires: %{name}-server = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

Requires: samba >= %{samba_version}

Requires: samba-winbind

Requires: sssd-winbind-idmap

Requires: libsss_idmap

%if 0%{?rhel}

Obsoletes: ipa-idoverride-memberof-plugin <= 0.1

%endif

Requires(post): python3

Requires: python3-samba

Requires: python3-libsss_nss_idmap

Requires: python3-sss

# We use alternatives to divert winbind_krb5_locator.so plugin to libkrb5

# on the installes where server-trust-ad subpackage is installed because

# IPA AD trusts cannot be used at the same time with the locator plugin

# since Winbindd will be configured in a different mode

Requires(post): %{_sbindir}/update-alternatives

Requires(postun): %{_sbindir}/update-alternatives

Requires(preun): %{_sbindir}/update-alternatives

Provides: %{alt_name}-server-trust-ad = %{version}

Conflicts: %{alt_name}-server-trust-ad

Obsoletes: %{alt_name}-server-trust-ad < %{version}

%description server-trust-ad

Cross-realm trusts with Active Directory in IPA require working Samba 4

installation. This package is provided for convenience to install all required

dependencies at once.

# ONLY_CLIENT

%endif

%package client

Summary: IPA authentication for use on clients

Requires: %{name}-client-common = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

Requires: python3-gssapi >= 1.2.0-5

Requires: python3-ipaclient = %{version}-%{release}

Requires: python3-ldap >= %{python_ldap_version}

Requires: python3-sssdconfig >= %{sssd_version}

Requires: cyrus-sasl-gssapi%{?_isa}

Requires: chrony

Requires: krb5-workstation >= %{krb5_version}

# support pkinit with client install

Requires: krb5-pkinit-openssl >= %{krb5_version}

# authselect: sssd profile with-subid

%if 0%{?fedora} >= 36

Requires: authselect >= 1.4.0

%else

Requires: authselect >= 1.2.5

%endif

Requires: curl

# NIS domain name config: /usr/lib/systemd/system/*-domainname.service

# All Fedora 28+ and RHEL8+ contain the service in hostname package

Requires: hostname

Requires: libcurl >= 7.21.7-2

%if %{with ipa_join_xml}

Requires: xmlrpc-c >= 1.27.4

%else

Requires: jansson

%endif

Requires: sssd-ipa >= %{sssd_version}

Requires: sssd-idp >= %{sssd_version}

Requires: sssd-krb5 >= %{sssd_version}

Requires: certmonger >= %{certmonger_version}

Requires: nss-tools >= %{nss_version}

Requires: bind-utils

Requires: oddjob-mkhomedir

Requires: libsss_autofs

Requires: autofs

Requires: libnfsidmap

Requires: nfs-utils

Requires: sssd-tools >= %{sssd_version}

Requires(post): policycoreutils

# https://pagure.io/freeipa/issue/8530

Recommends: libsss_sudo

Recommends: sudo

Requires: (libsss_sudo if sudo)

# Passkey support

Recommends: sssd-passkey

Provides: %{alt_name}-client = %{version}

Conflicts: %{alt_name}-client

Obsoletes: %{alt_name}-client < %{version}

Provides: %{alt_name}-admintools = %{version}

Conflicts: %{alt_name}-admintools

Obsoletes: %{alt_name}-admintools < 4.4.1

Obsoletes: %{name}-admintools < 4.4.1

Provides: %{name}-admintools = %{version}-%{release}

%if 0%{?rhel} == 8

# Conflict with crypto-policies < 20200629-1 to get AD-SUPPORT policy module

Conflicts: crypto-policies < 20200629-1

%endif

%if 0%{?rhel} == 9

# Conflict with crypto-policies < 20220223-1 to get upgraded AD-SUPPORT and

# AD-SUPPORT-LEGACY policy modules

Conflicts: crypto-policies < 20220223-1

%endif

%description client

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If your network uses IPA for authentication, this package should be

installed on every client machine.

This package provides command-line tools for IPA administrators.

%package client-samba

Summary: Tools to configure Samba on IPA client

Group: System Environment/Base

Requires: %{name}-client = %{version}-%{release}

Requires: python3-samba

Requires: samba-client

Requires: samba-winbind

Requires: samba-common-tools

Requires: samba

Requires: sssd-winbind-idmap

Requires: tdb-tools

Requires: cifs-utils

%description client-samba

This package provides command-line tools to deploy Samba domain member

on the machine enrolled into a FreeIPA environment

%package client-epn

Summary: Tools to configure Expiring Password Notification in IPA

Group: System Environment/Base

Requires: %{name}-client = %{version}-%{release}

Requires: systemd-units >= %{systemd_version}

Requires(post): systemd-units >= %{systemd_version}

Requires(preun): systemd-units >= %{systemd_version}

Requires(postun): systemd-units >= %{systemd_version}

%description client-epn

This package provides a service to collect and send expiring password

notifications via email (SMTP).

%package -n python3-ipaclient

Summary: Python libraries used by IPA client

BuildArch: noarch

%{?python_provide:%python_provide python3-ipaclient}

Requires: %{name}-client-common = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

Requires: python3-ipalib = %{version}-%{release}

Requires: python3-augeas

Requires: augeas-libs >= %{augeas_version}

Requires: python3-dns >= 1.15

Requires: python3-jinja2

%description -n python3-ipaclient

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If your network uses IPA for authentication, this package should be

installed on every client machine.

%package client-common

Summary: Common files used by IPA client

BuildArch: noarch

Provides: %{alt_name}-client-common = %{version}

Conflicts: %{alt_name}-client-common

Obsoletes: %{alt_name}-client-common < %{version}

# python2-ipa* packages are no longer available in 4.8.

Obsoletes: python2-ipaclient < 4.8.0-1

Obsoletes: python2-ipalib < 4.8.0-1

Obsoletes: python2-ipaserver < 4.8.0-1

Obsoletes: python2-ipatests < 4.8.0-1

%description client-common

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If your network uses IPA for authentication, this package should be

installed on every client machine.

%package python-compat

Summary: Compatiblity package for Python libraries used by IPA

BuildArch: noarch

Obsoletes: %{name}-python < 4.2.91

Provides: %{name}-python = %{version}-%{release}

Requires: %{name}-common = %{version}-%{release}

Requires: python3-ipalib = %{version}-%{release}

Provides: %{alt_name}-python-compat = %{version}

Conflicts: %{alt_name}-python-compat

Obsoletes: %{alt_name}-python-compat < %{version}

Obsoletes: %{alt_name}-python < 4.2.91

Provides: %{alt_name}-python = %{version}

%description python-compat

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

This is a compatibility package to accommodate %{name}-python split into

python3-ipalib and %{name}-common. Packages still depending on

%{name}-python should be fixed to depend on python2-ipaclient or

%{name}-common instead.

%package -n python3-ipalib

Summary: Python3 libraries used by IPA

BuildArch: noarch

%{?python_provide:%python_provide python3-ipalib}

Provides: python3-ipapython = %{version}-%{release}

%{?python_provide:%python_provide python3-ipapython}

Provides: python3-ipaplatform = %{version}-%{release}

%{?python_provide:%python_provide python3-ipaplatform}

Requires: %{name}-common = %{version}-%{release}

# we need pre-requires since earlier versions may break upgrade

Requires(pre): python3-ldap >= %{python_ldap_version}

Requires: gnupg2

Requires: keyutils

Requires: python3-cffi

Requires: python3-cryptography >= 1.6

Requires: python3-dateutil

Requires: python3-dbus

Requires: python3-dns >= 1.15

Requires: python3-gssapi >= 1.2.0

Requires: python3-jwcrypto >= 0.4.2

Requires: python3-libipa_hbac

Requires: python3-netaddr >= %{python_netaddr_version}

Requires: python3-netifaces >= 0.10.4

Requires: python3-pyasn1 >= 0.3.2-2

Requires: python3-pyasn1-modules >= 0.3.2-2

Requires: python3-pyusb

Requires: python3-qrcode-core >= 5.0.0

Requires: python3-requests

Requires: python3-six

Requires: python3-sss-murmur

Requires: python3-yubico >= 1.3.2-7

%if 0%{?rhel} && 0%{?rhel} == 8

Requires: platform-python-setuptools

%else

Requires: python3-setuptools

%endif

%if 0%{?rhel}

Requires: python3-urllib3 >= 1.24.2-3

%else

# For urllib3.util.ssl_match_hostname

Requires: python3-urllib3 >= 1.25.8

%endif

%description -n python3-ipalib

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If you are using IPA with Python 3, you need to install this package.

%package common

Summary: Common files used by IPA

BuildArch: noarch

Conflicts: %{name}-python < 4.2.91

Provides: %{alt_name}-common = %{version}

Conflicts: %{alt_name}-common

Obsoletes: %{alt_name}-common < %{version}

Conflicts: %{alt_name}-python < %{version}

%if %{with selinux}

# This ensures that the *-selinux package and all it’s dependencies are not

# pulled into containers and other systems that do not use SELinux. The

# policy defines types and file contexts for client and server.

Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})

%endif

%description common

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

If you are using IPA, you need to install this package.

%if %{with ipatests}

%package -n python3-ipatests

Summary: IPA tests and test tools

BuildArch: noarch

%{?python_provide:%python_provide python3-ipatests}

Requires: python3-ipaclient = %{version}-%{release}

Requires: python3-ipaserver = %{version}-%{release}

Requires: iptables

Requires: python3-cryptography >= 1.6

%if 0%{?fedora}

# These packages do not exist on RHEL and for ipatests use

# they are installed on the controller through other means

Requires: ldns-utils

Requires: python3-pexpect

# update-crypto-policies

Requires: crypto-policies-scripts

Requires: python3-polib

Requires: python3-pytest >= 3.9.1

Requires: python3-pytest-multihost >= 0.5

Requires: python3-pytest-sourceorder

Requires: sshpass

%endif

Requires: python3-sssdconfig >= %{sssd_version}

Requires: tar

Requires: xz

Requires: openssh-clients

%if 0%{?rhel}

AutoReqProv: no

%endif

%description -n python3-ipatests

IPA is an integrated solution to provide centrally managed Identity (users,

hosts, services), Authentication (SSO, 2FA), and Authorization

(host access control, SELinux user roles, services). The solution provides

features for further integration with Linux based clients (SUDO, automount)

and integration with Active Directory based infrastructures (Trusts).

This package contains tests that verify IPA functionality under Python 3.

# with ipatests

%endif

%if %{with selinux}

# SELinux subpackage

%package selinux

Summary: FreeIPA SELinux policy

BuildArch: noarch

Requires: selinux-policy-%{selinuxtype}

Requires(post): selinux-policy-%{selinuxtype}

%{?selinux_requires}

%description selinux

Custom SELinux policy module for FreeIPA

# with selinux

%endif

%prep