summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* jQuery.ordered_map: remove map attributePetr Vobornik2015-05-122-13/+2
| | | | | | | | map attribute is redundant and not used. Use `get` method instead. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* jQuery.ordered_map: faster creationPetr Vobornik2015-05-121-1/+7
| | | | | | | | Creation of map with e.g. 30K values was very slow. Map checked if a value is in in the map but it used Array's indexOf method therefore the complexity was quadratic instead of linear. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Server Upgrade: Allow base64 encoded valuesMartin Basti2015-05-118-51/+145
| | | | | | | | | | | | | | This patch allows to use base64 encoded values in update files. Double colon ('::') must be used as separator between attribute name and base64 encoded value. add:attr::<base64-value> replace:attr::<old-base64-value>::<new-base64-value> https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Server Upgrade: remove CSV from upgrade filesMartin Basti2015-05-1124-322/+319
| | | | | | | | | | | | | | | | | CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* use Connectible.disconnect() instead of .destroy_connection()Petr Vobornik2015-05-072-3/+3
| | | | | | | | | Destroy connection is an internal function of Connectible and therefore it should not be used directly. https://fedorahosted.org/freeipa/ticket/4991 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* allow to call ldap2.destroy_connection multiple timesPetr Vobornik2015-05-072-3/+4
| | | | | | A regression fix. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Update BUILD.txtPetr Vobornik2015-05-071-11/+18
| | | | | | | | Add note about `dnf builddep` command and link to http://www.freeipa.org/page/Build page which contains information about copr repos Reviewed-By: Martin Basti <mbasti@redhat.com>
* Test Objectclass of postdetach groupLenka Ryznarova2015-05-071-0/+69
| | | | | | | | | Add regression test to check whether a post detach group has a full set of objectclass. Add regression test to check whether group-add-member is successfull for a post detach group. https://fedorahosted.org/freeipa/ticket/4909 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* update 'api.env.ca_host' if a different hostname is used during server installMartin Babinsky2015-05-071-3/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4936 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-server-install: deprecate manual setting of master KDC passwordMartin Babinsky2015-05-072-4/+12
| | | | | | | | | | | Option '-P' was used in older version of FreeIPA to set up KDC master password during server install. This is no longer neccessary or desirable since the password of sufficient strength can be generated automatically during installation. https://fedorahosted.org/freeipa/ticket/4516 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Changed in-tree development setup instructionsThorsten Scherf2015-05-071-2/+4
| | | | | | | | Instructions on how to setup an in-tree development server were not were clear in the existing BUILD.txt. Setup procedure has been extended and corrected. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* prevent duplicate IDs when setting up multiple replicas against single masterMartin Babinsky2015-05-071-24/+50
| | | | | | | | | | | This patch forces replicas to use DELETE+ADD operations to increment 'nsDS5ReplicaId' in 'cn=replication,cn=etc,$SUFFIX' on master, and retry multiple times in the case of conflict with another update. Thus when multiple replicas are set-up against single master none of them will have duplicate ID. https://fedorahosted.org/freeipa/ticket/4378 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* webui-ci: do not open 2 browser windowsPetr Vobornik2015-05-071-3/+3
| | | | Reviewed-By: Milan Kubik <mkubik@redhat.com>
* webui: add pwpolicy link to group details page if group has associated pwpolicyPetr Vobornik2015-05-072-11/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/4982 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Unsaved changes dialog internally inconsistentGabe2015-05-078-27/+31
| | | | | | https://fedorahosted.org/freeipa/ticket/4926 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix stop_tracking_certificates call in ipa-restoreJan Cholasta2015-05-071-3/+2
| | | | | | | | | CAInstance.stop_tracking_certificates() no longer has dogtag_constants argument. https://fedorahosted.org/freeipa/ticket/4775 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: enable DS global lock during upgradeMartin Basti2015-05-053-7/+37
| | | | | | https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Server Upgrade: use LDIF parser to modify DSE.ldifMartin Basti2015-05-051-20/+165
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* move realm_to_serverid to installutils moduleMartin Basti2015-05-0516-37/+43
| | | | | | | | | To avoid cyclic imports realm_to_serverid function had to be moved to installutils from dsinstance. Required for: https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix a signedness bug in OTP codeNathaniel McCallum2015-05-051-3/+3
| | | | | | | | | This bug caused negative token windows to wrap-around, causing issues with TOTP authentication and (especially) synchronization. https://fedorahosted.org/freeipa/ticket/4990 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Server Upgrade: fix a comment in ldapupdaterMartin Basti2015-05-051-6/+1
| | | | | | | | DN sorting was removed in previous patches https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove unneeded ip-address option in ipa-adtrust-installGabe2015-05-053-41/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4575 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Server Upgrade: use ipa-server-upgrade in RPM upgradeMartin Basti2015-05-041-2/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Verify version and platformMartin Basti2015-05-0410-35/+187
| | | | | | | | | | | | | | | | | | | | | | | | Verify version and platform before upgrade or ipactl start|restart Upgrade: * do not allow upgrade on different platforms * do not allow upgrade data with higher version than build has Start: * do not start services if platform mismatch * do not start services if upgrade is needed * do not start services if data with higher version than build has New ipactl options: --skip-version-check: do not validate IPA version --ignore-service-failures (was --force): ignore if a service start fail and continue with starting other services --force: combine --skip-version-check and --ignore-service-failures https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: ipa-server-upgrade commandMartin Basti2015-05-046-0/+128
| | | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* suppress errors arising from deleting non-existent files during client uninstallMartin Babinsky2015-04-291-18/+22
| | | | | | | | | | | When rolling back partially configured IPA client a number of OSErrors pop up due to uninstaller trying to remove files that do not exist anymore. This patch supresses these errors while keeping them in log as debug messages. https://fedorahosted.org/freeipa/ticket/4966 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* point the users to PKI-related logs when CA configuration failsMartin Babinsky2015-04-293-5/+19
| | | | | | | | | | This patch adds an error handler which prints out the paths to logs related to configuration and installation of Dogtag/CA in the case of failure. https://fedorahosted.org/freeipa/ticket/4900 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Lint: Fix error on pylint-1.3.1 introduced by fix for pylint-1.4.1.David Kupka2015-04-271-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make lint work on Fedora 22.David Kupka2015-04-274-1/+5
| | | | | | | | | | | pylint added 'confidence' parameter to 'add_message' method of PyLinter. To be compatible with both, pre- and post- 1.4 IPALinter must accept the parameter but not pass it over. Also python3 checker was added and enabled by default. FreeIPA is still not ready for python3. Additionally few false-positives was marked. Reviewed-By: Martin Basti <mbasti@redhat.com>
* speed up indirect member processingPetr Vobornik2015-04-276-95/+81
| | | | | | | | | | | | | | | the old implementation tried to get all entries which are member of group. That means also user. User can't have any members therefore this costly processing was unnecessary. New implementation reduces the search only to entries which have members. Also page size was removed to avoid paging by small pages(default size: 100) which is very slow for many members. https://fedorahosted.org/freeipa/ticket/4947 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Lint: Skip checking of functions stolen by python-nose.David Kupka2015-04-241-2/+11
| | | | | | | python-nose modifies namespaces in a way that confuses pylint. To skip these PyCheckers' visit_callfunc method must be extended. Reviewed-By: Martin Basti <mbasti@redhat.com>
* use separate ccache filename for each IPA DNSSEC daemonMartin Babinsky2015-04-243-3/+3
| | | | | | | | | ipa-dnskeysyncd, ipa-dnskeysync-replica, and ipa-ods-exporter use a generic 'ccache' filename for credential storage, making debugging Kerberos-related errors unnecessarily complicated. This patch renames the ccache files so that each of these daemons now has its own credenital cache. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipa client: use NTP servers specified by userMartin Basti2015-04-241-9/+15
| | | | | | | | NTP servers specified by user should be used to synchronize time. https://fedorahosted.org/freeipa/ticket/4983 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa client: use NTP servers detected from SRVMartin Basti2015-04-241-1/+8
| | | | | | | | | Detected NTP servers from SRV records should be used in NTP client configuration. https://fedorahosted.org/freeipa/ticket/4981 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa client: make --ntp-server option multivaluedMartin Basti2015-04-243-14/+18
| | | | | | | | There can be more ntp servers in ntp.conf Required for ticket: https://fedorahosted.org/freeipa/ticket/4981 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update python-yubico dependency versionNathaniel McCallum2015-04-241-2/+2
| | | | | | | | This change enables support for all current YubiKey hardware. https://fedorahosted.org/freeipa/ticket/4954 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Remove Editable DN and DN component classesPetr Viktorin2015-04-232-1950/+1003
| | | | | | | | | | Make all DNs, RDNs and AVAs immutable. Immutability makes reasoning about DN-handling code easier, as value objects can't be changed once created. Instead of mutable DNs, one can use a list (or even a generator) of RDNs that's converted to a DN on output. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* rename_managed: Remove use of EditableDNPetr Viktorin2015-04-231-20/+32
| | | | | | This was the last use of EditableDN in IPA; the class can now be removed. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Removed recommendation from ipa-adtrust-installThorsten Scherf2015-04-211-9/+0
| | | | | | | | | | In the wiki we say it's not longer necessary to make the IPA LDAP server not reachable by any AD domain controller. To be consistence, the setup tool should reflext this statement. https://fedorahosted.org/freeipa/ticket/4977 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Adopted kinit_keytab and kinit_password for kerberos authMartin Babinsky2015-04-209-41/+54
| | | | | | | | | Calls to ipautil.run using kinit were replaced with calls kinit_keytab/kinit_password functions implemented in the PATCH 0015. Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipa-client-install: try to get host TGT several times before giving upMartin Babinsky2015-04-202-29/+48
| | | | | | | | | | | | | | New option '--kinit-attempts' enables the host to make multiple attempts to obtain host TGT from master before giving up and aborting client installation. In addition, all kinit attempts were replaced by calls to 'ipautil.kinit_keytab' and 'ipautil.kinit_password'. https://fedorahosted.org/freeipa/ticket/4808 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipautil: new functions kinit_keytab and kinit_passwordMartin Babinsky2015-04-201-17/+54
| | | | | | | | | | | | | kinit_keytab replaces kinit_hostprincipal and performs Kerberos auth using keytab file. Function is also able to repeat authentication multiple times before giving up and raising Krb5Error. kinit_password wraps kinit auth using password and also supports FAST authentication using httpd armor ccache. Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* speed up convert_attribute_membersPetr Vobornik2015-04-201-8/+28
| | | | | | | | A workaround to avoid usage of slow LDAPEntry._sync_attr #4946 https://fedorahosted.org/freeipa/ticket/4965 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ldap: Remove IPASimpleLDAPObjectJan Cholasta2015-04-161-105/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ldap: Use SimpleLDAPObject instead of IPASimpleLDAPObject in LDAPClientJan Cholasta2015-04-161-2/+2
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ldap: Move schema handling from IPASimpleLDAPObject to LDAPClientJan Cholasta2015-04-163-288/+264
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ldap: Use LDAPClient instead of IPASimpleLDAPObject in LDAPEntryJan Cholasta2015-04-162-5/+14
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ldap: Move value encoding from IPASimpleLDAPObject to LDAPClientJan Cholasta2015-04-162-140/+95
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* makeaci: Use LDAPClient instead of IPASimpleLDAPObjectJan Cholasta2015-04-161-11/+2
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* cainstance: Use LDAPClient instead of IPASimpleLDAPObjectJan Cholasta2015-04-161-7/+8
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-02 11:12:59 +0000