| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
This directory is no longer used as session storage.
|
|
|
|
|
|
|
|
|
| |
All SELinux policy needed by FreeIPA server is now part of the global
system SELinux policy which makes the subpackage redundant and slowing
down the installation. This patch drops it.
https://fedorahosted.org/freeipa/ticket/3683
https://fedorahosted.org/freeipa/ticket/3684
|
|
|
|
|
|
|
| |
Make sure that the success message is properly populated with actual number of
items that were successfully added/removed.
https://fedorahosted.org/freeipa/ticket/3708
|
|
|
|
|
|
|
|
|
|
| |
There is a JS error.
Rule tables with external member has more than one column and therefore exclude parameter for adder dialog is not array of strings but array of objects. normalize_values function can't work with it and causes JS error.
This patch creates proper exclude array before passing it to adder dialog.
https://fedorahosted.org/freeipa/ticket/3711
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3675
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3673
https://fedorahosted.org/freeipa/ticket/3674
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3667
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3665
|
|
|
|
|
|
| |
sys.stdout is buffered by default if redirected to a file.
This may causes automated installation to appear hung.
Flush the stream so that messages are written immediately.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Following values of ipaRangeType attribute are supported
and translated accordingly in the idrange commands:
'ipa-local': 'local domain range'
'ipa-ad-winsync': 'Active Directory winsync range'
'ipa-ad-trust': 'Active Directory domain range'
'ipa-ad-trust-posix': 'Active Directory trust range with
POSIX attributes'
'ipa-ipa-trust': 'IPA trust range'
Part of https://fedorahosted.org/freeipa/ticket/3647
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously, we deduced the range type from the range objectclass
and filled in virtual attribute in post_callback phase.
Having a ipaRangeType attributeType in schema, we need to fill
the attribute values to ranges created in previous IPA versions.
The plugin follows the same approach, setting ipa-local or
ipa-ad-trust value to the ipaRangeType attribute according
to the objectclass of the range.
Part of https://fedorahosted.org/freeipa/ticket/3647
|
|
|
|
|
|
|
|
|
|
| |
This adds a new LDAP attribute ipaRangeType with
OID 2.16.840.1.113730.3.8.11.41 to the LDAP Schema.
ObjectClass ipaIDrange has been altered to require
ipaRangeType attribute.
Part of https://fedorahosted.org/freeipa/ticket/3647
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3685
|
|
|
|
|
|
|
|
| |
Adds a new simple service called OtpdInstance, that manages
ipa-otpd.socket service. Added to server/replica installer
and ipa-upgradeconfig script.
https://fedorahosted.org/freeipa/ticket/3680
|
|
|
|
|
|
|
|
| |
Default list of attributes that are checked with 7-bit plugin
for being 7-bit clean includes userPassword. Consecutively, one
is unable to set passwords that contain non-ascii characters.
https://fedorahosted.org/freeipa/ticket/3640
|
|
|
|
|
|
| |
One Python's unicode marking character was being printed by RPC plugin
which then appeared in ipa-client-install output. This patch removes
it.
|
|
|
|
|
|
|
|
| |
Currently there is only empty space between facet tabs and facet title.
It's a regression caused by recent refactoring.
https://fedorahosted.org/freeipa/ticket/3688
|
|
|
|
|
|
|
|
|
|
|
| |
In idrange-add command, ensure that RID base is prompted for
in the interactive mode if domain SID or domain name was
specified.
If domain name nor SID was specified, make sure rid base is
prompted for if secondary rid base was specified and vice versa.
https://fedorahosted.org/freeipa/ticket/3602
|
|
|
|
|
|
|
|
|
|
| |
Extracted common code from ipalib/plugins/cli.py and
ipalib/plugins/dns.py that provided way to prompt user
for the value of specific attribute.
Added prompt_param method to Command class in ipalib/frontend.py
Done as part of https://fedorahosted.org/freeipa/ticket/3602
|
|
|
|
|
| |
Fixed as part of
https://fedorahosted.org/freeipa/ticket/3602
|
|
|
|
|
|
|
|
| |
All installers that handle Kerberos auth, have been altered to use
private ccache, that is ipa-server-install, ipa-dns-install,
ipa-replica-install, ipa-ca-install.
https://fedorahosted.org/freeipa/ticket/3666
|
|
|
|
|
|
|
|
| |
Manual configuration page for other browsers (ssbrowser.html) doesn't work in IE 10 - error page is displayed.
This patch is conditioning creation of Firefox configuration object so that configure.jar is requested only in Firefox. IE doesn't request it and so it does not fail.
https://fedorahosted.org/freeipa/ticket/3645
|
| |
|
|
|
|
|
|
|
|
| |
This was to resolve a -Werror=format-security error.
ipa_extdom_extop.c: In function 'ipa_extdom_extop':
ipa_extdom_extop.c:144:9: error: format not a string literal and no format
arguments [-Werror=format-security]
|
|
|
|
|
|
| |
Regression introduced by 6e90920233cc9a7c9feb040dea22cda837715c39 - 'Move spec modifications from facet factories to pre_ops'.
https://fedorahosted.org/freeipa/ticket/3605
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3636
|
|
|
|
|
|
|
|
|
|
| |
When removing an ID range using idrange-del command, validation
in pre_callback ensures that the range does not belong to any
active trust. In such case, ValidationError is raised.
Unit tests to cover the functionality has been added.
https://fedorahosted.org/freeipa/ticket/3615
|
| |
|
|
|
|
|
|
|
|
|
| |
Since we depend on Dogtag 10 now, there is no need to keep code
that installs a Dogtag 9 CA.
Support for upgraded Dogtag-9-style instances is left in.
https://fedorahosted.org/freeipa/ticket/3529
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3639
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In ip-adtrust-install, "adding RID bases" step would fail
if there was more than one local range defined. This can be a
common case if e.g. there are users that migrated from previous
IdM solution.
With this patch, we fail only if there are multiple local ranges
that do not have RID bases set.
Keep in mind that overlap checking is ensured by ipa-range-check
DS plugin.
https://fedorahosted.org/freeipa/ticket/3498
|
|
|
|
|
|
|
|
|
|
|
| |
trust-find
In trust_show command, make sure that --raw flag is honoured.
Attributes ipanttrusttype and ipanttrustdirection are no longer
translated to strings from their raw ldap values when --raw is
used.
https://fedorahosted.org/freeipa/ticket/3525
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Windows DCs return an empty reply when a legal request cannot satisfied.
If we get EINVAL or ENOENT it means the information requested could not be
found or input parameters were bogus.
Always return an empty reply in these cases.
On any other internal error just return, the request may have been legit but we
can't really handle it right now, pretend we never saw it and hope the next
attempt will succeed.
Fixes: https://fedorahosted.org/freeipa/ticket/3639
Signed-off-by: Simo Sorce <simo@redhat.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
1. Stop using getdomainname() as it is often not properly initialized
2. The code using getdomainname() was not working anyway it was trying to
look at the function call output in hostname which is always empty at that
point.
3. Always check the requested domain matches our own, we cannot reply to
anything else anyway.
Pre-requisite to fix: https://fedorahosted.org/freeipa/ticket/3639
Signed-off-by: Simo Sorce <simo@redhat.com>
|
|
|
|
|
| |
The variable is already defined, exporting in dirsrv systemd
environment is not needed and produces a (benign) error.
|
|
|
|
|
|
| |
Pass a whole krbV.CCache object to ldap2 connect() method so that
it can properly detect both type and name of a CCAHE. Otherwise
the test fails on systems with default DIR type CCACHE.
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3633
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3629
|
|
|
|
|
|
| |
Metadata provider is IPA specific object, not a framework object, so it should not be in _base directory.
https://fedorahosted.org/freeipa/ticket/3604
|
|
|
|
|
|
|
|
|
|
| |
Facet pre_ops defined in ./facet module were moved to modules where facet are actually defined. Moved pre_ops were united with the ones defined for the facets in these modules.
The move simplifies module dependencies - there is no reason to have general facet module dependent on specialized facet modules.
Pre_ops uniting makes the code simpler.
https://fedorahosted.org/freeipa/ticket/3605
|
|
|
|
|
|
|
|
| |
Spec modifications in factories makes inheritance and extensibility more difficult.
Moving them to pre_ops allows modification of their output by other pre_ops.
https://fedorahosted.org/freeipa/ticket/3605
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/3591
|
|
|
|
|
|
|
|
|
| |
During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.
https://fedorahosted.org/freeipa/ticket/3367
http://freeipa.org/page/V3/OTP
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.
https://fedorahosted.org/freeipa/ticket/3366
http://freeipa.org/page/V3/OTP
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If OTP is enabled for a user, then:
1. Long-term keys are not provided to KDB
2. The user string 'otp' is defined to KDB
Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string to a known default
('[]') which enables the default configuration in the KDC.
https://fedorahosted.org/freeipa/ticket/3561
http://freeipa.org/page/V3/OTP
|