summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Only set sebools when necessaryMartin Kosek2012-06-101-15/+46
| | | | | | | | | setsebool -P was run for every package upgrade or server installation even though the sebools were already set to the new value. Only set sebools which are different from current system values. This speeds up ipa-upgradeconfig or package update by 150 seconds.
* Enable psearch on upgradesMartin Kosek2012-06-102-8/+174
| | | | | | | | | | | | | From IPA 3.0, persistent search is a preferred mechanism for new DNS zone detection and is also needed for other features (DNSSEC, SOA serial updates). Enable psearch and make sure connections attribute is right. This step is done just once for a case when user switched the persistent search back to disabled on purpose. ipa-upgradeconfig was updated to accept --debug option in case somebody would want to see debug messages.
* Enable persistent search by defaultMartin Kosek2012-06-107-35/+41
| | | | | | | | | | | From IPA version 3.0, the persistent search is a preferred mechanism to for DNS zone list management. It will be also a requirement for several bind-dyndb-ldap features, like SOA serial automatic updates or DNSSEC. Make this mechanism default in ipa-server-install and ipa-dns-istall. https://fedorahosted.org/freeipa/ticket/2524
* Add sysupgrade state fileMartin Kosek2012-06-105-13/+91
| | | | | | | | | | | | | When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
* Fix update plugin orderPetr Viktorin2012-06-101-15/+5
| | | | | | | | | Sort a filtered list in the update plugin ordering method. Unlike the previous algorithm, this always gives a correct order. It should also be faster and more readable. https://fedorahosted.org/freeipa/ticket/2820
* Clean keytabs before installing new keys into themPetr Viktorin2012-06-111-0/+15
| | | | | | | | | In ipa-client-install (which is also called from server/replica installation), call `ipa-rmkeytab -k <keytab> -r $REALM` to be sure that there aren't any remnants from a previous install of IPA or another KDC altogether. https://fedorahosted.org/freeipa/ticket/2698
* Move some krb5 keys related functions from ipa-client to utilSumit Bose2012-06-113-376/+403
|
* ipasam: remove unused struct elementsSumit Bose2012-06-111-11/+0
|
* Use exop instead of kadmin.localSumit Bose2012-06-113-28/+81
|
* Only allow root to run update pluginsPetr Viktorin2012-06-072-16/+17
| | | | | | | | | | | | Several plugins need restarting the DS (or they currently do an external bind). Rather than disabling plugins (possibly partially), refuse to run them when run as an unprivileged user. This means running ipa-ldap-updater as non-root requires specifying a list of files, and omiting the --upgrade and --plugins options. https://fedorahosted.org/freeipa/ticket/2621
* Update of serverconfig ipaconfigstring optionsPetr Vobornik2012-06-061-1/+4
| | | | | | | | | | | | Patch "Add options to reduce writes from KDC" adds two more possible values to config plugins ipaconfigstring configuration options. These are: * KDC:Disable Last Success * KDC:Disable Lockout This patch adds them to Web UI https://fedorahosted.org/freeipa/ticket/2734
* Add support for disabling KDC writesSimo Sorce2012-06-065-2/+78
| | | | | | | | | | | Add two global ipaConfig options to disable undesirable writes that have performance impact. The "KDC:Disable Last Success" will disable writing back to ldap the last successful AS Request time (successful kinit) The "KDC:Disable Lockout" will disable completely writing back lockout related data. This means lockout policies will stop working. https://fedorahosted.org/freeipa/ticket/2734
* Prevent deletion of the last adminPetr Viktorin2012-06-065-3/+150
| | | | | | | | Raise an error when trying to delete the last user in the 'admins' group, or remove the last member from the group, or delete the group itself. https://fedorahosted.org/freeipa/ticket/2564
* Add samba4-python to BuildRequiresPetr Viktorin2012-06-071-1/+2
|
* Removal of illegal options in association dialogPetr Vobornik2012-06-073-15706/+13223
| | | | | | | | Association dialogs were using non-existent options for find commands. It causes error when #2509 is implemented. Now when creating a find command a check for options existence is performend. Option is not used if not present in metadata. It fixes the issue. https://fedorahosted.org/freeipa/ticket/2760
* Change json serialization to serialize useful dataPetr Vobornik2012-06-073-5/+40
| | | | | | | | | | | | | json_metadata command creates and sends metadata needed by Web UI. It uses __json__ method for serialization of commands, options, objects... . A lot of data sent was useless for Web UI and some usefull information were missing. We * mostly CLI specific option attribues are not send. * attributes evaluated to false or None are not send * options which are send are not got from takes_aptions attribute but by get_options() method. It finally sends usefull option collection for commands part of metadata. In the end the raw amount of data send is aproximately the same. This patch is needed for Web UI to determine which option it can use in which commands. https://fedorahosted.org/freeipa/ticket/2760
* Add python-crypto to build requires for AD server-side codeAlexander Bokovoy2012-06-071-0/+4
|
* Set samba_portmapper SELinux boolean during ipa-adtrust-installsbose2012-06-071-0/+51
|
* ipa-sam: update sid_to_id() interface to follow passdb API changes in SambaAlexander Bokovoy2012-06-072-18/+3
| | | | | | | | | Commit a6e29f23f09ba5b6b6d362f7683ae8088bc0ba85 in Samba changed id mapping API in passdb interface to use 'struct unixid'. The change replaced three arguments (uid, gid, type) by one (struct unixid). As result, ipa-sam became broken. Without this change ipa-sam introduces stack corruption in Samba post 4.0.0alpha18 leading to corrupted security context stack as well and then crashing in setgroups(3).
* get_fqdn() moved to ipaserver.installutilsAlexander Bokovoy2012-06-071-2/+2
|
* Add trust-related ACIsAlexander Bokovoy2012-06-075-81/+196
| | | | | | | | | A high-level description of the design and ACIs for trusts is available at https://www.redhat.com/archives/freeipa-devel/2011-December/msg00224.html and https://www.redhat.com/archives/freeipa-devel/2011-December/msg00248.html Ticket #1731
* ipa-kdb: Add MS-PAC on constrained delegation.Simo Sorce2012-06-071-22/+26
|
* Restart KDC after installing trust support to allow MS PAC generationAlexander Bokovoy2012-06-071-7/+16
| | | | | | | | Also make sure all exceptions are captured when creating CIFS service record. The one we care about is duplicate entry and we do nothing in that case anyway. Also make uniform use of action descriptors.
* Properly handle multiple IP addresses per host when installing trust supportAlexander Bokovoy2012-06-071-16/+22
| | | | | | | | resolve_host() function returns a list of IP addresses. Handle it all rather than expecting that there is a single address. It wouldn't hurt to make a common function that takes --ip-address into account when resolving host addresses and use it everywhere.
* Perform case-insensitive searches for principals on TGS requestsAlexander Bokovoy2012-06-076-22/+65
| | | | | | | | | | We want to always resolve TGS requests even if the user mistakenly sends a request for a service ticket where the fqdn part contain upper case letters. The actual implementation follows hints set by KDC. When AP_REQ is done, KDC sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests. https://fedorahosted.org/freeipa/ticket/1577
* Use fully qualified PDC name when contacting for extended DN informationAlexander Bokovoy2012-06-071-1/+1
|
* Add trust management for Active Directory trustsAlexander Bokovoy2012-06-0710-8/+673
|
* Use dedicated keytab for SambaAlexander Bokovoy2012-06-072-12/+19
| | | | | | | | Samba just needs the cifs/ key on the ipa server. Configure samba to use a different keytab file so that we do not risk samba commands (net, or similar) to mess up the system keytab. https://fedorahosted.org/freeipa/ticket/2168
* Add separate attribute to store trusted domain SIDAlexander Bokovoy2012-06-078-6/+69
| | | | | | | | | | | We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
* Fix dnszone-mod --forwader option help stringMartin Kosek2012-06-051-1/+1
| | | | | | | Help should not point to global forwarders but rather to per-zone conditional forwarders. https://fedorahosted.org/freeipa/ticket/2717
* Improve migration NotFound errorMartin Kosek2012-06-052-7/+14
| | | | | | | | | | | | | When no user/group was found, migration plugin reported an ambiguous error about invalid container. But the root cause may be for example in a wrong list of user/group objectclasses. Report both in the error message to avoid user confusion. User/group objectclass attribute is now also marked as required. Without the list of objectclasses, an invalid LDAP search is produced. https://fedorahosted.org/freeipa/ticket/2206
* Fill new DNS zone update policy by defaultMartin Kosek2012-06-057-14/+60
| | | | | | | | | | | | For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
* Text widget's dirty state is changed on various input methodsPetr Vobornik2012-06-041-2/+19
| | | | | | | | | | | | | | | | | | | | | | | on_value_changed event in textboxes and textareas was raised only on keyboard input. If user used different input method such as paste or browser undo and redo functions widget's on_value_changed event wasn't raised and so dirty state wasn't changed as well. This patch adds listener to text's and textarea's 'input' event. Input is a HTML 5 event which is raises on user initiated action. Some of user initiated actions : * Cut * Copy * Paste * Undo * Redo * Clear * Typing (like keyup) * Form AutoFill * User-invoked spellcheck corrections * Input from Input Method Editor It should be supported by all recent versions of major browsers. IE doesn't support it up to version 8. Listener for 'keyup' event was left in implementation for backward compatibility with older browsers. This may cause firing on_value_change twice but so far it shouldn't cause troubles. https://fedorahosted.org/freeipa/ticket/2647
* Added links to netgroup member tablesPetr Vobornik2012-06-041-4/+8
| | | | | | Tables with members in netgroup were missing links for navigation to associated details pages. This patch adds these links. https://fedorahosted.org/freeipa/ticket/2670
* Removal of illegal options in JSON-RPC callsPetr Vobornik2012-06-044-7/+28
| | | | | | | | | | Ticket https://fedorahosted.org/freeipa/ticket/2509 bans using non existent options. If such option is supplied command ends with error. It uncovered several cases in Web UI. This patch is fixing these cases. Automember, Self-service and Delegation don't support 'pkey-only', 'size-limit' and 'rights' option. Pagination and rights check were disabled for them. Automount map adder dialog was sending options for indirect map even if chosen type was direct (when those for indirect was filled earlier), also it was sending non-existant 'method' option. https://fedorahosted.org/freeipa/ticket/2760
* Added cancel button to service unprovision dialogPetr Vobornik2012-06-041-0/+8
| | | | | | Service unprovision dialog was missing a cancel button. The button was added. https://fedorahosted.org/freeipa/ticket/1811
* Enable reset password action according to attribute perrmissionPetr Vobornik2012-06-042-2/+46
| | | | | | | | This patch creates state_evaluator which creates permission states for defined attribute. The state format is: attributeName_permissionChar. This evaluator is used for user_password attribute and it control enabling/disabling of related action in user account action panel. https://fedorahosted.org/freeipa/ticket/2318
* Add shadow to dialogPetr Vobornik2012-06-041-0/+6
| | | | | | This patch adds shadow to dialog used in Web UI. It looks cooler. https://fedorahosted.org/freeipa/ticket/2248
* Added missing i18n in action list and action panelPetr Vobornik2012-06-045-3/+7
| | | | | | This patch adds strings to internal.py which were not translated in action list/panel patches. https://fedorahosted.org/freeipa/ticket/2248
* Action panel for userPetr Vobornik2012-06-041-1/+29
| | | | | | This patch adds action panel to user account section. The panel contain an action for reseting user password. https://fedorahosted.org/freeipa/ticket/2248
* User password widget modified.Petr Vobornik2012-06-043-73/+114
| | | | | | | | | | | | | | | Currently the user password is shown as follows in the details page: Password: Reset Password This is inconsistent with the rest of the page because the 'Reset Password' is an action, not the value of the password. Now password is shown as follows: Password: ******* (if set) Password: (if not set) Reset password link was removed as well the dialog for reset password was removed from password widget. The dialog was moved to its own object and can be now showed independently. An action for showing this dialog should be created. https://fedorahosted.org/freeipa/ticket/2248
* Action panelPetr Vobornik2012-06-044-2/+179
| | | | | | | | This patch implements action panel. Action panel is a box located in facet details section which contains actions related to that object/section. In spec file can be configured actions and title used in action panel. Default title is 'Actions'. Actions are specified by their name. They have to be defined in action collection in facet. https://fedorahosted.org/freeipa/ticket/2248
* Refactored entities to use changed actions conceptPetr Vobornik2012-06-045-188/+228
| | | | | | It's continuation of previous refactoring effort. This part is changing specs in entities to used changed concept. https://fedorahosted.org/freeipa/ticket/2248
* Refactored action list and control buttons to use shared list of actionsPetr Vobornik2012-06-045-292/+581
| | | | | | | | | | | This is a first step for implementing action panels which will also use the shared list of actions. This effor changes the way how action list and control buttons are defined. First all actions are defined on facet level - attribute 'actions' in spec file. Implementation of action list widget is not specified on facet level. It is left in facet header. A list of action names used in action list can be now specified in facet spec in 'header_actions' attribute. Control buttons use similar concept. Facet by default is using control_buttons_widget. Details and search facet are defining their own default actions (refresh/add/remove/update/reset). Additional buttons can be defined as array of action names on facet level in control_buttons attribute. state_evaluators and state_listeners were united. They are called state_evaluators but they uses state_listener concept, they are attached to an event. For former state_evaluator the event is post_load. They are defined in spec in state attribute. State object purpose is to aggregate states from all state evaluators. It offers changed event to which can other objects subscribe. It also has summary evaluator which evaluation conditions. Summary evaluator creates summary status with human readable description. It can be used by facet header. https://fedorahosted.org/freeipa/ticket/2248
* Add more automount testsPetr Viktorin2012-05-312-9/+224
| | | | | | | | | | | | | | | | This adds tests for the automountlocation_tofiles and automountlocation_import commands, and to automountmap_add_indirect with the --parentmap option. The tofiles test checks not only the XML-RPC output, but also the output_for_cli method. The import tests load data from tofiles output to the directory and check that tofiles output matches. This only works when all maps are connected to auto.master. Two minor touches to the automount plugin itself: remove an extra space, and don't hide the traceback when re-raising an exception.
* Allow relative DNS name in NS validatorMartin Kosek2012-06-012-10/+24
| | | | | | | | | | | | Precallback validator was failing when a zone-relative name was used as a NS record (for example record "ns" in a zone "example.com"). However, this is valid in BIND and we should allow it as well. Imports in dns module had to be switched to absolute imports (available from Python 2.5) to deal with a conflict of IPA dns module and dnspython module. https://fedorahosted.org/freeipa/ticket/2630
* permission-find missed some results with --pkey-only optionMartin Kosek2012-06-014-14/+49
| | | | | | | | | | | | | When permission-find post callback detected a --pkey-only option, it just terminated. However, this way the results that could have been added from aci_find matches were not included. Fix the post callback to go through the entire matching process. Also make sure that DNS permissions have a correct objectclass (ipapermission), otherwise such objects are not matched by the permission LDAP search. https://fedorahosted.org/freeipa/ticket/2658
* Move install script error handling to a common functionPetr Viktorin2012-05-3113-267/+243
| | | | | | | | | | | | | | All of our install/admin scripts had a try/except block calling the main function and handling common exceptions. These were copy-pasted from each other and modified to various levels of sophistication. This refactors them out of installers to a single function, which includes a final pass/fail message for all of the scripts. Non-install scripts that set up the same log handler levels for stderr and log file are not changed, as it's not possible to log to only the logfile without changing the logger configuration. https://fedorahosted.org/freeipa/ticket/2071
* If SELinux is enabled ensure we also have restorecon.Rob Crittenden2012-05-316-42/+107
| | | | | | | | | | | | We don't have a specific requires on the policycoreutils package. It gets pulled in as a dependency on the server anyway, but checking there is like a belt and suspenders. On the client we don't require SELinux at all. If SELinux is enabled however we need to set things up properly. This is provided by the policycoreutils package so fail if that isn't available. https://fedorahosted.org/freeipa/ticket/2368
* Add rename option for DNS recordsMartin Kosek2012-05-314-6/+47
| | | | | | | This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
generated by cgit (git 2.34.1) at 2024-06-10 16:49:49 +0000