summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Enable a host to retrieve a keytab for all its services.Rob Crittenden2010-08-165-125/+364
| | | | | | | | | | | | | | | | | | | | | | | | Using the host service principal one should be able to retrieve a keytab for other services for the host using ipa-getkeytab. This required a number of changes: - allow hosts in the service's managedby to write krbPrincipalKey - automatically add the host to managedby when a service is created - fix ipa-getkeytab to return the entire prinicpal and not just the first data element. It was returning "host" from the service tgt and not host/ipa.example.com - fix the display of the managedby attribute in the service plugin This led to a number of changes in the service unit tests. I took the opportunity to switch to the Declarative scheme and tripled the number of tests we were doing. This shed some light on a few bugs in the plugin: - if a service had a bad usercertificate it was impossible to delete the service. I made it a bit more flexible. - I added a summary for the mod and find commands - has_keytab wasn't being set in the find output ticket 68
* Add a BuildRequires for authconfigRob Crittenden2010-08-161-0/+4
| | | | ticket 137
* Add support for client failover to the ipa command-line.Rob Crittenden2010-08-1611-20/+172
| | | | | | | | | | | | This adds a new global option to the ipa command, -f/--no-fallback. If this is included then just the server configured in /etc/ipa/default.conf is used. Otherwise that is tried first then all servers in DNS with the ldap SRV record are tried. Create a new Local() Command class for local-only commands. The help command is one of these. It shouldn't need a remote connection to execute. ticket #15
* From: Pavel Zuna <pzuna@redhat.com>Adam Young2010-08-131-0/+65
| | | | | | | | | | | Date: Tue, 10 Aug 2010 16:41:28 -0400 Subject: [PATCH 2/6] Add a new INTERNAL plugin that exports plugin meta-data into JSON. This is required for the webUI, since we're dropping Genshi. *ehm* :) You can't use this command on the CLI. It takes one optional argument: the name of an IPA object. If not specified, meta-data for all objects are returned.
* Change the behaviour of addattr/setattr parameters.Adam Young2010-08-132-35/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | setattr and addattr can now be used both to set all values of ANY attribute. the last setattr always resets the attribute to the specified value and all addattr append to it. Examples: user-mod testuser --setattr=title=msc title: msc user-mod testuser --setattr=title=msb title: msb user-mod testuser --addattr=title=msc title: msb, msc user-mod testuser --setattr=title= title: user-mod testuser --setattr=title=msc --addattr=msb title: msc, msb user-mod testuser --setattr=title=ing --addattr=bc title: ing, bc user-mod testuser --setattr=title=doc title: doc It's not very user friendly, but it's going to be used very very rarely in special conditions in the CLI and we can use it to save lots of JSON-RPC roundtrips in the webUI. This version includes calling the validation of Params during the setting of the attrs.
* Improve serialization to JSON.Pavel Zuna2010-08-123-2/+27
| | | | | | - Make it recursive. - Make Param classes serializable. - Take python native data types into account.
* Stretch content div and make Reset/Update buttons stick to right.Pavel Zuna2010-08-121-0/+5
|
* Fix bug: not found exc. handler was failing for singleton objectsPavel Zuna2010-08-121-1/+4
|
* Add new parameters to LDAPSearch: timelimit and sizelimit.Pavel Zuna2010-08-121-2/+23
|
* Make LDAPObject classes JSON serializable.Pavel Zuna2010-08-122-0/+23
|
* Correct CA options in ipa-server-install manpageRob Crittenden2010-08-101-3/+3
|
* Allow decoupling of user-private groups.Rob Crittenden2010-08-104-8/+160
| | | | | | | | | | | To do this we need to break the link manually on both sides, the user and the group. We also have to verify in advance that the user performing this is allowed to do both. Otherwise the user could be decoupled but not the group leaving it in a quasi broken state that only ldapmodify could fix. ticket 75
* Fix user tests to handle managed entriesRob Crittenden2010-08-101-1/+2
| | | | | We now enable managed entries by default and need to account for it in the expected output.
* Fix reference to _handle_errors() in remove_principal_key()Rob Crittenden2010-08-101-1/+1
| | | | | It incorrectly was trying to call the class method _handle_errors() instead of the global function.
* Group add functionality now implmented.Adam Young2010-08-091-4/+63
| | | | | | - Proper navigation. (Add and edit versus add another) - posix field is respected - gid set accordingly
* IPA HTTPD config uses /usr/share/static as target for /ipa/uiAdam Young2010-08-091-2/+2
|
* Remove search field on group buttonAdam Young2010-08-093-7/+8
| | | | | | Hide the search bar when showing the groups listed for a user, and resotre it when doing other searches. The enroll button is added only on the groups page, and removed along with anything else in the searchButtons div when a new search is started.
* Properly show the members when an add/remove operation fails.Rob Crittenden2010-08-064-19/+20
| | | | | | | | | | | | The remove member function in baseldap was not returning failures at all. The add member function was only showing them in the group object. Most of the magic is handled in baseldap. Each plugin just needs to define object_name and object_name_plural. object_name must be all lower-case because fake-attributes are created so membership can be broken out per-object type. I left the plural name lower case as well. ticket 85
* Enforce existence of 389-ds header files.Rob Crittenden2010-08-061-0/+7
| | | | ticket #82
* Check to see if the command is available before running command tests.Rob Crittenden2010-08-062-2/+12
|
* Fix RPC tests. The method comes back as a unicode from xmlrpclib.Rob Crittenden2010-08-061-2/+2
|
* Add optional error message to pattern validatorRob Crittenden2010-08-065-3/+51
| | | | | | | | | The pattern validator by default displays the pattern that is being matched against. This isn't helpful, particularly for very hairy patterns. This adds a new parameter, pattern_errmsg, that is displayed on errors if set. ticket #11
* Skip the i18n test if the test language has not been builtRob Crittenden2010-08-061-0/+6
|
* Require that hosts be resolvable in DNS. Use --force to ignore warnings.Rob Crittenden2010-08-0612-33/+99
| | | | | | | | | | | | | This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
* Have the env plugin print all attributes by defaultRob Crittenden2010-08-061-0/+11
| | | | ticket #113
* Fix replacing a certificate in a service.Rob Crittenden2010-08-062-14/+42
| | | | | | | | | | | | When a service has a certificate and the CA backend doesn't support revocation (like selfsign) then we simply drop the old certificate in preparation for adding a new one. We weren't setting the usercertificate attribute to None so there was nothing to do in ldap_update(). Added a test case for this situation to ensure that re-issuing a certificate works. ticket #88
* Add framework for other command-line tests, starting with ipa-getkeytab.Rob Crittenden2010-08-062-0/+210
|
* Fix this test to work from source tree rootRob Crittenden2010-08-061-2/+2
| | | | | | | | It would work if you ran the test from its location in tests/test_ipalib but this isn't the most common method. If you want to run it individually you can do: $ ./make-test tests/test_ipalib/test_text.py
* Add hbac service for su-l, su with a login shellRob Crittenden2010-08-061-0/+6
|
* Changes to the install and config files to support deploying the javascript ↵Adam Young2010-08-064-0/+23
| | | | code.
* The Javascript code for the new web UIAdam Young2010-08-0633-0/+10392
| | | | Now with whitespace cleanup.
* Images for the Javascript Based webui.Adam Young2010-08-0623-0/+0
| | | | These are all binary files, in png format.
* whoami plugin.Adam Young2010-08-051-0/+41
| | | | | | It returns the user prinicpal. This is required by the webui, as the Kerberos credential mechanism in http does not expose the cleartext prinicpal to the web browser.
* Add container and initial ACIs for entitlement supportRob Crittenden2010-07-292-0/+43
| | | | | | | | The entitlement entries themselves will be rather simple, consisting of the objectClasses ipaObject and pkiUser. We will just store userCertificate in it. The DN will contain the UUID of the entitlement. ticket #27
* Drop our own PKCS#10 ASN.1 decoder and use the one from python-nssRob Crittenden2010-07-2911-481/+158
| | | | | | | | | | | | | | | This patch: - bumps up the minimum version of python-nss - will initialize NSS with nodb if a CSR is loaded and it isn't already init'd - will shutdown NSS if initialized in the RPC subsystem so we use right db - updated and added a few more tests Relying more on NSS introduces a bit of a problem. For NSS to work you need to have initialized a database (either a real one or no_db). But once you've initialized one and want to use another you have to close down the first one. I've added some code to nsslib.py to do just that. This could potentially have some bad side-effects at some point, it works ok now.
* Add some basic tests for ipalib/x509Rob Crittenden2010-07-291-0/+139
|
* This patch removes the existing UI functionality, as a prep for adding the ↵Adam Young2010-07-2917-675/+4
| | | | Javascript based ui.
* 1. Schema cleanupDmitri Pal2010-07-211-13/+12
| | | | | | | | | | | | The ipaAssociation is the core of different association object. It seems that the service is an exception rather then rule. So it is moved into the object where it belongs. Fixed matching rules and some attribute types. Addressing ticket: https://fedorahosted.org/freeipa/ticket/89 Removed unused password attribute and realigned OIDs.
* Become IPA v2 alpha 4 (1.9.0.pre4)alpha_4-1-9-0Rob Crittenden2010-07-151-1/+1
|
* Fix netgroup plugin to use correct member attribute names.Rob Crittenden2010-07-152-70/+148
| | | | | | | | | When the netgroup plugin was rebased it ended up using the member attribute for its memberships and not memberuser/memberhost. I also fixed this same attribute problem in the tests and tried to beef them up a little. If nis/schema compat are enabled it will try to compare the generated triplets with a known-good value.
* Fix nis netgroup configurationRob Crittenden2010-07-151-1/+11
| | | | | | | | This was originally configured to pull from the compat area but Nalin thinks that is a bad idea (and it stopped working anyway). This configures the netgroup map to create the triples on its own. Ticket #87
* Fix ipa-compat-manage and ipa-nis-manageRob Crittenden2010-07-152-54/+100
| | | | | | | | | | | | | | | Neither of these was working properly, I assume due to changes in the ldap backend. The normalizer now appends the basedn if it isn't included and this was causing havoc with these utilities. After fixing the basics I found a few corner cases that I also addressed: - you can't/shouldn't disable compat if the nis plugin is enabled - we always want to load the nis LDAP update so we get the netgroup config - LDAPupdate.update() returns True/False, not an integer I took some time and fixed up some things pylint complained about too. Ticket #83
* Use newer API in ipalib/x509 and add missing import.Rob Crittenden2010-07-152-6/+2
| | | | The import was only used when running the in-tree lite-server
* Clean up crypto code, take advantage of new nss-python capabilitiesRob Crittenden2010-07-155-338/+147
| | | | | | | | This patch does the following: - drops our in-tree x509v3 parser to use the python-nss one - return more information on certificates - make an API change, renaming cert-get to cert-show - Drop a lot of duplicated code
* Add API to delete a service principal key, service-disable.Rob Crittenden2010-07-136-7/+149
| | | | | | | | | | | | I have to do some pretty low-level LDAP work to achieve this. Since we can't read the key using our modlist generator won't work and lots of tricks would be needed to use the LDAPUpdate object in any case. I pulled usercertificate out of the global params and put into each appropriate function because it makes no sense for service-disable. This also adds a new variable, has_keytab, to service/host_show output. This flag tells us whether there is a krbprincipalkey.
* Add test to ensure that a certificate we issue is actually stored properly.Rob Crittenden2010-07-131-2/+32
|
* Include contents of has_output_params in get_output_paramsRob Crittenden2010-07-131-0/+2
|
* Add separate var for search attributes and config attribute for search fieldsRob Crittenden2010-07-133-1/+17
| | | | | | | | Add an optional search_attributes variable in case the attributes you want to display by default aren't what you want to search on. Also link in any cn=ipaconfig attributes that contain a comma-separated list of attributes to search on.
* Handle errors raised by plugins more gracefully in mod_wsgi.Rob Crittenden2010-07-126-22/+36
| | | | | | | | | | | | This started as an effort to display a more useful error message in the Apache error log if retrieving the schema failed. I broadened the scope a little to include limiting the output in the Apache error log so errors are easier to find. This adds a new configuration option, startup_traceback. Outside of lite-server.py it is False by default so does not display the traceback that lead to the StandardError being raised. This makes the mod_wsgi error much easier to follow.
* Change expected aci summary from Updated to Modify in test casesRob Crittenden2010-07-061-4/+4
|
generated by cgit (git 2.34.1) at 2024-09-29 17:57:12 +0000