summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Improve loops around slapi modsSimo Sorce2012-07-301-68/+62
| | | | | Avoid the need to allocate/free a Slapi_Mod and avoid checking for attribute equvalence after a match (use if/else)
* Move code into common krb5 utilsSimo Sorce2012-07-303-141/+159
| | | | | | | | This moves the decoding function that reads the keys from the ber format into a structure in the common krb5 util code right below the function that encodes the same data structure into a ber format. This way the 2 functions are in the same place and can be both used by all ia components.
* Use certmonger to renew CA subsystem certificatesRob Crittenden2012-07-3027-18/+724
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
* Fix validator for SELinux user map settings in config plugin.Rob Crittenden2012-07-262-15/+48
| | | | | | | | | | | | | We need to compare two values and need to be aware of where those values are coming from. They may come from options, setattr or existing config. The format of that data is going to be different depending on its source (always a list internally). One may also set both at the same time so a standard validator cannot be used because it lacks the context of the other value being set. https://fedorahosted.org/freeipa/ticket/2938 https://fedorahosted.org/freeipa/ticket/2940
* Do not check for DNA magic valuesSimo Sorce2012-07-262-8/+0
| | | | | | | The DNA magic value can be arbitrarily changed by admins so we cannot use a const value to check. And we relly do not need to check at all. If the DNA plugin is broken and leaves magic values to reach the post-op stage we have bigger problems. So just simply get rid of this check.
* Add all external samba libraries to BuildRequiresSimo Sorce2012-07-251-1/+2
| | | | | Also move them in the right spot (if ! only client) so that they are required only when building the server.
* Arrange stripping .po filesPetr Viktorin2012-07-244-6/+49
| | | | | | | | | | | | | | | | | | | | The .po files we use for translations have two shortcomings when used in Git: - They include file locations, which change each time the source is updated. This results in large, unreadable diffs that don't merge well. - They include source strings for untranslated messages, wasting space unnecessarily. Update the Makefile so that the extraneous information is stripped when the files are updated or pulled form Transifex, and empty translation files are removed entirely. Also, translations are normalized to a common style. This should help diffs and merges. The validator requires file location comments to identify the programming language, and to produce good error reports. To make this work, merge the comments in before validation. First patch for: https://fedorahosted.org/freeipa/ticket/2435
* Rework task naming in LDAP updates to avoid conflicting names in certain casesAlexander Bokovoy2012-07-241-9/+9
| | | | | | | | | | | | | | | | | There are two problems in task naming in LDAP updates: 1. Randomness may be scarce in virtual machines 2. Random number is added to the time value rounded to a second The second issue leads to values that may repeat themselves as time only grows and random number is non-negative as well, so t2+r2 can be equal to t1+t2 generated earlier. Since task name is a DN, there is no strict requirement to use an integer value. Instead, we generate an UUID and use its 60-bit time, 14-bit sequential number, and attribute name. https://fedorahosted.org/freeipa/ticket/2942
* Fix autoscroll to top in tables in IEPetr Vobornik2012-07-252-0/+13
| | | | | | | | | | In IE when a window is small (horizontal scrollbar is displayed) click or keyboard input on various parts of UI makes search tables scroll to top. It prevents from selecting items in a table. This issue happens when using absolute positioned element with overflow style. It's a bug in IE. Two workarounds were added to make UI usable in IE. Adding position:relative; style to body element fixes the problem in search pages. It doesn't help in association dialogs though. The bug doesn't occur when some child element has focus. It's possible to set focus to first visible checkbox while scrolling down but user experience is very bad. Better solution seems to scroll back when IE scrolls to top on mousedown. That way mouse click event happens on the target element and it can gain focus and therefore be selected. Some glitches still remains but is usable. https://fedorahosted.org/freeipa/ticket/2835
* IDs and names for dialogsPetr Vobornik2012-07-256-11/+33
| | | | | | | | | | It's hard to detect if or which type dialog is displayed becouse not all dialogs have IDs. On dialog open, it's id or name (if id is not set) is used for containing element id. Many of dialog types were missing id or name so name was added to each dialog type. In HTML, element's id should be unique. Our framework allows opening two dialogs with the same id. It may lead to state where getElementById method may have unpredicted behaviour. Therefore attribute 'data-name' with dialog's name was added to dialog's containing element. Automation framework can search more reliable by using this attribute instead of id. https://fedorahosted.org/freeipa/ticket/2853
* Add libtalloc-devel as spec file BuildRequireSimo Sorce2012-07-241-0/+1
|
* Framework for admin/install tools, with ipa-ldap-updaterPetr Viktorin2012-07-226-210/+463
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently, FreeIPA's install/admin scripts are long pieces of code that aren't very reusable, importable, or testable. They have been extended over time with features such as logging and error handling, but since each tool was extended individually, there is much inconsistency and code duplication. This patch starts a framework which the admin tools can use, and converts ipa-ldap-updater to use the framework. Common tasks the tools do -- option parsing, validation, logging setup, error handling -- are represented as methods. Individual tools can extend, override or reuse the defaults as they see fit. The ipa-ldap-updater has two modes (normal and --upgrade) that don't share much functionality. They are represented by separate classes. Option parsing, and selecting which class to run, happens before they're instantiated. All code is moved to importable modules to aid future testing. The only thing that remains in the ipa-ldap-updater script is a two-line call to the library. First part of the work for: https://fedorahosted.org/freeipa/ticket/2652
* Default to no when trying trying to install a replica on wrong server.Rob Crittenden2012-07-191-1/+1
| | | | | | | | When installing a replica file on the wrong server we warn that this will likely fail and prompt to Continue. This prompt should default to False, not True. https://fedorahosted.org/freeipa/ticket/2325
* Fix updating minimum_connections in ipa-upgradeconfigPetr Viktorin2012-07-181-18/+19
| | | | | | | | | | | The upgrade script set the "psearch" directive in some circumstances, but did not remember that it was set, so later, when setting minimum_connections, it assumed psearch is not set. Also, the script did not set minimum_connections if the directive wasn't already there. It should be set in that case. Related to https://fedorahosted.org/freeipa/ticket/2554
* Support per-principal sessions and handle session update failuresRob Crittenden2012-07-181-11/+23
| | | | | | | | | | | | | User had a system that refused to store keys into the kernel keyring. Any operation at all on the keyring would return "Key has been revoked". Wrap the operations in a try/except so we can ignore keyring failures. This also adds per-principal sessions. The principal name is stored in the session key so switching principals in the ccache doesn't require clearing the keyring. https://fedorahosted.org/freeipa/ticket/2880
* Fix detection of deleted mastersSimo Sorce2012-07-171-9/+15
| | | | | | | | | | | | | | | When setting up agreements we need to be careful in not allowing to 'reconnect' a master that was previously completely deleted as it would misses entries that are vital for proper functioning. This change in code fixes 2 problems with the current approach. 1) it removes false positives when we are tryig to reconnect a replica that was previosuly merely disconnected but was still part of the domain and just replicating via a different topology and not a direct link 2) adds checks for entries that are deleted when an actual removal is performed. so that we cannot 'reconnect' previously unrelated replicas when one of the 2 has been permanently deleted from the masters tree. Second part of ticket https://fedorahosted.org/freeipa/ticket/2925
* Fix safety checks to prevent orphaning replicasSimo Sorce2012-07-171-1/+1
| | | | | | | | This is just a typo, we were checking one side twice and never the other side. So depending on which side you run the command you'd be able or not to remove the replication agreement even if it was the last one. First part of ticket: https://fedorahosted.org/freeipa/ticket/2925
* Don't hardcode serial_autoincrement to True.Rob Crittenden2012-07-171-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2554
* Follow change in samba4 beta4 for sid_check_is_domain to sid_check_is_our_samAlexander Bokovoy2012-07-182-2/+7
| | | | | | | With c43505b621725c9a754f0ee98318d451b093f2ed in samba git master the function sid_check_is_domain() was renamed to sid_check_is_our_sam(). https://fedorahosted.org/freeipa/ticket/2929
* Handle various forms of admin accounts when establishing trustsAlexander Bokovoy2012-07-182-0/+13
| | | | | | | | | | | | | | | | | | | | | | Realm administrator account may be specified using different form: Administrator, DOM\Administrator, Administrator@DOMAIN This patch introduces handling of the second two forms: - In DOM\Administrator only user name is used, short domain name is then taken from a discovered record from the AD DC - In Administrator@DOMAIN first DOMAIN is verified to be the same as the domain we are establishing trust to, and then user name is taken, together with short domain name taken from a discovered record from the AD DC Note that we do not support using to-be-trusted domain's trusted domains' accounts to establish trust as there is basically zero chance to verify that things will work with them. In addition, in order to establish trust one needs to belong to Enterprise Admins group in AD or have specially delegated permissions. These permissions are unlikely delegated to the ones in already trusted domain. https://fedorahosted.org/freeipa/ticket/2864
* ipalib/plugins/trust.py: ValidationError takes 'error' named argument, not ↵Alexander Bokovoy2012-07-181-3/+3
| | | | | | 'reason' https://fedorahosted.org/freeipa/ticket/2865
* Bigger textarea for permission type=subtreePetr Vobornik2012-07-182-2/+8
| | | | | | Adder dialog and details facet for permission type=subtree have small textarea for defining subtree filter. It was unconfortable to define the filter. This difference was removed. https://fedorahosted.org/freeipa/ticket/2832
* Fixed display of attributes_widget in IE9Petr Vobornik2012-07-175-5/+44
| | | | | | | | Attributes widget is using overflow css rule in tbody element. IE9 doesn't handle it well. To fix the issue, attributes widget was slightly modified and conditional css stylesheet was added just for fixing IE problems. https://fedorahosted.org/freeipa/ticket/2822
* Differentiation of widget type and text_widget input typePetr Vobornik2012-07-171-3/+3
| | | | | | | | | There was a clash of 'type' attribute in widget's spec. Usually 'type' is used for telling a builder which field and widget to build. Text widget used this attribute also for definion of html input type. It was problematic for some special widgets, which defined own field and used text_widget, like service_type or dnszone_name. In those and possibly other cases it used widget type for specifying input type which lead to execution error in Internet Explorer. Firefox and Chrome took it. This patch is changing text_widget's 'type' to 'input_type' which removes the collision and hence fixes the problem. https://fedorahosted.org/freeipa/ticket/2806 and half of: https://fedorahosted.org/freeipa/ticket/2834
* Enforce CNAME constrains for DNS commandsMartin Kosek2012-07-122-24/+98
| | | | | | | | | | RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
* Print ipa-ldap-updater errors during RPM upgradeMartin Kosek2012-07-132-5/+13
| | | | | | | | | | | | | | | | | ipa-ldap-updater does a lot of essential LDAP changes and if it fails, user may be surprised after the upgrade why things does not work. Modify ipa-ldap-updater to print ERROR logging messages by default and modify RPM upgrade scriptlet to show these errors to user. Console error messages are now formated in a more user-friendly way. Information message stating that IPA is not configured and i.e. there is nothing to be updated is not printer to stderr so that it does not pop up for every freeipa-server package update when IPA is not configured. https://fedorahosted.org/freeipa/ticket/2892
* Warn user if an ID range with incorrect size was createdMartin Kosek2012-07-132-6/+55
| | | | | | | | | | | | | IPA 3.0 introduced range ID objects in replicated space which specify a range of IDs assigned via DNA plugin. ipa-ldap-updater generates the default ID range which should correspond with IDs assigned to IPA users. However, since correct range size is not known, we should at least warn that a range with invalid size was created so that user can amend it. https://fedorahosted.org/freeipa/ticket/2892
* Add range-mod commandMartin Kosek2012-07-134-9/+76
| | | | | | | | | | | range plugin was missing range-mod command that could be used for example to fix a size for a range generated during upgrades. The range should be updated with a caution though, a misconfiguration could break trusts. iparangetype is now also handled better and filled in all commands instead of just range-show. objectclass attribute is deleted only when really needed now.
* Enable SOA serial autoincrementMartin Kosek2012-07-1310-51/+145
| | | | | | | | | | | | | | | | | | SOA serial autoincrement is a requirement for major DNS features, e.g. zone transfers or DNSSEC. Enable it by default in named.conf both for new and upgraded installations. Name of the bind-dyndb-ldap option is "serial_autoincrement". From now on, idnsSOAserial attribute also has to be put to replication agreement exclude list as serial will be incremented on each DNS server separately and won't be shared. Exclude list has to be updated both for new replication agreements and the current ones. Minimum number of connections for bind-dyndb-ldap has been rised to 4 connections, the setting will be updated during package upgrade. https://fedorahosted.org/freeipa/ticket/2554
* Improve address family handling in socketsMartin Kosek2012-07-136-162/+160
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many functions use low-level socket interface for connection or various checks. However, most of the time we don't respect automatic address family detection but rather try to force our values. This may cause either redundat connection tries when an address family is disabled on system tries or even crashes when socket exceptions are not properly caught. Instead of forcing address families to socket, rather use getaddrinfo interface to automatically retrieve a list of all relevant address families and other connection settings when connecting to remote/local machine or binding to a local port. Now, we will also fill correctly all connection parameters like flowinfo and scopeid for IPv6 connections which will for example prevent issues with scoped IPv6 addresses. bind_port_responder function was changed to at first try to bind to IPv6 wildcard address before IPv4 as IPv6 socket is able to accept both IPv4 and IPv6 connections (unlike IPv4 socket). nsslib connection was refactored to use nss.io.AddrInfo class to get all the available connections. Socket is now not created by default in NSSConnection class initializer, but rather when the actual connection is being made, becase we do not an address family where connection is successful. https://fedorahosted.org/freeipa/ticket/2913 https://fedorahosted.org/freeipa/ticket/2695
* Fix ipa-managed-entries man page typoMartin Kosek2012-07-121-2/+1
| | | | | Extra new line in .TH section of the man page caused invalid wrapping.
* Adding exit status 3 & 4 to ipa-client-install man pageGowrishankar Rajaiyan2012-07-121-0/+4
|
* Add automount map/key update permissionsMartin Kosek2012-07-102-2/+41
| | | | | | | | | | | | | Add missing permissions that can be used to delegate write access to existing automount maps or keys. Since automount key RDN has been changed in the past from "automountkey" to "description" and there can be LDAP entries with both RDNs, structure of relevant ACI need to be changed to different scheme. Now, it rather targets a DN of parent automount map object and uses targetfilter to limit the target to automount key objects only. https://fedorahosted.org/freeipa/ticket/2687
* Add and remove dns per-domain permission in Web UIPetr Vobornik2012-07-116-11/+285
| | | | | | | | | | | | | | This patch adds support for new per-domain permissions to Web UI. User with assigned permission (through role,priviledge) can edit DNS zone. These permissions can be added/remove by ipa dnszone-{add/remove}permission $dnszone command. For adding/removing of this permission in Web UI new actions in DNS zone action list were created. DNS zone object doesn't contain information about existance of related permission. Such information is required for enabling/disabling of new actions. Web UI has to search for the permission to get it. DNS zone facet was modified to use batch command, in a same way as user facet, for loading dnszone and the permission at the same time - on load. Batch command has a feature to report all errors. Such behavior is unwanted because we expect that permission-show command will fail when the permission doesn't exist. Batch command was therefore modified to not report commands which has retry attribute set to false. This attr was chosen because it has similar purpose in single command execution. New actions should be enabled only for users with appropriate rights. It is not possible to obtain rights for certain action in advance so an approximation is used: write right for dns zones' managedby attribute. https://fedorahosted.org/freeipa/ticket/2851
* Fix wrong option name in ipa-managed-entries man pagePetr Viktorin2012-07-111-1/+1
| | | | The page said `-y` but the actual option is `-p`.
* Fix batch command error reportingPetr Viktorin2012-07-112-12/+59
| | | | | | | | | | | | The Batch command did not report errors correctly: it reported the text of *all* errors, not just PublicError, used unicode(e) instead of e.strerror (which results in incorrect i18n), and only reported the text of error messages, not their type and code. Fix these problems. Update tests. https://fedorahosted.org/freeipa/ticket/2874 https://fedorahosted.org/freeipa/ticket/2901
* Indirect roles in WebUIDavid Spångberg2012-07-111-0/+3
| | | | | Add a check in the WebUI to use the admin navigation if a user is a indirect member of a role.
* Web UI: kerberos ticket policy measurement unitsPetr Vobornik2012-07-102-4/+12
| | | | | | Added measurement units for kerberos ticket policy. https://fedorahosted.org/freeipa/ticket/2444
* Password policy measurement units.Petr Vobornik2012-07-106-9/+44
| | | | | | | | | | | | When filling password policy it may be unclear what value to enter because user may not remember field's measurement unit. This patch adds support for declaring measurement units. It's done in field's/widget's spec by entering key for unit's string (which is in IPA.messages.measurement_units[key]). Measurement units in table layout are displayed in parenthesis after label. It is to be consistent with some fields which have measurement unit integrated in label. This patch defines measurement units for password policy's 'History size', 'Failure reset interval' and 'Lockout duration' fields. https://fedorahosted.org/freeipa/ticket/2437
* Display loginas information only after loginPetr Vobornik2012-07-104-5/+16
| | | | | | | | Message 'Logged in as: user@FREEIPA.ORG' was displayed before user was logged in. It was wrong. Now 'Logged in as: XXX' is displayed only when user XXX is logged in. So no more user@FREEIPA.ORG :) . https://fedorahosted.org/freeipa/ticket/2882
* Make client server option multi-valued, allow disabling DNS discoveryRob Crittenden2012-07-103-38/+70
| | | | | | | | | | | | | Let the --server option be specified multiple times on the command line. The first one passed in is the one we enroll against. Do additional verification before setting dnsok so we can be sure that the record(s) were actually discovered in DNS. If servers are provided on the CLI and --fixed-primary is set then _srv_ is not added to ipa_server in sssd.conf. https://fedorahosted.org/freeipa/ticket/2841
* Do not change LDAPObject objectclass listMartin Kosek2012-07-091-1/+1
| | | | | | | | | | | | | __json__ method of LDAPObject may inadvertently append a list of possible objectclasses to a list of basic objectclasses and thus change a behavior of all subsequent LDAPSearch command. The command may only return objects where all "possible" objectclasses are present and thus returning an incomplete list. Make sure that the LDAPObject object_class list is not modified during the __json__ method. https://fedorahosted.org/freeipa/ticket/2906
* Fix typoSumit Bose2012-07-091-1/+1
| | | | Signed-off-by: Simo Sorce <ssorce@redhat.com>
* Fix wrong check after allocation.Simo Sorce2012-07-071-1/+1
|
* Moved configuration to last position in navigationPetr Vobornik2012-07-061-2/+2
| | | | | | | | Configaration was the last navigation item in IPA server tab. Trusts changed it. It was wrong because configuration is like 'other settings' and so it should be last. This patch moves configuration navigation item to the last position again. https://fedorahosted.org/freeipa/ticket/2900
* reduce redundant checks in ldapsam_search_users() to a single statementAlexander Bokovoy2012-07-061-8/+1
|
* Use smb.conf 'dedicated keytab file' parameter instead of hard-coded valueAlexander Bokovoy2012-07-061-1/+2
|
* ipasam: replace testing codeSumit Bose2012-07-061-5/+5
|
* ipasam: fixes for clang warningsSumit Bose2012-07-061-28/+20
|
* Allow silent build if availableSumit Bose2012-07-061-0/+1
|
generated by cgit (git 2.34.1) at 2024-07-02 07:18:20 +0000