summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Installer should always wait until CA starts upMartin Kosek2013-10-172-6/+11
| | | | | | | | | | | | | | Patch for ticket 3964 changed the installer so that it does not always wait for CA if the proxy is not configured. However, it was found out that it may freeze an installation when a step subsequent after CA restart call the CA and receives no reply. Change the wait so that it always waits for CA to start up. If HTTP proxy is already configured, it should wait on port 443. If not, it should wait on local PKI port 8443. https://fedorahosted.org/freeipa/ticket/3973
* ipatests: Extend the order plugin to properly handle inheritanceTomas Babej2013-10-171-1/+24
| | | | | | | | | | | When trying to create a new ordered test case by inheriting from already defined test case, by overriding few of its methods, the execution order of the tests is as follows: - first all non-overriden test methods from the parent test class - then all overriden tests methods This patch makes sure that methods are executed in the logical order, that is, the order defined in the parent class.
* Registries and Build GuidePetr Vobornik2013-10-162-0/+310
|
* Navigation GuidePetr Vobornik2013-10-162-0/+276
|
* Plugin Infrastructure GuidePetr Vobornik2013-10-162-0/+79
|
* Debugging Web UI guidePetr Vobornik2013-10-162-0/+85
|
* Phases GuidePetr Vobornik2013-10-163-0/+131
|
* Configuration for JSDuck documentation generatorPetr Vobornik2013-10-165-0/+252
| | | | | | | | | | Installation: https://github.com/senchalabs/jsduck/wiki/Installation Basically it requires ruby and jsduck gem. Usage: $ cd install/ui/doc $ make Documentation will be generated into: install/ui/build/code_doc directory
* Web UI source code annotationPetr Vobornik2013-10-1643-479/+5571
| | | | Part of ongoing Web UI documentation effort. Source code is annotated in a way that it can be processed by documentation generator.
* Removal of unused codePetr Vobornik2013-10-161-14/+0
|
* Load updated Web UI files after server upgradePetr Vobornik2013-10-1614-105/+243
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Issue: * There was no caching policy specified. * -> Browsers use their own default policy. * -> After upgrade, some Web UI files might have been actualized some not. * -> With schema change may result into weird bugs in Web UI Solution considerations: 1. Detect server version change and hard-reload at runtime Detection is easy. Problem is the reload. Obvious candidate 'window.location.reload(true)' works in Firefox but not in Chrome because expected behavior when parameter is used is not in standard and therefore Chromium/WebKit authors did not implement it. 2. Application Cache HTML 5 technology which lets web apps to run offline. Besides weird issues with event handlers which I encountered, this would be an ideal candidate. Simple change of manifest file would lead to reload of all files (requires reload of page to used the new files). Showstopper was usage with untrusted certificate. If user did not add exception for the cert or its CA and would visit the page for a second time, all AJAX calls would fail. 3. Set Expires to now() for everything Web UI rarely changes so this is an overkill. Setting it to different value is not a solution either. We can't predict when the upgrade will happen and when new Web UI will be needed. Solution: * Implemented a mini loader which loads basic resources. Dojo loader takes action after Dojo is loaded. * The loader adds a version parameter (?v=__NUM_VERSION__) to all requests. * Version is defined in the loader. It's set to current in `make version-update`. * All static pages use this loader to fetch their resources. * Version is also passed to dojo loader as cache-bust for the same effect. * Expire header was set to 'access time plus 1 year' for /ui folder. Exceptions are HTML files and loader (set to immediate expiration). Possible issues: * Images are cached but not requested with version param. * Images with version and without are considered different * -> We would have to attach version to all URIs - in CSS and in JS. But we should avoid changing jQuery UI CSS. * Proposed solution is to change image name when changing image. Image change is done rarely. * Version is set by build and therefore updated just on server update. It might cause trouble with different update schedule of plugins. * No action taken to address this issue yet. * We might leave it on plugin devs (own .conf in /etc/httpd/conf.d/) * or set expires to now for all plugins * running `make version-update` is required in order to use static version of UI for testing https://fedorahosted.org/freeipa/ticket/3798
* Added warning if cert '/etc/ipa/ca.crt' existsMartin Basti2013-10-161-0/+4
| | | | https://fedorahosted.org/freeipa/ticket/3944
* adtrustinstance: Move attribute definitions from setup to init methodTomas Babej2013-10-141-29/+49
| | | | | | | | | | | | | | | Majority of the attributes set in the setup method can be set in the __init__ method where they are actually defined (and set to None). This is true for attributes that hold constant values and for attributes that have their values derived from api.env dictionary. Creates a new __setup_default_attributes method, that is called from within __init__ and setup (in case the passed values for hostname or domain do not correspond to that what is set in api.env, doing otherwise could cause unexpected behaviour). Part of: https://fedorahosted.org/freeipa/ticket/3479
* adtrustinstance: Properly handle uninstall of AD trust instanceTomas Babej2013-10-143-16/+42
| | | | | | | | | | | | | | | | | | The uninstall method of the AD trust instance was not called upon at all in the ipa-server-install --uninstall phase. This patch makes sure that AD trust instance is unconfigured when the server is uninstalled. The following steps are undertaken: * Remove /var/run/samba/krb5cc_samba * Remove our keys from /etc/samba/samba.keytab using ipa-rmkeytab * Remove /var/lib/samba/*.tdb files Additionally, we make sure winbind service is stopped from within the stop() method. Part of: https://fedorahosted.org/freeipa/ticket/3479
* ipa-adtrust-install: Add warning that we will break existing samba configurationTomas Babej2013-10-141-3/+15
| | | | | | | | In case /etc/samba/smb.conf exists and it was not created by ipa-adtrust-install, print a warning that we will break existing samba configuration and ask for a confirmation in the interactive mode. Part of: https://fedorahosted.org/freeipa/ticket/3479
* ipa-upgradeconfig: Remove backed up smb.confTomas Babej2013-10-142-9/+20
| | | | | | | | | | | Since we are not able to properly restore the Samba server to the working state after running ipa-adtrust-install, we should not keep the smb.conf in the fstore. This patch makes sure that any backed up smb.conf is removed from the backup and that this file is not backed up anymore. Part of: https://fedorahosted.org/freeipa/ticket/3479
* trusts: Do not create ranges for subdomains in case of POSIX trustTomas Babej2013-10-141-11/+39
| | | | | | For the AD trusts where the ID range for the root level domain is of ipa-ad-trust-posix type, do not create a separate ranges for the subdomains, since POSIX attributes provide global mapping.
* Winsync re-initialize should not run memberOf fixup taskMartin Kosek2013-10-111-5/+6
| | | | | | | Change re-initialize command to consider memberOf fixup task only for non-winsync replication agreements. https://fedorahosted.org/freeipa/ticket/3854
* Use consistent realm name in cainstance and dsinstanceMartin Kosek2013-10-112-19/+18
| | | | | | | | The installers used custom self.realm_name instead of standard self.realm defined in Service class. It caused crashes in some cases when Service class methods expected the self.realm to be filled. https://fedorahosted.org/freeipa/ticket/3854
* PKI installation on replica failing due to missing proxy confMartin Kosek2013-10-112-2/+5
| | | | | | | | Proxy configuration was not detected correctly. Both ipa-pki-proxy.conf and ipa.conf need to be in place and httpd restarted to be able to check it's status. https://fedorahosted.org/freeipa/ticket/3964
* Remove --no-serial-autoincrementMartin Kosek2013-10-116-22/+3
| | | | | | | | Deprecate this option and do not offer it in installation tools. Without this option enabled, advanced DNS features like DNSSEC would not work. https://fedorahosted.org/freeipa/ticket/3962
* Add tests for the IntEnum classPetr Viktorin2013-10-091-54/+100
| | | | | The StrEnum and Int tests are restructured to allow sharing the tests. Individual *Enum tests are separated into methods.
* Add IntEnum parameter to ipalibNathaniel McCallum2013-10-092-25/+43
|
* Allow multiple types in Param type validationNathaniel McCallum2013-10-092-36/+20
| | | | | Int already needed to take both int and long. This makes the functionality available for all Param classes.
* Add optional_create flagNathaniel McCallum2013-10-082-5/+12
|
* test_ipalib.test_crud: Don't use a string in takes_optionsPetr Viktorin2013-10-081-1/+1
| | | | Options should be Param subclasses.
* Don't special case the Password class in Param.__init__()Nathaniel McCallum2013-10-081-11/+6
|
* Use the right attribute with ipapwd_entry_checks for MagicRegenSumit Bose2013-10-081-1/+2
| | | | | | | | | | | | | There is a special mode to set the ipaNTHash attribute if a RC4 Kerberos key is available for the corresponding user. This is typically triggered by samba via the ipa_sam passdb plugin. The principal used by samba to connect to the IPA directory server has the right to modify ipaNTHash but no other password attribute. This means that the current check on the userPassword attribute is too strict for this case and leads to a failure of the whole operation. With this patch the access right on ipaNTHash are checked if no other password operations are requested.
* Document no_search in Param flagsNathaniel McCallum2013-10-071-1/+3
|
* Do not allow '%' in DM passwordMartin Kosek2013-10-041-1/+1
| | | | | | | Having '%' in DM password causes pkispawn to crash. Do not allow users to enter it until pkispawn is fixed. https://bugzilla.redhat.com/show_bug.cgi?id=953488
* ipapython.nsslib: Name arguments to NSPRErrorPetr Viktorin2013-10-041-5/+7
| | | | | Previously NSPRError was given arguments in the wrong order. Fix this by naming the arguments.
* Do not fail upgrade if the global anonymous read ACI is not foundPetr Viktorin2013-10-041-2/+6
| | | | | | This helps forward compatibility: the anon ACI is scheduled for removal. https://fedorahosted.org/freeipa/ticket/3956
* ipa-client-install: Verify RPC connection with a pingPetr Viktorin2013-10-041-0/+9
| | | | | | | | | With old servers, it is possible that xmlclient.connect() succeeds but commands fail with a Kerberos error. Verify that commands succeed by sending a ping after connecting. Follow-up to: https://fedorahosted.org/freeipa/ticket/3931
* ipa-client-install: Use direct RPC instead of api.CommandPetr Viktorin2013-10-041-3/+13
| | | | | | | | | | | | To make sure the installation works with older servers, use XML-RPC directly, with a version set explicitly so the request is not rejected. RPC was chosen over ldapmodify, because going through the API allows the server to process the request properly, or even cleanly reject it if there are incompatible changes in future versions. https://fedorahosted.org/freeipa/ticket/3931
* Update translations from TransifexPetr Viktorin2013-10-0417-516/+2596
|
* Remove faulty DNS memberOf TaskMartin Kosek2013-10-041-9/+2
| | | | | | | | | | | This task was added with a DN colliding with privilege update memberOf task being run later and caused this task to be ineffective and thus miss some privilege membership, like "SELinux User Map Administrators" DNS update plugin do not need to run any task at all as privileges will be updated later in scope of 55-pbacmemberof.update https://fedorahosted.org/freeipa/ticket/3877
* Add tests for installing with empty PKCS#12 passwordPetr Viktorin2013-10-041-14/+87
|
* Allow PKCS#12 files with empty password in install tools.Jan Cholasta2013-10-043-11/+11
| | | | https://fedorahosted.org/freeipa/ticket/3897
* Read passwords from stdin when importing PKCS#12 files with pk12util.Jan Cholasta2013-10-046-35/+42
| | | | | | | This works around pk12util refusing to use empty password files, which prevents the use of PKCS#12 files with empty password. https://fedorahosted.org/freeipa/ticket/3897
* Require new SSSD to pull required AD subdomain fixesMartin Kosek2013-10-041-1/+1
|
* ipa-kdb: Handle parent-child relationship for subdomainsAlexander Bokovoy2013-10-042-10/+105
| | | | | | | | | | | | | | | | | When MS-PAC information is re-initialized, record also parent-child relationship between trust root level domain and its subdomains. Use parent incoming SID black list to check if child domain is not allowed to access IPA realm. We also should really use 'cn' of the entry as domain name. ipaNTTrustPartner has different meaning on wire, it is an index pointing to the parent domain of the domain and will be 0 for top level domains or disjoint subdomains of the trust. Finally, trustdomain-enable and trustdomain-disable commands should force MS-PAC cache re-initalization in case of black list change. Trigger that by asking for cross-realm TGT for HTTP service.
* KDC: implement transition check for trusted domainsAlexander Bokovoy2013-10-043-2/+68
| | | | | | | | | | | | When client principal requests for a ticket for a server principal and we have to perform transition, check that all three belong to either our domain or the domains we trust through forest trusts. In case all three realms (client, transition, and server) match trusted domains and our domain, issue permission to transition from client realm to server realm. Part of https://fedorahosted.org/freeipa/ticket/3909
* ipasam: for subdomains pick up defaults for missing valuesAlexander Bokovoy2013-10-041-0/+12
| | | | | | We don't store trust type, attributes, and direction for subdomains of the existing trust. Since trust is always forest level, these parameters can be added as defaults when they are missing.
* trust: integrate subdomains support into trust-addAlexander Bokovoy2013-10-042-36/+67
|
* ipaserver/dcerpc: remove use of trust account authenticationAlexander Bokovoy2013-10-042-71/+6
| | | | | | | | Since FreeIPA KDC supports adding MS-PAC to HTTP/ipa.server principal, it is possible to use it when talking to the trusted AD DC. Remove support for authenticating as trust account because it should not really be used other than within Samba.
* frontend: report arguments errors with better detailAlexander Bokovoy2013-10-042-2/+3
| | | | | When reporting argument errors, show also a context -- what is processed, what is the name of the command.
* trusts: support subdomains in a forestAlexander Bokovoy2013-10-043-51/+420
| | | | | | | | | | | | | | | | | | | Add IPA CLI to manage trust domains. ipa trust-fetch-domains <trust> -- fetch list of subdomains from AD side and add new ones to IPA ipa trustdomain-find <trust> -- show all available domains ipa trustdomain-del <trust> <domain> -- remove domain from IPA view about <trust> ipa trustdomain-enable <trust> <domain> -- allow users from trusted domain to access resources in IPA ipa trustdomain-disable <trust> <domain> -- disable access to resources in IPA from trusted domain By default all discovered trust domains are allowed to access IPA resources IPA KDC needs also information for authentication paths to subdomains in case they are not hierarchical under AD forest trust root. This information is managed via capaths section in krb5.conf. SSSD should be able to generate it once ticket https://fedorahosted.org/sssd/ticket/2093 is resolved. part of https://fedorahosted.org/freeipa/ticket/3909
* ipaserver/dcerpc.py: populate forest trust information using realmdomainsAlexander Bokovoy2013-10-041-18/+95
| | | | | | | | Use realmdomains information to prepopulate forest trust info. As result, all additional domains should now be enabled from the beginning, unless they really conflict with existing DNS domains on AD side. https://fedorahosted.org/freeipa/ticket/3919
* ipatests.test_cmdline.test_help: Re-raise unexpected exceptions on failurePetr Viktorin2013-10-031-1/+2
| | | | | | If an exception is expected, but another one is raised, the CLITestContext raised a generic AssertionError. Pass through the original exception instead
* ipatests.test_integration.host: Add logging to ldap_connect()Petr Vobornik2013-10-031-2/+4
|
generated by cgit (git 2.34.1) at 2024-10-01 07:43:15 +0000