summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add labels so HBAC and Sudo rules show under hosts/hostgroups.Rob Crittenden2012-01-162-4/+18
| | | | | | Also fix a bunch of trailing whitespace. https://fedorahosted.org/freeipa/ticket/1751
* Fixed problem removing automount keys and DNS records.Endi Sukma Dewata2012-01-163-55/+61
| | | | | | | | | Due to a recent change the deleting automount keys and DNS records no longer worked. The functions that are supposed to get the selected values has been fixed to use the correct names and element type. They also have been converted into methods of the search facets. Ticket #2256
* Restore ACI when aci_mod failsMartin Kosek2012-01-132-4/+43
| | | | | | | | | | aci_mod command is composed of 2 ACI commands: aci_del which deletes the old ACI and aci_add which adds the new modified ACI. However, if aci_add command fails then both new and the old ACI are lost. Old ACI must be restored in this case. https://fedorahosted.org/freeipa/ticket/2013 https://fedorahosted.org/freeipa/ticket/2014
* slapi-plugins: use thread-safe ldap librarySimo Sorce2012-01-132-2/+2
|
* Added instructions to generate CSR.Endi Sukma Dewata2012-01-13109-527/+484
| | | | | | | | | | The certificate request dialog box has been modified to show the OpenSSL commands for generating a CSR. The realm and entry names in the test data have been fixed to be more consistent. Ticket #1012
* Fix some typos in automember help and paramters.Rob Crittenden2012-01-121-5/+5
| | | | | | Contributed by Jérôme Fenal https://fedorahosted.org/freeipa/ticket/2261
* Allow hbactest to work with HBAC rules exceeding default IPA limitsAlexander Bokovoy2012-01-132-4/+27
| | | | | | | | | | | | | When multiple HBAC rules are defined, IPA default limits to retrieve objects may limit the scope of HBAC testing. To allow full range of rules to be tested support for --sizelimit option is added. In addition, when --rules option is specified, make sure only those rules are retrieved regardless total number of rules defined. This should also speed up HBAC test performance for real life scenarios when few new rules are added to large collection of rules. https://fedorahosted.org/freeipa/ticket/2230
* Fix replication setupSimo Sorce2012-01-132-10/+20
| | | | | | Changes to add a cs-replication management tool mistakenly always set a flag that caused replicas to not add the list of attribute we exclude from replication.
* Let replicas install without DNSMartin Kosek2012-01-136-64/+76
| | | | | | | | | | | | | | | | | Let ipa-replica-prepare and ipa-replica-install work without proper DNS records as records in /etc/hosts are sufficient for DS replication. 1) ipa-replica-prepare now just checks if the replica hostname is resolvable (DNS records are not required). It is now able to prepare a replica file even when the replica IP address is present in /etc/hosts only. 2) ipa-replica-install is now able to proceed when the hostname is not resolvable. It uses an IP address passed in a new option --ip-address to create a record in /etc/hosts in the same way as ipa-server-install does. https://fedorahosted.org/freeipa/ticket/2139
* Fix LDAP updates in ipa-replica-installMartin Kosek2012-01-131-1/+1
| | | | | | | | ipalib API needs to be bootstrapped in 'installer' context otherwise LDAP update plugins don't get initialized and ipa-replica-install crashes. https://fedorahosted.org/freeipa/ticket/2139
* Prevent service restart failures in ipa-replica-installMartin Kosek2012-01-131-5/+16
| | | | | | | | | | Call restart() methods of appropriate services instead of calling the system service restart command directly as service() method has a capability to wait until the service is fully up. Without this patch ipa-replica-install crashed on F-16 because krb5kdc service was started before dirsrv service was fully up. https://fedorahosted.org/freeipa/ticket/2139
* Fix LDAP add calls in replication moduleMartin Kosek2012-01-131-11/+11
| | | | | | | Replace conn.add_s(entry) with conn.addEntry(entry) to avoid function calls with an invalid number of parameters. https://fedorahosted.org/freeipa/ticket/2139
* Validate sudo RunAsUser/RunAsGroup argumentsAlexander Bokovoy2012-01-131-1/+38
| | | | | | | | | | | | | FreeIPA SUDO rules use --usercat/--groupcat to specify that rule applies to all users or groups. Thus, sudorule-add-runasuser and sudorule-add-runasgroup accept specific groups and users and do not accept ALL reserved word. The patch validates user and group passed to these commands and reports appropriate errors when these are ALL. Ticket #1496 https://fedorahosted.org/freeipa/ticket/1496
* Catch exception when trying to list missing managed entries definitionsRob Crittenden2012-01-121-3/+7
| | | | | | | On the off chance that the definitions cannot be found we should catch the error and not raise a backtrace. https://fedorahosted.org/freeipa/ticket/1912
* Document the ping plugin.Rob Crittenden2012-01-121-1/+25
| | | | https://fedorahosted.org/freeipa/ticket/1903
* Fix maxvalue in DNS pluginMartin Kosek2012-01-122-7/+6
| | | | | | | | | | | | Having a Parameter maxvalue larger that 2G makes Python convert it to "long" type instead of "int" type. Our framework than fails to bootstrap the API when it detects long integer in Parameter maxvalue. Remove the clashing maxvalue out entirely as we can't transfer values larger than 2G anyway (xmlrpc limitation). https://fedorahosted.org/freeipa/ticket/2082
* Create per-type DNS APIMartin Kosek2012-01-123-189/+740
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use new structured DNSRecord parameters to generate per-type API for all supported DNS RR types. This should help significantly the end-user with manipulating complex DNS record type (MX, LOC, etc.). All enhancements are integrated to current DNS record commands: 1) dnsrecord-add - Records can be either entered as a raw value (e.g. --mx-rec= "1 srv1.example.com" for MX record) or per-part: --mx-preference=1 --mx-exchanger=srv1.example.com - CLI interactive help behavior was changed. It will ask for a record type and then ask for all DNS record part values (e.g. MX Preference value, MX Exchanger value). 2) dnsrecord-mod - This command can now operate in 2 modes. When only a raw DNS record is entered (e.g. --mx-rec="1 srv1.example.com") it operates in standard mode and replaces any previous mxrecord value with the --mx-rec value. When any structured parameter (e.g. --mx-preference) is passed it modifies just the specified parts of one mxrecord value referred by --mx-rec: --mx-rec="1 srv1.example.com" --mx-preference=2 - New interactive help has been implemented. It will ask for a record to be modified (in the same manner as dnsrecord-del) and then let user change DNS record part(s) for chosen records. 3) All dnsrecord-* commands have now --structured option - When this option is passed, instead of displaying raw DNS values all DNS records are parsed and displayed per-part. Example: $ ipa dnsrecord-show example.com @ --structured Record name: @ Records: Record type: MX Record data: 0 server1.example.com. MX Preference: 0 MX Exchanger: server1.example.com. Record type: NS Record data: ns1.example.com. NS Hostname: ns1.example.com. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Improve CLI output for complex commandsMartin Kosek2012-01-122-4/+24
| | | | | | | | | | | | | | | Complex commands may have many options or non-standard output. This patch adds 2 improvements to handle these commands better: 1) Add "option_group" parameter attribute Make command help more readable by specifying an option group for the parameter. All parameters in the same option group are then placed to one named option group 2) Allow nested entries in the output Current CLI output module cannot handle a list of nested entries (dictionaries) contained in an entry attribute. Make sure they are printed properly (with indentation) https://fedorahosted.org/freeipa/ticket/2082
* Fix Parameter csv parsingMartin Kosek2012-01-121-4/+10
| | | | | | | CSV values were not parsed in ipalib.parameters.normalize method properly when passed as a list and not as a basestring. Based on Jan Cholasta's contribution.
* Refactor dnsrecord processingMartin Kosek2012-01-124-739/+971
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* ipa-kdb: Create PAC's KDC checksum with right keySimo Sorce2012-01-111-2/+89
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2170
* ipa-kdb: Verify the correct checksum in PAC validationSimo Sorce2012-01-111-5/+45
| | | | | | | | | | | | | | | | | | This patch requires a forthcoming change in MIT libraries which allows to pass NULL for the server_key to the krb5_pac_verify() function. In most cases we should always only check the KDC checksum to verify the PAC validity. The only exception is when we are releasing a ticket to a client from another realm. In this case the only signature we can check is the server checksum, and we use the cross-realm key to validate in this case. The previous code was working for normal cases because the kdc uses the same key to create the server and the kdc checksum for a TGT, but that is not true for evidence tickets (s4u2proxy) or cross-realm TGTs. Fixes: https://fedorahosted.org/freeipa/ticket/2169
* Configure s4u2proxy during installation.Rob Crittenden2012-01-106-2/+51
| | | | | | | | | | | | This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
* Added IP address validator to Host and DNS record adder dialogPetr Vobornik2012-01-115-23/+101
| | | | | | | | | Also fixed minor issues reagarding IP addresses or multivalued field: - removed unnecessary method overrides from multivalued_field - fixed extract_child_value method in multivalued_widget to return '' instead of empty arrays when value array is empty - net.js - changed method name and error message from 'trailing zeros' to 'leading zeros' https://fedorahosted.org/freeipa/ticket/1466
* Added support for memberof attribute in permissionPetr Vobornik2012-01-112-19/+49
| | | | | | The attribute was added to adder dialog and details facet. It uses entity select (group) widget. https://fedorahosted.org/freeipa/ticket/2101
* Load user data and policies in a single batch.Endi Sukma Dewata2012-01-103-139/+321
| | | | | | | | The user details facet has been modified to load the user data, password policy and Kerberos ticket policy in a single batch command. Ticket #703
* Added policies into user details page.Endi Sukma Dewata2012-01-1011-168/+467
| | | | | | | | The user details page has been modified to show the password policy and Kerberos ticket policy that apply to the user. The policies are currently displayed as read-only. Ticket #703
* HBAC test optional sourcehost optionOndrej Hamada2012-01-094-29/+115
| | | | | | | | | | | | | | | New version of SSSD begins ignoring sourcehost value of HBAC rules by default. In order to match this behaviour the sourcehost option in hbactest is optional now, but the value of sourcehost is ignored in all rules. Every rule's sourcehost value is set to 'ALL' what turns sourchost value comparation off. If srchost option is used, warning is displayed to inform the user about changes. Text of plugin help was also updated. Also the unit tests for hbactest plugin were updated. Every test was doubled. The second ones test the plugin without sourcehost option. They are supposed to have the same result. https://fedorahosted.org/freeipa/ticket/2085
* Added account status into user search facet.Endi Sukma Dewata2012-01-067-48/+120
| | | | | | | | The user search facet has been modified to show the account status. The IPA.boolean_format has been converted into a class to allow behavior customization. Ticket #1996
* Fix two typos in role help.Rob Crittenden2012-01-041-2/+2
| | | | Contributed by Jérôme Fenal
* Display the value of memberOf ACIs in permission plugin.Rob Crittenden2012-01-043-7/+70
| | | | | | | | | | | | | | | | There were two problems: 1. memberof wasn't in the list of things we looked for in the return value from aci_show() 2. The value wasn't being translated into a group name. Use the DN class to retrieve the group name from the memberof URI. Note that I changed the parsing for targetgroup as well. We now save a lookup and potentially returning a NotFound if an aci points to a group that no longer exists. https://fedorahosted.org/freeipa/ticket/2100
* ipa-cldap: Support clients asking for default domainSimo Sorce2012-01-051-1/+21
|
* Add DNS check to conncheck port probeMartin Kosek2012-01-031-0/+5
| | | | | | | | | It is pointless to report failures for all checked ports when the target hostname is not resolvable - user may get easily confused. This patch changes this behavior so that conncheck fails with a proper error and does not even continue to port probing part. https://fedorahosted.org/freeipa/ticket/1984
* update i18n pot file for branch masterJohn Dennis2012-01-031-3574/+3705
|
* Fixed IPv6 validation special case: single colonPetr Vobornik2012-01-032-0/+8
| | | | | | IPv6 parsing was incorrectly evaluating ':' as a valid IPv6 address. https://fedorahosted.org/freeipa/ticket/1466
* Added client-side validation of A and AAAA DNS recordsPetr Vobornik2012-01-034-3/+64
| | | | https://fedorahosted.org/freeipa/ticket/1466
* Added validation logic to multivalued text fieldPetr Vobornik2012-01-032-2/+55
| | | | https://fedorahosted.org/freeipa/ticket/1466
* Added support of custom field validatorsPetr Vobornik2012-01-031-51/+87
| | | | | | | | | | | | | Current validation logic supports only validation based on metadata. It can be extended only by overriding field's validation method. This approach requires creating subclasses of field for each different format of desired value. It's inconvenient for cases like adding the same validation logic to two different subclasses of field. This patch is adding support for creating custom validators. Validator is an object which contains validation logic. Validation is executed in a validate(value, context) method. This method checks if the value is valid and returns a validation result. Validation result is a simple object which contains valid property and an error message if valid is false. Field is extended by validators property. It can be set in spec object or later. It should contain instances of validators for the field. Validators are run in field's validation method. This patch is a prerequisite for: https://fedorahosted.org/freeipa/ticket/1466
* Fix attempted write to attribute of read-only object.Jan Cholasta2012-01-029-17/+55
| | | | | | | | | Add new class "cachedproperty" for creating property-like attributes that cache the return value of a method call. Also fix few issues in the unit tests to enable them to succeed. ticket 1959
* Reload UI on server upgrade.Endi Sukma Dewata2011-12-213-0/+9
| | | | | | | | | | The JSON server has been modified to return the version number in all responses. The UI has been modified to keep the version obtained during env operation and check the version returned in subsequent operations. If the version changes the UI will reload itself. Ticket #946
* Reload UI when the user changes.Endi Sukma Dewata2011-12-212-0/+5
| | | | | | | | | | The JSON server has been modified to return the principal name in all responses. The UI has been modified to keep the principal obtained during whoami operation and check the principal returned in subsequent operations. If the principal changes the UI will reload itself. Ticket #1400
* Parsing of IPv4 and IPv6 addressesPetr Vobornik2011-12-219-4/+716
| | | | | | | | | Added support of parsing and validation of IPv4 and IPv6 addresses. Class IP.address can also create reverse address from any valid IPv4 or IPv6 address. This functionality is needed for tickets: https://fedorahosted.org/freeipa/ticket/1466 https://fedorahosted.org/freeipa/ticket/1975
* Refactored entity object resolution.Endi S. Dewata2011-12-2124-154/+157
| | | | | | | | | | | | | The IPA.get_entity() has been modified to accept either entity name or entity object. If it receives an entity object it will return the object itself. Otherwise, it will resolve the name in the entity registry. The other_entity variables have been modified to store a reference to the entity object instead of its name. The test cases have been modified to use real entity objects instead of just the names. Ticket #2042
* Fixed labels in Sudo, HBAC rulesPetr Vobornik2011-12-202-19/+8
| | | | | | Fixed regression in labels introduced by refactoring #1515. https://fedorahosted.org/freeipa/ticket/1515
* Better table column width computingPetr Vobornik2011-12-172-22/+44
| | | | | | | | Columns can have width set or not. Without setting the width it was computed based on tbody width and number of columns. This method is working well if no column has width set. The disadvantage of this approach is that all columns have the same width and so they are not reflecting their possible usage. Flag columns such as 'external' in rule association tables or various 'enable' flags in search facets can be narrower. If we set them fixed small width it will have different size because this width is not currently added to the computation. This is fixing this problem so dynamic and fixed width can be combined and the columns have desired width. https://fedorahosted.org/freeipa/ticket/2200
* Distinguishing of external values in association tablesPetr Vobornik2011-12-153-54/+75
| | | | | | | | | | | | | | | | | | | | Problem: Rule association widget was displaying standard records with external records in one table. User couldn't distinguish the values. When clicking on the external record link it navigated to appropriate page for that entity. But for external value there is no record to show so it displayed error. Solution: * For tables with possible external values a 'external' column was added. It displays "True" if the value is external and nothing if not. Displaying nothing is intentional. If user sees some text in external column he imidiately knows that the record is external without even reading the "True" text. * Rows with external values don't have a link for navigating to record page. This prevents showing the error as no record exists. Additional changes: * Association table widget was stripped of get_records method. Loading records isn't its resposibility it's a resposibility of field. * Column was extended by possible suppressing of link creation. It's done by optional suppress_link argument in setup method. * To allow setting suppress_link attribute in inherited tables a new overridable method was created - setup_column. Posible future improvements: * Table is using dynamic setting of width for columns. Each column has the same width. For flag columns such as 'external' the width of the column is too big. It would be better to be able to set smaller fixed width and the rest of the columns width (without the width set) would be computed (to fit the table). * When a table has displayed buttons in its last column header the cells in column header have different vertical alignmnent. It should be united. https://fedorahosted.org/freeipa/ticket/1993
* Fixed displaying of external records in rule association widgetsPetr Vobornik2011-12-153-19/+51
| | | | | | It's a fix for regression introduced by widget refactoring #2040. https://fedorahosted.org/freeipa/ticket/2040
* Added facet tabs coloringPetr Vobornik2011-12-144-8/+28
| | | | | | Facet tabs are now colored according to their group. https://fedorahosted.org/freeipa/ticket/1976
* Require an HTTP Referer header in the server. Send one in ipa tools.Rob Crittenden2011-12-125-5/+67
| | | | | | | | | | This is to prevent a Cross-Site Request Forgery (CSRF) attack where a rogue server tricks a user who was logged into the FreeIPA management interface into visiting a specially-crafted URL where the attacker could perform FreeIPA oonfiguration changes with the privileges of the logged-in user. https://bugzilla.redhat.com/show_bug.cgi?id=747710
* User-add random password supportOndrej Hamada2011-12-126-13/+201
| | | | | | | | | | | | | | | | | | | | | | I've used code from ipalib/plugins/host.py to add support for random password generation. The '--random' option is now available in user-add and user-mod commands. If both the 'password' and 'random' options are used the 'random' option will be ignored. Two test cases were added to unit test's module test_user_plugin.py - they test creating and modifying user with random password. Two fuzzy tests were added: test for password(string that doesn't start or end with whitespace and doesn't containt other whitespace than ' ') and for whatever string(because of krbextradata). I've slightly modified ipa_generate_password in order to make passwords for users more user-friendly(reduce number of non-letters). It has two optional parameters now - first one is string of characters that should be used for generating the passwd and second one is length of password. If none parameter is set default values will be used so there's no need to modify other plugins that use random password generator. https://fedorahosted.org/freeipa/ticket/1979
generated by cgit (git 2.34.1) at 2024-09-21 19:39:59 +0000