summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Make proper LDAP configuration reporting for ipa-client-installticket-1369-liteAlexander Bokovoy2011-07-291-18/+29
| | | | Ticket https://fedorahosted.org/freeipa/ticket/1369
* use other_entity for adder columnsAdam Young2011-07-292-2/+6
| | | | | delay creation of the table until the columns have been set https://fedorahosted.org/freeipa/ticket/1544
* Modify /etc/sysconfig/network on a client when IPA manages hostnameAlexander Bokovoy2011-07-292-5/+62
| | | | https://fedorahosted.org/freeipa/ticket/1368
* Fix date order in changelog.Rob Crittenden2011-07-281-1/+1
|
* Deprecated managing users and runas user/group in sudorule add/modRob Crittenden2011-07-292-15/+27
| | | | | | | | We have helpers to manage these values so they shouldn't be available via add/mod. There is no logic behind them to do the right thing. https://fedorahosted.org/freeipa/ticket/1307 https://fedorahosted.org/freeipa/ticket/1320
* Add hbactest command. https://fedorahosted.org/freeipa/ticket/386Alexander Bokovoy2011-07-285-1/+554
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
* Clean up existing DN object usageJohn Dennis2011-07-295-24/+19
|
* Set minimum version of pki-ca to 9.0.10 to pick up new ipa cert profileRob Crittenden2011-07-291-2/+6
| | | | | | | The caIPAserviceCert.cfg was updated to set the client cert flag on server certs we issue. https://fedorahosted.org/freeipa/ticket/1434
* When setting a host password don't set krbPasswordExpiration.Rob Crittenden2011-07-291-8/+12
| | | | | | | This can cause problems if a host is enrolled, unenrolled and a password set. The password will be marked as expired like all new passwords are. https://fedorahosted.org/freeipa/ticket/1526
* Added association facets for HBAC and sudo.Endi S. Dewata2011-07-282-80/+94
| | | | | | | The HBAC service, HBAC service group, sudo command and sudo command group have been modified to show the associations as facets. Ticket #1536
* Fixed missing memberof definition in HBAC service.Endi S. Dewata2011-07-281-1/+4
| | | | | | | The HBAC service class has been modified to define the memberof relationship with HBAC service group. Ticket #1546
* Fixed problem unprovisioning service.Endi S. Dewata2011-07-281-1/+1
| | | | | | | The IPA.service_provisioning_status_widget has been modified to execute the disable command with the right entity name. Ticket #1543
* Fix message in test case for checking minimum valuesRob Crittenden2011-07-281-1/+1
|
* dns section header i18n.Adam Young2011-07-283-3/+7
| | | | https://fedorahosted.org/freeipa/ticket/1493
* Fixed missing section header in sudo command group.Endi S. Dewata2011-07-281-1/+1
| | | | | | | The sudo command group details page has been fixed to use the correct label name. Ticket #1537.
* removing setters setup and initAdam Young2011-07-2829-1878/+1191
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | change widget and widget unit tests to hold on to entity, not entity name. Replacing entity_name with entity.name in most places. The one exception is columns for table_widget. Widgets that refer to other entities have to have late resolution of the entity object, due to circular dependencies. cleanup entity assignment. removed template and layout, merged setup into create adder dialogs adjust height for external removed init from widget, isection, association, facet, host and service Make unit tests use factory. fix functional tests to click find link correctly. tweak to activation test, but still broken. moved initialization code to the end use --all for hbacrule find, so the type shows up now fixed dns exception code and exception handling for get_entity replace metadata look up with value from entity. fixed author lines removed duplicate columns in managed by facets. tweak to nav fix in order to initialize tab. more defensive code update metadata for true false one line init for entity_name in widget move init code to end of constructor functions moved constants to start of function for adder_dialog external fields for dialogs initialized at dialog creation sudo sections: move add fields and columns to widget definition. The parameter validation in IPA.column ...This is precondition checking. Note that it merely throws an exception if the entity_name is not set. I want this stuff at the top of the function so that it is obvious to people looking to use them what is required. I added a comment to make this clear, but I'd like to keep precondition checking at the top of the function. decreased the scope of the pkey_name and moved the initiailzation fof columns into the setup_column function for association_tables return false at the end of click handler removed blank labels in sudo command section fix radio buttons for sudo category fixed table side for adder dialogs with external fields comments for future direction with add_columns https://fedorahosted.org/freeipa/ticket/1451 https://fedorahosted.org/freeipa/ticket/1462 https://fedorahosted.org/freeipa/ticket/1493 https://fedorahosted.org/freeipa/ticket/1497 https://fedorahosted.org/freeipa/ticket/1532 https://fedorahosted.org/freeipa/ticket/1534
* Make AVA, RDN & DN comparison case insensitive. No need for lowercase ↵John Dennis2011-07-272-140/+211
| | | | | | | | | | | | | | | | | | | | | | | | | | normalization. Replace deepcopy with constructor (i.e. type call) Can now "clone" with configuration changes by passing object of the same type to it's constructor, e.g. dn1 = DN(('cn', 'foo')) dn2 = DN(dn1) dn2 = DN(dn1, first_key_match=False) Remove pairwise grouping for RDN's. Had previously removed it for DN's, left it in for RDN's because it seemed to make sense because of the way RDN's work but consistency is a higher goal. Add keyword constructor parameters to pass configuration options. Make first_key_match a configuration keyword. Updated documentation. Updated unit test. FWIW, I noticed the unittest is now running 2x faster, not sure why, removal of deepcopy? Anyway, hard to argue with performance doubling.
* Fix invalid issuer in unit testsMartin Kosek2011-07-274-8/+14
| | | | | | | Fix several test failures when issuer does not match the one generated by make-testcert (CN=Certificate Authority,O=<realm>). https://fedorahosted.org/freeipa/ticket/1527
* Fixed hard-coded label in Find button.Endi S. Dewata2011-07-281-1/+1
| | | | | The IPA.adder_dialog has been modified to use translated label for the Find button.
* Fixed hard-coded labels in sudo rules.Endi S. Dewata2011-07-281-6/+10
| | | | | | | The sudo rule interface has been modified to remove unused labels and use translated dialog box title. Ticket #1518
* Fixed problem setting host OTP.Endi S. Dewata2011-07-281-10/+14
| | | | | | | | The handler for host 'Set OTP' button has been modified to obtain the primary key from the entity and return false to stop the normal event processing. Ticket #1511
* Don't leave dangling map if adding an indirect map failsRob Crittenden2011-07-272-5/+21
| | | | | | | | When using the add_indirect helper we create a new map and then add a key for it all in one step. If adding the key fails for any reason be sure to remove the map we added. https://fedorahosted.org/freeipa/ticket/1520
* Fix external CA install.Jan Cholasta2011-07-261-25/+34
| | | | ticket 1523
* Fix automountkey commands summaryMartin Kosek2011-07-271-4/+12
| | | | | | | | | | | The summary value was set to primary key. However, the primary key may contain also an info option as a workaround for multiple direct maps problem. This patch sets the result 'value' and thus summary text to expected and consistent value. https://fedorahosted.org/freeipa/ticket/1524
* Fixed problem bookmarking Policy/IPA Server tabsEndi S. Dewata2011-07-261-9/+31
| | | | | | | | | When opening a bookmark, each tab level will be updated separately from top to bottom according to the URL state. The navigation code has been modified to recognize when an ancestor tab is being updated and not change the URL state. Ticket #1521
* Revert use of 'can be at least' to 'must be at least' in minvalue validatorRob Crittenden2011-07-261-1/+1
| | | | BZ https://bugzilla.redhat.com/show_bug.cgi?id=723969
* fixed empty dns record updatePetr Vobornik2011-07-253-2/+43
| | | | | | | https://fedorahosted.org/freeipa/ticket/1477 Redirection after updating empty DNS Record (which is deleted). Added hook to details facet for post update operation.
* Make sure that hostname specified by user is not an IP address.Jan Cholasta2011-07-253-1/+10
| | | | ticket 1375
* New icons for entitlement buttonsEndi S. Dewata2011-07-255-4/+19
| | | | | | | The entitlement facets have been modified to use the new icons provided by Kyle Baker. Ticket #1425
* Add an arch-specific Requires on cyrus-sasl-gssapiRob Crittenden2011-07-241-2/+5
| | | | | | | | If you had a 64-bit system and installed a 32-bit version of IPA then ipa-getkeytab probably wouldn't work because yum wouldn't know to pull in the 32-bit version of cyrus-sasl-gssapi. https://fedorahosted.org/freeipa/ticket/1499
* Fix man page ipa-csreplica-manageMartin Kosek2011-07-251-3/+3
| | | | | | Fix references to ipa-replica-manage in ipa-csreplica-manage. https://fedorahosted.org/freeipa/ticket/1519
* Don't check for leading/trailing spaces in a File parameterRob Crittenden2011-07-251-1/+2
| | | | https://fedorahosted.org/freeipa/ticket/1505
* move dns to identity tabAdam Young2011-07-221-4/+4
| | | | fix JSL warning
* Fixed click handlers on certificate buttons.Endi S. Dewata2011-07-221-5/+10
| | | | | The click event handlers for certificate buttons have been fixed to stop standard event processing which causes the page to change.
* remove hardcoded DNS label for record name.Adam Young2011-07-221-1/+2
| | | | https://fedorahosted.org/freeipa/ticket/1493
* Fixed navigation unit test.Endi S. Dewata2011-07-221-2/+2
| | | | | The mock-up get_state() has been modified to return an empty object if it's called without parameter. It's the same as $bbq.getState().
* Fixed navigation problems.Endi S. Dewata2011-07-223-59/+105
| | | | | | | | | | | | The navigation code has been modified store the facet's state separately in the facet object itself. The path state is stored in the navigation object. When the path is changed to view a new facet, only the path and the state of the new facet will be shown in the URL, thus keeping the URL short. This fixes pagination, bookmark and search filter problems as well. Ticket #1507, 1516, 1517
* Fixed problem with navigation state loading.Endi S. Dewata2011-07-221-8/+30
| | | | | | | | The select event handler in the navigation tab has been modified to distinguish the source of the event. If the event is triggered by URL hash change, it will use the state specified in the URL. If the event is triggered by a mouse click, it will use the state stored internally.
* Refactored IPA.current_facet().Endi S. Dewata2011-07-227-48/+32
| | | | | | | | The IPA.current_facet() has been merged into IPA.entity.setup() and replaced by IPA.entity.get_facet(). The setup() will read the current facet's name from the <entity>-facet URL parameter and store the facet object in the entity object. The get_facet() without any parameter will return the current facet object.
* Fix ipa-compat-manage not working after recent ipa-nis-manage change.Jan Cholasta2011-07-222-42/+68
| | | | ticket 1147
* Autofill the default revocation reasonRob Crittenden2011-07-222-1/+2
| | | | https://fedorahosted.org/freeipa/ticket/1514
* Hide the HBAC access type attribute now that deny is deprecated.Rob Crittenden2011-07-213-8/+9
| | | | | | | It won't appear in the UI/CLI but is still available via XML-RPC. allow is the default and deny will be rejected. https://fedorahosted.org/freeipa/ticket/1495
* Remove wrong kpasswd sysconfigJakub Hrozek2011-07-211-3/+0
|
* Ticket 1485 - DN pairwise groupingJohn Dennis2011-07-213-222/+398
| | | | | | | | | | | | | | | | | | | | | The pairwise grouping used to form RDN's and AVA's proved to be confusing in practice, this patch removes that functionality thus requiring programmers to explicitly pair attr,value using a tuple or list. In addition it was discovered additional functionality was needed to support some DN operations in freeipa. DN objects now support startswith(), endswith() and the "in" membership test. These functions and operators will accept either a DN or RDN. The unittest was modified to remove the pairwise tests and add new explicit tests. The unittest was augmented to test the new functionality. In addition the unittest was cleaned up a bit to use common utilty functions for improved readabilty and robustness. The documentation was updated. fix test_role_plugin use of DN to avoid pairwise grouping
* Add missing automount summariesMartin Kosek2011-07-211-0/+40
| | | | | https://fedorahosted.org/freeipa/ticket/1509 https://fedorahosted.org/freeipa/ticket/1510
* Removed custom layouts using HTML templates.Endi S. Dewata2011-07-2122-1172/+84
| | | | | | | The code for supporting custom layouts using HTML templates has been removed. If it's needed again in the future the code can be restored. Ticket #1501
* Removed HBAC access time code.Endi S. Dewata2011-07-211-344/+0
| | | | | | | | The HBAC access time is currently not supported, so the related UI code has been removed to reduce maintenance issue. When the feature becomes supported in the future the code may be restored/rewritten. Ticket #546
* Fixed problem loading data in HBAC/sudo details page.Endi S. Dewata2011-07-213-21/+51
| | | | | | | | In a recent change the details page was changed to create and locate field containers with 'details-field' CSS class. The HBAC and sudo custom details pages have been modified to use the same CSS class. Ticket #1508
* Removed entitlement registration UUID field.Endi S. Dewata2011-07-211-4/+9
| | | | | | | | | The UUID field has been removed from the entitlement registration dialog box because it's currently not supported. The code has been modified not to send empty UUID value should this become supported in the future. Ticket #1506
* Creating reverse zones from IP address.Endi S. Dewata2011-07-202-16/+181
| | | | | | | | | | A custom adder dialog has been added for DNS zones to simplify creating reverse zones from IP address. The dialog provides a checkbox which indicates whether the content of the zone name field is an IP address. The IP address will be used to generate the reverse zone name and email address. Ticket #1045
generated by cgit (git 2.34.1) at 2024-04-26 01:00:10 +0000