summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* sudorule: PEP8 fixes in sudorule.pyTomas Babej2014-06-251-52/+104
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix incompatible DNS permissionMartin Basti2014-06-251-1/+30
| | | | | | | | | dns(forward)zone-add/remove-permission can work with permissions with relative zone name Ticket:https://fedorahosted.org/freeipa/ticket/4383 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: don't limit permission search in privilegesPetr Vobornik2014-06-251-2/+1
| | | | | | | | | | | | Search for privileges was limited to bindruletype==permission. There was no reason to do that. This patch removes the restriction. Related to: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: fix field's default valuePetr Vobornik2014-06-251-1/+1
| | | | | | | | Fields with default value, such as DNS Zone's idnsforwardpolicy, were marked as dirty when no value was loaded and when default value of input control was other than empty. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui-ci: adjust tests to dns changesPetr Vobornik2014-06-252-2/+2
| | | | | | All DNS Zone names must be fully qualified. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* trusts: Allow reading system trust accounts by adtrust agentsTomas Babej2014-06-253-0/+21
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* trusts: Add more read attributesTomas Babej2014-06-252-2/+3
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Change OTPSyncRequest structure to use OctetStringNathaniel McCallum2014-06-255-56/+79
| | | | | | | | This change has two motivations: 1. Clients don't have to parse the string. 2. Future token types may have new formats. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add missing ipa-otptoken-import.1.gz to spec fileAlexander Bokovoy2014-06-251-0/+1
| | | | Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix packaging issue with doubly specified directoriesAlexander Bokovoy2014-06-251-1/+1
| | | | Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Implement OTP token importingNathaniel McCallum2014-06-2516-0/+1089
| | | | | | | | | | | | | | | | | | | | This patch adds support for importing tokens using RFC 6030 key container files. This includes decryption support. For sysadmin sanity, any tokens which fail to add will be written to the output file for examination. The main use case here is where a small subset of a large set of tokens fails to validate or add. Using the output file, the sysadmin can attempt to recover these specific tokens. This code is implemented as a server-side script. However, it doesn't actually need to run on the server. This was done because importing is an odd fit for the IPA command framework: 1. We need to write an output file. 2. The operation may be long-running (thousands of tokens). 3. Only admins need to perform this task and it only happens infrequently. https://fedorahosted.org/freeipa/ticket/4261 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ipa.service restartMartin Basti2014-06-251-1/+4
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_permission_plugin: Fix permission_find test for legacy permissionsPetr Viktorin2014-06-241-2/+2
| | | | | | | Most of the legacy permissions have been removed. Do not test that there are many of them. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add several CRUD default permissionsPetr Viktorin2014-06-244-0/+42
| | | | | | | | | | | | Add missing Add, Modify, Removedefault permissions to: - automountlocation (Add/Remove only; locations have no data to modify) - privilege - sudocmdgroup (Modify only; the others were present) Related to: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Sudo Command Group default permissions to managedPetr Viktorin2014-06-243-27/+28
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Sudo Command default permissions to managedPetr Viktorin2014-06-243-27/+31
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Service default permissions to managedPetr Viktorin2014-06-243-55/+38
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert SELinux User Map default permissions to managedPetr Viktorin2014-06-243-30/+31
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Role default permissions to managedPetr Viktorin2014-06-243-44/+38
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert the Modify privilege membership permission to managedPetr Viktorin2014-06-243-9/+10
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Netgroup default permissions to managedPetr Viktorin2014-06-243-44/+40
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Hostgroup default permissions to managedPetr Viktorin2014-06-243-44/+38
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert HBAC Service Group default permissions to managedPetr Viktorin2014-06-243-26/+28
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert HBAC Service default permissions to managedPetr Viktorin2014-06-243-16/+18
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert HBAC Rule default permissions to managedPetr Viktorin2014-06-243-32/+44
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Group default permissions to managedPetr Viktorin2014-06-245-54/+48
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Automount default permissions to managedPetr Viktorin2014-06-244-83/+68
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Remove GetEffectiveRights control when ldap2.get_effective_rights fails.Jan Cholasta2014-06-241-3/+5
| | | | Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Support requests with SAN in cert-request.Jan Cholasta2014-06-244-43/+193
| | | | | | | | | | For each SAN in a request there must be a matching service entry writable by the requestor. Users can request certificates with SAN only if they have "Request Certificate With SubjectAltName" permission. https://fedorahosted.org/freeipa/ticket/3977 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow SAN in IPA certificate profile.Jan Cholasta2014-06-242-1/+57
| | | | | | https://fedorahosted.org/freeipa/ticket/3977 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* netgroup: Add objectclass attribute to read permissionsPetr Viktorin2014-06-232-4/+4
| | | | | | | | The entries were unreadable without this. Additional fix for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* trusts: Allow reading ipaNTSecurityIdentifier in user and group objectsTomas Babej2014-06-233-3/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4385 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: plugin APIPetr Vobornik2014-06-233-2/+63
| | | | | | | | | new `extend` module should serve as a stable API for plugin authors. It should expose the most commonly used global calls. https://fedorahosted.org/freeipa/ticket/4345 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add parent link to widgets in ContainerMixinPetr Vobornik2014-06-232-0/+3
| | | | | | | | Standard facets sets `facet` attribute to widgets. This one adds similar, more generic `parent` attribute which should be used for going through the hierarchy up to top. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: generic routingPetr Vobornik2014-06-234-259/+538
| | | | | | | | | | | Router is not able to create hash from facet state for custom routes/facets. This patch refactors router methods into providers. It allows to create additional route handlers, navigators and hash creators. These providers are mapped to facets and therefore it's possible to create router hash for any facet without any logic in the facet itself. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: support standalone facets in navigation modulePetr Vobornik2014-06-231-4/+18
| | | | | | | | | One can access standard standalone facets with: `navigation.show('facet_name')` and completely custom facets with low level call: `navigation.show_generic('/custom/hash', facet)`` Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: fix excessive registration of state change event listenersPetr Vobornik2014-06-231-1/+1
| | | | | | | | `Facet` descendants don't have `container` attribute as opposite to `facet.facet`. Therefore the registration will happen on every facet visit. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* host permissions: Allow writing attributes needed for automatic enrollmentPetr Viktorin2014-06-232-2/+18
| | | | | | | | | | | - userclass added to existing Modify hosts permission - usercertificate, userpassword added to a new permissions https://fedorahosted.org/freeipa/ticket/4252 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Host default permissions to managedPetr Viktorin2014-06-234-110/+81
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add posixgroup to groups' permission object filterPetr Viktorin2014-06-233-7/+105
| | | | | | | | | | Private groups don't have the 'ipausergroup' objectclass. Add posixgroup to the objectclass filters to make "--type group" permissions apply to all groups. https://fedorahosted.org/freeipa/ticket/4372 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Join --type objectclass filters with ORPetr Viktorin2014-06-232-19/+26
| | | | | | | | | | | | For groups, we will need to filter on either posixgroup (which UPGs have but non-posix groups don't) and groupofnames/nestedgroup (which normal groups have but UPGs don't). Join permission_filter_objectclasses with `|` and add them as a single ipapermtargetfilter value. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Test and docstring fixesPetr Viktorin2014-06-234-18/+18
| | | | | | | | | The recent conversions to managed permissions left behind a few failing tests. Fix them. Also fix a now incorrect docstring in ipalib.config. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow anonymous read access to virtual operation entriesPetr Viktorin2014-06-203-8/+1
| | | | | | | | | | These entries are the same in all IPA installations, so there's no need to hide them. Also remove the ipaVirtualOperation objectclass, since it is no longer needed. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make otptoken use os.urandom() for random dataNathaniel McCallum2014-06-201-2/+2
| | | | | | | This also fixes an error where the default value was not respecting the KEY_LENGTH variable. Reviewed-By: Simo Sorce <ssorce@redhat.com>
* DNSSEC: WebUI add DLV record typeMartin Basti2014-06-201-1/+15
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Digest part in DLV/DS records allows only heaxadecimal charactersMartin Basti2014-06-202-4/+6
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNSSEC: Test: DLV recordMartin Basti2014-06-201-1/+35
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNSSEC: DLVRecord type addedMartin Basti2014-06-206-23/+34
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Tests: tests for NSEC3PARAM recordsMartin Basti2014-06-201-0/+63
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Tests: remove unused records from testsMartin Basti2014-06-201-57/+1
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-28 15:31:22 +0000