summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* webui: append network.negotiate-auth.trusted-urisPetr Vobornik2014-09-111-1/+23
| | | | | | https://fedorahosted.org/freeipa/ticket/4478 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* Fix hardcoded lib dir in freeipa.specGabe2014-09-091-3/+3
| | | | | | | | - Migrate hardcoded tmpfiles.d paths to %{_tmpfilesdir} macro in spec file https://fedorahosted.org/freeipa/ticket/4528 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use autobind when updating CA people entries during certificate renewalJan Cholasta2014-09-092-12/+4
| | | | | | | | | Requires fix for <https://bugzilla.redhat.com/show_bug.cgi?id=1122110>, bump selinux-policy in the spec file. https://fedorahosted.org/freeipa/ticket/4005 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove internaldb password from password.confAna Krivokapic2014-09-091-0/+3
| | | | | | | | | Remove internaldb password from password.conf after switching over to client certificate authentication. The password is no longer needed. https://fedorahosted.org/freeipa/ticket/4005 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: notify psw change success only oncePetr Vobornik2014-09-081-2/+0
| | | | | | | | | | | Password change initiated from header menu notified success twice. First one in `dialogs.password.dialog` and second one in a success callback. The second notification was removed. Caused by: https://fedorahosted.org/freeipa/changeset/870db2f677dff01750aeec104c90fce3ca0e54be/ Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: switch associators if default doesn't workPetr Vobornik2014-09-081-0/+10
| | | | | | | | | | Make association auto-magic little bit less stupid. Now it supports adding of new attribute member with add_member and remove_member methods only on one side of the relationship. https://fedorahosted.org/freeipa/ticket/4507 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: do not show login error when switching back from otp sync screenPetr Vobornik2014-09-082-4/+24
| | | | | | | | Errors should reflect only a result of last operation. https://fedorahosted.org/freeipa/ticket/4470 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: adjust behavior of bounce urlPetr Vobornik2014-09-082-2/+46
| | | | | | | | | | | | | | | | | | | | | - bounce url param was renamed from 'redirect' to 'url' - support for 'delay' param added Behavior: - "Continue to next page" link is shown if 'url' is present - page is no longer automatically redirected if 'url' is present - automatic redirect is controlled by 'delay' param - it specifies number of seconds until redirection - info message 'You will be redirected in Xs' is show to notify the user that something will happen. It's useful even if delay is 0 or negative because redirection might be slow. - counter is decremented every second - delay is ignored if parsed as NaN https://fedorahosted.org/freeipa/ticket/4440 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* No longer generate a machine certificate on client installsRob Crittenden2014-09-051-66/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4449 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Backup CS.cfg before modifying itJan Cholasta2014-09-052-0/+22
| | | | | | https://fedorahosted.org/freeipa/ticket/4166 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix: Add managed read permissions for compat tree and operational attrsPetr Viktorin2014-09-056-10/+32
| | | | | | | | | | | This is a fix for an earlier version, which was committed by mistake as: master: 418ce870bfbe13cea694a7b862cafe35c703f660 ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17 ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7 Thanks to Alexander Bokovoy for contributions https://fedorahosted.org/freeipa/ticket/4521
* webui: extract complex pkey on Add and EditPetr Vobornik2014-09-051-3/+4
| | | | | | | | | | DNS zone 'Add and Edit' failed because of new DNS name encoding. This patch makes sure that keys are extracted properly. https://fedorahosted.org/freeipa/ticket/4520 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* Allow user to force Kerberos realm during installation.David Kupka2014-09-052-21/+33
| | | | | | | | | User can set realm not matching one resolved from DNS. This is useful especially when DNS is missconfigured. https://fedorahosted.org/freeipa/ticket/4444 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make CA-less ipa-server-install option --root-ca-file optional.Jan Cholasta2014-09-056-44/+59
| | | | | | | | | | | | | The CA cert specified by --root-ca-file option must always be the CA cert of the CA which issued the server certificates in the PKCS#12 files. As the cert is not actually user selectable, use CA cert from the PKCS#12 files by default if it is present. Document --root-ca-file in ipa-server-install man page. https://fedorahosted.org/freeipa/ticket/4457 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add managed read permissions for compat treePetr Viktorin2014-09-055-0/+49
| | | | | | https://fedorahosted.org/freeipa/ticket/4521 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Do not restart apache server when not necessary.David Kupka2014-09-051-1/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/4352 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Tests: DNS wildcard recordsMartin Basti2014-09-051-1/+46
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* FIX DNS wildcard records (RFC4592)Martin Basti2014-09-051-0/+22
| | | | | | | | | | Make validation more strict * DS, NS, DNAME owners should not be a wildcard domanin name * zone name should not be a wildcard domain name Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix DNS record rename testMartin Basti2014-09-051-15/+14
| | | | | | | | | | bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Test: DNS NS validationMartin Basti2014-09-051-16/+17
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* DNS fix NS record coexistence validatorMartin Basti2014-09-051-6/+17
| | | | | | | NS can coexistent only with A, AAAA, DS, NS record Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Tests: DNS dsrecord validationMartin Basti2014-09-051-0/+83
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* DNSSEC: fix DS record validationMartin Basti2014-09-051-36/+63
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Use certmonger D-Bus API instead of messing with its files.David Kupka2014-09-059-311/+297
| | | | | | | | | | | | FreeIPA certmonger module changed to use D-Bus to communicate with certmonger. Using the D-Bus API should be more stable and supported way of using cermonger than tampering with its files. >=certmonger-0.75.13 is needed for this to work. https://fedorahosted.org/freeipa/ticket/4280 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix dnsrecord-mod raise error if last record attr is removedMartin Basti2014-09-052-3/+10
| | | | | | Removing last record attribute causes output type validation error Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-client-install: Do not add already configured sources to nsswitch.conf ↵Tomas Babej2014-09-041-12/+18
| | | | | | | | | | | entries Makes sure that any new sources added are not already present in the entry. https://fedorahosted.org/freeipa/ticket/4508 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Normalize external CA cert before passing it to pkispawnJan Cholasta2014-09-041-2/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/4019 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add record(s) to /etc/host when IPA is configured as DNS server.David Kupka2014-09-031-1/+1
| | | | | | | | | | This is to avoid chicken-egg problem when directory server fails to start without resolvable hostname and named fails to provide hostname without directory server. https://fedorahosted.org/freeipa/ticket/4220 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Ensure ipaUserAuthTypeClass when needed on user creationNathaniel McCallum2014-09-031-13/+11
| | | | | | | | | Also, remove the attempt to load the objectClasses when absent. This never makes sense during an add operation. https://fedorahosted.org/freeipa/ticket/4455 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* permission plugin: Improve description of the target optionPetr Viktorin2014-09-031-1/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4521 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Make --target available in the CLIPetr Viktorin2014-09-031-1/+0
| | | | | | | This was left out by mistake when permissions were refactored. The API is already tested. https://fedorahosted.org/freeipa/ticket/4522
* freeipa.spec.in: Add python-backports-ssl_match_hostname to BuildRequiresPetr Viktorin2014-09-021-0/+1
| | | | | | | | | | This patch adds an explicit build dependency to python-backports-ssl_match_hostname. Without it, the build-time lint would fail. https://fedorahosted.org/freeipa/ticket/4515 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* CLIENT: Explicitly require python-backports-ssl_match_hostnameJakub Hrozek2014-09-021-0/+1
| | | | | | | | | | | | | | Without python-backports-ssl_match_hostname installed, an ipa-client installation could have failed with: from backports.ssl_match_hostname import match_hostname ImportError: No module named ssl_match_hostname This patch adds an explicit dependency to python-backports-ssl_match_hostname. https://fedorahosted.org/freeipa/ticket/4515 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow changing CA renewal master in ipa-csreplica-manage.Jan Cholasta2014-09-022-9/+33
| | | | | | https://fedorahosted.org/freeipa/ticket/4039 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* pwpolicy-add: Added better error handlingThorsten Scherf2014-09-021-1/+6
| | | | | | | | | Make error message more meaningful when a password policy is added for a non existing group. https://fedorahosted.org/freeipa/ticket/4334 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaserver/dcerpc.py: Make sure trust is established only to forest root domainAlexander Bokovoy2014-09-012-0/+22
| | | | | | Part of https://fedorahosted.org/freeipa/ticket/4463 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: be more open to what domains can be seen through the ↵Alexander Bokovoy2014-09-011-1/+1
| | | | | | | | forest trust https://fedorahosted.org/freeipa/ticket/4463 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: Avoid hitting issue with transitive trusts on Windows ↵Alexander Bokovoy2014-09-011-3/+10
| | | | | | | | Server prior to 2012 http://msdn.microsoft.com/en-us/library/2a769a08-e023-459f-aebe-4fb3f595c0b7#id83 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: make PDC discovery more robustAlexander Bokovoy2014-09-011-5/+16
| | | | | | | | | | Certain operations against AD domain controller can only be done if its FSMO role is primary domain controller. We need to use writable DC and PDC when creating trust and updating name suffix routing information. https://fedorahosted.org/freeipa/ticket/4479 Reviewed-By: Sumit Bose <sbose@redhat.com>
* ipaserver/dcerpc.py: if search of a closest GC failed, try to find any GCAlexander Bokovoy2014-09-011-1/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4458 Reviewed-By: Sumit Bose <sbose@redhat.com>
* User Life Cycle: DNA scopes full SUFFIXThierry bordaz (tbordaz)2014-09-011-3/+1
| | | | | | | | | | | In patch 0001-3, the DNA plugins configuration was changed to scope only 'cn=accounts,SUFFIX' This part of the fix was invalid as trust domain object (that need uid/gid allocation) are under 'cn=trust,SUFFIX'. Revert that part of the fix. Waiting on https://fedorahosted.org/389/ticket/47828, to exclude provisioning contains https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add man page for ipa-kra-installAde Lee2014-08-263-0/+58
| | | | | | https://fedorahosted.org/freeipa/ticket/4504 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa trust-add command should be interactiveGabe2014-08-251-1/+25
| | | | | | | | | - Make ipa trust-add command interactive for realm_admin and realm_passwd - Fix 'Active directory' typo to 'Active Directory' https://fedorahosted.org/freeipa/ticket/3034 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add a KRA to IPAAde Lee2014-08-2223-640/+1773
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the capability of installing a Dogtag KRA to an IPA instance. With this patch, a KRA is NOT configured by default when ipa-server-install is run. Rather, the command ipa-kra-install must be executed on an instance on which a Dogtag CA has already been configured. The KRA shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. To create a clone KRA, simply execute ipa-kra-install <replica_file> on a replica on which a Dogtag CA has already been replicated. ipa-kra-install will use the security domain to detect whether the system being installed is a replica, and will error out if a needed replica file is not provided. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to KRA and CA installs. This will become very useful when we add more PKI subsystems. The KRA will install its database as a subtree of o=ipaca, specifically o=ipakra,o=ipaca. This means that replication agreements created to replicate CA data will also replicate KRA data. No new replication agreements are required. Added dogtag plugin for KRA. This is an initial commit providing the basic vault functionality needed for vault. This plugin will likely be modified as we create the code to call some of these functions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3872 The uninstallation option in ipa-kra-install is temporarily disabled. Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: fix group type paddingPetr Vobornik2014-08-211-1/+1
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: disable batch action buttons by defaultPetr Vobornik2014-08-213-0/+6
| | | | | | | | | | action buttons associated with batch actions were enabled by default, but they were disabled right after facet creation and a load of data. It caused a visual flicker. UX is enhanced by making them disabled by default. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: sshkey widget - usability fixesPetr Vobornik2014-08-212-3/+19
| | | | | | | | - save one click by opening edit dialog right after adding new row - add margin between fingerprint and "show/edit" button - fix honoring of writable/read-only flags upon row creation Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: improve rule table cssPetr Vobornik2014-08-213-3/+14
| | | | | | | | | | | - category radio line has line-height large enough to contain undo button -> content doesn't move several pixels on change - remove vertical padding from btns in table headers to maintain about the same height - remove invisible border from link buttons to have the same height for disabled and enabled button Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: convert widget.less indentation to spacesPetr Vobornik2014-08-211-49/+49
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* service: Normalize service principal in get_dnPetr Viktorin2014-08-212-4/+9
| | | | | | This will make any lookup go through the normalization. Reviewed-By: Martin Kosek <mkosek@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-19 22:11:44 +0000