| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/543
|
|
|
|
| |
no longer calling them role groups.
|
|
|
|
|
|
|
| |
Override forward() to grab the result and if a certificate is in the entry
and the file is writable then dump the certificate in PEM format.
ticket 473
|
|
|
|
|
|
|
|
|
| |
permissions are a real group pointed to by an aci, managed by the same
plugin. Any given update can update one or both or neither. Do a better
job at determining what it is that needs to be updated and handle the
case where only the ACI is updated so that EmptyModList is not thrown.
ticket 603
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The Managed Entries plugin will allow a user to be added even if a group
of the same name exists. This would leave the user without a private
group.
We need to check for both the user and the group so we can do 1 of 3 things:
- throw an error that the group exists (but not the user)
- throw an error that the user exists (and the group)
- allow the uesr to be added
ticket 567
|
| |
|
|
|
|
| |
ticket 579
|
|
|
|
|
|
|
| |
If the ticket is expired or otherwise unusable it should fall back to the DM
password. It was prompted for correctly but wasn't being passed on.
ticket 549
|
| |
|
|
|
|
| |
Fixes: https://fedorahosted.org/freeipa/ticket/613
|
|
|
|
|
|
|
| |
The CA is installed before DS so we need to wait until DS is actually installed
to be able to ldap_enable the CA instance.
Fixes: https://fedorahosted.org/freeipa/ticket/612
|
|
|
|
|
|
|
| |
This patch catches NotFound exception and calls handling function
which then sends exception with unified error message.
https://fedorahosted.org/freeipa/ticket/487
|
|
|
|
|
|
|
|
|
|
|
|
| |
The problem was that the normalizer was returning each value as a tuple
which we were then appending to a list, so it looked like
[(u'value1',), (u'value2',),...]. If there was a single value we could
end up adding a tuple to a list which would fail. Additionally python-ldap
doesn't like lists of lists so it was failing later in the process as well.
I've added some simple tests for setattr and addattr.
ticket 565
|
|
|
|
|
|
|
| |
Make the cert subject base read-only. This is here only so replicated servers
know their base.
ticket 466
|
|
|
|
|
|
|
|
| |
This allows us to have the CA ready to serve out certs for any operation even
before the dsinstance is created. The CA is independent of the dsinstance
anyway.
Also fixes: https://fedorahosted.org/freeipa/ticket/544
|
|
|
|
|
|
|
|
|
|
|
| |
This replace the former ipactl script, as well as replace the current way ipa
components are started.
Instead of enabling each service in the system init scripts, enable only the
ipa script, and then let it start all components based on the configuration
read from the LDAP tree.
resolves: https://fedorahosted.org/freeipa/ticket/294
|
|
|
|
|
| |
This is so that master and replica creation can perform different operations as
they need slightly diffeent settings to be applied.
|
|
|
|
|
|
| |
replaced expand contract +- with icons
removed background for action buttons and gave them their own class
Major css cleanup
|
|
|
|
|
|
|
|
|
| |
The '+' and '-' signs before the section headers in details facet
are now enclosed in square brackets. The section content is now
hidden/shown using slideToggle().
The ipa_details_create() and ipa_details_setup() have been moved
into ipa_details_facet.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The SUDO rule details facet has been updated to support the latest UI
spec. The facet consists of 5 sections: general, users, hosts, commands,
and run-as.
The general section contains the SUDO rule description and status. If
the status is changed, the sudorule-enable/disable will be invoked.
The other sections contain radio buttons for the association category
and tables for the members. When a member is added or removed, the
category will be adjusted appropriately. If the category is changed to
'all', 'allow', or 'deny', all members will be removed.
The last section is currently not working because backend support is
not yet available.
The adder dialog boxes for users, groups, and hosts has been modified
to accept external identities. The layout for the base adder dialog
was updated. The base dialog class was updated to support templates.
The SUDO dialog boxes were implemented using templates. New CSS
classes were added to ipa.css.
The HBAC rule details facet has been updated as well.
|
|
|
|
| |
ticket 604
|
|
|
|
| |
ticket 539
|
|
|
|
|
|
|
| |
Also move down some dsinstance related operation close to other dsinstance
operations.
Fixes: https://fedorahosted.org/freeipa/ticket/595
|
| |
|
| |
|
|
|
|
| |
URL was always ipa/json. This means nothing to the end user.
|
|
|
|
|
| |
Search filters generated from attributes with multiple values
were incorrect when the NOT operator was used (ldap.MATCH_NONE).
|
|
|
|
|
|
|
|
|
| |
This is just a thin wrapper around the aci plugin, controlling what
types of ACIs can be added.
Right now only ACIs in the basedn can be managed with this plugin.
ticket 531
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/570 This patch Addresses items: 1. The UI needs a rule status with values active & inactive. The CLI doesn't have this attribute. HBAC has ipaenabledflag attribute which can be managed using hbac-enable/disable operations. 2. The UI needs a user category for the "Who" section. The CLI doesn't have this attribute. HBAC has usercategory attribute which can be managed using hbac-add/mod operations. 3. The UI needs a host category for the "Access this host" section. The CLI doesn't have this attribute. HBAC has hostcategory attribute which can be managed using hbac-add/mod operations.
|
|
|
|
|
|
| |
Also add fixes for ipa-replica-install as that had issues too.
Fixes: https://fedorahosted.org/freeipa/ticket/527
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The entity.default_facet has been removed, instead the first facet
registered to the entity will be considered as the default facet.
So, the 'setup' parameter has been removed from tab definitions
because it's no longer necessary. The ipa_details_only_setup() has
been removed as well.
An 'entity' parameter has been added to tab definitions to specify
which entity corresponds to a tab item. The tab label has been
changed to use entity label if available.
Some hard-coded labels have been removed. The unit tests have been
updated.
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/580
|
|
|
|
| |
Ticket #573
|
|
|
|
| |
ticket 496
|
|
|
|
| |
more general, so that we don't have to hard code for SUDO and HBAC, and now to support ACI
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/455
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds new options to the migration plugin:
* the option to fine-tune the objectclass of users or groups being imported
* the option to select the LDAP schema (RFC2307 or RFC2307bis)
Also makes the logic that decides whether an entry is a nested group or user
(for RFC2307bis) smarter by looking at the DNS. Does not hardcode primary keys
for migrated entries.
https://fedorahosted.org/freeipa/ticket/429
|
|
|
|
|
|
|
| |
Instead of allocating a completely random start between 1M and 2G and a range
of 1M values, give 10000 possible 200k ranges. They all start at a 200k
boundary so they generate more readable IDs, at least until there arent't too
many users/replicas involved.
|
|
|
|
|
|
|
|
|
|
| |
The ipa_add_dialog has been fixed to initialize the fields which
will get the labels from metadata. Hard-coded labels have been
removed from field declarations.
The superior() method has been removed because it doesn't work with
multi-level inheritance. Superclass method for now is called using
<class name>_<method> (e.g. widget_init).
|
|
|
|
|
| |
The association facet for SUDO Command Groups has been removed and
replaced with an association table in the details page.
|
|
|
|
|
|
|
|
|
|
| |
The ipa_column has been modified to get the label from metadata
during initialization. The ipa_table_widget has been modified to
initialize the columns. Hard-coded labels have been removed from
column declarations.
The ipa_adder_dialog has been modified to execute a search at the
end of setup.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The association facet for HBAC Service Groups has been removed
and replaced with an association table in the details page.
The ipa_association_table_widget has been modified to support
multiple columns in the table itself and in the adder dialog.
The ipa_association_adder_dialog and ipa_association_facet have
been refactored.
The ipa_sudorule_association_widget and ipa_rule_association_widget
has been removed because their functionalities have been merged into
ipa_association_table_widget.
|
|
|
|
|
|
|
|
|
|
|
| |
Updated the user,group,host, hostgroup, netgroup, service, and all policy
entities to use the newer framework functions, in order to
replaced the old array style definitions which did not support i18n.
update a few of the newer framerwork functions to get the lables from the
meta data.
Fixed the unit tests which were expecting a details facet for users,
no longer automatically created
|
| |
|
|
|
|
| |
ticket 310
|
|
|
|
|
|
|
|
|
|
|
| |
This fixes search where we were asking for the member attribute 10 or more
times.
When retrieving indirect members make sure we always pass around the
size and time limits so we don't have to look it up with every call to
find_entries()
ticket 557
|
|
|
|
| |
ticket 545
|
|
|
|
|
|
|
|
| |
When setting default group, we should check if the group exists.
If not, it could lead to some issues with adding new users after
the new default group is set.
https://fedorahosted.org/freeipa/ticket/504
|
|
|
|
|
|
|
|
|
| |
After calling ipa config --defaultgroup=xxx with nonexistent group xxx,
the result will be that no new user can be added. The operation will
always fail in the middle because it is not possible to add the new user
to desired default group.
https://bugzilla.redhat.com/show_bug.cgi?id=654117#c4
|