| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
| |
ticket 1147
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1514
|
|
|
|
|
|
|
| |
It won't appear in the UI/CLI but is still available via XML-RPC.
allow is the default and deny will be rejected.
https://fedorahosted.org/freeipa/ticket/1495
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The pairwise grouping used to form RDN's and AVA's proved to be
confusing in practice, this patch removes that functionality thus
requiring programmers to explicitly pair attr,value using a tuple or
list.
In addition it was discovered additional functionality was needed to
support some DN operations in freeipa. DN objects now support
startswith(), endswith() and the "in" membership test. These functions
and operators will accept either a DN or RDN.
The unittest was modified to remove the pairwise tests and add new
explicit tests. The unittest was augmented to test the new
functionality. In addition the unittest was cleaned up a bit to use
common utilty functions for improved readabilty and robustness.
The documentation was updated.
fix test_role_plugin use of DN to avoid pairwise grouping
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1509
https://fedorahosted.org/freeipa/ticket/1510
|
|
|
|
|
|
|
| |
The code for supporting custom layouts using HTML templates has been
removed. If it's needed again in the future the code can be restored.
Ticket #1501
|
|
|
|
|
|
|
|
| |
The HBAC access time is currently not supported, so the related UI
code has been removed to reduce maintenance issue. When the feature
becomes supported in the future the code may be restored/rewritten.
Ticket #546
|
|
|
|
|
|
|
|
| |
In a recent change the details page was changed to create and locate
field containers with 'details-field' CSS class. The HBAC and sudo
custom details pages have been modified to use the same CSS class.
Ticket #1508
|
|
|
|
|
|
|
|
|
| |
The UUID field has been removed from the entitlement registration
dialog box because it's currently not supported. The code has been
modified not to send empty UUID value should this become supported
in the future.
Ticket #1506
|
|
|
|
|
|
|
|
|
|
| |
A custom adder dialog has been added for DNS zones to simplify creating
reverse zones from IP address. The dialog provides a checkbox which
indicates whether the content of the zone name field is an IP address.
The IP address will be used to generate the reverse zone name and email
address.
Ticket #1045
|
|
|
|
|
|
|
| |
A custom deleter dialog for hosts has been added to provide an option
whether to remove the hosts from DNS.
Ticket #1470
|
|
|
|
|
|
|
|
|
| |
Remove all DNS entities if the DNS server is not installed.
Removes it from the navigation as well.
https://fedorahosted.org/freeipa/ticket/1498
move created count to last thing in the funciton.
|
|
|
|
| |
This fixes an indentation problem.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
* Check remote LDAP server to see if it is a V2 server
* Replace numeric return values with alphanumeric constants
* Display the error message from the ipa-enrollment extended op
* Remove generic join failed error message when XML-RPC fails
* Don't display Certificate subject base when enrollment fails
* Return proper error message when LDAP bind fails
https://fedorahosted.org/freeipa/ticket/1417
|
|
|
|
|
|
|
| |
Allow a long to get as far as the min/max constraints where we can
compare it to min/max int values and reject with a proper error message.
https://fedorahosted.org/freeipa/ticket/1494
|
|
|
|
|
| |
The unit tests were incorrectly expecting the removed data back when
removing external users.
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1309
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1309
|
|
|
|
|
| |
The members should be the current members of the entry, not the refreshed
copy
|
|
|
|
|
|
|
|
|
| |
Fixes https://fedorahosted.org/freeipa/ticket/1476
SSSD will need TLS for checking if ipaMigrationEnabled attribute is set
Note that SSSD will force StartTLS because the channel is later used for
authentication as well if password migration is enabled. Thus set the option
unconditionally.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have no visibility into whether an entry has a keytab or not so
krbLastPwdChange is used as a rough guide.
If this value exists during enrollment then it fails because the host
is considered already joined. This was getting set when a OTP was
added to a host that had already been enrolled (e.g. you enroll a host,
unenroll it, set a OTP, then try to re-enroll). The second enrollment
was failing because the enrollment plugin thought it was still
enrolled becaused krbLastPwdChange was set.
https://fedorahosted.org/freeipa/ticket/1357
|
|
|
|
|
|
| |
This is just a display problem, the host is actually removed from the entry.
https://fedorahosted.org/freeipa/ticket/1492
|
|
|
|
|
|
|
| |
Removed sudorule "External User" is displayed in the output when
"--all" switch is used.
https://fedorahosted.org/freeipa/ticket/1489
|
|
|
|
| |
ticket 1469
|
|
|
|
|
|
|
|
|
|
|
| |
Add a new command that lets you wait for an attribute to appear in
a value. Using this you can do things like wait for a managed entry
to be created, adding a new objectclass to the parent entry.
This is controlled by a new booleon option, wait_for_attr, defaulting
to False.
https://fedorahosted.org/freeipa/ticket/1144
|
|
|
|
|
|
| |
Fixes ipa-dns-install incorrect warning.
ticket 1486
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1472
|
|
|
|
| |
ticket https://fedorahosted.org/freeipa/ticket/1449
|
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1373
When SSSD is in use, we actually trying to disable NSCD daemon. Telling
that we failed to configure automatic _startup_ of the NSCD is wrong then.
|
|
|
|
|
|
|
|
|
| |
If you used sudorule-remove-runasgroup to remove a member that member
still appeared in the command output when --all was included (it isn't a
default attribute). This was due to post-processing to evaluate external
users/groups, the entry was actually updated properly.
https://fedorahosted.org/freeipa/ticket/1348
|
|
|
|
| |
ticket https://fedorahosted.org/freeipa/ticket/1155
|
|
|
|
|
|
|
| |
The host details facet has been fixed to remove a redundant field
and include some missing fields.
Ticket #1484
|
|
|
|
|
|
|
| |
The host adder dialog has been modified to specify the new flag
for retrieving the forward zones only.
Ticket #1458
|
|
|
|
|
|
|
|
| |
The IPA.entity_select_widget has been modified into a searchable and
editable drop down list. The base functionality has been extracted
into IPA.combobox_widget.
Ticket #1361
|
|
|
|
| |
ticket 1288
|
|
|
|
|
|
|
|
|
|
|
| |
If the password passed in when creating a NSS certificate database is None
then a random password is generated. If it is empty ('') then an empty
password is set.
Because of this the HTTP instance on replicas were created with an empty
password.
https://fedorahosted.org/freeipa/ticket/1407
|
|
|
|
|
|
|
|
| |
The default precedence for plugins is 50 and the run in more or less
alphabetical order (but not guaranteed). This plugin needs to run after
the others have already done their work.
https://fedorahosted.org/freeipa/ticket/1370
|
|
|
|
|
|
|
|
|
|
| |
The old nickname was 'RA Subsystem' and this may confuse some users
with the dogtag RA subsystem which we do not use.
This will only affect new installs. Existing installations will
continue to work fine.
https://fedorahosted.org/freeipa/ticket/1236
|
|
|
|
|
| |
Some object names had spaces in them which was bad, update the tests
to reflect the new names.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
For the most part the existing replication code worked with the
following exceptions:
- Added more port options
- It assumed that initial connections were done to an SSL port. Added
ability to use startTLS
- It assumed that the name of the agreement was the same on both sides.
In dogtag one is marked as master and one as clone. A new option is
added, master, the determines which side we're working on or None
if it isn't a dogtag agreement.
- Don't set the attribute exclude list on dogtag agreements
- dogtag doesn't set a schedule by default (which is actually recommended
by 389-ds). This causes problems when doing a force-sync though so
if one is done we set a schedule to run all the time. Otherwise the
temporary schedule can't be removed (LDAP operations error).
https://fedorahosted.org/freeipa/ticket/1250
|
|
|
|
|
|
|
|
|
|
|
| |
There were a few places in the code where certs were loaded from a
PKCS#7 file or a chain in a PEM file. The certificates got very
generic nicknames.
We can instead pull the subject from the certificate and use that as
the nickname.
https://fedorahosted.org/freeipa/ticket/1141
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1176
|
|
|
|
|
|
|
|
|
| |
Passing a number of "long" type to IPA Int parameter invokes
user-unfriendly error message about incompatible types. This patch
improves Int parameter with user understandable message along with
maximum value he can pass.
https://fedorahosted.org/freeipa/ticket/1346
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1327
https://fedorahosted.org/freeipa/ticket/1347
|
|
|
|
|
|
|
|
| |
Implement a test for new dnszone-find option --forward-only.
Fix example for reverse zone (zone was not fully qualified and
DNS plugin would forbid adding PTR records).
https://fedorahosted.org/freeipa/ticket/1473
|
|
|
|
|
|
|
|
|
| |
Install tools may fail with unexpected error when IPA server is not
installed on a system. Improve user experience by implementing
a check to affected tools.
https://fedorahosted.org/freeipa/ticket/1327
https://fedorahosted.org/freeipa/ticket/1347
|
|
|
|
| |
ticket 1247
|
|
|
|
|
|
|
| |
In order for this to work, chaining of parameters through
default_from is made possible.
ticket 1474
|