summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Unenroll the client from the IPA server on uninstall.Rob Crittenden2010-09-206-74/+358
| | | | | | | | | | | | | | | | | Unenrollment means that the host keytab is disabled on the server making it possible to re-install on the client. This host principal is how we distinguish an enrolled vs an unenrolled client machine on the server. I added a --unroll option to ipa-join that binds using the host credentials and disables its own keytab. I fixed a couple of other unrelated problems in ipa-join at the same time. I also documented all the possible return values of ipa-getkeytab and ipa-join. There is so much overlap because ipa-join calls ipa-getkeytab and it returns whatever value ipa-getkeytab returned on failure. ticket 242
* Better distinguish between when DNS discovery works and search more domains.Rob Crittenden2010-09-202-13/+66
| | | | | | | | | | | | | | | | | | | | | | Passing domain and server on the command-line used to be considered as DNS autodiscovery worked. This was problematic if there was in fact no SRV records because krb5.conf would be configured without a specific KDC causing all Kerberos ops to fail. Now if you pass in a domain/server it still tries to see if they are discoverable and if so won't hardcode a server, but will fall back to doing so if necessary. Also be a lot more aggressive on looking for the SRV records. Use the search and domain values from /etc/resolv.conf on the chance that the SRV records aren't in the domain of the hostname of the machine. An example of this would be if your laptop is in dhcp.example.com and your company's SRV records are in corp.example.com. Searching dhcp.example.com and example.com won't find the SRV records but the user is likely to have corp.redhat.com in the search list, at least. ticket 234
* Set ipaUniqueId to be unwritable and add to uniqueness configuration.Rob Crittenden2010-09-202-2/+20
| | | | | | We don't want admins messing with this value. ticket 231
* Add missing man pageas for ipa-dns-install and ipa-upgradeconfig.Rob Crittenden2010-09-202-0/+81
| | | | tickets 130 and 131
* links and facet iconsAdam Young2010-09-205-12/+34
| | | | Enables the icons in the links and in the facets lists
* placeholder iconsAdam Young2010-09-2022-0/+0
| | | | Place holder icons to show how things should be layed out. THese will be replaced by the real icons once we get them from UXD
* Restoring Services tab.Endi Sukma Dewata2010-09-174-96/+83
| | | | | | | | | | | | | The add.js has been modified to support adding new entry with dynamically generated pkey. The index.xhtml has been modified to include service.js. The service.js has been modified to use the new API to define the search, add, and details fields. Callbacks are used to add quick links and generate pkey dynamically. The webui.js has been modified to add the Services tab.
* Adding quick links in user and group search results.Endi Sukma Dewata2010-09-173-4/+104
| | | | | | | | The render_call() signature has been modified to pass the entry_attrs so each callback function can construct the appropriate quick links using any attributes from the search results. The callback function has been implemented for user and group entities.
* pointer cursor for facetsAdam Young2010-09-171-0/+1
|
* css cleanupAdam Young2010-09-171-20/+8
| | | | Site looks much better. It is not currently meeting the specs of UXD, but it is a t least presentable.
* unbroke the facets linkAdam Young2010-09-171-6/+5
|
* moved images upAdam Young2010-09-1718-47/+36
| | | | | Adding an images subdir was proliferating changes throught the build system this seemed easier
* css tabs and facetsAdam Young2010-09-175-31/+91
| | | | includes Makfile changes to get images to deploy
* themeAdam Young2010-09-1716-33/+33
| | | | Use customized theme and images that is closer to the UX suggested look and feel
* fix sampledataAdam Young2010-09-171-1/+1
| | | | URL needs to be relative, not absolute in order for in tree development
* fixed formatting of search tableAdam Young2010-09-171-25/+13
|
* remove pagaparamsAdam Young2010-09-171-1/+0
|
* Add jQuery UI and jQuery BBQ libraries to the project.Pavel Zuna2010-09-175-0/+1359
|
* Big webUI patch.Pavel Zuna2010-09-1722-2150/+1274
| | | | | | | | | | | | | Quick summary: - use jQuery UI and jQuery BBQ libraries - code restructuring The patch has so many changes they can't be listed here. Many parts of the code have been rewritten from scrach. See freeipa-devel mailing list: webUI code restructuring [wall of text, diagrams, ... you've been warned!] 2010-09-07
* Use a more specific name for the IPA server certificate we install.Rob Crittenden2010-09-171-9/+24
| | | | | | | This should avoid conflicts with any other certs that might be installed there. ticket 49
* Fix for include problems relating to NSS3, NSPR4 and SVRCORERob Crittenden2010-09-162-7/+26
| | | | | | | This addresses some problems trying to build on non-Fedora/RHEL distributions, notably Gentoo and Ubuntu/Debian. Patch contributed by Ian Kumlien <pomac@vapor.com>
* Have ipactl start named after the KDC, otherwise it will fail.Rob Crittenden2010-09-161-1/+1
|
* Add --no-host-dns argument to ipa-replica-installRob Crittenden2010-09-162-13/+19
| | | | | | | The server installer has this option, the replica installer should have it too. ticket 146
* Show all missing packages when setting up bind, not one at a time.Rob Crittenden2010-09-161-4/+8
| | | | | | | | We used to check for these one at a time so you'd run it once and find out you're missing the bind package. Install that and run the installer again and you'd discover you're missing bind-dyndb-ldap. ticket 140
* Enabling SUDO supportDmitri Pal2010-09-165-8/+70
| | | | | | | | | | | * Adding a new SUDO schema file * Adding this new file to the list of targets in make file * Create SUDO container for sudo rules * Add default sudo services to HBAC services * Add default SUDO HBAC service group with two services sudo & sudo-i * Installing schema No SUDO rules are created by default by this patch.
* user-find whoamiAdam Young2010-09-151-0/+13
| | | | | | Now no longer breaks user-find with a filter Uses the corrected Params for getting option printf style strings
* Revert "user whoami"Adam Young2010-09-141-11/+0
| | | | This reverts commit bef0690a2ff9cccf7de132e5e64b4ba631482764.
* user whoamiAdam Young2010-09-141-0/+11
| | | | Added a whoami option to the user, allows the user to query their own information based on their Kerberos principal
* Remove some additional instances of krbV from ipa-clientRob Crittenden2010-09-103-9/+16
| | | | | | | | | | | Make two krbV imports conditional. These aren't used during a client install so should cause no problems. Also fix the client installer to use the new env option in ipautil.run. We weren't getting the krb5 configuration set in the environment because we were overriding the environment to set the PATH. ticket 136
* Clean up the spec file, add Requires for nss-pam-ldapd for F14+Rob Crittenden2010-09-101-14/+17
| | | | | | | | Also do the following: - Remove conflicts on mod_ssl - Remove a lot of version checking for EOL'd Fedora versions - Add a few conditionals for rhel6 - Add Requires of nss-tools on ipa-client
* Fix the ipa-ldap-updater tests.Rob Crittenden2010-09-101-2/+1
| | | | | | We dropped the schema for ipaContainer so use nsContainer instead. ticket 121
* Splitting service principal into service name and hostname.Endi DeWata2010-09-105-89/+92
| | | | | | | | | | | | | | | | | | The EntityBuilder has been modified to obtain the pkey value by invoking getPKey(). This function can be overriden for different entities. The addOptionsFunction() has been renamed to getOptions() and it can be overriden for different entities. Each entity that uses this function has been modified accordingly. The addEdit(), addAnother(), add_fail() has been moved into the EntityBuilder class. The global builders is no longer needed because a reference to the builder object can be obtained via enclosure. The ServiceForms has been modified to take service name and hostname and combine them to generate the service principal by overriding the getPKey().
* Fix certmonger errors when doing a client or server uninstall.Rob Crittenden2010-09-096-28/+131
| | | | | | | | | | | | | | | | This started with the client uninstaller returning a 1 when not installed. There was no way to tell whether the uninstall failed or the client simply wasn't installed which caused no end of grief with the installer. This led to a lot of certmonger failures too, either trying to stop tracking a non-existent cert or not handling an existing tracked certificate. I moved the certmonger code out of the installer and put it into the client/server shared ipapython lib. It now tries a lot harder and smarter to untrack a certificate. ticket 142
* Have certmonger track the initial Apache and 389-ds server certs.Rob Crittenden2010-09-097-19/+254
| | | | | | | | | | | | | | | We don't use certmonger to get certificates during installation because of the chicken-and-egg problem. This means that the IPA web and ldap certs aren't being tracked for renewal. This requires some manual changes to the certmonger request files once tracking has begun because it doesn't store a subject or principal template when a cert is added via start-tracking. This also required some changes to the cert command plugin to allow a host to execute calls against its own service certs. ticket 67
* Netgroup associationsAdam Young2010-09-096-35/+156
| | | | | | | netgroup->user,group,host,hostgroup -- Added facets to netgroup -- added links into lists for associations
* Allow the schema to be set once an ldap connection is locked.Rob Crittenden2010-09-091-1/+3
| | | | | | | | | | | | When making LDAP calls via api.Backend.ldap2 the ldap2 object will already be locked by the api.finalize() call. So the first time that api.Backend.ldap2.connect() is called an error would be thrown that self.schema cannot be set because the object is ReadOnly. This uses the documented procedure for working around this lock. This was preventing the DNS installation to proceed. ticket #188
* ServicesEndi DeWata2010-09-0811-3/+255
| | | | | adds the Service tab: search, details, add, associations It also contains the sample data for some service operations
* Make ipactl a lot smarter and have it manage named as well.Rob Crittenden2010-09-071-26/+71
| | | | ticket 138
* Make ldap2 class work as a client library as well.Rob Crittenden2010-09-072-37/+49
| | | | | | | | | | | | | | | | | | Move the user-private group caching code out of the global config and determine the value the first time it is needed. Renamed global_init() back to get_schema() and make it take an optional connection. This solves the problem of being able to do all operations with a simple bind instead of GSSAPI. Moved the global get_syntax() into a class method so that a schema can be passed in. If a schema wasn't loaded during the module import then it is loaded when the connection is created (so we have the credntials needed for binding). ticket 63
* local param for this in closureAdam Young2010-09-071-2/+2
|
* associationsAdam Young2010-09-0730-559/+1011
| | | | | | | | | | | | | -Refactored the associations code into a set of objects that are configured by the entities -Added support for associations that can be done in a single rpc -hostgroup to host and group to user associations working -Restructed sampledata so that the file is matched automatically by the RPC method name -The new ipa_cmd/sampledata scheme insists on there being sample data for any commands or the ipa_command fails. -Added sampledata files for all the calls we make -renamed several of the sampledata files to match their rpc calls -Started a pattern of refactoring where all the forms for the entity fall under a single object
* ipautil Syntax error in commentNalin Dahyabhai2010-09-011-1/+1
|
* Changes to fix compatibility with Fedora 14Rob Crittenden2010-08-315-12/+30
| | | | | | | | | | | | Fedora 14 introduced the following incompatiblities: - the kerberos binaries moved from /usr/kerberos/[s]/bin to /usr/[s]bin - the xmlrpclib in Python 2.7 is not fully backwards compatible to 2.6 Also, when moving the installed host service principals: - don't assume that krbticketflags is set - allow multiple values for krbextradata ticket 155
* Remove passwords when running commands including stdout and stderrRob Crittenden2010-08-312-28/+16
| | | | | | | | | | | This replaces the old no logging mechanism that only handled not logging passwords passed on the command-line. The dogtag installer was including passwords in the output. This also adds no password logging to the sslget invocations and removes a couple of extraneous log commands. ticket 156
* Merge branch 'master' of ssh://rcritten@git.fedorahosted.org/git/freeipaRob Crittenden2010-08-313-12/+2
|\
| * calculate useSampledata by protocol.Adam Young2010-08-303-12/+2
| |
* | Merge branch 'master' of ssh://rcritten@git.fedorahosted.org/git/freeipaRob Crittenden2010-08-301-1/+1
|\|
| * quote obj param for groupAdam Young2010-08-301-1/+1
| | | | | | | | Correction for previous comit. 'group' not group.
| * Fix EnrollAdam Young2010-08-301-1/+1
| | | | | | | | Enroll was broken due to the missing obj.
* | Add some basic rules for adding new schemaRob Crittenden2010-08-271-0/+15
|/
generated by cgit (git 2.34.1) at 2024-06-10 14:43:40 +0000