summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Giant webui patch take 2Jason Gerard DeRose2009-10-1330-4302/+956
|
* Add man page for ipa-join commandRob Crittenden2009-10-123-1/+63
|
* Use nestedgroup instead of groupofnames for rolegroups so we have memberofRob Crittenden2009-10-121-50/+50
|
* No longer use the IPA-specific memberof plugin. Use the DS-supplied one.Rob Crittenden2009-10-124-3/+6
|
* Improve debugging, general output, initialize xmlrpc-c properlyRob Crittenden2009-10-121-9/+34
|
* Fix bug in HBAC and netgroup plugin get_primary_key_from_dn methods.Pavel Zuna2009-10-082-2/+8
|
* Fix bug in group plugin. Was using wrong variable for attributes.Pavel Zuna2009-10-081-1/+1
| | | | Fix bug #527537.
* Fix unit tests for plugins using baseldap classes.Pavel Zuna2009-10-071-3/+1
|
* Make the taskgroup plugin use baseldap classes.Pavel Zuna2009-10-071-135/+40
|
* Make the rolegroup plugin use baseldap classes.Pavel Zuna2009-10-051-46/+41
|
* Make the hostgroup plugin use baseldap classes.Pavel Zuna2009-10-051-173/+45
|
* Make the netgroup plugin use baseldap classes.Pavel Zuna2009-10-051-309/+116
|
* Make the user plugin use baseldap classes.Pavel Zuna2009-10-051-230/+76
|
* Make the service plugin use baseldap classes.Pavel Zuna2009-10-051-205/+66
|
* Fix unit tests for plugins using baseldap classes.Pavel Zuna2009-10-0511-277/+231
|
* Make the group plugin use baseldap classes.Pavel Zuna2009-10-051-124/+65
|
* Make the config plugin use baseldap classes.Pavel Zuna2009-10-051-103/+33
|
* Add HBAC plugin and introduce GeneralizedTime parameter type.Pavel Zuna2009-10-055-1/+738
|
* Add support for per-group kerberos password policy.Rob Crittenden2009-10-054-20/+437
| | | | | | | | | | Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
* Make primary_key optional.Rob Crittenden2009-10-051-2/+4
| | | | | The pwpolicy plugin doesn't have a primary key but can still take advantage of other parts of the framework.
* Loosen the ACI for the KDC to allow adds/deletesRob Crittenden2009-10-051-3/+1
| | | | | | | | Password policy entries must be a child of the entry protected by this ACI. Also change the format of this because in DS it was stored as: \n(target)\n so was base64-encoded when it was retrieved.
* Robustness fix for updater, in case updates['updates'] is not set yet.Rob Crittenden2009-10-051-1/+1
|
* Let the updater delete entries and add small test harnessRob Crittenden2009-10-0513-7/+322
| | | | | | | | In order to run the tests you must put your DM password into ~/.ipa/.dmpw Some tests are expected to generate errors. Don't let any ERROR messages from the updater fool you, watch the pass/fail of the nosetests.
* Add option to not normalize a DN when adding/updating a record.Rob Crittenden2009-10-051-4/+6
| | | | | The KDC ldap plugin is very picky about the format of DNs. It does not allow spacing between elements so we can't normalize it.
* Fix aci plugin, enhance aci parsing capabilities, add user group supportRob Crittenden2009-09-283-34/+138
| | | | | | | | | | | | - The aci plugin didn't quite work with the new ldap2 backend. - We already walk through the target part of the ACI syntax so skip that in the regex altogether. This now lets us handle all current ACIs in IPA (some used to be ignored/skipped) - Add support for user groups so one can do v1-style delegation (group A can write attributes x,y,z in group B). It is actually quite a lot more flexible than that but you get the idea) - Improve error messages in the aci library - Add a bit of documentation to the aci plugin
* Only initialize the API once in the installerRob Crittenden2009-09-284-35/+36
| | | | | | Make the ldap2 plugin schema loader ignore SERVER_DOWN errors 525303
* Properly own (via ghost) the Apache configuration files.Rob Crittenden2009-09-281-2/+6
|
* Fix Python 2.6 deprecation warning with the md5 import. Use hashlib instead.Rob Crittenden2009-09-281-2/+5
|
* Make the host plugin use baseldap classes.Pavel Zuna2009-09-281-252/+90
|
* Added BuildRequires: xmlrpc-c-develJason Gerard DeRose2009-09-241-0/+1
|
* Enrollment for a host in an IPA domainRob Crittenden2009-09-2419-81/+1577
| | | | | | | | | | | | This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
* Use the same variable name in the response as the dogtag pluginRob Crittenden2009-09-241-1/+1
|
* Better upgrade detection so we don't print spurious errorsRob Crittenden2009-09-151-17/+42
| | | | | | Also add copyright 519414
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-1514-222/+833
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Explicitly set verbosity off in the XML-RPC clientRob Crittenden2009-09-141-0/+1
| | | | | This is so I don't have to hunt for where to set this to True when doing low-level client debugging.
* Raise more specific error when an Objectclass Violation occurs Fix the ↵Rob Crittenden2009-09-143-3/+20
| | | | virtual plugin to work with the new backend
* Remove deprecated comment on plugin naming conventionsRob Crittenden2009-09-141-3/+0
|
* Fix typos and minor bugs in baseldap. Add --all to LDAPUpdate.Pavel Zuna2009-09-111-6/+17
| | | | | | | Also, member attributes are now mapped to 'member user', 'member group', etc. instead of 'member users', 'member groups'. In other words, the second word is now taken from LDAPObject.object_name instead of LDAPObject.object_name_plural.
* Fix incorrect imports in ipa-server-certinstall.Pavel Zuna2009-09-111-1/+3
|
* Many SELinux fixes: ldapi, ctypes and dogtagRob Crittenden2009-09-103-17/+18
| | | | | | | | | | | ldapi: grants httpd and krb5kdc to access the DS ldapi socket ctypes: the Python uuid module includes ctypes which makes httpd segfault due to SELinux problems. dogtag: remove the CRL publishing permissions. This only worked if you had dogtag installed. In the near future will publish elsewhere so for the time being CRL file publishing will be broken with SELinux enabled.
* Allow httpd to read unix sockets so it can communicate to DS over ldapiRob Crittenden2009-09-101-0/+6
|
* Automatically generate an auto.master map for new automount location.Pavel Zuna2009-09-101-0/+12
| | | | Also, add the automountlocation-show command for completeness sake.
* Remove parent_key parameter kwarg.Pavel Zuna2009-09-101-7/+4
| | | | Also replace a TYPE_ERROR with ValidationError.
* Add support for different automount maps per location.Pavel Zuna2009-09-101-91/+139
|
* Ensure that dnaMaxValue is higher than dnaNextValue at install timeRob Crittenden2009-09-091-2/+2
| | | | Resolves 522179
* Fix: Object.params_minus_pk was invalid when there was no primary_key.Pavel Zuna2009-09-091-0/+2
|
* Improve ipalib.plugins.baseldap classes.Pavel Zuna2009-09-091-97/+72
| | | | | | | | | | - remove obsolete code related to PluginProxy - remove parent_key attribute, for the purpose of nested objects the parent's primary key is retrieved automatically - added support for auto-generating of UUIDs - make use of the improved attribute printing in CLI - make LDAPDelete delete all sub-entries, not just one-level - minor bug fixes
* Add forgotten chunks from commit 4e5a68397a102f0beMartin Nagy2009-09-082-3/+31
| | | | | I accidentally pushed the older patch that didn't contain bits for ipa-replica-install.
* Remove obsolete CRUD base classes as they aren't used anymore.Pavel Zuna2009-09-081-48/+0
|
* Improve attribute printing in the CLI.Pavel Zuna2009-09-081-5/+28
| | | | | - allow choice between single/multiple value per line - word wrapping
generated by cgit (git 2.34.1) at 2024-05-10 21:55:49 +0000