summaryrefslogtreecommitdiffstats
path: root/freeipa.spec.in
Commit message (Collapse)AuthorAgeFilesLines
* WIP: add range check pluginSumit Bose2012-06-261-0/+2
|
* Add sidgen postop and taskSumit Bose2012-06-261-0/+4
| | | | | | | | A postop plugin is added to create the SID for new created users and groups. A directory server task allows to set the SID for existing users and groups. Fixes https://fedorahosted.org/freeipa/ticket/2825
* Add external domain extop DS pluginSumit Bose2012-06-261-0/+7
| | | | | | This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
* Add logging to ipa-upgradeconfigRob Crittenden2012-06-211-1/+1
| | | | | | | | | Log to the same file as ipa-ldap-updater --upgrade, /var/log/ipaupgrade.log Will output basic stauts information if executed from the command-line. https://fedorahosted.org/freeipa/ticket/2696
* Separate reset password pagePetr Vobornik2012-06-211-0/+4
| | | | | | This patch adds separate reset password page. It is a complement to separate login page. It differentiate from reset password capabilities in Web UI's anauthorized dialog by not performing login. This is useful for users who wants only to reset the password and not to use Web UI. And also for users who are using the separate login page. https://fedorahosted.org/freeipa/ticket/2755
* Case sensitive renaming of objectsOndrej Hamada2012-06-201-1/+9
| | | | | | | | When renaming object its case sensitivity is obeyed. This was DS bug. Unit tests were corrected and minimal DS version was updated in spec file. https://fedorahosted.org/freeipa/ticket/2620
* Store session cookie in ccache for cli usersRob Crittenden2012-06-141-0/+1
| | | | | | | | | Try to use the URI /ipa/session/xml if there is a key in the kernel keyring. If there is no cookie or it turns out to be invalid (expired, whatever) then use the standard URI /ipa/xml. This in turn will create a session that the user can then use later. https://fedorahosted.org/freeipa/ticket/2331
* Move AD trust support code to freeipa-server-trust-ad subpackageAlexander Bokovoy2012-06-131-5/+14
| | | | | | | | | | | DCERPC code in AD trusts implementation depends on Samba 4 Python bindings. Make this dependency optional for main freeipa-server package by moving the dependency to freeipa-server-trust-ad subpackage. Main interface to AD trusts (ipalib/plugins/trust.py) will still stay, as well as LDIF files and updates as they are not causing real dependency. https://fedorahosted.org/freeipa/ticket/2821
* Enable persistent search by defaultMartin Kosek2012-06-101-1/+3
| | | | | | | | | | | From IPA version 3.0, the persistent search is a preferred mechanism to for DNS zone list management. It will be also a requirement for several bind-dyndb-ldap features, like SOA serial automatic updates or DNSSEC. Make this mechanism default in ipa-server-install and ipa-dns-istall. https://fedorahosted.org/freeipa/ticket/2524
* Add sysupgrade state fileMartin Kosek2012-06-101-0/+5
| | | | | | | | | | | | | When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
* Add samba4-python to BuildRequiresPetr Viktorin2012-06-071-1/+2
|
* Add python-crypto to build requires for AD server-side codeAlexander Bokovoy2012-06-071-0/+4
|
* Add trust management for Active Directory trustsAlexander Bokovoy2012-06-071-1/+20
|
* Replace DNS client based on acutil with python-dnsMartin Kosek2012-05-241-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
* Configure certmonger to execute restart scripts on renewal.Rob Crittenden2012-04-101-2/+9
| | | | | | | | certmonger now has the ability to execute a script when it renews a certificate. This can be used to automatically restart servers so the certificate doesn't expire in the running server. https://fedorahosted.org/freeipa/ticket/2050
* Return consistent value when hostcat and usercat is all.Rob Crittenden2012-04-081-1/+4
| | | | | | | | | | We were returning '' for the first entry when hostcat and usercat were set to all. All subsequent entries were padded with - which effectively denied access. This requires slapi-nis 0.40+ https://fedorahosted.org/freeipa/ticket/2192
* Add requires on python-krbV to client subpackageRob Crittenden2012-03-281-0/+4
| | | | | | This is needed since ipa-client-install initializes the ipalib api. https://fedorahosted.org/freeipa/ticket/2577
* Replace broken i18n shell test with Python testJohn Dennis2012-03-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We had been using shell scripts and sed to test our translations. But trying to edit pot and po files with sed is nearly impossible because the file format can vary significantly and the sed editing was failing and gettext tools were complaining about our test strategy. We had been using a Python script (test_i18n.py) to perform the actual test after using shell, sed, and gettext tools to create the files. There is a Python library (polib) which can read/write/edit pot/po/mo files (used internally by Transifex, our translation portal). The strategy now is to do everything in Python (in test_i18n.py). This is easier, more robust and allows us to do more things. * add python-polib to BuildRequires * Remove the logic for creating the test lang from Makefile.in and replace it with calls to test_i18n.py * add argument parsing, usage, configuration parameters, etc. to test_i18n.py to make it easier to use and configurable. * add function to generate a test po and mo file. It also writes the files and creates the test directory structure. * Took the existing validate code and refactored it into validation function. It used to just pick one string and test it, now it iterates over all strings and all plural forms. * Validate anonymous Python format substitutions in pot file * added support for plural forms. * Add pot po file validation for variable substitution * In install/po subdir you can now do: $ make test $ make validate-pot $ make validate-po * The options for running test_i18n.py are: $ ./test_i18n.py --help Usage: test_i18n.py --test-gettext test_i18n.py --create-test test_i18n.py --validate-pot [pot_file1, ...] test_i18n.py --validate-po po_file1 [po_file2, ...] Options: -h, --help show this help message and exit -s, --show-strings show the offending string when an error is detected --pedantic be aggressive when validating -v, --verbose be informative --traceback print the traceback when an exception occurs Operational Mode: You must select one these modes to run in -g, --test-gettext create the test translation file(s) and exercise them -c, --create-test create the test translation file(s) -P, --validate-pot validate pot file(s) -p, --validate-po validate po file(s) Run Time Parameters: These may be used to modify the run time defaults --test-lang=TEST_LANG test po file uses this as it's basename (default=test) --lang=LANG lang used for locale, MUST be a valid lang (default=xh_ZA) --domain=DOMAIN translation domain used during test (default=ipa) --locale=LOCALE locale used during test (default=test_locale) --pot-file=POT_FILE default pot file, used when validating pot file or generating test po and mo files (default=ipa.pot) https://fedorahosted.org/freeipa/ticket/2044
* Set minimum version of 389-ds-base to 1.2.10.4-2 to fix upgrade issueRob Crittenden2012-03-261-1/+4
| | | | | | | The IPA upgrade process was starting before 389-ds had upgraded the database which caused corruption. https://fedorahosted.org/freeipa/ticket/2541
* Add missing BuildRequiresPetr Viktorin2012-03-261-0/+5
| | | | | | | | Since our build process runs pylint, we need all Python dependencies installed at RPM creation time. This adds python-lxml and python-pyasn1 to BuildRequires. https://fedorahosted.org/freeipa/ticket/2538
* No longer shell escape the DM password when calling pkisilent.Rob Crittenden2012-03-211-13/+5
| | | | | | | | | pkisilent was modified to handle escaping characters itself in BZ https://bugzilla.redhat.com/show_bug.cgi?id=769388 This removes the workaround from ticket 1636. https://fedorahosted.org/freeipa/ticket/2529
* Allow port numbers for idnsForwardersMartin Kosek2012-03-201-2/+5
| | | | | | | | Let user enter custom ports for zone conditional forwarders or global forwarders in dnsconfig. Ports can be specified in a standard BIND format: IP_ADDRESS [port PORT] https://fedorahosted.org/freeipa/ticket/2462
* Fixed rpm build warning - extension.js listed twicePetr Vobornik2012-03-191-1/+2
| | | | | | | | | | | | | Building the ipa rpms returns this: warning: File listed twice: /usr/share/ipa/ui/extension.js This is because of a glob: %{_usr}/share/ipa/ui/*.js and then more specifically: %config(noreplace) %{_usr}/share/ipa/ui/extension.js https://fedorahosted.org/freeipa/ticket/2253
* Set minimum version of selinux-policy to pick up memcached fixRob Crittenden2012-03-111-1/+9
| | | | | | | This package version adds a boolean, httpd_manage_ipa, that enables the ipa_memcached service to work. https://fedorahosted.org/freeipa/ticket/2433
* Configure SSH features of SSSD in ipa-client-install.Jan Cholasta2012-03-011-1/+7
| | | | | | | | OpenSSH server (sshd) is configured to fetch user authorized keys from SSSD and OpenSSH client (ssh) is configured to use and trigger updates of the SSSD-managed known hosts file. This requires SSSD 1.8.0.
* Forms based authentication UIPetr Voborník2012-03-021-1/+5
| | | | | | | | | | | | | | | | | | | | Support for forms based authentication was added to UI. It consist of: 1) new login page Page url is [ipa server]/ipa/ui/login.html Page contains a login form. For authentication it sends ajax request at [ipa server]/session/json/login_password. If authentication is successfull page is redirected to [ipa server]/ipa/ui if it fails from whatever reason a message is shown. 2) new enhanced error dialog - authorization_dialog. This dialog is displayed when user is not authorized to perform action - usually when ticket and session expires. It is a standard error dialog which shows kerberos ticket related error message and newly offers (as a link) to use form based authentication. If user click on the link, the dialog content and buttons switch to login dialog which has same functionality as 'new login page'. User is able to return back to the error message by clicking on a back button. login.html uses same css styles as migration page -> ipa-migration.css was merged into ipa.css. https://fedorahosted.org/freeipa/ticket/2450
* Added logout buttonPetr Voborník2012-02-281-0/+4
| | | | | | | | | | Logout button was added to Web UI. Click on logout button executes session_logout command. If command succeeds or xhr stutus is 401 (unauthorized - already logged out) page is redirected to logout.html. logout.html is a simple page with "You have been logged out" text and a link to return back to main page. https://fedorahosted.org/freeipa/ticket/2363
* Tweak the session auth to reflect developer consensus.John Dennis2012-02-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
* Add Requires to ipa-client on oddjob-mkhomedirRob Crittenden2012-02-271-0/+4
| | | | https://fedorahosted.org/freeipa/ticket/2337
* Update schema for bind-dyndb-ldapMartin Kosek2012-02-241-1/+4
| | | | | | | | | | | Add new attributes and objectclasses to support new features: - global bind-dyndb-ldap settings in LDAP - conditional per-zone forwarding - per-zone configuration of automatic PTR updates - AllowQuery and AllowTransfer ACIs https://fedorahosted.org/freeipa/ticket/2215 https://fedorahosted.org/freeipa/ticket/2072
* Add Conflicts on mod_ssl because it interferes with mod_proxy and dogtagRob Crittenden2012-02-221-0/+7
| | | | | | | | | | | | We had this in v1 but removed it with v2 because we no longer used TurboGears for the UI. Because we are now proxying requests to dogtag we need to re-add this so that mod_ssl doesn't interfere with our communication. mod_ssl always blindly registers itself as the SSL provider for mod_proxy. mod_nss will only register itself if mod_ssl hasn't already done so. https://fedorahosted.org/freeipa/ticket/2177
* Set min for 389-ds-base to 1.2.10.1-1 to fix install segfault, schema ↵Rob Crittenden2012-02-151-1/+5
| | | | | | replication. https://fedorahosted.org/freeipa/ticket/2118
* Require krb5 1.10Simo Sorce2012-02-161-2/+2
|
* Don't set delegation flag in client, we're using S4U2Proxy nowRob Crittenden2012-02-151-7/+6
| | | | | | | | | | | | A forwardable ticket is still required but we no longer need to send the TGT to the IPA server. A new flag, --delegate, is available if the old behavior is required. Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up needed patches for S4U2Proxy to work. https://fedorahosted.org/freeipa/ticket/1098 https://fedorahosted.org/freeipa/ticket/2246
* Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.confRob Crittenden2012-02-151-0/+13
| | | | | | | | | | | The ipa_kpasswd service was deprecated in 2.2, replaced by kadmin. On upgrade it will be left running by the previous installation, we need to stop it and uninstall the service. The dbmodules section needs to reflect that we're now using the new IPA kdb backend instead of the standard MIT ldap backend. https://fedorahosted.org/freeipa/ticket/2341
* Add ipa_memcached serviceJohn Dennis2012-02-091-0/+22
| | | | | | | | | | | | | | | | | | | | | | | * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
* %ghost the UI files that we install/create on the flyRob Crittenden2012-01-311-0/+15
| | | | https://fedorahosted.org/freeipa/ticket/1764
* Update and package ipa-upgradeconfig man page.Rob Crittenden2012-01-231-0/+1
| | | | | | | Require that the tool be run as root to avoid a permission-related backtrace. https://fedorahosted.org/freeipa/ticket/1758
* slapi-plugins: use thread-safe ldap librarySimo Sorce2012-01-131-1/+1
|
* Configure s4u2proxy during installation.Rob Crittenden2012-01-101-1/+4
| | | | | | | | | | | | This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
* Fix dependency for samba4-devel packageAlexander Bokovoy2011-12-091-1/+4
|
* Add ipasam samba passdb backendSumit Bose2011-12-061-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/1874
* spec: We do not need krb5-server-ldap anymoreSimo Sorce2011-11-291-1/+0
| | | | We now use our own ipa-kdb DAL driver
* Add plugin framework to LDAP updates.Rob Crittenden2011-11-221-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
* Create skeleton CLDAP server as a DS pluginSimo Sorce2011-11-211-6/+9
|
* Removed develop.js.Endi S. Dewata2011-11-141-0/+4
| | | | | | | | | | The develop.js is no longer necessary because the code in it has been merged into the main code. An empty extension.js has been added to provide a place for UI customization. Ticket #2099
* Add support for generating PAC for AS requests for user principalsSimo Sorce2011-11-071-0/+1
|
* Fixed inconsistent image names.Endi S. Dewata2011-10-271-2/+6
| | | | | | | The images have been renamed to be more consistent and moved into the "images" directory to mimic the original jQuery UI structure. Ticket #1613
* Removed HBAC deny rule warning.Endi S. Dewata2011-10-261-4/+3
| | | | | | | The HBAC deny rule is no longer supported so it's no longer necessary to show the warning. Ticket #1444
* Update spec file to use systemd on Fedora 16 and aboveAlexander Bokovoy2011-10-241-1/+74
|
generated by cgit (git 2.34.1) at 2024-04-28 09:20:12 +0000