summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Use exop instead of kadmin.localSumit Bose2012-06-111-1/+1
|
* Only allow root to run update pluginsPetr Viktorin2012-06-071-13/+17
| | | | | | | | | | | | Several plugins need restarting the DS (or they currently do an external bind). Rather than disabling plugins (possibly partially), refuse to run them when run as an unprivileged user. This means running ipa-ldap-updater as non-root requires specifying a list of files, and omiting the --upgrade and --plugins options. https://fedorahosted.org/freeipa/ticket/2621
* Update of serverconfig ipaconfigstring optionsPetr Vobornik2012-06-061-1/+4
| | | | | | | | | | | | Patch "Add options to reduce writes from KDC" adds two more possible values to config plugins ipaconfigstring configuration options. These are: * KDC:Disable Last Success * KDC:Disable Lockout This patch adds them to Web UI https://fedorahosted.org/freeipa/ticket/2734
* Removal of illegal options in association dialogPetr Vobornik2012-06-073-15706/+13223
| | | | | | | | Association dialogs were using non-existent options for find commands. It causes error when #2509 is implemented. Now when creating a find command a check for options existence is performend. Option is not used if not present in metadata. It fixes the issue. https://fedorahosted.org/freeipa/ticket/2760
* Add trust-related ACIsAlexander Bokovoy2012-06-073-2/+41
| | | | | | | | | A high-level description of the design and ACIs for trusts is available at https://www.redhat.com/archives/freeipa-devel/2011-December/msg00224.html and https://www.redhat.com/archives/freeipa-devel/2011-December/msg00248.html Ticket #1731
* Properly handle multiple IP addresses per host when installing trust supportAlexander Bokovoy2012-06-071-16/+22
| | | | | | | | resolve_host() function returns a list of IP addresses. Handle it all rather than expecting that there is a single address. It wouldn't hurt to make a common function that takes --ip-address into account when resolving host addresses and use it everywhere.
* Perform case-insensitive searches for principals on TGS requestsAlexander Bokovoy2012-06-073-0/+6
| | | | | | | | | | We want to always resolve TGS requests even if the user mistakenly sends a request for a service ticket where the fqdn part contain upper case letters. The actual implementation follows hints set by KDC. When AP_REQ is done, KDC sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests. https://fedorahosted.org/freeipa/ticket/1577
* Add trust management for Active Directory trustsAlexander Bokovoy2012-06-074-1/+5
|
* Use dedicated keytab for SambaAlexander Bokovoy2012-06-071-1/+3
| | | | | | | | Samba just needs the cifs/ key on the ipa server. Configure samba to use a different keytab file so that we do not risk samba commands (net, or similar) to mess up the system keytab. https://fedorahosted.org/freeipa/ticket/2168
* Add separate attribute to store trusted domain SIDAlexander Bokovoy2012-06-076-1/+59
| | | | | | | | | | | We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
* Text widget's dirty state is changed on various input methodsPetr Vobornik2012-06-041-2/+19
| | | | | | | | | | | | | | | | | | | | | | | on_value_changed event in textboxes and textareas was raised only on keyboard input. If user used different input method such as paste or browser undo and redo functions widget's on_value_changed event wasn't raised and so dirty state wasn't changed as well. This patch adds listener to text's and textarea's 'input' event. Input is a HTML 5 event which is raises on user initiated action. Some of user initiated actions : * Cut * Copy * Paste * Undo * Redo * Clear * Typing (like keyup) * Form AutoFill * User-invoked spellcheck corrections * Input from Input Method Editor It should be supported by all recent versions of major browsers. IE doesn't support it up to version 8. Listener for 'keyup' event was left in implementation for backward compatibility with older browsers. This may cause firing on_value_change twice but so far it shouldn't cause troubles. https://fedorahosted.org/freeipa/ticket/2647
* Added links to netgroup member tablesPetr Vobornik2012-06-041-4/+8
| | | | | | Tables with members in netgroup were missing links for navigation to associated details pages. This patch adds these links. https://fedorahosted.org/freeipa/ticket/2670
* Removal of illegal options in JSON-RPC callsPetr Vobornik2012-06-044-7/+28
| | | | | | | | | | Ticket https://fedorahosted.org/freeipa/ticket/2509 bans using non existent options. If such option is supplied command ends with error. It uncovered several cases in Web UI. This patch is fixing these cases. Automember, Self-service and Delegation don't support 'pkey-only', 'size-limit' and 'rights' option. Pagination and rights check were disabled for them. Automount map adder dialog was sending options for indirect map even if chosen type was direct (when those for indirect was filled earlier), also it was sending non-existant 'method' option. https://fedorahosted.org/freeipa/ticket/2760
* Added cancel button to service unprovision dialogPetr Vobornik2012-06-041-0/+8
| | | | | | Service unprovision dialog was missing a cancel button. The button was added. https://fedorahosted.org/freeipa/ticket/1811
* Enable reset password action according to attribute perrmissionPetr Vobornik2012-06-042-2/+46
| | | | | | | | This patch creates state_evaluator which creates permission states for defined attribute. The state format is: attributeName_permissionChar. This evaluator is used for user_password attribute and it control enabling/disabling of related action in user account action panel. https://fedorahosted.org/freeipa/ticket/2318
* Add shadow to dialogPetr Vobornik2012-06-041-0/+6
| | | | | | This patch adds shadow to dialog used in Web UI. It looks cooler. https://fedorahosted.org/freeipa/ticket/2248
* Added missing i18n in action list and action panelPetr Vobornik2012-06-044-3/+5
| | | | | | This patch adds strings to internal.py which were not translated in action list/panel patches. https://fedorahosted.org/freeipa/ticket/2248
* Action panel for userPetr Vobornik2012-06-041-1/+29
| | | | | | This patch adds action panel to user account section. The panel contain an action for reseting user password. https://fedorahosted.org/freeipa/ticket/2248
* User password widget modified.Petr Vobornik2012-06-042-73/+113
| | | | | | | | | | | | | | | Currently the user password is shown as follows in the details page: Password: Reset Password This is inconsistent with the rest of the page because the 'Reset Password' is an action, not the value of the password. Now password is shown as follows: Password: ******* (if set) Password: (if not set) Reset password link was removed as well the dialog for reset password was removed from password widget. The dialog was moved to its own object and can be now showed independently. An action for showing this dialog should be created. https://fedorahosted.org/freeipa/ticket/2248
* Action panelPetr Vobornik2012-06-044-2/+179
| | | | | | | | This patch implements action panel. Action panel is a box located in facet details section which contains actions related to that object/section. In spec file can be configured actions and title used in action panel. Default title is 'Actions'. Actions are specified by their name. They have to be defined in action collection in facet. https://fedorahosted.org/freeipa/ticket/2248
* Refactored entities to use changed actions conceptPetr Vobornik2012-06-045-188/+228
| | | | | | It's continuation of previous refactoring effort. This part is changing specs in entities to used changed concept. https://fedorahosted.org/freeipa/ticket/2248
* Refactored action list and control buttons to use shared list of actionsPetr Vobornik2012-06-045-292/+581
| | | | | | | | | | | This is a first step for implementing action panels which will also use the shared list of actions. This effor changes the way how action list and control buttons are defined. First all actions are defined on facet level - attribute 'actions' in spec file. Implementation of action list widget is not specified on facet level. It is left in facet header. A list of action names used in action list can be now specified in facet spec in 'header_actions' attribute. Control buttons use similar concept. Facet by default is using control_buttons_widget. Details and search facet are defining their own default actions (refresh/add/remove/update/reset). Additional buttons can be defined as array of action names on facet level in control_buttons attribute. state_evaluators and state_listeners were united. They are called state_evaluators but they uses state_listener concept, they are attached to an event. For former state_evaluator the event is post_load. They are defined in spec in state attribute. State object purpose is to aggregate states from all state evaluators. It offers changed event to which can other objects subscribe. It also has summary evaluator which evaluation conditions. Summary evaluator creates summary status with human readable description. It can be used by facet header. https://fedorahosted.org/freeipa/ticket/2248
* permission-find missed some results with --pkey-only optionMartin Kosek2012-06-012-0/+10
| | | | | | | | | | | | | When permission-find post callback detected a --pkey-only option, it just terminated. However, this way the results that could have been added from aci_find matches were not included. Fix the post callback to go through the entire matching process. Also make sure that DNS permissions have a correct objectclass (ipapermission), otherwise such objects are not matched by the permission LDAP search. https://fedorahosted.org/freeipa/ticket/2658
* Move install script error handling to a common functionPetr Viktorin2012-05-3111-265/+110
| | | | | | | | | | | | | | All of our install/admin scripts had a try/except block calling the main function and handling common exceptions. These were copy-pasted from each other and modified to various levels of sophistication. This refactors them out of installers to a single function, which includes a final pass/fail message for all of the scripts. Non-install scripts that set up the same log handler levels for stderr and log file are not changed, as it's not possible to log to only the logfile without changing the logger configuration. https://fedorahosted.org/freeipa/ticket/2071
* If SELinux is enabled ensure we also have restorecon.Rob Crittenden2012-05-312-0/+3
| | | | | | | | | | | | We don't have a specific requires on the policycoreutils package. It gets pulled in as a dependency on the server anyway, but checking there is like a belt and suspenders. On the client we don't require SELinux at all. If SELinux is enabled however we need to set things up properly. This is provided by the policycoreutils package so fail if that isn't available. https://fedorahosted.org/freeipa/ticket/2368
* Replace DNS client based on acutil with python-dnsMartin Kosek2012-05-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
* ipa-server-install reword messageOndrej Hamada2012-05-221-1/+1
| | | | | | | Output message of the 'read_domain_name' function in ipa-server-install was reworded. https://fedorahosted.org/freeipa/ticket/2704
* During replication installation see if an agreement already exists.Rob Crittenden2012-05-172-10/+30
| | | | | | | | We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
* Validate on the user-provided domain name in the installer.Rob Crittenden2012-05-171-2/+13
| | | | | | Wrap printing exceptions in unicode() to do Gettext conversion. https://fedorahosted.org/freeipa/ticket/2196
* Correction of nested search facets tab labelsPetr Vobornik2012-05-152-0/+3
| | | | | | | | Nested search facets were using 'search' tab label instead of their nested entity name. This patch is fixing that regression. https://fedorahosted.org/freeipa/ticket/2744
* Improved calculation of max pkey length in facet headerPetr Vobornik2012-05-151-9/+55
| | | | | | | | | | | | Very long pkeys in facet header were limited to 60 characters. This magic number was good enough but with new action lists it isn't. This patch is adding calculation of maximum characters for pkey in facet header. It fixes regression introduced by Action Lists and also it uses effectively available space. Also this patch is changing limiting of breadcrumbs element to use as much space as possible. It works in three steps. First a threshold is set which is equal to length average. Then a total length of keys with length less than threshold is calculated. From this we can get remaining space for long keys and calculate new threshold. At last keys are limited to new threshold. https://fedorahosted.org/freeipa/ticket/2247 f
* Host page fixed to work with disabled DNS supportPetr Vobornik2012-05-153-0/+27
| | | | | | | | | | | | | | | | | When DNS support was disabled there were following errors in Web UI: 1) Host details page was not filled with data 2) Host adder dialog was broken -> unusable 3) DNS tab was displayed in navigation The bugs were fixed by: 1) Was caused by entity_link_widget. The widget was modified to do not show link if other_entity (in this case dnsrecord) is not present. 2) Was caused by host_fqdn_widget. The widget is unusable becouse withou DNS support it doesn't have access to DNS zone entity. The section with this widget was removed. Also IP address field was removed because it shouln't be used without DNS support. New 'fqdn' text box was added for specifying hostname. 3) New DNS config entity was initialized but it wasn't shown because it caused some JavaScript error. The dnsconfig's init method was modified to throw expected exception. Now no dns entity is initialized and therefore DNS tab in navigation is not displayed. https://fedorahosted.org/freeipa/ticket/2728
* Instructions to generate cert use certutil instead of opensslPetr Vobornik2012-05-151-1/+1
| | | | | | Instructions to generate certificate were changed. Now they use certutil instead of openssl. In the example is also used option for specifying key size. https://fedorahosted.org/freeipa/ticket/2725
* Disallow '<' and non-ASCII characters in the DM passwordPetr Viktorin2012-05-151-6/+8
| | | | | | pkisilent does not handle these properly. https://fedorahosted.org/freeipa/ticket/2675
* Consistent change of entry status.Petr Vobornik2012-05-115-237/+215
| | | | | | | | | This patch adds action list and control buttons for consistent change of enty status for user, hbac rules, sudo rules, SELinux maps and dns zones. Action lists with 'enable' and 'disable' and 'delete' options were added to details facets. Two control buttons: 'enable' and 'disable' were added to search facets. https://fedorahosted.org/freeipa/ticket/2247
* General details facet actionsPetr Vobornik2012-05-113-0/+169
| | | | | | This patch adds common action button actions for enabling/disabling/deleting object. https://fedorahosted.org/freeipa/ticket/2707
* Batch action for search page control buttonsPetr Vobornik2012-05-111-0/+42
| | | | | | This patch implements a base action which can execute a batch of commands with single pkey as a parameter. https://fedorahosted.org/freeipa/ticket/2707
* Hide search facet add/delete buttons in self-servicePetr Vobornik2012-05-113-44/+78
| | | | | | Adds hiding/showing capabilities to action_button_widget. This patch is fixing regression caused replacing old details facet buttons with control_buttons_widget. The problem was that some buttons were not hidden in self-service mode. https://fedorahosted.org/freeipa/ticket/2707
* Redefined search control buttonsPetr Vobornik2012-05-112-72/+93
| | | | | | This patch replaces old search facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Redefined details control buttonsPetr Vobornik2012-05-111-68/+65
| | | | | | This patch replaces old details facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Control buttonsPetr Vobornik2012-05-111-1/+275
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Control buttons is a widget which contains action buttons. It is located in facet header and are supposed to replace old action buttons created by IPA.action_button(spec) call. The benefit is that now it is possible to define new buttons declaratively in spec definition without a need of inheriting facet and overriding create method. Action buttons are an entry poing for execution facet-wide action so they are tightly bound to facet. Action button options: name: string label: string, human readable label tooltip: string, human readable tooltip href: string, optional icon: string, icon class needs_confirm: boolean, default false confirm_msg: string, human readable confirmation message confirm_dialog: confirmation dialog, optional, custom confirmation dialog action: action, action which will be executed enabled: boolean, optional, default true Control buttons are define in facet spec in control_buttons property. Its a spec object with following attributes: all attributes which normal widget can have buttons: array of action_button specs state_listeners: array of state listener specs In init phase control_buttons_widget should assign a action_button a facet. control_buttons_widget are resposible for evaluation of action_button disable/enable state because they contain state_listeners which creates the state upon the enabled/disabled state is evaluated. State listeners are similar to state_evaluators. The differce is that the state is not evaluated from record set but from facet itself. The execution of evaluation is bound to a facet event. https://fedorahosted.org/freeipa/ticket/2247
* Action listsPetr Vobornik2012-05-115-18/+521
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch add support fo Action Lists. Action list is a select widget with actions as options located in facet header. Action can be selected and then executed by clickin on 'apply' button. Actions lists are defined on facet level. Facet header takes them from facet. Action list options actions: list of actions state_evaluator: a state evaluator which is needed for enabling/disabling options. Can encapsulate more evaluators. State evaluator object ---------------------- State evaluator is resposible for evaluating a state from result set. State is a array of strings. Each evaluator should inherit from IPA.state_evaluator and override evaluate method. Methods: evaluate(record): should return string array which represents the state get_description(): human readable representation of a state Action ------ Action is a object which can perform certain action on a facet. Action has enabling and disabling conditions. action options: name: string, required, name of the option label: string, required, human readable name of the option enable_cond: string array, states which need to be present in order to run this action disable_cond: string array, states which must not be present in order to run this action handler: function, contains action's logic needs_confirm: boolean, default false, indicates if action needs user confirmation confirm_msg: string, default generic message, human readable confirmation message. Action list should contain logic which enables/disables action based on facet state and action's enabling/disabling conditions. It should also enforce presence of confirmation. In this patch is also slightly modified facet header, mostly title part. It was revised to contain status icon, title and action list on single line. Facet header is using state evaluator's get_description method to properly set tooltip for state icon. https://fedorahosted.org/freeipa/ticket/2247
* General builder supportPetr Vobornik2012-05-111-0/+67
| | | | | | | | | | | | Web UI mainly uses declarative way of defining UI structure. When a new object type is created it is often required to create a new builder which would build the objects from spec file. The builders' logic is mostly the same. This patch adds a general builder with some extendability capabilities. Now it is possible to: 1) define spec for single object and build it by calling IPA.build(spec, /* optional */ builder_fac) 2) define an array of specs and build the objects by the same call Prerequisite for following action list patches. https://fedorahosted.org/freeipa/ticket/2707
* Remove duplicate and unused utility codePetr Viktorin2012-05-096-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Paging disable for password policiesPetr Vobornik2012-04-261-1/+3
| | | | | | | | | | Password policies are sorted by priority. When paging is enabled, table facet uses pwpolicy-find --pkey-only to get all pwpolicies keys. Those keys are sorted on server by priority but table facet sorts them again. This breaks the priority sorting. This patch disables the paging in passord policy serch page so the keys are sorted by priority. TODO: we should inspect sorting in table facet more deeply and disable it if it don't break anything. https://fedorahosted.org/freeipa/ticket/2676
* validate i18n strings when running "make lint"John Dennis2012-04-261-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | * Add bootstrap-autogen depdenency to lint target to force generated files to be created. * Add validate-src-strings to lint rules * Add validate-src-strings as dependency to lint targett * Remove obsolete test_lang frm test target * Add diagnostic message to validation command in i18n.py that outputs how many objects were scanned. Formerly it only output a message if there were errors. This made it impossible to distinguish an empty file from one with no errors. * While adding the validation counts it was discovered plurals had been omitted for some of the validation checks. Added the missing checks for plural forms. * Also distinguished between errors and warnings. Permit warnings to be emitted but do not fail the validatition unless actual errors were also detected.
* - add a pair of ethers maps for computers with hardware addresses on fileNalin Dahyabhai2012-04-262-0/+46
|
* - create a "cn=computers" compat area populated with ieee802Device entries ↵Nalin Dahyabhai2012-04-262-0/+29
| | | | corresponding to computers with fqdn and macAddress attributes
* - index the fqdn and macAddress attributes for the sake of the compat pluginNalin Dahyabhai2012-04-262-0/+35
|
* Use mixed-case for Read DNS Entries permissionRob Crittenden2012-04-231-3/+3
| | | | https://fedorahosted.org/freeipa/ticket/2569
generated by cgit (git 2.34.1) at 2024-05-08 17:14:36 +0000