summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* webui: fix switching between multiple_choice_section choicesPetr Vobornik2014-05-051-3/+4
| | | | | | | | | | | | | - required indicators are not present for all sections except the last - validation has wrong color for the same sections There was only one layout for all choices. Layout should not be reused because `create` method will reset layout's rows therefore it worked properly only for the last choice. https://fedorahosted.org/freeipa/ticket/4327 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: regression - enable fields on idrange type change (add)Petr Vobornik2014-04-291-8/+9
| | | | | | | | | | ID range adder was not properly addressed in field binding refactoring. The usage of reset caused some weird loops. https://fedorahosted.org/freeipa/ticket/4326 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: select all checkbox remains selected after operationAdam Misnyovszki2014-04-293-1/+9
| | | | | | | | | | The select all checkbox remained selected after bulk operation. This patch fixes it, after any bulk modify or delete operation, unselect_all function is called. https://fedorahosted.org/freeipa/ticket/4245 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* aci-update: Add ACI for read-only admin attributesPetr Viktorin2014-04-251-0/+2
| | | | | | | | | | | Most admin access is granted with the "Admin can manage any entry" ACI, but before the global anonymous read ACI is removed, read-only admin access must be explicitly given. Add an ACI for read-only attributes. https://fedorahosted.org/freeipa/ticket/4319 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci-update: Trim the admin write blacklistPetr Viktorin2014-04-253-9/+13
| | | | | | | | | | | | | | | | | | | These attributes are removed from the blacklist, which means high-level admins can now modify them: - krbPrincipalAliases - krbPrincipalType - krbPwdPolicyReference - krbTicketPolicyReference - krbUPEnabled - serverHostName The intention is to only blacklist password attributes and attributes that are managed by DS plugins. Also, move the admin ACIs from ldif and trusts.update to aci.update. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add several managed read permissions under cn=etcPetr Viktorin2014-04-241-0/+7
| | | | | | | | | | | | | | This adds permissions to: - cn=masters,cn=ipa (with new privilege) - cn=dna,cn=ipa (authenticated users) - cn=ca_renewal,cn=ipa (authenticated users) - cn=CAcert,cn=ipa (anonymous) - cn=replication (authenticated users) - cn=ad (authenticated users) Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Extend anonymous read ACI for containersPetr Viktorin2014-04-241-1/+4
| | | | | | | | | | | | - Allow cn=etc,$SUFFIX with these exceptions: - cn=masters,cn=ipa,cn=etc,$SUFFIX - virtual operations - cn=replicas,cn=ipa,cn=etc,$SUFFIX - Disallow anonymous read access to Kerberos password policy Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add a new ipaVirtualOperation objectClass to virtual operationsPetr Viktorin2014-04-243-36/+40
| | | | | | | | The entries are moved from the ldif file to an update file. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui doc: typo fixes in guidesAdam Misnyovszki2014-04-232-3/+3
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fix OTP Token add regressionPetr Vobornik2014-04-171-1/+1
| | | | | | | | | | | | OTP Token add failed because of invalid function call. qr_widget doesn't contain `on_value_changed` method since it inherits from `IPA.widget` and not from `IPA.input_widget`. Emitting the event was preserved for future possible usage. https://fedorahosted.org/freeipa/ticket/4306 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add managed read permissions to automemberPetr Viktorin2014-04-171-0/+7
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow anonymous read access to Kerberos containersPetr Viktorin2014-04-161-0/+4
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to krbtpolicyPetr Viktorin2014-04-161-0/+7
| | | | | | | | | | | | Unlike other objects, the ticket policy is stored in different subtrees: global policy in cn=kerberos and per-user policy in cn=users,cn=accounts. Add two permissions, one for each location. Also, modify tests so that adding new permissions in cn=users doesn't cause failures. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* webui: remove IPA.unauthorized_dialogPetr Vobornik2014-04-152-469/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: fix combobox styles to work with selenium testingPetr Vobornik2014-04-152-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: use asynchronous call for authenticationPetr Vobornik2014-04-153-38/+57
| | | | | | | | | | | | | | Change `IPA.login_password` and `IPA.get_credentials` to use async AJAX and to return promise instead of blocking the code. IPA.get_credentials is still partially blocking because of negotiate process. We can't do anything about that. It allows activity indicators to do their job. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: authentication modulePetr Vobornik2014-04-155-54/+317
| | | | | | | | General purpose authentication interface and state. See doc of 'freeipa/auth' module. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: login pagePetr Vobornik2014-04-155-2/+101
| | | | | | | | A facet with login sreen widget. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: login screen widgetPetr Vobornik2014-04-158-2/+722
| | | | | | | | | | | | | | | | | | Reimplementation of unauthorized dialog into separate widget. It uses RCUE design. New features compared to unauthorized dialog: - reflects auth methods from `auth` module - validation summary - differentiates Kerberos auth failure with session expiration - Caps Lock warning - form based method doesn't allow password only submission https://fedorahosted.org/freeipa/ticket/4017 https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: validation summary widgetPetr Vobornik2014-04-152-0/+91
| | | | | | | | A widget which aggregates warnings and errors and shows them on one place. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: load pagePetr Vobornik2014-04-156-7/+110
| | | | | | | | | | Load page is a simple facet which is displayed up to 'runtime' phase. On application start it tells the user that there is ongoing activity. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: publish network activity topicsPetr Vobornik2014-04-151-1/+7
| | | | | | | | | Network activity is now published through global topics. It allows other components like activity_widget to listen to them. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: activity widgetPetr Vobornik2014-04-153-2/+120
| | | | | | | | | | | | A widget for showing ongoing activity. Displays a text with changing dots. It listens to `network-activity-start` and `network-activity-end` topics. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: standalone facetPetr Vobornik2014-04-156-2/+355
| | | | | | | | | | `facet.Facet` is a new base class for facets. It doesn't have any dependencies on entities so it's usable for general purpose facets, e.g., future API browser, load facet or login facet. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: ContainerMixinPetr Vobornik2014-04-151-0/+154
| | | | | | | | | | | | | A mixin which implements widget storing logic. Similar logic is already implemented in details facet and dialog. Long term goal is to replace that with this one. Separating the logic into mixin makes it usable in other components. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: FormMixinPetr Vobornik2014-04-153-2/+207
| | | | | | | | | | | | | | a mixin used for fields validation. Basically implements a logic which is already in details facet and dialog. Now this logic can be used in any component. The long term goal is to replace the logic in details facet and dialog with this mixin. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: facet containerPetr Vobornik2014-04-155-14/+159
| | | | | | | | | | | A widget which servers as container for facets. FacetContainer is a base class. App is specialization. Doing this abstraction will allow us to implement various facet containers. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add managed read permissions to pwpolicy and cosentryPetr Viktorin2014-04-141-0/+7
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to RBAC objectsPetr Viktorin2014-04-111-0/+9
| | | | | | | Add default read permissions to roles, privileges and permissions. Also add permission to read ACIs. This is required for legacy permissions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* Allow anonymous read access to containersPetr Viktorin2014-04-081-0/+8
| | | | | | | | | | | | | All nsContainer objects, except ones in cn=etc, can now be read anonymously. The allowed attributes are cn and objectclass. These are the same in all IPA installations so they don't provide any sensitive information. Also, $SUFFIX itself can now be read anonymously. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* schema-compat: set precedence to 49 to allow OTP binds over compat treeAlexander Bokovoy2014-04-042-0/+11
| | | | | | | | | | | | | schema-compat plugin rewrites bind DN to point to the original entry on LDAP bind operation. To work with OTP tokens this requires that schema-compat's pre-bind callback is called before pre-bind callback of the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have a nsslapd-pluginprecedence value lower than (default) 50 which is used by the ipa-pwd-extop plugin. Note that this will only work if ticket 47699 is fixed in 389-ds. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* webui-tests: binding test suitePetr Vobornik2014-04-034-2/+154
| | | | | | Add basic tests for two-way binding between a field and two widgets Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: change widget updated event into value change eventPetr Vobornik2014-04-0310-47/+38
| | | | | | | | | | This change allow us to use proper two way binding between a field and a widget. In previous implementation field was not changed if something changed the value of a widget in 'update'. Now listeners are notified when the widget value is changed by: calling 'update', 'set_value' or by user change. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: replace widget's hidden property with visiblePetr Vobornik2014-04-032-17/+39
| | | | | | | Hidden was used only in ACI. There is no reason to have two properties which are negations of each other. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: field and widget binding refactoringPetr Vobornik2014-04-0324-921/+1739
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a Web UI wide change. Fields and Widgets binding was refactored to enable proper two-way binding between them. This should allow to have one source of truth (field) for multiple consumers - widgets or something else. One of the goal is to have fields and widget implementations independent on each other. So that one could use a widget without field or use one field for multiple widgets, etc.. Basically a fields logic was split into separate components: - adapters - parsers & formatters - binder Adapters - extract data from data source (FreeIPA RPC command result) - prepares them for commands. Parsers - parse extracted data to format expected by field - parse widget value to format expected by field Formatters - format field value to format suitable for widgets - format field value to format suitable for adapter Binder - is a communication bridge between field and widget - listens to field's and widget's events and call appropriate methods Some side benefits: - better validation reporting in multivalued widget Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Extending user plugin with inetOrgPerson fieldsAdam Misnyovszki2014-03-281-2/+8
| | | | | | | | | | | | | | | According to http://tools.ietf.org/html/rfc2798 ipa client and web ui extended with inetOrgPerson fields: - employeenumber - employeetype - preferredlanguage - departmentnumber carlicenseplate is now multivalued https://fedorahosted.org/freeipa/ticket/4165 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: replace IPA.command usage with rpc.commandPetr Vobornik2014-03-2724-166/+187
| | | | | | | Replace all IPA.command, IPA.batch_command and IPA.concurrent_command usages by equivalents from rpc module. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: move RPC code from IPA module to its own modulePetr Vobornik2014-03-272-884/+930
| | | | | | | | - moves RPC code from ipa.js to it's own module - part of ongoing effort where the ultimate goal is to get rid of ipa.js and IPA namespace Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: make navigation module independent on app modulePetr Vobornik2014-03-274-109/+122
| | | | | | | | | | | | When some module used 'freeipa/navigation' it pulled the entire Web UI because navigation depended on app. This patch splits the app into two modules: app and app_container. App specifies the entities which are part of final application. app_container module represents the application boot classes. Navigation now depends on app_container. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: rename domNode to dom_nodePetr Vobornik2014-03-265-39/+39
| | | | | | - unites domNode and dom_node usage to dom_node Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Support exporting CSRs in dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-251-0/+27
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Update certmonger configuration in ipa-upgradeconfig.Jan Cholasta2014-03-251-57/+90
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use the same certmonger configuration for both CA masters and clones.Jan Cholasta2014-03-251-10/+4
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Merge restart_httpd functionality to renew_ra_cert.Jan Cholasta2014-03-251-9/+11
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Merge restart_pkicad functionality to renew_ca_cert and remove restart_pkicad.Jan Cholasta2014-03-253-92/+31
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Make the default dogtag-ipa-ca-renew-agent behavior depend on CA setup.Jan Cholasta2014-03-251-1/+6
| | | | | | | On CA masters, a certificate is requested and stored to LDAP. On CA clones, the certificate is retrieved from LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Store information about which CA server is master for renewals in LDAP.Jan Cholasta2014-03-251-1/+1
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use dogtag-ipa-ca-renew-agent to track certificates on master CA.Jan Cholasta2014-03-253-105/+28
| | | | | | | | | Before, dogtag-ipa-renew-agent was used to track the certificates and the certificates were stored to LDAP in renew_ca_cert and renew_ra_cert. Since dogtag-ipa-ca-renew-agent can store the certificates itself, the storage code was removed from renew_ca_cert and renew_ra_cert. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Support storing renewed certificates to LDAP in dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-251-4/+127
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove dogtag-ipa-retrieve-agent-submit.Jan Cholasta2014-03-252-93/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-25 04:22:31 +0000