| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
| |
attribute permissions and all other benefits of building on the baseldap plugin
|
|
|
|
|
| |
The Find, Add, and Remove buttons in the enrollment dialog have
been replaced with ipa_buttons.
|
| |
|
|
|
|
|
|
|
| |
Prompt for creation of reverse zone, with the default for unattended
installations being False.
https://fedorahosted.org/freeipa/ticket/418
|
|
|
|
| |
ticket 420
|
|
|
|
|
|
|
| |
A custom facet has been added to manage the host's managedby attribute.
The facet defines the add and remove methods, the columns for the
association table and enrollment dialog, and the link for the primary
key column.
|
|
|
|
| |
enrollment-adder pages
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The enrollment dialog has been modified to use scrollable tables that
supports multiple columns to display the search results and selected
entries. The columns are specified by calling create_adder_column()
on the association facet. By default the tables will use only one
column which is to display the primary keys.
The following enrollment dialogs have been modified to use multiple
columns:
- Group's member_user
- Service's managedby_host
- HBAC Service Group's member_hbacsvc
- SUDO Command Group's member_sudocmd
The ipa_association_table_widget's add() and remove() have been moved
into ipa_association_facet so they can be customized by facet's
subclass. The ipa_table's add_row() has been renamed to add_record().
Some old code has been removed from ipa_facet_create_action_panel().
The code was used to generate association links from a single facet.
It's no longer needed because now each association has its own facet.
The test data has been updated. The IPA.nested_tabs() has been fixed
to return the entity itself if IPA.tab_set is not defined. This is
needed to pass unit test.
|
|
|
|
|
|
|
|
|
|
| |
The certificate_status_widget has been modified to check for the
environment variable ra_plugin to determine the CA used by IPA
server. If self-signed CA is used, some operations will not be
available (e.g. checking certificate status, revoking/restoring
certificate), so the corresponding interface will be hidden. Other
operations such as creating new certificate and viewing certificate
are still available.
|
|
|
|
| |
Meta data, including them in the code causes breakage at initialization
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The new model is based on permssions, privileges and roles.
Most importantly it corrects the reverse membership that caused problems
in the previous implementation. You add permission to privileges and
privileges to roles, not the other way around (even though it works that
way behind the scenes).
A permission object is a combination of a simple group and an aci.
The linkage between the aci and the permission is the description of
the permission. This shows as the name/description of the aci.
ldap:///self and groups granting groups (v1-style) are not supported by
this model (it will be provided separately).
This makes the aci plugin internal only.
ticket 445
|
|
|
|
|
| |
extends the logic for showing the admin or self service ui to admins by checking for membership in the group admins
added check for group admins
|
|
|
|
| |
set. remove explicit sibling code from entity pages Modified the Label fields on HBAC and SUDO to make them appear cleaner in the UI
|
|
|
|
|
|
|
| |
This will allow clients to use entryusn values to track what changed in the
directory regardles of replication delays.
Fixes: https://fedorahosted.org/freeipa/ticket/526
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The association facet has been modified to support multiple columns.
By default the facet will have one column which is the primary key of
the associated object (e.g. username of a group member), so the
existing code will work like before. Other fields (e.g. user's full
name) can be added by subclassing the ipa_association_facet class and
specifying the additional columns to display. These additional fields
will be retrieved using a batch operation.
Previously a single association facet instance will be used for all
associations in an entity. Now each association will have its own
association facet. This way each association facet can be customized
differently as needed. The <entity>-enroll URL parameter has been
removed because it's no longer needed.
The ipa_entity.create_association_facets() is provided to generate
the default association facets with one column for the primary key.
The column click handler has been moved out of ipa_column to provide
more flexibility for customization.
The get_action_panel() and get_client_area() have been modified to
search within the entity's container.
The group entity has been fully converted to use the new UI framework.
Association facets that have been modified to use multiple columns are:
- User Group's member_user
- HBAC Service Group's member_hbacsvc
- SUDO Command Group's member_sudocmd
- Service's managedby_host
New test data files have been added. Unit tests have been updated.
|
|
|
|
|
|
|
|
|
|
| |
The list of attributes that a host bound as itself could write was
overly broad.
A host can now only update its description, information about itself
such as OS release, etc, its certificate, password and keytab.
ticket 416
|
|
|
|
|
|
|
|
|
|
| |
If we don't then we need to add it when a group is detached causing
aci issues.
I had to move where we create the UPG template until after the DS
restart so the schema is available.
ticket 542
|
|
|
|
|
| |
Replaced _entity with -entity in IPA.tab_state().
Replaced sudo-entity with sudorule-entity.
|
|
|
|
| |
the index of the top level tab for the target tab. new version creats third level navigation for nested entities, such as SUDO and HBAC
|
|
|
|
| |
satisfy gnu mode - run autoreconf -f to ensure that everything matches
|
|
|
|
|
| |
the class member variable is a reserved keyword in Javascript.
This patch fixes a syntax error.
|
| |
|
|
|
|
|
| |
Cleans up the indentation of the action panel
Puts the sudo and HBAC entries in a consistent order
|
|
|
|
|
|
|
|
|
| |
There was a corner case where the value of --ip-address was never verified
if you were also setting up DNS.
Added this bit of information to the man page too.
ticket 399
|
|
|
|
|
|
|
| |
This uses an enhanced memberof plugin that allows multiple attributes
to be configured to create memberOf attributes.
tickets 109 and 110
|
|
|
|
|
|
|
|
|
|
|
|
| |
The SUDO Commands and Command Groups pages have been added under
SUDO Rules tab.
Similar to HBAC navigation issue, these entities do not have their
own tab, so an exception has been added to the navigation code
to read sudo-entity parameter to determine the entity being viewed.
Fixing this issue will require framework changes.
New test data for these operations have been added.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Previously the queries for action panel were done globally. Since each
entity container has its own action panel, the queries will return multiple
results. This is fixed by qualifying the query to run within the entity
container.
The query has also been moved into ipa_facet.get_action_panel(). Entities
that do not have their own entity container (e.g. HBAC services and service
groups) will need to override this method to get the action panel from the
right entity container (e.g. HBAC rules).
The facet.setup_views() has been renamed to facet.create_action_panel().
New test data for SUDO rules have been added.
|
|
|
|
|
|
|
|
| |
This changes the system limits for the dirsrv user as well as
configuring DS to allow by default 8192 max files and 64 reserved
files (for replication indexes, etc..).
Fixes: https://fedorahosted.org/freeipa/ticket/464
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Change the way we specify the id ranges to force uid and gid ranges to always
be the same. Add option to specify a maximum id.
Change DNA configuration to use shared ranges so that masters and replicas can
actually share the same overall range in a safe way.
Configure replicas so that their default range is depleted. This will force
them to fetch a range portion from the master on the first install.
fixes: https://fedorahosted.org/freeipa/ticket/198
|
|
|
|
|
|
|
| |
Script wsgi.py checks if Apache is compiled with MPM=Prefork
and if not, it refuses to run.
https://fedorahosted.org/freeipa/ticket/252
|
|
|
|
|
|
|
| |
Instead of print and return, use sys.exit() to quit scripts with an
error message and a non zero return code.
https://fedorahosted.org/freeipa/ticket/425
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
The UUID plugin handles adding ipaUniqueId for us as well as the access
control for it.
ticket 250
|
|
|
|
|
| |
To be consistent with the details page, the rule type in the HBAC
add dialog box has been converted into radio buttons.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The support for host enrollment via one-time-password has been added.
When submitted, the OTP will be used to set the host's userpassword.
Previously each IPA command can only have one JSON test data file.
The ipa_cmd() has been modifies to accept an optional command name.
When used with static files, it will pull the test data whose name
is the same as the command name.
The batch.json has been renamed to ipa_init.json for UI initialization.
Some test data have been added for operations against specific hosts.
|
| |
|
|
|
|
| |
fixes the spacing and width for the top and second row of tabs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The search and details pages for SUDO Rule have been added. Codes
that are shared with HBAC have been moved to rule.js.
The following methods were renamed for consistency:
- ipa_details_load() -> ipa_details_refresh()
- ipa_details_display() -> ipa_details_load()
The ipa_details_cache has been removed because the cache is now
stored in each widget.
The index.xhtml has been removed. All references to it has been
changed to index.html.
The Unselect All checkbox has been fixed. Unnecessary parameter
'container' has been removed.
The unit test has been updated and new test data has been added.
|
|
|
|
|
|
| |
This will allow others to provision on behalf of the host.
ticket 280
|
|
|
|
|
|
|
|
|
| |
Disable any services when its host is disabled.
This also adds displaying the certificate attributes (subject, etc)
a bit more universal and centralized in a single function.
ticket 297
|
| |
|
|
|
|
| |
then close' https://fedorahosted.org/freeipa/ticket/471
|
|
|
|
| |
also removed language on html, as the same page should be used for all languages.
|
| |
|
|
|
|
|
| |
altough the kdc certificate name is not tied to the fqdn we create separate
certs for each KDC so that renewal of each of them is done separately.
|
| |
|
|
|
|
|
| |
This patch adds support only for the selfsign case.
Replica support is also still missing at this stage.
|
|
|
|
| |
Also use the realm name as nickname for the CA certificate
|