summaryrefslogtreecommitdiffstats
path: root/ipalib/backend.py
Commit message (Collapse)AuthorAgeFilesLines
* Add CLI parsing testsPetr Viktorin2012-03-281-1/+0
| | | | | | | These test that command lines are parsed to correct Command arguments. Includes some tests for interactive prompts. To make this possible cli.run is broken up into several pieces.
* Tweak the session auth to reflect developer consensus.John Dennis2012-02-271-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
* Don't set delegation flag in client, we're using S4U2Proxy nowRob Crittenden2012-02-151-1/+1
| | | | | | | | | | | | A forwardable ticket is still required but we no longer need to send the TGT to the IPA server. A new flag, --delegate, is available if the old behavior is required. Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up needed patches for S4U2Proxy to work. https://fedorahosted.org/freeipa/ticket/1098 https://fedorahosted.org/freeipa/ticket/2246
* Fix lint false positives.Jan Cholasta2011-04-131-1/+1
|
* Add default success/failure output logging.Rob Crittenden2011-02-141-2/+2
| | | | | | | | | | Request logging on the server only happened if you added verbose=True or debug=True to the IPA config file. We should log the basics at least: who, what, result. Move a lot of entries from info to debug logging as well. Related to ticket 873
* Change FreeIPA license to GPLv3+Jakub Hrozek2010-12-201-5/+5
| | | | | | | | | | The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
* Add support for client failover to the ipa command-line.Rob Crittenden2010-08-161-1/+2
| | | | | | | | | | | | This adds a new global option to the ipa command, -f/--no-fallback. If this is included then just the server configured in /etc/ipa/default.conf is used. Otherwise that is tried first then all servers in DNS with the ldap SRV record are tried. Create a new Local() Command class for local-only commands. The help command is one of these. It shouldn't need a remote connection to execute. ticket #15
* Connect the -v cli argument to the verbose flag in xmlrpclibRob Crittenden2010-06-031-1/+1
| | | | | | If you pass two -v to the ipa command you'll get the XML-RPC data in the output. This can be handy so you know exactly what went out over the wire.
* Remove __public__ and __proxy__ hold-overs from Plugin classJason Gerard DeRose2010-01-281-2/+0
|
* Allow creation of new connections by unshared instances of backend.Connectible.Pavel Zuna2010-01-111-13/+21
|
* Add fail-safe so any kind of exception is handled in XML-RPC server.Rob Crittenden2009-11-181-0/+5
| | | | | | | If an exception is not handled here then the context isn't destroyed leaving at least an LDAP connection dangling. This means the next time this thread/process tries to handle a connection it will fail because a context already exists.
* First pass at enforcing certificates be requested from same hostRob Crittenden2009-10-211-0/+5
| | | | | | | | | | | | We want to only allow a machine to request a certificate for itself, not for other machines. I've added a new taksgroup which will allow this. The requesting IP is resolved and compared to the subject of the CSR to determine if they are the same host. The same is done with the service principal. Subject alt names are not queried yet. This does not yet grant machines actual permission to request certificates yet, that is still limited to the taskgroup request_certs.
* Fix three broken unit testsJason Gerard DeRose2009-08-041-0/+1
|
* Add textui function to display and prompt user for selection for *-find.Rob Crittenden2009-07-101-1/+3
| | | | | Since we may end up executing a *-show when an entry is selected we need to defer destroying the connection context.
* Always use new LDAP backend when creating context.Pavel Zuna2009-07-021-4/+1
|
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-231-1/+1
|
* Add conditional (env.use_ldap2 is True) modifications required by new LDAP ↵Pavel Zuna2009-04-221-1/+4
| | | | backend.
* Fixed Executioner.execute() so that its 'name' argument doesn't conflict ↵Jason Gerard DeRose2009-03-131-4/+4
| | | | with a param called 'name' (which is a valid param name)
* Got new ldap connection working using Connectible.connect()Jason Gerard DeRose2009-02-031-2/+2
|
* Started reworking CLI class into cli pluginJason Gerard DeRose2009-02-031-0/+7
|
* Added docstring to Connectible classJason Gerard DeRose2009-02-031-0/+8
|
* Ported xmlclient to subclass from ConnectibleJason Gerard DeRose2009-02-031-10/+20
|
* Removed the depreciated Context and LazyContext classesJason Gerard DeRose2009-02-031-14/+0
|
* Added stuff for managing connections and new Executioner backend base classJason Gerard DeRose2009-02-031-1/+67
|
* Did some initial work for Context pluginsJason Gerard DeRose2008-10-301-0/+14
|
* 320: plugable.API now respects the Plugin.__proxy__ flag; added test for ↵Jason Gerard DeRose2008-09-241-1/+5
| | | | plugins without proxy to unit tests for API
* 319: Added new backend and tests.test_backend modules; added place-holder ↵Jason Gerard DeRose2008-09-241-0/+27
Backend class and corresponding unit tests
generated by cgit (git 2.34.1) at 2024-11-16 00:18:20 +0000