summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/baseldap.py
Commit message (Collapse)AuthorAgeFilesLines
* Use Sudo rather than SUDO as a label.Rob Crittenden2011-03-011-2/+2
| | | | ticket 1005
* Fix translatable strings in ipalib plugins.Pavel Zuna2011-03-011-3/+6
| | | | Needed for xgettext/pygettext processing.
* Sudo command groups are not supposed to allow nesting.Rob Crittenden2011-02-231-10/+1
| | | | | | | It was a design decision to not allow nesting sudo command groups, remove it. ticket 1004
* Collect memberof information for sudo commands.Rob Crittenden2011-02-231-0/+3
| | | | | | | | | | | | We weren't searching the cn=sudo container so all members of a sudocmdgroup looked indirect. Add a label for sudo command groups. Update the tests to include verifying that membership is done properly. ticket 1003
* Add handling for indirect memberof other entries.Rob Crittenden2011-02-211-0/+18
| | | | | | | | | | | | | | | This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an actual memberof another entry and being a memberof as the result if inheritence. This is particularly useful when trying to remove members of an entry, you can only remove direct members. I had to add a couple of short sleep calls to make things work a little better. The memberof plugin runs as a postop and we have no way of knowing when it has done its work. If we don't pause we may show some stale data that memberof hasn't updated yet. .3 seconds is an arbitrary choice. ticket 966
* Updated json_metadata and i18n_messages.Endi S. Dewata2011-02-181-0/+10
| | | | | | The json_metadata() has been updated to return ipa.Objects and ipa.Methods. The i18n_messages() has been updated to include other messages that are not available from the metadata.
* Document the --rights output formatJan Zeleny2011-02-171-2/+2
| | | | | https://fedorahosted.org/freeipa/ticket/563 https://fedorahosted.org/freeipa/ticket/588
* A mod command should not be able to remove a required attribute.Rob Crittenden2011-02-141-0/+9
| | | | | | | | | | | | Some attribute enforcement is done by schema, others should be done by the required option in a Parameter. description, for example, is required by many plugins but not the schema. We need to enforce in the framework that required options are provided. After all the setattr/addattr work is done run through the modifications and ensure that no required values will be removed. ticket 852
* Display error messages for failed manageby in service-add/remove-host.Pavel Zuna2011-02-101-0/+3
| | | | Fix #830
* Fixed permission lookupJan Zeleny2011-01-311-7/+5
| | | | | | | | Lookup based on --filter wasn't implemented at all. It did't show until now, because of bug sitting on top of it which was resulting in internal error. This patch fixes the bug and adds the filtering functionality. https://fedorahosted.org/freeipa/ticket/818
* Disable renaming to empty stringJan Zeleny2011-01-241-0/+2
| | | | | | | | So far it was possible to rename any object using LDAPUpdate to a name with empty primary key. Since this can cause nasty problems, this patch disables empty string in --rename argument. https://fedorahosted.org/freeipa/ticket/827
* Make a copy of objectclasses so a call can't update them globally.Rob Crittenden2011-01-241-1/+2
| | | | | | In the host plugin we may change the default objectclasses based on the options selected. This was affecting it globally and causing subsequent calls to fail.
* Fix output of failed managedby hosts, allow a host to manage itself.Rob Crittenden2011-01-111-1/+2
| | | | | | | | | | | The output problem was a missing label for failed managedby. This also fixes a call to print_entry that was missing the flags argument. Add a flag to specify whether a group can be a member of itself, defaulting to False. ticket 708
* Display the entries that failed when deleting with --continue.Rob Crittenden2011-01-101-2/+6
| | | | | | | | | | | | We collected the failures but didn't report it back. This changes the API of most delete commands so rather than returning a boolean it returns a dict with the only current key as failed. This also adds a new parameter flag, suppress_empty. This will try to not print values that are empty if included. This makes the output of the delete commands a bit prettier. ticket 687
* facet nestingAdam Young2011-01-071-1/+1
| | | | | correctly nest the facet groups change 'parent' to 'member of' for facet group
* Improve filtering of enrollments search results.Pavel Zuna2011-01-041-9/+48
| | | | | | | | | | | | | | | | | | | | | | This is required for effective filtering of enrollments search results in the webUI and also gives an edge to the CLI. After this patch, each LDAPObject can define its relationships to other LDAPObjects. For now, this is used only for filtering search results by enrollments, but there are probably more benefits to come. You can do this for example: # search for all users not enrolled in group admins ipa user-find --not-in-groups=admins # search for all groups not enrolled in group global with user Pavel ipa group-find --users=Pavel --not-in-groups=global # more examples: ipa group-find --users=Pavel,Jakub --no-users=Honza ipa hostgroup-find --hosts=webui.pzuna
* In meta data make ACI attributes lower-case, sorted. Add possible attributes.Rob Crittenden2010-12-211-2/+7
| | | | | | | | | | | | The metadata contains a list of possible attributes that an ACI for that object might need. Add a new variable to hold possible objectclasses for optional elements (like posixGroup for groups). To make the list easier to handle sort it and make it all lower-case. Fix a couple of missed camel-case attributes in the default ACI list. ticket 641
* Fix the mod operations.Pavel Zuna2010-12-211-0/+1
|
* Change FreeIPA license to GPLv3+Jakub Hrozek2010-12-201-5/+5
| | | | | | | | | | The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
* Enable filtering search results by member attributes.Pavel Zuna2010-12-201-1/+33
| | | | | | | | | | | | | | LDAPSearch base class has now the ability to generate additional options for objects with member attributes. These options are used to filter search results - search only for objects without the specified members. Example: ipa group-find --no-users=admin Only direct members are taken into account. Ticket #288
* Allow RDN changes from CLIJakub Hrozek2010-12-201-0/+14
| | | | https://fedorahosted.org/freeipa/ticket/397
* Allow renaming of object that have a parentJakub Hrozek2010-12-201-1/+2
| | | | Allow renaming of object that have a parent
* Make pkey always iterable when deletingJakub Hrozek2010-12-201-3/+5
|
* Give the memberof plugin time to work when adding/removing reverse members.Rob Crittenden2010-12-131-3/+62
| | | | | | | | | | | | When we add/remove reverse members it looks like we're operating on group A but we're really operating on group B. This adds/removes the member attribute on group B and the memberof plugin adds the memberof attribute into group A. We need to give the memberof plugin a chance to do its work so loop a few times, reading the entry to see if the number of memberof is more or less what we expect. Bail out if it is taking too long. ticket 560
* Properly handle multi-valued attributes when using setattr/addattr.Rob Crittenden2010-12-101-1/+1
| | | | | | | | | | | | The problem was that the normalizer was returning each value as a tuple which we were then appending to a list, so it looked like [(u'value1',), (u'value2',),...]. If there was a single value we could end up adding a tuple to a list which would fail. Additionally python-ldap doesn't like lists of lists so it was failing later in the process as well. I've added some simple tests for setattr and addattr. ticket 565
* When deleting multiple entries use --continue, not --continuous.Rob Crittenden2010-12-031-1/+1
| | | | ticket 561
* Provide list of available attributes for use in ACI UI.Rob Crittenden2010-12-031-1/+22
| | | | | | | Also include flag indicating whether the object is bindable. This will be used to determine if the object can have a selfservice ACI. ticket 446
* This is the second half of a patch. Only the part that had to beRob Crittenden2010-12-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | re-based got pushed for some reason. Use better description for group names in help and always prompt for members When running <foo>-[add|remove]-member completely interactively it didn't prompt for managing membership, it just reported that 0 members were handled which was rather confusing. This will work via a shell if you want to echo too: $ echo "" | ipa group-add-member g1 This returns 0 members because nothing is read for users or group members. $ echo -e "g1\nadmin\n" | ipa group-add-member This adds the user admin to the group g1. It adds it as a user because user membership is prompted for first. ticket 415
* Re-implement access control using an updated model.Rob Crittenden2010-12-011-11/+253
| | | | | | | | | | | | | | | | | | | The new model is based on permssions, privileges and roles. Most importantly it corrects the reverse membership that caused problems in the previous implementation. You add permission to privileges and privileges to roles, not the other way around (even though it works that way behind the scenes). A permission object is a combination of a simple group and an aci. The linkage between the aci and the permission is the description of the permission. This shows as the name/description of the aci. ldap:///self and groups granting groups (v1-style) are not supported by this model (it will be provided separately). This makes the aci plugin internal only. ticket 445
* Rename parent LDAPObject pkeys in child LDAPObject methods.Pavel Zuna2010-11-241-1/+5
| | | | | | | | If the parent and child entries have the same attribute as primary key (such as in the DNS schema), we need to rename the parent key to prevent a param name conflict. It has no side effects, because the primary key name is always taken from the LDAPObject params, never from the method params.
* Gracefully handle an empty members listRob Crittenden2010-11-241-1/+4
| | | | | | | | | | | This can occur if you do something like: $ ipa hbac-add-host --hosts="" testrule options will have an entry for 'host' but it will be None whcih is not iterable. ticket 486
* Generate better DuplicateEntry error messages in LDAPCreate.Pavel Zuna2010-11-231-6/+13
| | | | Ticket #530
* Change signature of LDAPSearch.pre_callback.Pavel Zuna2010-11-231-9/+10
| | | | Add the opportunity to change base DN and scope in the callback.
* Improve the documentation of setattr/addattrJakub Hrozek2010-11-191-2/+3
| | | | https://fedorahosted.org/freeipa/ticket/245
* Give a detached group a full set of group objectclasses.Rob Crittenden2010-11-191-0/+4
| | | | | | | The UUID plugin handles adding ipaUniqueId for us as well as the access control for it. ticket 250
* Fix returning effective rights for password policy.Rob Crittenden2010-11-191-1/+1
| | | | | | This also returns the rights for cospriority if the policy is for a group. ticket 449
* Add the --rights option to the LDAPUpdate base class.Rob Crittenden2010-11-051-10/+24
| | | | ticket 437
* user-enable/disable improvementsRob Crittenden2010-11-041-6/+6
| | | | | | | | | | | | | Always display the account enable/disable status. Don't ignore the exceptions when a user is already enabled or disabled. Fix the exception error messages to use the right terminology. In baseldap when retrieving all attributes include the default attributes in case they include some operational attributes. ticket 392
* Implement nested netgroups and include summaries for the commands.Rob Crittenden2010-10-291-8/+11
| | | | | | | Replace the existing netgroup test cases with Declarative tests. This triples the number of tests we were doing. ticket 209
* Return reason for failure when updating group membership fails.Rob Crittenden2010-10-281-9/+17
| | | | | | | | | | | We used to return a list of dns that failed to be added. We now return a list of tuples instead. The tuple looks like (dn, reason) where reason is the exception that was returned. Also made the label we use for failures to be singular instead of plural since we now print them out individually instead of as comma-separated. ticket 270
* Populate indirect members when showing a group object.Rob Crittenden2010-10-281-10/+98
| | | | | | | | | | | | | | | This is done by creating a new attribute, memberindirect, to hold this indirect membership. The new function get_members() can return all members or just indirect or direct. We are only using it to retrieve indirect members currently. This also: * Moves all member display attributes into baseldap.py to reduce duplication * Adds netgroup nesting * Use a unique object name in hbacsvc and hbacsvcgroup ticket 296
* Retrieve Get Effective Rights output with LDAPRetrieveRob Crittenden2010-10-281-0/+18
| | | | | | | The output is a pure python dict so is really only useful when used with --all so it is required. Updated to return a string for rights as opposed to a list. Terser, reducing the wire size by a factor of 3.5
* Allow RDN changes for users, groups, rolegroups and taskgroups.Rob Crittenden2010-10-281-0/+18
| | | | | | | | | | | | To do a change right now you have to perform a setattr like: ipa user-mod --setattr uid=newuser olduser The RDN change is performed before the rest of the mods. If the RDN change is the only change done then the EmptyModlist that update_entry() throws is ignored. ticket 323
* Add LDAPObject setting to handle different attributes for RDN and PKEY.Pavel Zuna2010-10-281-6/+44
|
* UUIDs: remove uuid python plugin and let DS always autogenerateSimo Sorce2010-10-281-2/+2
| | | | merge in remove uuid
* Disallow RDN change and single-value bypass using setattr/addattr.Pavel Zuna2010-10-181-1/+13
| | | | | | | | | | | When setting or adding an attribute wiht setatt/addattr check to see if there is a Param for the attribute and enforce the multi-value. If there is no Param check the LDAP schema for SINGLE-VALUE. Catch RDN mods and try to return a more reasonable error message. Ticket #230 Ticket #246
* Add 'continuous' mode to LDAPDelete. Fix *-del unit tests.Pavel Zuna2010-10-061-0/+9
| | | | Ticket #321
* Generate additional positional arguments for baseldap commands from takes_args.Pavel Zuna2010-10-061-0/+8
|
* Add LDAPMultiQuery base class and make it the base of LDAPDelete.Pavel Zuna2010-10-011-33/+65
| | | | | | | In other words: make *-del commands accept 1 or more primary keys of entries to be deleted. Ticket #20
* Use global time and size limit values when searching.Rob Crittenden2010-08-191-12/+10
| | | | | | Add test to verify that limit is honored and truncated flag set. ticket #48
generated by cgit (git 2.34.1) at 2024-09-26 18:23:59 +0000