summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/user.py
Commit message (Collapse)AuthorAgeFilesLines
* fix broken search for users by their managerMartin Babinsky2015-07-231-4/+0
| | | | | | | | | The patch fixes incorrect construction of search filter when using `ipa user-find` with '--manager' option. https://fedorahosted.org/freeipa/ticket/5146 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* new commands to manage user/host/service certificatesMartin Babinsky2015-07-021-0/+52
| | | | | | | | | | | | A new group of commands is introduced that simplifies adding and removing binary certificates to entries. A general form of the command is ipa [user/host/service]-[add/remove]-cert [pkey] --certificate=[BASE64 BLOB] Part of http://www.freeipa.org/page/V4/User_Certificates and https://fedorahosted.org/freeipa/ticket/4238 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* plugable: Pass API to plugins on initialization rather than using set_apiJan Cholasta2015-07-011-3/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3090 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipalib: Load ipaserver plugins when api.env.in_server is TrueJan Cholasta2015-07-011-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/3090 https://fedorahosted.org/freeipa/ticket/5073 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* idviews: Remove ID overrides for permanently removed users and groupsTomas Babej2015-07-011-5/+10
| | | | | | | | | For IPA users and groups we are able to trigger a removal of any relevant ID overrides in user-del and group-del commands. https://fedorahosted.org/freeipa/ticket/5026 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* User life cycle: change user-del flags to be CLI-specificJan Cholasta2015-06-181-8/+24
| | | | | | | | Rename --permanently to --no-preserve. https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* User life cycle: provide preserved user virtual attributeJan Cholasta2015-06-151-30/+48
| | | | | | | https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add usercertificate attribute to user pluginFraser Tweedale2015-06-041-1/+1
| | | | | | Part of: https://fedorahosted.org/freeipa/tickets/4938 Reviewed-By: Martin Basti <mbasti@redhat.com>
* User life cycle: support of user-undelThierry Bordaz2015-05-181-1/+46
| | | | | | | | | add user plugin commands : user-undel user-undel: moves a user from delete container to the active container https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: user-find support finding delete usersThierry Bordaz2015-05-181-3/+20
| | | | | | | | | change user plugin commands : user-find user-find support of --preserved option to show preserved (aka deleted) users https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: user-del supports --permanently, --preserve options and ↵Thierry Bordaz2015-05-181-12/+123
| | | | | | | | | | | | | ability to delete deleted user change user plugin commands : user-del - --permanently: deletes permanently an Active user (DEL) - --preserve: move an Active user to Delete user (MODRDN) - allows to delete Active user and Delete user https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: new stageuser commands del/mod/find/showThierry Bordaz2015-05-181-76/+7
| | | | | | | | | | | | Add plugin commands to stageuser plugin: stageuser_del stageuser_mod stageuser_find stageuser_show https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* use Connectible.disconnect() instead of .destroy_connection()Petr Vobornik2015-05-071-1/+1
| | | | | | | | | Destroy connection is an internal function of Connectible and therefore it should not be used directly. https://fedorahosted.org/freeipa/ticket/4991 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* User life cycle: stageuser-add verbThierry bordaz (tbordaz)2015-04-081-401/+38
| | | | | | | | | | | | | | | Add a accounts plugin (accounts class) that defines variables and methods common to 'users' and 'stageuser'. accounts is a superclass of users/stageuser Add the stageuser plugin, with support of stageuser-add verb. Reviewed By: David Kupka, Martin Basti, Jan Cholasta https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: Make sure correct attribute name is referenced for faxTomas Babej2015-02-191-1/+1
| | | | | | | | | | Fixes the invalid attribute name reference in the 'System: Read User Addressbook Attributes' permission. https://fedorahosted.org/freeipa/ticket/4883 Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow PassSync user to locate and update NT usersMartin Kosek2015-01-191-0/+12
| | | | | | | | | | | | | | | Add new PassSync Service privilege that have sufficient access to let AD PassSync service search for NT users and update the password. To make sure existing PassSync user keeps working, it is added as a member of the new privilege. New update plugin is added to add link to the new privilege to the potentially existing PassSync user to avoid breaking the PassSync service. https://fedorahosted.org/freeipa/ticket/4837 Reviewed-By: David Kupka <dkupka@redhat.com>
* Support idviews in compat treeAlexander Bokovoy2014-10-201-0/+11
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add managed read permissions for compat treePetr Viktorin2014-09-051-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/4521 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Ensure ipaUserAuthTypeClass when needed on user creationNathaniel McCallum2014-09-031-13/+11
| | | | | | | | | Also, remove the attempt to load the objectClasses when absent. This never makes sense during an add operation. https://fedorahosted.org/freeipa/ticket/4455 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* trusts: Allow reading ipaNTSecurityIdentifier in user and group objectsTomas Babej2014-06-231-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4385 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipaplatform: Move all filesystem paths to ipaplatform.paths moduleTomas Babej2014-06-161-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add support for managedBy to tokensNathaniel McCallum2014-06-161-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also constitutes a rethinking of the token ACIs after the introduction of SELFDN support. Admins, as before, have full access to all token permissions. Normal users have read/search/compare access to all of the non-secret data for tokens assigned to them, whether managed by them or not. Users can add tokens if, and only if, they will also manage this token. Managers can also read/search/compare tokens they manage. Additionally, they can write non-secret data to their managed tokens and delete them. When a normal user self-creates a token (the default behavior), then managedBy is automatically set. When an admin creates a token for another user (or no owner is assigned at all), then managed by is not set. In this second case, the token is effectively read-only for the assigned owner. This behavior enables two important other behaviors. First, an admin can create a hardware token and assign it to the user as a read-only token. Second, when the user is deleted, only his self-managed tokens are deleted. All other (read-only) tokens are instead orphaned. This permits the same token object to be reasigned to another user without loss of any counter data. https://fedorahosted.org/freeipa/ticket/4228 https://fedorahosted.org/freeipa/ticket/4259 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make 'permission' the default bind type for managed permissionsPetr Viktorin2014-06-111-9/+0
| | | | | | | | | | | This reduces typing (or copy/pasting), and draws a bit of attention to any non-default privileges (currently 'any' or 'anonymous'). Leaving the bindtype out by mistake isn't dangerous: by default a permission is not granted to anyone, since it is not included in any priviliges. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update all remaining plugins to the new Registry APINathaniel McCallum2014-06-111-18/+12
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add missing attributes to User managed permissionsPetr Viktorin2014-06-101-2/+3
| | | | | | | | | | - Add nsAccountLock to the Unlock user accounts permission - Add member to Read User Membership - Add userClass and preferredLanguage to Modify Users https://fedorahosted.org/freeipa/ticket/3697 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert User default permissions to managedPetr Viktorin2014-06-101-0/+91
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission for the UPG DefinitionPetr Viktorin2014-05-291-0/+17
| | | | | | | | | | | | Since user_add checks the UPG definition to see if UPG is enabled, user admins need read access to add users correctly. All attributes are allowed since UPG Definition is an extensibleObject; the needed attributes are not in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-261-0/+17
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipalib: Expose krbPrincipalExpiration in CLITomas Babej2014-05-051-2/+7
| | | | | | | | | Adds a krbPrincipalExpiration attribute to the user class in user.py ipalib plugin as a DateTime parameter. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow primary keys to use different type than unicode.Jan Cholasta2014-04-181-3/+3
| | | | | | | | | | Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Extending user plugin with inetOrgPerson fieldsAdam Misnyovszki2014-03-281-1/+16
| | | | | | | | | | | | | | | According to http://tools.ietf.org/html/rfc2798 ipa client and web ui extended with inetOrgPerson fields: - employeenumber - employeetype - preferredlanguage - departmentnumber carlicenseplate is now multivalued https://fedorahosted.org/freeipa/ticket/4165 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add permission_filter_objectclasses for explicit type filtersPetr Viktorin2014-02-201-0/+1
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4074 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert remaining frontend code to LDAPEntry API.Jan Cholasta2014-01-241-21/+24
|
* Stop adding a default password policy referenceSimo Sorce2014-01-161-3/+0
| | | | | | | | | | | | | | | Both the password plugin and the kdb driver code automatically fall back to the default password policy. so stop adding an explicit reference to user objects and instead rely on the fallback. This way users created via the framework and users created via winsync plugin behave the same way wrt password policies and no surprises will happen. Also in case we need to change the default password policy DN this will allow just code changes instead of having to change each user entry created, and distinguish between the default policy and explicit admin changes. Related: https://fedorahosted.org/freeipa/ticket/4085
* Add OTP support to ipalib CLINathaniel McCallum2013-12-181-1/+9
| | | | https://fedorahosted.org/freeipa/ticket/3368
* Fix internal error in the user-status command.Jan Cholasta2013-12-101-3/+3
| | | | https://fedorahosted.org/freeipa/ticket/4066
* Add RADIUS proxy support to ipalib CLINathaniel McCallum2013-12-031-8/+57
| | | | https://fedorahosted.org/freeipa/ticket/3368
* Add userClass attribute for usersAna Krivokapic2013-11-191-3/+19
| | | | | | | | | This new freeform user attribute will allow provisioning systems to add custom tags for user objects which can be later used for automember rules or for additional local interpretation. Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems https://fedorahosted.org/freeipa/ticket/3588
* Add support for managing user auth typesNathaniel McCallum2013-11-081-5/+14
| | | | https://fedorahosted.org/freeipa/ticket/3368
* Remove word 'field' from GECOS param labelPetr Vobornik2013-07-231-1/+1
| | | | No other param/field has 'field' in a label.
* Use LDAP search instead of *group_show to check if a group exists.Jan Cholasta2013-07-111-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3706
* Change DNA magic value to -1 to make UID 999 usablePetr Viktorin2013-03-111-12/+22
| | | | | | | | | | | | | Change user-add's uid & gid parameters from autofill to optional. Change the DNA magic value to -1. For old clients, which will still send 999 when they want DNA assignment, translate the 999 to -1. This is done via a new capability, optional_uid_params. Tests included https://fedorahosted.org/freeipa/ticket/2886
* Use full DNs in plugin code.Jan Cholasta2013-03-011-1/+1
|
* Use the dn attribute of LDAPEntry to set/get DNs of entries.Jan Cholasta2013-03-011-6/+3
| | | | | Convert all code that uses the 'dn' key of LDAPEntry for this to use the dn attribute instead.
* Enable transactions by default, make password and modrdn TXN-awareRob Crittenden2012-11-211-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | The password and modrdn plugins needed to be made transaction aware for the pre and post operations. Remove the reverse member hoop jumping. Just fetch the entry once and all the memberof data is there (plus objectclass). Fix some unit tests that are failing because we actually get the data now due to transactions. Add small bit of code in user plugin to retrieve the user again ala wait_for_attr but in the case of transactions we need do it only once. Deprecate wait_for_attr code. Add a memberof fixup task for roles. https://fedorahosted.org/freeipa/ticket/1263 https://fedorahosted.org/freeipa/ticket/1891 https://fedorahosted.org/freeipa/ticket/2056 https://fedorahosted.org/freeipa/ticket/3043 https://fedorahosted.org/freeipa/ticket/3191 https://fedorahosted.org/freeipa/ticket/3046
* Improve user addition to default group in user-addTomas Babej2012-10-031-1/+9
| | | | | | | | | | On adding new user, user-add tries to make it a member of default user group. This, however, can raise AlreadyGroupMember when the user is already member of this group due to automember rule or default group configured. This patch makes sure AlreadyGroupMember exception is caught in such cases. https://fedorahosted.org/freeipa/ticket/3097
* Fix various typos.Yuri Chornoivan2012-09-181-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3089
* Use OpenSSH-style public keys as the preferred format of SSH public keys.Jan Cholasta2012-09-061-12/+14
| | | | | | | | | | | | | | | Public keys in the old format (raw RFC 4253 blob) are automatically converted to OpenSSH-style public keys. OpenSSH-style public keys are now stored in LDAP. Changed sshpubkeyfp to be an output parameter, as that is what it actually is. Allow parameter normalizers to be used on values of any type, not just unicode, so that public key blobs (which are str) can be normalized to OpenSSH-style public keys. ticket 2932, 2935
* Set the e-mail attribute using the default domain name by defaultRob Crittenden2012-09-071-6/+20
| | | | https://fedorahosted.org/freeipa/ticket/2810
generated by cgit (git 2.34.1) at 2024-05-27 22:45:13 +0000