summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/user.py
Commit message (Collapse)AuthorAgeFilesLines
...
* Use kerberos password policy.Rob Crittenden2010-11-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51
* Populate indirect members when showing a group object.Rob Crittenden2010-10-281-16/+0
| | | | | | | | | | | | | | | This is done by creating a new attribute, memberindirect, to hold this indirect membership. The new function get_members() can return all members or just indirect or direct. We are only using it to retrieve indirect members currently. This also: * Moves all member display attributes into baseldap.py to reduce duplication * Adds netgroup nesting * Use a unique object name in hbacsvc and hbacsvcgroup ticket 296
* Allow RDN changes for users, groups, rolegroups and taskgroups.Rob Crittenden2010-10-281-0/+1
| | | | | | | | | | | | To do a change right now you have to perform a setattr like: ipa user-mod --setattr uid=newuser olduser The RDN change is performed before the rest of the mods. If the RDN change is the only change done then the EmptyModlist that update_entry() throws is ignored. ticket 323
* Improve doc string for passwordRob Crittenden2010-10-151-1/+1
| | | | ticket 182
* Enforce the maximum username length from cn=ipaconfigRob Crittenden2010-10-131-0/+3
| | | | ticket 226
* Rename user-lock and user-unlock to user-enable user-disable.Pavel Zuna2010-10-061-12/+12
| | | | Ticket #165
* phonenumbersAdam Young2010-10-011-0/+10
| | | | Added in params for phone number types: phone, fax, mobile ,pager
* Remove reliance on the name 'admin' as a special user.Rob Crittenden2010-10-011-5/+0
| | | | | | | And move it to the group 'admins' instead. This way the admin user can be removed/renamed. ticket 197
* Fix sizelimit/timelimit options not working in user_findRob Crittenden2010-09-301-1/+1
|
* Use the principal from the context in whoami.Rob Crittenden2010-09-241-2/+2
| | | | ticket 227
* user-find whoamiAdam Young2010-09-151-0/+13
| | | | | | Now no longer breaks user-find with a filter Uses the corrected Params for getting option printf style strings
* Revert "user whoami"Adam Young2010-09-141-11/+0
| | | | This reverts commit bef0690a2ff9cccf7de132e5e64b4ba631482764.
* user whoamiAdam Young2010-09-141-0/+11
| | | | Added a whoami option to the user, allows the user to query their own information based on their Kerberos principal
* Update command documentation based on feedback from docs team.Rob Crittenden2010-08-271-11/+15
| | | | ticket #158
* Add optional error message to pattern validatorRob Crittenden2010-08-061-0/+3
| | | | | | | | | The pattern validator by default displays the pattern that is being matched against. This isn't helpful, particularly for very hairy patterns. This adds a new parameter, pattern_errmsg, that is displayed on errors if set. ticket #11
* Add separate var for search attributes and config attribute for search fieldsRob Crittenden2010-07-131-0/+1
| | | | | | | | Add an optional search_attributes variable in case the attributes you want to display by default aren't what you want to search on. Also link in any cn=ipaconfig attributes that contain a comma-separated list of attributes to search on.
* Add support for User-Private GroupsRob Crittenden2010-07-061-10/+16
| | | | | | | | | | | | | | | This uses a new 389-ds plugin, Managed Entries, to automatically create a group entry when a user is created. The DNA plugin ensures that the group has a gidNumber that matches the users uidNumber. When the user is removed the group is automatically removed as well. If the managed entries plugin is not available or if a specific, separate range for gidNumber is passed in at install time then User-Private Groups will not be configured. The code checking for the Managed Entries plugin may be removed at some point. This is there because this plugin is only available in a 389-ds alpha release currently (1.2.6-a4).
* First pass at per-command documentationRob Crittenden2010-06-221-0/+22
|
* Try to clear up that uid is a number, not the login nameRob Crittenden2010-05-171-1/+1
|
* Code cleanup: remove unused stuff, take 1.Pavel Zuna2010-03-011-23/+12
|
* Translatable Param.label, Param.docJason Gerard DeRose2010-02-241-14/+14
|
* Use the Output tuple to determine the order of outputRob Crittenden2010-02-151-5/+9
| | | | | | | | | | | | | | The attributes displayed is now dependant upon their definition in a Param. This enhances that, giving some level of control over how the result is displayed to the user. This also fixes displaying group membership, including failures of adding/removing entries. All tests pass now though there is still one problem. We need to return the dn as well. Once that is fixed we just need to comment out all the dn entries in the tests and they should once again pass.
* Add Object.label class attribute, enable in webUIJason Gerard DeRose2010-02-121-0/+2
|
* Enabled CRUDS in webUI using wehjit 0.2.0Jason Gerard DeRose2010-01-261-0/+3
|
* Add --all to LDAPCreate and make LDAP commands always display default ↵Pavel Zuna2010-01-111-1/+1
| | | | attributes.
* Take 2: Extensible return values and validation; steps toward a single ↵Jason Gerard DeRose2009-12-101-29/+50
| | | | output_for_cli(); enable more webUI stuff
* Giant webui patch take 2Jason Gerard DeRose2009-10-131-5/+4
|
* Make the user plugin use baseldap classes.Pavel Zuna2009-10-051-230/+76
|
* Add a new objectclass, ipaObject, that will add a UUID to many IPA objectsRob Crittenden2009-08-101-0/+3
| | | | | | | | | ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
* Fix bug: number of found entries was reported incorrectly in some plugins.Pavel Zuna2009-07-021-1/+1
|
* Rename *-create/*-delete commands to *-add/*-del respectively.Pavel Zuna2009-07-021-4/+4
|
* Rename plugins2 to plugins.Pavel Zuna2009-07-021-16/+16
|
* Rename plugins2 files (remove '2' suffix').Pavel Zuna2009-07-021-0/+405
|
* Delete plugins using old LDAP backend.Pavel Zuna2009-07-021-383/+0
|
* Add a reason to the NotFound exception so we can provide more robust errorsRob Crittenden2009-05-131-1/+1
|
* Use correct attribute for e-mail addressRob Crittenden2009-04-291-1/+1
| | | | Resolves 498269
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-231-3/+3
|
* Renamed remaining plugins still using f_* b_* conventionJason Gerard DeRose2009-04-011-0/+383
generated by cgit (git 2.34.1) at 2024-05-20 11:17:16 +0000