summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Validation of details facet before update ↵test-patches-2-1Petr Vobornik2011-08-251-2/+4
| | | | | | | | https://fedorahosted.org/freeipa/ticket/1676 The ticket is a duplicate of server error, but it revealed few UI errors. Newly performs validation of details facet before update. If validation fails, notification dialog is shown and command isn't executed. Fixed integer minimum and maximum value checking. Read-only and non-writable fields are no longer considered required.
* Change the way has_keytab is determined, also check for password.Rob Crittenden2011-08-244-31/+61
| | | | | | | | | | | | | | | | | | | | We need an indicator to see if a keytab has been set on host and service entries. We also need a way to know if a one-time password is set on a host. This adds an ACI that grants search on userPassword and krbPrincipalKey so we can do an existence search on them. This way we can tell if the attribute is set and create a fake attribute accordingly. When a userPassword is set on a host a keytab is generated against that password so we always set has_keytab to False if a password exists. This is fine because when keytab gets generated for the host the password is removed (hence one-time). This adds has_keytab/has_password to the user, host and service plugins. ticket https://fedorahosted.org/freeipa/ticket/1538
* Improve sudorule documentationJr Aquino2011-08-231-0/+11
| | | | | | | | Added brief explanations for the various Sudo components in the top level doc. Added doc entries for RunAs User and RunAs Group. https://fedorahosted.org/freeipa/ticket/1657
* Updated add and delete association dialog titles.Endi S. Dewata2011-08-231-2/+20
| | | | | | | | | | The association table widget and facet have been modified to accept titles for the add and delete dialogs. The table and facet definitions have been modified to specify the appropriate titles. Some unused code have been removed. Ticket #1629
* Fix wording in examples of delegation plugin.Rob Crittenden2011-08-191-5/+5
| | | | https://fedorahosted.org/freeipa/ticket/1013
* Do batch logging on successful commands too, not just failures.Rob Crittenden2011-08-191-1/+1
| | | | This was an oversight for previous logging patch, ticket 1598
* Log each command in a batch separately.Rob Crittenden2011-08-191-1/+25
| | | | | | | This also fixes command logging in general, it wasn't working in most cases as a regression in ticket 1322. https://fedorahosted.org/freeipa/ticket/1598
* Fix automountlocation-import conflictsMartin Kosek2011-08-181-2/+14
| | | | | | | | | Do not fail import operation with DuplicateEntry when imported maps/keys conflict with maps/keys pre-created by automountlocation-add command. Currently, this applies for map 'auto.direct' and key '/-'. https://fedorahosted.org/freeipa/ticket/1551
* Replaced page dirty dialog title.Endi S. Dewata2011-08-191-1/+1
| | | | | | The title of page dirty dialog has been changed to 'Unsaved Changes'. Ticket #1653
* Removed 'Hide already enrolled' checkbox.Endi S. Dewata2011-08-191-1/+0
| | | | | | | | The 'Hide already enrolled' has been removed from the enrollment dialog because it is checked by default and entries that are already enrolled cannot be enrolled again. Ticket #1638
* Fix automountkey-modMartin Kosek2011-08-181-17/+36
| | | | | | | | | | | | | Fix automountkey-mod so that automountkey attribute is correctly updated. Add this test case to the unit tests. Make automountkey required for automountkey-mod, otherwise it would cause internal server error. Make --newinfo optional so that automountkey may be just renamed without changing its info attribute. https://fedorahosted.org/freeipa/ticket/1528
* ticket 1659 - invalid i18n string in dns.pyJohn Dennis2011-08-181-3/+2
| | | | | | | | | dns.py at line 976 has an invalid i18n string and cannot be processed during message extraction causing message catalog generation to fail. The format parameters are trapped inside the i18n string. Also it's not necessary to promote the i18n string literal to unicode via the u prefix because the _() function returns unicode.
* Add missing attribute labels for sudoruleMartin Kosek2011-08-171-0/+8
| | | | https://fedorahosted.org/freeipa/ticket/1571
* error dialog for batch commandPetr Vobornik2011-08-171-0/+5
| | | | | | | https://fedorahosted.org/freeipa/ticket/1597 https://fedorahosted.org/freeipa/ticket/1592 Added option to show multiple errors in error dialog.
* Pass empty options as empty arrays for supported dns record types. ↵Alexander Bokovoy2011-08-151-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/1632
* Fixed facet group labels.Endi S. Dewata2011-08-081-6/+3
| | | | | | | | The facet group labels have been modified according to UXD spec. Some facet groups will have more descriptive labels. Some others will not have any labels because the facet tab is self-explanatory. Ticket #1423, #1561
* Improve dnszone-add error messageMartin Kosek2011-08-081-1/+7
| | | | | | | Check that NS address passed in dnszone-add is a domain name and not an IP address. Make this clear also the parameter help. https://fedorahosted.org/freeipa/ticket/1567
* Hide continue option from automountkey-delMartin Kosek2011-08-021-0/+8
| | | | | | | This option makes no sense for automount keys. This should be removed in future versions. https://fedorahosted.org/freeipa/ticket/1529
* Deprecated managing users and runas user/group in sudorule add/modRob Crittenden2011-07-291-6/+18
| | | | | | | | We have helpers to manage these values so they shouldn't be available via add/mod. There is no logic behind them to do the right thing. https://fedorahosted.org/freeipa/ticket/1307 https://fedorahosted.org/freeipa/ticket/1320
* Add hbactest command. https://fedorahosted.org/freeipa/ticket/386Alexander Bokovoy2011-07-281-0/+327
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HBAC rules control who can access what services on what hosts and from where. You can use HBAC to control which users or groups on a source host can access a service, or group of services, on a target host. Since applying HBAC rules implies use of a production environment, this plugin aims to provide simulation of HBAC rules evaluation without having access to the production environment. Test user coming from source host to a service on a named host against existing enabled rules. ipa hbactest --user= --srchost= --host= --service= [--rules=rules-list] [--nodetail] [--enabled] [--disabled] --user, --srchost, --host, and --service are mandatory, others are optional. If --rules is specified simulate enabling of the specified rules and test the login of the user using only these rules. If --enabled is specified, all enabled HBAC rules will be added to simulation If --disabled is specified, all disabled HBAC rules will be added to simulation If --nodetail is specified, do not return information about rules matched/not matched. If both --rules and --enabled are specified, apply simulation to --rules _and_ all IPA enabled rules. If no --rules specified, simulation is run against all IPA enabled rules. EXAMPLES: 1. Use all enabled HBAC rules in IPA database to simulate: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 2. Disable detailed summary of how rules were applied: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail -------------------- Access granted: True -------------------- 3. Test explicitly specified HBAC rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: myrule 4. Use all enabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule matched: allow_all 5. Test all disabled HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled --------------------- Access granted: False --------------------- notmatched: new-rule 6. Test all disabled HBAC rules in IPA database + explicitly specified rules: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled --------------------- Access granted: False --------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule 7. Test all (enabled and disabled) HBAC rules in IPA database: $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled -------------------- Access granted: True -------------------- notmatched: my-second-rule notmatched: my-third-rule notmatched: myrule notmatched: new-rule matched: allow_all Only rules existing in IPA database are tested. They may be in enabled or disabled disabled state. Specifying them through --rules option explicitly enables them only in simulation run. Specifying non-existing rules will not grant access and report non-existing rules in output.
* Fixed missing memberof definition in HBAC service.Endi S. Dewata2011-07-281-1/+4
| | | | | | | The HBAC service class has been modified to define the memberof relationship with HBAC service group. Ticket #1546
* dns section header i18n.Adam Young2011-07-281-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/1493
* removing setters setup and initAdam Young2011-07-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | change widget and widget unit tests to hold on to entity, not entity name. Replacing entity_name with entity.name in most places. The one exception is columns for table_widget. Widgets that refer to other entities have to have late resolution of the entity object, due to circular dependencies. cleanup entity assignment. removed template and layout, merged setup into create adder dialogs adjust height for external removed init from widget, isection, association, facet, host and service Make unit tests use factory. fix functional tests to click find link correctly. tweak to activation test, but still broken. moved initialization code to the end use --all for hbacrule find, so the type shows up now fixed dns exception code and exception handling for get_entity replace metadata look up with value from entity. fixed author lines removed duplicate columns in managed by facets. tweak to nav fix in order to initialize tab. more defensive code update metadata for true false one line init for entity_name in widget move init code to end of constructor functions moved constants to start of function for adder_dialog external fields for dialogs initialized at dialog creation sudo sections: move add fields and columns to widget definition. The parameter validation in IPA.column ...This is precondition checking. Note that it merely throws an exception if the entity_name is not set. I want this stuff at the top of the function so that it is obvious to people looking to use them what is required. I added a comment to make this clear, but I'd like to keep precondition checking at the top of the function. decreased the scope of the pkey_name and moved the initiailzation fof columns into the setup_column function for association_tables return false at the end of click handler removed blank labels in sudo command section fix radio buttons for sudo category fixed table side for adder dialogs with external fields comments for future direction with add_columns https://fedorahosted.org/freeipa/ticket/1451 https://fedorahosted.org/freeipa/ticket/1462 https://fedorahosted.org/freeipa/ticket/1493 https://fedorahosted.org/freeipa/ticket/1497 https://fedorahosted.org/freeipa/ticket/1532 https://fedorahosted.org/freeipa/ticket/1534
* Don't leave dangling map if adding an indirect map failsRob Crittenden2011-07-271-5/+10
| | | | | | | | When using the add_indirect helper we create a new map and then add a key for it all in one step. If adding the key fails for any reason be sure to remove the map we added. https://fedorahosted.org/freeipa/ticket/1520
* Fix automountkey commands summaryMartin Kosek2011-07-271-4/+12
| | | | | | | | | | | The summary value was set to primary key. However, the primary key may contain also an info option as a workaround for multiple direct maps problem. This patch sets the result 'value' and thus summary text to expected and consistent value. https://fedorahosted.org/freeipa/ticket/1524
* fixed empty dns record updatePetr Vobornik2011-07-251-0/+3
| | | | | | | https://fedorahosted.org/freeipa/ticket/1477 Redirection after updating empty DNS Record (which is deleted). Added hook to details facet for post update operation.
* Autofill the default revocation reasonRob Crittenden2011-07-221-0/+1
| | | | https://fedorahosted.org/freeipa/ticket/1514
* Hide the HBAC access type attribute now that deny is deprecated.Rob Crittenden2011-07-211-4/+6
| | | | | | | It won't appear in the UI/CLI but is still available via XML-RPC. allow is the default and deny will be rejected. https://fedorahosted.org/freeipa/ticket/1495
* Add missing automount summariesMartin Kosek2011-07-211-0/+40
| | | | | https://fedorahosted.org/freeipa/ticket/1509 https://fedorahosted.org/freeipa/ticket/1510
* Only call entry_from_entry() after waiting for the new entry.Rob Crittenden2011-07-191-1/+1
| | | | This fixes an indentation problem.
* Fix regression when calculating external groups.Rob Crittenden2011-07-191-1/+1
| | | | | The members should be the current members of the entry, not the refreshed copy
* A removed external host is shown in output when removing external hosts.Rob Crittenden2011-07-181-3/+3
| | | | | | This is just a display problem, the host is actually removed from the entry. https://fedorahosted.org/freeipa/ticket/1492
* Fix sudorule-remove-userMartin Kosek2011-07-191-2/+2
| | | | | | | Removed sudorule "External User" is displayed in the output when "--all" switch is used. https://fedorahosted.org/freeipa/ticket/1489
* Optionally wait for 389-ds postop plugins to completeRob Crittenden2011-07-193-0/+66
| | | | | | | | | | | Add a new command that lets you wait for an attribute to appear in a value. Using this you can do things like wait for a managed entry to be created, adding a new objectclass to the parent entry. This is controlled by a new booleon option, wait_for_attr, defaulting to False. https://fedorahosted.org/freeipa/ticket/1144
* Return correct "RunAs External Group" when removing membersJr Aquino2011-07-181-4/+4
| | | | | | | | | If you used sudorule-remove-runasgroup to remove a member that member still appeared in the command output when --all was included (it isn't a default attribute). This was due to post-processing to evaluate external users/groups, the entry was actually updated properly. https://fedorahosted.org/freeipa/ticket/1348
* Add new dnszone-find testMartin Kosek2011-07-181-1/+1
| | | | | | | | Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
* Add ability to specify DNS reverse zone name by IP network address.Jan Cholasta2011-07-151-0/+30
| | | | | | | In order for this to work, chaining of parameters through default_from is made possible. ticket 1474
* Remove the ability to create new HBAC deny rules.Rob Crittenden2011-07-141-2/+8
| | | | | | | | | | New rules will all be allow type. Existing rules cannot be changed to deny. The type attribute now defaults to allow with autofill so it won't be prompted in interactive mode in the cli. https://fedorahosted.org/freeipa/ticket/1432
* In sudo labels we should use RunAs and not Run As.Rob Crittenden2011-07-141-6/+6
| | | | https://fedorahosted.org/freeipa/ticket/1328
* Document registering to an entitlement server with a UUID as not implemented.Rob Crittenden2011-07-141-1/+4
| | | | | | | | It was my understanding that we would be able to pass in an existing UUID when registering to connect to an existing registration (for the case where IPA is re-installed). This is supported in the REST API but not python-rhsm. https://fedorahosted.org/freeipa/ticket/1216
* Fixed label capitalizationEndi S. Dewata2011-07-1425-28/+28
| | | | | | | | The CSS text-transform sometimes produces incorrect capitalization, so the code has been modified to use translated labels that already contain the correct capitalization. Ticket #1424
* Filter reverse zones in dnszone-findMartin Kosek2011-07-131-4/+19
| | | | | | | | | Implements a new option to filter out reverse zones. This patch also do some clean up in dns plugin - debug prints were accidentally left here in the last dns patch. https://fedorahosted.org/freeipa/ticket/1471
* Convert nsaccountlock to always work as bool towards Python codeAlexander Bokovoy2011-07-131-11/+16
| | | | | | | | https://fedorahosted.org/freeipa/ticket/1259 Python code will see nsaccountlock as bool. JavaScript code will also see it as bool. This allows native boolean operations with the lock field. Passes both CLI and WebUI tests.
* Fixed object_name and object_name_plural internationalizationEndi S. Dewata2011-07-1226-63/+63
| | | | | | | | | The object_name, object_name_plural and messages that use these attributes have been converted to support translation. The label attribute in the Param class has been modified to accept unicode string. Ticket #1435
* Add DNS record modification commandMartin Kosek2011-07-121-42/+85
| | | | | | | | | | | | | | | | | The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
* Enforce class rules when query=True, continue to not run validators.ticket-hbac-testRob Crittenden2011-07-111-1/+1
| | | | | | | | | | | | | | | This started as a problem in allowing leading/trailing whitespaces on primary keys. In nearly every command other than add query is True so all rules were ignored on the primary key. This meant that to enforce whitespace we would need to define a validator for each one. I decided instead to set self.all_rules to just the class rules if query == True. So the minimum set of validators will be executed against each type but param-specific validators will only run on add. https://fedorahosted.org/freeipa/ticket/1285 https://fedorahosted.org/freeipa/ticket/1286 https://fedorahosted.org/freeipa/ticket/1287
* Added sudo options.Endi S. Dewata2011-07-111-0/+1
| | | | | | | A table has been added into sudo rule details page for managing sudo options. Ticket #1447
* password expiration labelAdam Young2011-07-051-1/+1
|
* Fixed object_name usage.Endi S. Dewata2011-07-058-15/+15
| | | | | | | | | | | The object_name attribute was used as both an identifier and a label which sometimes require different values (e.g. hbacrule vs. HBAC rule). The code that uses object_name as an identifier has been changed to use the 'name' attribute instead. The values of the object_name attribute have been fixed to become proper labels. Ticket #1217
* Add pwd expiration notif (ipapwdexpadvnotify) to config plugin def attr listRob Crittenden2011-07-051-0/+1
| | | | https://fedorahosted.org/freeipa/ticket/1416
generated by cgit (git 2.34.1) at 2024-05-11 00:28:49 +0000