summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Unable to rename permission objectOndrej Hamada2012-04-111-8/+11
| | | | | | | The update was failing because of the case insensitivity of permission object DN. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2571
* Fix expected error messages in testsPetr Viktorin2012-04-101-1/+4
| | | | | | | | | | | | | | | | | Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
* Removal of memberofindirect_permissons from privilegesPetr Vobornik2012-04-091-4/+1
| | | | | | | | | | | | | Problem: In the Privilege page, can list Permissions. This "Shows Results" for "Direct Membership". But there is an option to list this for "Indirect Membership" also. There isn't a way to nest permissions, so this option is not needed. Solution: This patch removes the memberofindirect_persmission definition from server plugin. It fixes the problem in Web UI. https://fedorahosted.org/freeipa/ticket/2611
* Convert --setattr values for attributes marked no_updatePetr Viktorin2012-04-092-3/+10
| | | | | | | | | | | | | Attribute Patrams marked no_update never get cloned to Update commands, and thus never receive the `attribute` flag. This makes their `encode` method a no-op, which meant they don't get properly encoded when used with --setattr, making the --setattr fail. Introduce a `force` argument to encode, which overrides checking for the attribute flag. Use this in set/add/delattr normalization, where we know we are dealing with attributes. https://fedorahosted.org/freeipa/ticket/2616
* Limit permission and selfservice names to alphanumerics, -, _, spacePetr Viktorin2012-04-092-0/+8
| | | | | | | | The DN and ACI code doesn't always escape special characters properly. Rather than trying to fix it, this patch takes the easy way out and enforces that the names are safe. https://fedorahosted.org/freeipa/ticket/2585
* DNS forward policy: checkboxes changed to radio buttonsPetr Vobornik2012-04-101-0/+2
| | | | | | | | DNS forward policy fields were using mutually exclusive checkboxes. Such behavior is unusual for users. Checkboxes were changed to radios. https://fedorahosted.org/freeipa/ticket/2599
* Reworked netgroup Web UI to allow setting user/host categoryPetr Vobornik2012-04-101-0/+11
| | | | | | | | This patch is changing netgroup web ui to look more like hbac or sudo rule UI. This change allows to define and display user category, host category and external host. The core of the change is changing member attributes (user, group, host, hostgroup) to use rule_details_widget instead of separate association facets. In host case it allows to display and add external hosts. https://fedorahosted.org/freeipa/ticket/2578
* Check configured maximum user login length on user rename.Jan Cholasta2012-04-081-0/+10
| | | | ticket 2587
* Confusing default user groupsOndrej Hamada2012-04-081-15/+20
| | | | | | | Added 'fallback' into the labels for default automember group and hostgroup. https://fedorahosted.org/freeipa/ticket/2354
* Add missing comma to list of services that cannot be disabled.Rob Crittenden2012-04-051-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2487
* Check whether the default user group is POSIX when adding new user with ↵Jan Cholasta2012-04-051-4/+8
| | | | | | --noprivate. ticket 2572
* Make revocation_reason required when revoking a certificate.Rob Crittenden2012-04-051-1/+1
| | | | | | | This will prevent errors if an empty reason is provided and it is set by default one doesn't have to always set it on the command-line. https://fedorahosted.org/freeipa/ticket/2597
* Defer conversion and validation until after --{add,del,set}attr are handledPetr Viktorin2012-04-031-17/+35
| | | | | | | | | | | | | | | | | | | | | --addattr & friends that modified attributes known to Python sometimes used converted and validated Python values instead of LDAP strings. This caused a problem for --delattr, which searched for a converted integer in a list of raw strings (ticket 2407). With this patch we work on raw strings, converting only when done. Deferring validation ensures the end result is valid, so proper errors are raised instead of failing later (ticket 2405). Tests included. Replaces previous fix for: https://fedorahosted.org/freeipa/ticket/2418 Fixes: https://fedorahosted.org/freeipa/ticket/2405 https://fedorahosted.org/freeipa/ticket/2407 https://fedorahosted.org/freeipa/ticket/2408
* Test the batch pluginPetr Viktorin2012-04-031-7/+4
| | | | | | | | | This adds tests for the batch plugin, and changes its output declaration to allow results as tuples (this tripped validation). The assert_deepequal function ignores the order of items in lists. Document this in its docstring, and use a custom checker for the batch plugin results.
* Don't create private groups for migrated users, check for valid gidnumberRob Crittenden2012-04-031-31/+67
| | | | | | | | | | | | | | | | | Migrated users don't get a private group, there is no safe way to verify that the namespace is correct without redoing the uidnumber as well. Verify that the GID at least points to a valid group on the remote server and warn if it doesn't (this doesn't guarantee that the group gets migrated but at least we try). If the remote entry has no gidNumber then don't migrate that user. We don't know why that user is non-POSIX, it could be a special user used for auth, for example. Add a loginshell if the remote user doesn't have one. https://fedorahosted.org/freeipa/ticket/2562
* Improve automount indirect map error messageMartin Kosek2012-03-281-0/+4
| | | | | | | | | | When user does not pass a name of parent map in automountmap-add-indirect command, auto.master is used as a default. However, when auto.master does not exist in a given location, we raise NotFound error with a name of a location instead of a name of the missing automount map. https://fedorahosted.org/freeipa/ticket/2387
* Allow multi-line CSV parametersPetr Viktorin2012-03-281-5/+6
| | | | | | | Feed individual lines of input into the CSV parser, and include all lines in the output. https://fedorahosted.org/freeipa/ticket/2402
* Netgroup nisdomain and hosts validationOndrej Hamada2012-03-285-11/+47
| | | | | | | | | | | | | | | | | | | | | | | | nisdomain validation: Added pattern to the 'nisdomain' parameter to validate the specified nisdomain name. According to most common use cases the same pattern as for netgroup should fit. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2448 'add_external_pre_callback' function was created to allow validation of all external members. Validation is based on usage of objects primary key parameter. The 'add_external_pre_callback' fucntion has to be called directly from in the 'pre_callback' function. This change affects netgroup, hbacrule and sudorule commands. For hostname, the validator allows non-fqdn and underscore characters. validate_hostname function in ipalib.util was modified and contains additional option that allows hostname to contain underscore characters. This option is disabled by default. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2447
* Add CLI parsing testsPetr Viktorin2012-03-283-5/+23
| | | | | | | These test that command lines are parsed to correct Command arguments. Includes some tests for interactive prompts. To make this possible cli.run is broken up into several pieces.
* Change parameters to use only default_from for dynamic default values.Jan Cholasta2012-03-283-76/+9
| | | | | | | | | Replace all occurences of create_default with equivalent default_from and remove create_default from the framework. This is needed for proper parameter validation, as there is no way to tell which parameters to validate prior to calling create_default, because create_default does not provide information about which parameters are used for generating the default value.
* Fix the procedure for getting default values of command parameters.Jan Cholasta2012-03-283-34/+75
| | | | | | | The parameters used in default_from of other parameters are now properly validated before the default_from is called. ticket 1847
* Fix uses of O=REALM instead of the configured certificate subject base.Jan Cholasta2012-03-261-4/+18
| | | | ticket 2521
* Fix dnsrecord-del interactive modeMartin Kosek2012-03-271-2/+1
| | | | | | | User was not able to select multiple values in dnsrecord-del interactive mode. https://fedorahosted.org/freeipa/ticket/2581
* Improve user awareness about dnsconfigMartin Kosek2012-03-261-0/+22
| | | | | | | | | | | | Global DNS configuration is a nice tool to maintain a common DNS settings stored in LDAP which are then used for all enrolled IPA servers. However, the settings stored in LDAP override local settings in named.conf on DNS servers. This patch adds more information about global DNS configuration options in install scripts and DNS module help. https://fedorahosted.org/freeipa/ticket/2525
* Typos in FreeIPA messagesOndrej Hamada2012-03-232-2/+2
| | | | | | | Rebased patch sent by Yuri Chornoivan (yurchor@ukr.net). Fixes 'occured' and 'commond' typos in FreeIPA messages. https://fedorahosted.org/freeipa/ticket/2526
* Fix default SOA serial formatMartin Kosek2012-03-231-2/+2
| | | | | | RFC 1912 recommends format YYYYMMDDnn, we used YYYYDDMMnn. https://fedorahosted.org/freeipa/ticket/2567
* Avoid deleting DNS zone when a context is reusedMartin Kosek2012-03-231-5/+12
| | | | | | | | | | | | | | | | | | | When dnsrecord-del pre_callback detects that the record does not contain any records, it sets a flag to connection context and deletes the record object later. However, when more dnsrecord-del commands share the same context (and this is the case of "ipa-replica-manage del $MASTER" DNS cleanup), it may reuse a positive flag from previous dnsrecord-del command and delete the root DNS zone record and thus effectively delete the zone. This patch makes sure that this flag is always initialized to a sane value in dnsrecord-del pre_callback to make sure that the DNS zone is not deleted. It also fixes pre_callback function definition to prevent adding attrs_list to "keys" parameter and thus confuse developers. https://fedorahosted.org/freeipa/ticket/2503
* Normalize the primary key value to lowercase during migration.Rob Crittenden2012-03-221-0/+1
| | | | https://bugzilla.redhat.com/show_bug.cgi?id=804609
* Fix attributes that contain DNs when migrating.Rob Crittenden2012-03-222-2/+52
| | | | | | | Some attributes, like secretary and manager, may point to other LDAP entries. We need to fix these during migration. https://fedorahosted.org/freeipa/ticket/2562
* Harden raw record processing in DNS pluginMartin Kosek2012-03-221-12/+18
| | | | | | | | | | | | | | | | There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
* Fix precallback validators in DNS pluginMartin Kosek2012-03-221-28/+32
| | | | | | | | | | | | | | | DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
* Only split CSV in the client, quote instead of escapingPetr Viktorin2012-03-203-12/+63
| | | | | | | | | | | | | | | | | Splitting on commas is not an idempotent operation: 'a,b\,c' -> ('a', 'b,c') -> ('a', 'b', 'c') That means we can't do it when the call is forwarded, so this is only done on the CLI. The UI already sends values as a tuple. Replace escaping in the csv parser with quoting. Quoted strings can have embedded commas instead of having to escape them. This prevents the csv parser from eating all escape characters. Also, document Param's csv arguments, and update tests. https://fedorahosted.org/freeipa/ticket/2417 https://fedorahosted.org/freeipa/ticket/2227
* DNS forwarder validatorPetr Vobornik2012-03-201-0/+1
| | | | | | | | DNS forwarder's value can consist of IP address and a port. The syntax is '<IP ADDRESS> port <PORT>'. A new validator was created for this purpose. It is based on IP address validator. https://fedorahosted.org/freeipa/ticket/2490
* Add missing global options in dnsconfigMartin Kosek2012-03-201-1/+20
| | | | | | | | | | | Add a support for new global options in bind-dyndb-ldap, that is: * idnsforwardpolicy: Default policy for conditional forwarding * idnsallowsyncptr: Allow globaly PTR synchronization for dynamic updates * idnszonerefresh: Default interval between regular polls of the name server for new DNS zones https://fedorahosted.org/freeipa/ticket/2439
* Allow port numbers for idnsForwardersMartin Kosek2012-03-201-4/+24
| | | | | | | | Let user enter custom ports for zone conditional forwarders or global forwarders in dnsconfig. Ports can be specified in a standard BIND format: IP_ADDRESS [port PORT] https://fedorahosted.org/freeipa/ticket/2462
* Use a consistent parameter name in errors, defaulting to cli_name.Rob Crittenden2012-03-202-16/+24
| | | | | | | | For general command-line errors we want to use the cli_name on output. The exception is when using *attr, we want to return that attribute name in the exception. https://fedorahosted.org/freeipa/ticket/1418
* Content is no more overwritten by error messagePetr Vobornik2012-03-191-0/+8
| | | | | | | | | | | | | | | | | When an error which caused calling of report_error occurt, the content of a facet got replaced by error message. There was no way how to force the facet to recreate its content and the facet became unusable. This patch creates a containter for an error message. On error, report_error writes its content to error container, content container is hidden and error container is shown. Older comment in a code suggested to move the error message to facet's footer. A message in a footer could be missed by the user and on top of that a footer is sometimes used by various facet and we would have to solve the same problem again. From experience the cause of an error is usually a missing pkey in a path. Therefore error information suggests user to navigate to top level. It causes to load default facets with default values so errors in navigation state shouldn't happen. Facet content is displayed back on facet_show. If user tries to display same object as before facet's need_update() would return false, therefore need_update was modified to always return true if error is displayed. Reproduction: 1) display any nested entity - ie DNS record 2) delete its parent pkey from path - &dnszone-pkey=example.com 3) reload the page with this path https://fedorahosted.org/freeipa/ticket/2449
* Don't allow hosts and services of IPA masters to be disabled.Rob Crittenden2012-03-193-7/+19
| | | | https://fedorahosted.org/freeipa/ticket/2487
* Import the ipaserver plugins based on context, not env.in_server.Rob Crittenden2012-03-191-1/+1
| | | | | | | | | in_server controls how a method is dispatched, it should not also control what plugins are imported. This suppresses the error message "session memcached servers not running." https://fedorahosted.org/freeipa/ticket/2499
* Better hbactest validation messagePetr Vobornik2012-03-151-0/+1
| | | | | | | | HBAC Test validation message contains all missing values in form of list of links instead of general 'missing values' message and redirection to first missing value's facet. When a link is clicked user is redirected to value's facet. https://fedorahosted.org/freeipa/ticket/2182
* Display serial number as HEX (DECIMAL) when showing certificates.Rob Crittenden2012-03-144-19/+25
| | | | https://fedorahosted.org/freeipa/ticket/1991
* Don't crash when searching with empty relationship optionsPetr Viktorin2012-03-131-22/+14
| | | | | | | | | | | | | | | | Empty sequences (and sequences of empty strings) are normalized to None, but the member filter code expected a list. This patch extends a test for missing options to also catch false values. The functional change is from `if param_name in options:` to `if options.get(param_name):`; the rest of the patch is code de-duplication and tests. These are CSV params with csv_skipspace set, so on the CLI, empty set is given as a string with just spaces and commas (including the empty string). https://fedorahosted.org/freeipa/ticket/2479
* Don't set dbdir in the connection until after the connection is created.Rob Crittenden2012-03-131-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were comparing the current connection with itself so were never going to call nss_shutdown(). dbdir needs to be set after the connection has been made. This worked on single server installs because we don't do a ping so NSS would never be pre-initialized. If multiple servers are available we call ping() to find one that is up before submitting the request, this is what would have pre-initialized NSS. This was tripping up request-cert because it will intialize NSS with no DB if it hasn't been initialized. We need to initialize it to validate the CSR. A non-working client was doing this when calling cert-request: - call load_certificate_request() - nss.nss_nodb_init() - load the CSR - create a connection, dbdir=/etc/pki/nssdb - the dbdir matches within the same connection, don't call nss_shutdown() - connect to remote server - fail, untrusted CA because we are still using db from nss_nodb_init. Instead if we set dbdir afterward then this will properly be shutdown and NSS re-initialized with correct dbdir. https://fedorahosted.org/freeipa/ticket/2498
* Fix migration plugin compat checkMartin Kosek2012-03-111-3/+7
| | | | | | | | | | | | Ticket #2274 implements a check for compat plugin and warns user if it is enabled. However, there are 2 issues connected with the plugin: 1) The check is performed against the remote (migrated) LDAP server and not the local LDAP server, which does not make much sense 2) When the compat plugin is missing in cn=plugins,cn=config, it raises an error and thus breaks the migration This patch fixes both issues. https://fedorahosted.org/freeipa/ticket/2508
* Mark most config options as requiredPetr Viktorin2012-03-121-15/+15
| | | | | | | IPA assumes most config options are present, but allowed the user to delete them. This patch marks them as required. https://fedorahosted.org/freeipa/ticket/2159
* Enforce that required attributes can't be set to None in CRUD UpdatePetr Viktorin2012-03-123-7/+17
| | | | | | | | | | | | The `required` parameter attribute didn't distinguish between cases where the parameter is not given and all, and where the parameter is given but empty. The case of updating a required attribute couldn't be validated properly, because when it is given but empty, validators don't run. This patch introduces a new flag, 'nonempty', that specifies the parameter can be missing (if not required), but it can't be None. This flag gets added automatically to required parameters in CRUD Update.
* Allow removing sudo commands with special characters from command groupsPetr Viktorin2012-03-121-2/+2
| | | | | | | | | Previously the commands were compared as serialized strings. Differences in serializations meant commands with special characters weren't found in the checked list. Use the DN class to compare DNs correctly. https://fedorahosted.org/freeipa/ticket/2483
* Ignore case in yes/no promptsMartin Kosek2012-03-071-1/+1
| | | | | | | | | We did not accept answers like "Yes", "YES", "No", etc. as valid answers to yes/no prompts (used for example in dnsrecord-del interactive mode). This could confuse users. This patch changes the behavior to ignore the answer case. https://fedorahosted.org/freeipa/ticket/2484
* Do kinit in client before connecting to backendRob Crittenden2012-03-041-4/+27
| | | | | | | | | | | | | | The client installer was failing because a backend connection could be created before a kinit was done. Allow multiple simultaneous connections. This could fail with an NSS shutdown error when the second connection was created (objects still in use). If all connections currently use the same database then there is no need to initialize, let it be skipped. Add additional logging to client installer. https://fedorahosted.org/freeipa/ticket/2478
* Improve dnsrecord interactive helpMartin Kosek2012-03-012-20/+109
| | | | | | | | | | | | | | | | | | | | | Add 2 new features to DNS record interactive help to increase its usability and also make its behavior more consistent with standard parameter interactive help: 1) Ask for missing DNS parts When a required part of a newly added DNS record was missing, we just returned a ValidationError. Now, the interactive help rather asks for all missing required parts of all DNS records that were being added by its parts. 2) Let user amend invalid part When an interactive help asked for a DNS record part value and user enters an invalid value, the entire interactive help exits with an error. This may upset a user if he already entered several correct DNS record part values. Now, the help rather tells user what's wrong and give him an opportunity to amend the value. https://fedorahosted.org/freeipa/ticket/2386
generated by cgit (git 2.34.1) at 2024-06-08 15:39:35 +0000