summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Remove ipalib/plugins/basegroup.py. It's become obsolete.Pavel Zuna2009-10-231-551/+0
|
* Fix bug in print_attribute.Pavel Zuna2009-10-231-1/+1
| | | | | When the attribute had no values an exception was generated while trying to word-wrap it.
* Display membership attributes (member, memberOf) by default in show/find.Pavel Zuna2009-10-213-3/+5
|
* Require that a host exist before creating a service for it.Rob Crittenden2009-10-211-0/+5
|
* The name coming out of DNS will have a trailing dot (.). Remove it.Rob Crittenden2009-10-211-1/+1
|
* First pass at enforcing certificates be requested from same hostRob Crittenden2009-10-213-29/+91
| | | | | | | | | | | | We want to only allow a machine to request a certificate for itself, not for other machines. I've added a new taksgroup which will allow this. The requesting IP is resolved and compared to the subject of the CSR to determine if they are the same host. The same is done with the service principal. Subject alt names are not queried yet. This does not yet grant machines actual permission to request certificates yet, that is still limited to the taskgroup request_certs.
* Change Password param so (password, confirm_password) can be passed to ↵Jason Gerard DeRose2009-10-182-0/+18
| | | | _convert_scalar()
* Use the FQDN and not just the hostname internally.Rob Crittenden2009-10-161-2/+2
|
* Fixed 'import json' for simplejson compatabilityJason Gerard DeRose2009-10-161-0/+51
|
* Make plugin browser show plugin parent classJason Gerard DeRose2009-10-141-0/+3
|
* Removed util.add_global_options() and frontend.ApplicationJason Gerard DeRose2009-10-144-72/+4
|
* Giant webui patch take 2Jason Gerard DeRose2009-10-139-23/+85
|
* Fix bug in HBAC and netgroup plugin get_primary_key_from_dn methods.Pavel Zuna2009-10-082-2/+8
|
* Fix bug in group plugin. Was using wrong variable for attributes.Pavel Zuna2009-10-081-1/+1
| | | | Fix bug #527537.
* Make the taskgroup plugin use baseldap classes.Pavel Zuna2009-10-071-135/+40
|
* Make the rolegroup plugin use baseldap classes.Pavel Zuna2009-10-051-46/+41
|
* Make the hostgroup plugin use baseldap classes.Pavel Zuna2009-10-051-173/+45
|
* Make the netgroup plugin use baseldap classes.Pavel Zuna2009-10-051-309/+116
|
* Make the user plugin use baseldap classes.Pavel Zuna2009-10-051-230/+76
|
* Make the service plugin use baseldap classes.Pavel Zuna2009-10-051-205/+66
|
* Fix unit tests for plugins using baseldap classes.Pavel Zuna2009-10-051-1/+4
|
* Make the group plugin use baseldap classes.Pavel Zuna2009-10-051-124/+65
|
* Make the config plugin use baseldap classes.Pavel Zuna2009-10-051-103/+33
|
* Add HBAC plugin and introduce GeneralizedTime parameter type.Pavel Zuna2009-10-053-1/+427
|
* Add support for per-group kerberos password policy.Rob Crittenden2009-10-051-17/+217
| | | | | | | | | | Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
* Make primary_key optional.Rob Crittenden2009-10-051-2/+4
| | | | | The pwpolicy plugin doesn't have a primary key but can still take advantage of other parts of the framework.
* Fix aci plugin, enhance aci parsing capabilities, add user group supportRob Crittenden2009-09-282-33/+135
| | | | | | | | | | | | - The aci plugin didn't quite work with the new ldap2 backend. - We already walk through the target part of the ACI syntax so skip that in the regex altogether. This now lets us handle all current ACIs in IPA (some used to be ignored/skipped) - Add support for user groups so one can do v1-style delegation (group A can write attributes x,y,z in group B). It is actually quite a lot more flexible than that but you get the idea) - Improve error messages in the aci library - Add a bit of documentation to the aci plugin
* Fix Python 2.6 deprecation warning with the md5 import. Use hashlib instead.Rob Crittenden2009-09-281-2/+5
|
* Make the host plugin use baseldap classes.Pavel Zuna2009-09-281-252/+90
|
* Enrollment for a host in an IPA domainRob Crittenden2009-09-242-152/+26
| | | | | | | | | | | | This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-153-11/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Explicitly set verbosity off in the XML-RPC clientRob Crittenden2009-09-141-0/+1
| | | | | This is so I don't have to hunt for where to set this to True when doing low-level client debugging.
* Raise more specific error when an Objectclass Violation occurs Fix the ↵Rob Crittenden2009-09-142-3/+18
| | | | virtual plugin to work with the new backend
* Fix typos and minor bugs in baseldap. Add --all to LDAPUpdate.Pavel Zuna2009-09-111-6/+17
| | | | | | | Also, member attributes are now mapped to 'member user', 'member group', etc. instead of 'member users', 'member groups'. In other words, the second word is now taken from LDAPObject.object_name instead of LDAPObject.object_name_plural.
* Many SELinux fixes: ldapi, ctypes and dogtagRob Crittenden2009-09-102-4/+11
| | | | | | | | | | | ldapi: grants httpd and krb5kdc to access the DS ldapi socket ctypes: the Python uuid module includes ctypes which makes httpd segfault due to SELinux problems. dogtag: remove the CRL publishing permissions. This only worked if you had dogtag installed. In the near future will publish elsewhere so for the time being CRL file publishing will be broken with SELinux enabled.
* Automatically generate an auto.master map for new automount location.Pavel Zuna2009-09-101-0/+12
| | | | Also, add the automountlocation-show command for completeness sake.
* Remove parent_key parameter kwarg.Pavel Zuna2009-09-101-7/+4
| | | | Also replace a TYPE_ERROR with ValidationError.
* Add support for different automount maps per location.Pavel Zuna2009-09-101-91/+139
|
* Fix: Object.params_minus_pk was invalid when there was no primary_key.Pavel Zuna2009-09-091-0/+2
|
* Improve ipalib.plugins.baseldap classes.Pavel Zuna2009-09-091-97/+72
| | | | | | | | | | - remove obsolete code related to PluginProxy - remove parent_key attribute, for the purpose of nested objects the parent's primary key is retrieved automatically - added support for auto-generating of UUIDs - make use of the improved attribute printing in CLI - make LDAPDelete delete all sub-entries, not just one-level - minor bug fixes
* Remove obsolete CRUD base classes as they aren't used anymore.Pavel Zuna2009-09-081-48/+0
|
* Improve attribute printing in the CLI.Pavel Zuna2009-09-081-5/+28
| | | | | - allow choice between single/multiple value per line - word wrapping
* Fix bug in dns_find - execute() returned different value than expected.Pavel Zuna2009-09-081-1/+1
|
* Fleshed out krb plugin and added example of scripting against Python APIJason Gerard DeRose2009-08-311-0/+90
|
* Enable ldapi connections in the management framework.Rob Crittenden2009-08-271-2/+0
| | | | | | If you don't want to use ldapi then you can remove the ldap_uri setting in /etc/ipa/default.conf. The default for the framework is to use ldap://localhost:389/
* Fix service_mod and add a test caseRob Crittenden2009-08-261-8/+7
|
* Remove Python 2.6 BaseException.message deprecation warningRob Crittenden2009-08-201-5/+5
|
* Clean up additional issues discovered with pylint and pycheckerRob Crittenden2009-08-203-2/+18
|
* Clean up some problems discovered with pylint and pycheckerRob Crittenden2009-08-121-0/+16
| | | | | Much of this is formatting to make pylint happy but it also fixes some real bugs.
* Add a new objectclass, ipaObject, that will add a UUID to many IPA objectsRob Crittenden2009-08-105-5/+16
| | | | | | | | | ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
generated by cgit (git 2.34.1) at 2024-05-09 05:28:13 +0000