| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
recent changes to the scope mechanism weren't propigated to the whoami call
|
|
|
|
|
|
|
|
| |
If the parent and child entries have the same attribute as primary
key (such as in the DNS schema), we need to rename the parent key
to prevent a param name conflict. It has no side effects, because
the primary key name is always taken from the LDAPObject params,
never from the method params.
|
|
|
|
|
|
|
|
|
|
|
| |
This can occur if you do something like:
$ ipa hbac-add-host --hosts="" testrule
options will have an entry for 'host' but it will be None whcih is
not iterable.
ticket 486
|
|
|
|
| |
Ticket #530
|
|
|
|
| |
Add the opportunity to change base DN and scope in the callback.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A host in DNS must have an IP address so a valid IP address is required
when adding a host. The --force flag will be needed too since you are
adding a host that isn't in DNS.
For IPv4 it will create an A and a PTR DNS record.
IPv6 isn't quite supported yet. Some basic work in the DNS installer
is needed to get this working. Once the get_reverse_zone() returns the
right value then this should start working and create an AAAA record and
the appropriate reverse entry.
When deleting a host with the --updatedns flag it will try to remove all
records it can find in the zone for this host.
ticket 238
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/245
|
|
|
|
|
|
|
| |
The UUID plugin handles adding ipaUniqueId for us as well as the access
control for it.
ticket 250
|
|
|
|
|
|
| |
This also returns the rights for cospriority if the policy is for a group.
ticket 449
|
|
|
|
|
|
| |
This will allow others to provision on behalf of the host.
ticket 280
|
|
|
|
|
|
|
|
|
| |
Disable any services when its host is disabled.
This also adds displaying the certificate attributes (subject, etc)
a bit more universal and centralized in a single function.
ticket 297
|
| |
|
| |
|
|
|
|
| |
and user-find [whoami] tostreamline the init process, and also allow us to add a call to enumerate the plugins.
|
|
|
|
| |
ticket 434
|
|
|
|
| |
ticket 463
|
|
|
|
| |
Ticket #452
|
|
|
|
| |
breaks the WebUI on Chrome. This fixes replaces the word with delete.
|
|
|
|
| |
ticket 443
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/244
|
|
|
|
|
|
|
|
| |
THis patch handles Kerberos ticket expiration in the UI. Additionally it removes the mod_atuh_kerb authorization for elements in the static directory, cutting down on the number of round trips required for initializing the web app
Conflicts:
install/static/ipa.js
|
|
|
|
| |
ticket 437
|
| |
|
|
|
|
| |
Allows the user to send multiple commands bundled together
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Always display the account enable/disable status.
Don't ignore the exceptions when a user is already enabled or disabled.
Fix the exception error messages to use the right terminology.
In baseldap when retrieving all attributes include the default attributes
in case they include some operational attributes.
ticket 392
|
|
|
|
|
|
| |
Also add validation to the List parameter type.
ticket 357
|
|
|
|
| |
sudorule to allow for cmdCategory all Added fixes for xmlrpc tests to reflect sudocmd changes.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This lets the KDC count password failures and can lock out accounts for
a period of time. This only works for KDC >= 1.8.
There currently is no way to unlock a locked account across a replica. MIT
Kerberos 1.9 is adding support for doing so. Once that is available unlock
will be added.
The concept of a "global" password policy has changed. When we were managing
the policy using the IPA password plugin it was smart enough to search up
the tree looking for a policy. The KDC is not so smart and relies on the
krbpwdpolicyreference to find the policy. For this reason every user entry
requires this attribute. I've created a new global_policy entry to store
the default password policy. All users point at this now. The group policy
works the same and can override this setting.
As a result the special "GLOBAL" name has been replaced with global_policy.
This policy works like any other and is the default if a name is not
provided on the command-line.
ticket 51
|
|
|
|
|
|
|
| |
Replace the existing netgroup test cases with Declarative tests. This triples
the number of tests we were doing.
ticket 209
|
|
|
|
|
|
|
|
|
|
|
| |
We used to return a list of dns that failed to be added. We now return
a list of tuples instead. The tuple looks like (dn, reason) where reason
is the exception that was returned.
Also made the label we use for failures to be singular instead of plural
since we now print them out individually instead of as comma-separated.
ticket 270
|
|
|
|
|
|
|
| |
UPG cannot have members and we use memberOf in class of service to determine
which policy to apply.
ticket 160
|
|
|
|
| |
ticket 389
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When a Requirement fails we throw an exception including the name of the
field that is missing. To make the command-line friendlier we have a
cli_name defined which may or may not match the LDAP attribute. This can
be confusing if you are using ipalib directly because the attribute name
missing may not match what is actually required (desc vs description is
a good example).
If you use the context 'cli' then it will throw exceptions using cli_name.
If you use any other context it will use the name of the attribute.
ticket 187
|
|
|
|
| |
ticket 228
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This is done by creating a new attribute, memberindirect, to hold this
indirect membership.
The new function get_members() can return all members or just indirect or
direct. We are only using it to retrieve indirect members currently.
This also:
* Moves all member display attributes into baseldap.py to reduce duplication
* Adds netgroup nesting
* Use a unique object name in hbacsvc and hbacsvcgroup
ticket 296
|
|
|
|
|
|
|
| |
The output is a pure python dict so is really only useful when used with
--all so it is required.
Updated to return a string for rights as opposed to a list. Terser, reducing the wire size by a factor of 3.5
|
|
|
|
|
|
|
|
|
|
|
|
| |
To do a change right now you have to perform a setattr like:
ipa user-mod --setattr uid=newuser olduser
The RDN change is performed before the rest of the mods. If the RDN
change is the only change done then the EmptyModlist that update_entry()
throws is ignored.
ticket 323
|
| |
|
|
|
|
| |
merge in remove uuid
|
|
|
|
| |
Removing the whoami plugin, as it has been wrapped up into the user plugin
|
|
|
|
|
|
| |
The first test is a mismatch in the sample output of an exception.
The second test adds certificate information output to the service plugin.
|
|
|
|
|
|
| |
The Gettext() object only does the lookup when you print it as a unicode.
ticket 308
|
|
|
|
| |
ticket #251
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The service certificate management UI has been generalized and moved
into certificate.js. The host details page is now using the same code
to manage certificates. The host.py has been modified to return host
certificate info.
The Get/Revoke/View buttons behavior has been modified such that they
are visible only if there is a valid certificate. The Get dialog box
has been fixed to show the correct certificate header and footer.
The ipa.css has been modified to store the style of the status bullets.
New unit tests for certificate has been added. The test data has been
modified to include sample host certificate.
|
|
|
|
| |
This should fix the hbac tests.
|
|
|
|
|
|
|
|
|
|
|
| |
When setting or adding an attribute wiht setatt/addattr check to
see if there is a Param for the attribute and enforce the multi-value.
If there is no Param check the LDAP schema for SINGLE-VALUE.
Catch RDN mods and try to return a more reasonable error message.
Ticket #230
Ticket #246
|
|
|
|
|
|
|
|
|
|
| |
It makes little sense to install ipa-admintools without ipa-client, require it.
Also see if the client has been configured. This is a bit tricky since we
have a full set of defaults. Add a new env option that gets set if at least
one configuration file is loaded.
ticket 213
|
|
|
|
| |
ticket 382
|
|
|
|
| |
ticket 182
|