summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Implement permission/aci find by subtreeRob Crittenden2012-05-151-1/+12
| | | | https://fedorahosted.org/freeipa/ticket/2321
* Do not use extra command options in ACI, permission, selfservicePetr Viktorin2012-05-143-36/+26
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for ACI-related plugins. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Fix overlapping cn param/option issue, pass cn as aciname in findRob Crittenden2012-05-141-0/+7
| | | | | | | | | | | | permission-find --name wasn't working for two reasons. The first was that the cn to search on in options ended up overlapping the primary key name causing the request to fail. The second reason was aci uses aciname, not cn, as its name field. So searching on --name matched everything because it was as if you were searching on nothing. https://fedorahosted.org/freeipa/ticket/2320
* General details facet actionsPetr Vobornik2012-05-111-0/+2
| | | | | | This patch adds common action button actions for enabling/disabling/deleting object. https://fedorahosted.org/freeipa/ticket/2707
* Action listsPetr Vobornik2012-05-111-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch add support fo Action Lists. Action list is a select widget with actions as options located in facet header. Action can be selected and then executed by clickin on 'apply' button. Actions lists are defined on facet level. Facet header takes them from facet. Action list options actions: list of actions state_evaluator: a state evaluator which is needed for enabling/disabling options. Can encapsulate more evaluators. State evaluator object ---------------------- State evaluator is resposible for evaluating a state from result set. State is a array of strings. Each evaluator should inherit from IPA.state_evaluator and override evaluate method. Methods: evaluate(record): should return string array which represents the state get_description(): human readable representation of a state Action ------ Action is a object which can perform certain action on a facet. Action has enabling and disabling conditions. action options: name: string, required, name of the option label: string, required, human readable name of the option enable_cond: string array, states which need to be present in order to run this action disable_cond: string array, states which must not be present in order to run this action handler: function, contains action's logic needs_confirm: boolean, default false, indicates if action needs user confirmation confirm_msg: string, default generic message, human readable confirmation message. Action list should contain logic which enables/disables action based on facet state and action's enabling/disabling conditions. It should also enforce presence of confirmation. In this patch is also slightly modified facet header, mostly title part. It was revised to contain status icon, title and action list on single line. Facet header is using state evaluator's get_description method to properly set tooltip for state icon. https://fedorahosted.org/freeipa/ticket/2247
* Validate externalhost (when added by --addattr/--setattr)Petr Viktorin2012-05-114-3/+17
| | | | | | | | | | | | Change the externalhost attribute of hbacrule, netgroup and sudorule into a full-fledged Parameter, and attach a validator to it. The validator is relaxed to allow underscores, so that some hosts with nonstandard names can be added. Tests included. https://fedorahosted.org/freeipa/ticket/2649
* Remove duplicate and unused utility codePetr Viktorin2012-05-093-49/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Don't fail when adding default objectclasses using config-modPetr Viktorin2012-05-091-2/+2
| | | | | | | | | | The config plugin was adding together a list and a tuple, then converting to a set. Replace the operation with a set union. Regression test included. https://fedorahosted.org/freeipa/ticket/2706
* Redo boolean value encoding.Jan Cholasta2012-05-094-50/+9
| | | | | | | Move the code for encoding boolean values to LDAP boolean syntax from the Parameter class to the Encoder class, where the rest of LDAP encoding takes place. Remove encoding code from the Parameter class altogether, as all LDAP encoding should be done in the Encoder class.
* Do not crash on empty --setattr, --getattr, --addattrPetr Viktorin2012-05-071-8/+8
| | | | | | Also the unused `append` argument from _convert_2_dict. https://fedorahosted.org/freeipa/ticket/2680
* Do not crash on empty reverse member optionsPetr Viktorin2012-05-071-2/+2
| | | | | | | | | | | Calling a LDAP{Add,Remove}ReverseMember with an empty reverse_member caused an internal error, because empty values are converted to None, which is then iterated. Use an empty list instead of None (or other false falues, of which we only use the empty list). https://fedorahosted.org/freeipa/ticket/2681
* Do not use extra command options in the automount pluginPetr Viktorin2012-05-071-20/+18
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for the automount plugin and its tests. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Allow one letter net/hostgroups namesOndrej Hamada2012-05-071-1/+1
| | | | | | | Changed regex validating net/hostgroup names to allow single letter names. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2671
* Improve error message in zonemgr validatorMartin Kosek2012-04-291-18/+22
| | | | | | | | | This patch consolidates zonemgr function to move the most of the checks to common functions in order to provide consistent output. The error messages produced by the validator should now be more helpful when identifying the source of error. https://fedorahosted.org/freeipa/ticket/1966
* Revert "Validate attributes in permission-add"Rob Crittenden2012-04-291-56/+0
| | | | | | | | This reverts commit 1356988b7a40a60af39807db143860efb4a2f435. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Sort password policies properly with --pkey-onlyMartin Kosek2012-04-262-12/+31
| | | | | | | | | | | | | | | | | | | | | | Password policy plugin sorts password policies by its COS priority. However, when the pwpolicy-find command is run with --pkey-only, the resulting entries do not contain COS priority and the sort function crashes. This patch makes sure that cospriority is present in the time of the result sorting process and removes the cospriority again when the sorting is done. This way, the entries are sorted properly both with and without --pkey-only flag. Previous entries_sortfn member attribute of LDAPSearch class containing custom user sorting function was replaced just with a flag indicating if a sorting in LDAPSearch shall be done at all. This change makes it possible to sort entries in a custom post_callback which is much more powerful (and essential for sorting like in pwpolicy plugin) approach than a plain sorting function. https://fedorahosted.org/freeipa/ticket/2676
* Refactor exc_callback invocation.Jan Cholasta2012-04-265-182/+113
| | | | | | | | | Replace _call_exc_callbacks with a function wrapper, which will automatically call exception callbacks when an exception is raised from the function. This removes the need to specify the function and its arguments twice (once in the function call itself and once in _call_exc_callbacks). Add some extra checks to existing exception callbacks.
* Update docs for user-status, always show disabled, time for each server.Rob Crittenden2012-04-231-2/+31
| | | | | | | | | | | | Provide some guidance on how to read and understand the output. Some manual work is needed to identify which master the user is locked on. Always display the enabled/disabled status. Include the time that the master was contacted in the output for each master as lockout is very time sensitive. https://fedorahosted.org/freeipa/ticket/2162
* Fix name error in hbactestJohn Dennis2012-04-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Ticket #2512 In hbactest.py there is a name error wrapped inside a try/except block that ignores all errors so the code block exits prematurely leaving a critical variable uninitialized. The name error is the result of a cut-n-paste error that references a variable that had never been initialized in the scope of the code block. Python generates an exception when this variable is referenced but because it's wrapped in a try/except block that catches all errors and ignores all errors there is no evidence that something went wrong. The fix is to use the correct variables. At some point we may want to revist if ignoring all errors and proceding as if nothing happened is actually correct. Alexander tells me this mimics what SSSD does in the hbac rule processing, thus the ignoring of errors is intentional. But in a plugin whose purpose is to test and exercise hbac rules I'm not sure ignoring all errors is really the right behavior.
* Fix internal error when renaming user with an empty string.Jan Cholasta2012-04-181-1/+1
| | | | ticket 2629
* Do not fail migration because of duplicate groupsMartin Kosek2012-04-171-1/+6
| | | | | | | | | | | When 2 groups in a remote LDAP server share the same GID number, the migration may fail entirely with incomprehensible message. This should not be taken as unrecoverable error - GID number check is just a sanity check, a warning is enough. This patch also makes sure that GID check warnings include a user name to make an investigation easier. https://fedorahosted.org/freeipa/ticket/2644
* Raise proper exception when LDAP limits are exceededMartin Kosek2012-04-161-0/+2
| | | | | | | | | | | | | | | | | | | ldap2 plugin returns NotFound error for find_entries/get_entry queries when the server did not manage to return an entry due to time limits. This may be confusing for user when the entry he searches actually exists. This patch fixes the behavior in ldap2 plugin to 1) Return even a zero search results + truncated bool set in ldap2.find_entries 2) Raise LimitsExceeded in ldap2.get_entry and ldap2.find_entry_by_attr instead of NotFound error This changed several assumptions about ldap2.find_entries results. Several calls accross IPA code base had to be amended. https://fedorahosted.org/freeipa/ticket/2606
* don't append basedn to container if it is includedJohn Dennis2012-04-161-2/+8
| | | | | | | | | | | ticket #2566 When specifying a container to ds-migrate we should not automatically append the basedn if it is provided by the end-user. This is easy to detect using DN objects because DN objects have a endswith() method which can easily and correctly ascertain if a base already exists.
* Fix empty external member processingOndrej Hamada2012-04-171-1/+1
| | | | | | | Validation of external member was failing for empty strings because of wrong condition. https://fedorahosted.org/freeipa/ticket/2447
* Fix dnsrecord_add interactive modeMartin Kosek2012-04-151-1/+1
| | | | | | | | | | dnsrecord_add interactive mode did not work correctly when more than one DNS record part was entered as command line option. It asked for remaining options more than once. This patch fixes this situation and also adds tests to cover this use case properly. https://fedorahosted.org/freeipa/ticket/2641
* Return correct record name in DNS pluginMartin Kosek2012-04-161-0/+6
| | | | | | | | | | | | | | When dnsrecord-add or dnsrecord-mod commands are used on a root zone record (it has a special name "@"), a zone name is returned instead of a special name "@". This confuses DNS part of Web UI which is then not able to manipulate records in the root zone when these commands are used. This patch fixes these 2 commands to return correct value when a root zone is modified. https://fedorahosted.org/freeipa/ticket/2627 https://fedorahosted.org/freeipa/ticket/2628
* Validate DN & RDN parameters for migrate commandJohn Dennis2012-04-162-8/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2555 We were generating a traceback (server error) if a malformed RDN was passed as a parameter to the migrate command. * add parameter validation functions validate_dn_param() and validate_rdn_param() to ipalib.util. Those functions simply invoke the DN or RDN constructor from our dn module passing it the string representation. If the constructor does not throw an error it's valid. * Add the parameter validation function pointers to the Param objects in the migrate command. * Make the usercontainer and groupcontainer parameters required. passing --usercontainer= on the command line will produce ipa: ERROR: 'user_container' is required * Fix _get_search_bases() so if a container dn is empty it it just uses the base dn alone instead of faulting (currently bullet-proofing because now the containers are required). * Update the doc for usercontainer and groupcontainer to reflect the fact they are DN's not RDN's. A RDN can only be one level and it should be possible to have a container more than one RDN removed from the base.
* Document the 'nonempty' flagPetr Viktorin2012-04-131-0/+6
| | | | Missing documentation for commit 7cfc16c/c6e4372
* Unable to rename permission objectOndrej Hamada2012-04-111-8/+11
| | | | | | | The update was failing because of the case insensitivity of permission object DN. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2571
* Fix expected error messages in testsPetr Viktorin2012-04-101-1/+4
| | | | | | | | | | | | | | | | | Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
* Removal of memberofindirect_permissons from privilegesPetr Vobornik2012-04-091-4/+1
| | | | | | | | | | | | | Problem: In the Privilege page, can list Permissions. This "Shows Results" for "Direct Membership". But there is an option to list this for "Indirect Membership" also. There isn't a way to nest permissions, so this option is not needed. Solution: This patch removes the memberofindirect_persmission definition from server plugin. It fixes the problem in Web UI. https://fedorahosted.org/freeipa/ticket/2611
* Convert --setattr values for attributes marked no_updatePetr Viktorin2012-04-092-3/+10
| | | | | | | | | | | | | Attribute Patrams marked no_update never get cloned to Update commands, and thus never receive the `attribute` flag. This makes their `encode` method a no-op, which meant they don't get properly encoded when used with --setattr, making the --setattr fail. Introduce a `force` argument to encode, which overrides checking for the attribute flag. Use this in set/add/delattr normalization, where we know we are dealing with attributes. https://fedorahosted.org/freeipa/ticket/2616
* Limit permission and selfservice names to alphanumerics, -, _, spacePetr Viktorin2012-04-092-0/+8
| | | | | | | | The DN and ACI code doesn't always escape special characters properly. Rather than trying to fix it, this patch takes the easy way out and enforces that the names are safe. https://fedorahosted.org/freeipa/ticket/2585
* DNS forward policy: checkboxes changed to radio buttonsPetr Vobornik2012-04-101-0/+2
| | | | | | | | DNS forward policy fields were using mutually exclusive checkboxes. Such behavior is unusual for users. Checkboxes were changed to radios. https://fedorahosted.org/freeipa/ticket/2599
* Reworked netgroup Web UI to allow setting user/host categoryPetr Vobornik2012-04-101-0/+11
| | | | | | | | This patch is changing netgroup web ui to look more like hbac or sudo rule UI. This change allows to define and display user category, host category and external host. The core of the change is changing member attributes (user, group, host, hostgroup) to use rule_details_widget instead of separate association facets. In host case it allows to display and add external hosts. https://fedorahosted.org/freeipa/ticket/2578
* Check configured maximum user login length on user rename.Jan Cholasta2012-04-081-0/+10
| | | | ticket 2587
* Confusing default user groupsOndrej Hamada2012-04-081-15/+20
| | | | | | | Added 'fallback' into the labels for default automember group and hostgroup. https://fedorahosted.org/freeipa/ticket/2354
* Add missing comma to list of services that cannot be disabled.Rob Crittenden2012-04-051-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2487
* Check whether the default user group is POSIX when adding new user with ↵Jan Cholasta2012-04-051-4/+8
| | | | | | --noprivate. ticket 2572
* Make revocation_reason required when revoking a certificate.Rob Crittenden2012-04-051-1/+1
| | | | | | | This will prevent errors if an empty reason is provided and it is set by default one doesn't have to always set it on the command-line. https://fedorahosted.org/freeipa/ticket/2597
* Defer conversion and validation until after --{add,del,set}attr are handledPetr Viktorin2012-04-031-17/+35
| | | | | | | | | | | | | | | | | | | | | --addattr & friends that modified attributes known to Python sometimes used converted and validated Python values instead of LDAP strings. This caused a problem for --delattr, which searched for a converted integer in a list of raw strings (ticket 2407). With this patch we work on raw strings, converting only when done. Deferring validation ensures the end result is valid, so proper errors are raised instead of failing later (ticket 2405). Tests included. Replaces previous fix for: https://fedorahosted.org/freeipa/ticket/2418 Fixes: https://fedorahosted.org/freeipa/ticket/2405 https://fedorahosted.org/freeipa/ticket/2407 https://fedorahosted.org/freeipa/ticket/2408
* Test the batch pluginPetr Viktorin2012-04-031-7/+4
| | | | | | | | | This adds tests for the batch plugin, and changes its output declaration to allow results as tuples (this tripped validation). The assert_deepequal function ignores the order of items in lists. Document this in its docstring, and use a custom checker for the batch plugin results.
* Don't create private groups for migrated users, check for valid gidnumberRob Crittenden2012-04-031-31/+67
| | | | | | | | | | | | | | | | | Migrated users don't get a private group, there is no safe way to verify that the namespace is correct without redoing the uidnumber as well. Verify that the GID at least points to a valid group on the remote server and warn if it doesn't (this doesn't guarantee that the group gets migrated but at least we try). If the remote entry has no gidNumber then don't migrate that user. We don't know why that user is non-POSIX, it could be a special user used for auth, for example. Add a loginshell if the remote user doesn't have one. https://fedorahosted.org/freeipa/ticket/2562
* Improve automount indirect map error messageMartin Kosek2012-03-281-0/+4
| | | | | | | | | | When user does not pass a name of parent map in automountmap-add-indirect command, auto.master is used as a default. However, when auto.master does not exist in a given location, we raise NotFound error with a name of a location instead of a name of the missing automount map. https://fedorahosted.org/freeipa/ticket/2387
* Allow multi-line CSV parametersPetr Viktorin2012-03-281-5/+6
| | | | | | | Feed individual lines of input into the CSV parser, and include all lines in the output. https://fedorahosted.org/freeipa/ticket/2402
* Netgroup nisdomain and hosts validationOndrej Hamada2012-03-285-11/+47
| | | | | | | | | | | | | | | | | | | | | | | | nisdomain validation: Added pattern to the 'nisdomain' parameter to validate the specified nisdomain name. According to most common use cases the same pattern as for netgroup should fit. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2448 'add_external_pre_callback' function was created to allow validation of all external members. Validation is based on usage of objects primary key parameter. The 'add_external_pre_callback' fucntion has to be called directly from in the 'pre_callback' function. This change affects netgroup, hbacrule and sudorule commands. For hostname, the validator allows non-fqdn and underscore characters. validate_hostname function in ipalib.util was modified and contains additional option that allows hostname to contain underscore characters. This option is disabled by default. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2447
* Add CLI parsing testsPetr Viktorin2012-03-283-5/+23
| | | | | | | These test that command lines are parsed to correct Command arguments. Includes some tests for interactive prompts. To make this possible cli.run is broken up into several pieces.
* Change parameters to use only default_from for dynamic default values.Jan Cholasta2012-03-283-76/+9
| | | | | | | | | Replace all occurences of create_default with equivalent default_from and remove create_default from the framework. This is needed for proper parameter validation, as there is no way to tell which parameters to validate prior to calling create_default, because create_default does not provide information about which parameters are used for generating the default value.
* Fix the procedure for getting default values of command parameters.Jan Cholasta2012-03-283-34/+75
| | | | | | | The parameters used in default_from of other parameters are now properly validated before the default_from is called. ticket 1847
* Fix uses of O=REALM instead of the configured certificate subject base.Jan Cholasta2012-03-261-4/+18
| | | | ticket 2521
generated by cgit (git 2.34.1) at 2024-07-05 17:51:12 +0000