summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* dns metadataAdam Young2010-10-122-5/+27
| | | | | | This is a little bit of a copy and paste approach, as the code for__json__ was copied from baseldap. Long term, we want to rewrite this plugin as an extension of baseldap anyway.
* Certificate management for services.Endi S. Dewata2010-10-121-27/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is an initial implementation of certificate management for services. It addresses the mechanism required to view and update certificates. The complete UI implementation will be addressed in subsequent patches. On the server side, the service.py has been modified to define usercertificate in the service object's takes_params. This is needed to generate the proper JSON metadata which is needed by the UI. It also has been modified to accept null certificate for deletion. On the client side, the service details page has been modified to display the base64-encoded certificate in a text area. When the page is saved, the action handler will store the base64-encoded certificate in the proper JSON structure. Also the service name and service hostname are now displayed in separate fields. The details configuration has been modified to support displaying and updating certificates. The structure is changed to use maps to define sections and fields. A section contains name, label, and an array of fields. A field contains name, label, setup function, load function, and save function. This is used to implement custom interface and behavior for certificates. All other entities, test cases, and test data have been updated accordingly. Some functions and variables have been renamed to improve clarity and consistency.
* Accept an incoming certificate as either DER or base64 in the service plugin.Rob Crittenden2010-10-083-12/+78
| | | | | | | | | | | | | The plugin required a base64-encoded certificate and always decoded it before processing. This doesn't work with the UI because the json module decodes binary values already. Try to detect if the incoming value is base64-encoded and decode if necessary. Finally, try to pull the cert apart to validate it. This will tell us for sure that the data is a certificate, regardless of the format it came in as. ticket 348
* Return non-zero when group membership change fails, no empty fail list.Rob Crittenden2010-10-081-0/+26
| | | | | | | | | There is no point (and it is confusing) to print an empty list when modifying group membership fails, so suppress it. If any membership change fails we should return non-zero. tickets 271, 273, 274
* If an HBAC category is 'all' don't allow individual objects to be added.Rob Crittenden2010-10-082-0/+61
| | | | | | | | Basically, make 'all' mutually exclusive. This makes debugging lots easier. If say usercat='all' there is no point adding specific users to the rule because it will always apply to everyone. ticket 164
* policy and configAdam Young2010-10-073-0/+6
| | | | | | | | Population of the policy and entites tabs. DNS and ACI are broken due to PLugin issues Fix for entities without search Added new files to Makefile.am used rolegroup.js file as the start point, renamed to serverconfig.js
* Fix inconsistent error message when deleting groups that don't exist.Pavel Zuna2010-10-061-1/+3
| | | | Ticket #292
* Rename user-lock and user-unlock to user-enable user-disable.Pavel Zuna2010-10-061-12/+12
| | | | Ticket #165
* Add 'continuous' mode to LDAPDelete. Fix *-del unit tests.Pavel Zuna2010-10-061-0/+9
| | | | Ticket #321
* Generate additional positional arguments for baseldap commands from takes_args.Pavel Zuna2010-10-062-1/+11
|
* Added modifications to the sudorule plugin to reflect the schema update.Jr Aquino2010-10-051-17/+41
|
* phonenumbersAdam Young2010-10-011-0/+10
| | | | Added in params for phone number types: phone, fax, mobile ,pager
* Groups are now created as POSIX by default.Rob Crittenden2010-10-011-14/+15
| | | | ticket 241
* Remove reliance on the name 'admin' as a special user.Rob Crittenden2010-10-011-5/+0
| | | | | | | And move it to the group 'admins' instead. This way the admin user can be removed/renamed. ticket 197
* Add Delete capabilities to Search facet in the WebUI.Pavel Zuna2010-10-011-2/+6
| | | | Ticket #206
* Add LDAPMultiQuery base class and make it the base of LDAPDelete.Pavel Zuna2010-10-011-33/+65
| | | | | | | In other words: make *-del commands accept 1 or more primary keys of entries to be deleted. Ticket #20
* Fix sizelimit/timelimit options not working in user_findRob Crittenden2010-09-301-1/+1
|
* Handle an empty base_dn and no cn=ipaconfig in the ldap2 backend, fix migration.Rob Crittenden2010-09-281-6/+17
| | | | | | | | | | | | | We lacked good error messages if the user/group container you used doesn't exist. Add a --continue option so things can continue if you use a bad user/group container. This has the side-effect of letting you migrate just users or groups by using a bad container for the one you don't want. Fix a Gettext() error when displaying the migrated password message. ticket 289
* Add plugins for Sudo Commands, Command Groups and RulesJr Aquino2010-09-274-0/+496
|
* I18N for webAdam Young2010-09-272-6/+32
| | | | | | | | | | | | | | | | | | | | | | | Performing I18N completely on the server, to leverage the existing gettext architecture. Also, the browser does not have access to the Language header. Added the additional po files for a set of required languages conflict with install/static/ipa.js was resolved. Note that the addition of the .po files in this patch is necessary. In order to get Transifex support, we need to update the LINGUAS file with the languages for which we want support. If we don't add the .po files in, they get automatically generated by the rpmbuild process. Our implementation of gettext has a bug in it (It might be F13 thing) where the the Plurals line is not getting correctly transformed, which causes a build failure. However, since the RPM would have the .po files anyway, we should revision control the ones we have, even if they are empty. Fixed the Bug reporting url to the original value. Corrected the Chartype encoding for UK
* Use the principal from the context in whoami.Rob Crittenden2010-09-241-2/+2
| | | | ticket 227
* Try to make topic help less confusing. Rename Related to Topic commands.Rob Crittenden2010-09-231-3/+4
| | | | | | | Also don't print the commands at the bottom if the plugin implements only one command, like the passwd plugin. ticket 105
* Add an example for creating an HBAC service and service group.Rob Crittenden2010-09-231-0/+9
| | | | | | | Try to tie in the hbacsvc and hbacsvcgroup plugins better through an example. ticket 159
* Add command to resolve a hostname. Returns True or raises NotFound.Rob Crittenden2010-09-231-0/+36
| | | | | | | | | | | | Note that this doesn't rely on IPA having a configured DNS server. It passes the host name to the resolver and doesn't try to do a lookup within the IPA DNS directly (e.g. no internal LDAP search). Tries to determine if a domain is included and if not then the IPA domain is added. This won't do the right thing if there are multiple configured subdomains. ticket 106
* Big webUI patch.Pavel Zuna2010-09-171-0/+1
| | | | | | | | | | | | | Quick summary: - use jQuery UI and jQuery BBQ libraries - code restructuring The patch has so many changes they can't be listed here. Many parts of the code have been rewritten from scrach. See freeipa-devel mailing list: webUI code restructuring [wall of text, diagrams, ... you've been warned!] 2010-09-07
* user-find whoamiAdam Young2010-09-151-0/+13
| | | | | | Now no longer breaks user-find with a filter Uses the corrected Params for getting option printf style strings
* Revert "user whoami"Adam Young2010-09-141-11/+0
| | | | This reverts commit bef0690a2ff9cccf7de132e5e64b4ba631482764.
* user whoamiAdam Young2010-09-141-0/+11
| | | | Added a whoami option to the user, allows the user to query their own information based on their Kerberos principal
* Remove some additional instances of krbV from ipa-clientRob Crittenden2010-09-101-1/+4
| | | | | | | | | | | Make two krbV imports conditional. These aren't used during a client install so should cause no problems. Also fix the client installer to use the new env option in ipautil.run. We weren't getting the krb5 configuration set in the environment because we were overriding the environment to set the PATH. ticket 136
* Have certmonger track the initial Apache and 389-ds server certs.Rob Crittenden2010-09-091-2/+27
| | | | | | | | | | | | | | | We don't use certmonger to get certificates during installation because of the chicken-and-egg problem. This means that the IPA web and ldap certs aren't being tracked for renewal. This requires some manual changes to the certmonger request files once tracking has begun because it doesn't store a subject or principal template when a cert is added via start-tracking. This also required some changes to the cert command plugin to allow a host to execute calls against its own service certs. ticket 67
* Changes to fix compatibility with Fedora 14Rob Crittenden2010-08-311-3/+11
| | | | | | | | | | | | Fedora 14 introduced the following incompatiblities: - the kerberos binaries moved from /usr/kerberos/[s]/bin to /usr/[s]bin - the xmlrpclib in Python 2.7 is not fully backwards compatible to 2.6 Also, when moving the installed host service principals: - don't assume that krbticketflags is set - allow multiple values for krbextradata ticket 155
* Update command documentation based on feedback from docs team.Rob Crittenden2010-08-2718-248/+323
| | | | ticket #158
* Use global time and size limit values when searching.Rob Crittenden2010-08-191-12/+10
| | | | | | Add test to verify that limit is honored and truncated flag set. ticket #48
* Add support for ldap:///self bind rulesRob Crittenden2010-08-191-11/+37
| | | | | | | This is added mainly so the self service rules can be updated without resorting to ldapmodify. ticket 80
* Fix Update function on details page.Pavel Zuna2010-08-171-4/+4
| | | | | | | | | | The problem was that parameters with no values are automatically set to None by the framework and it wasn't handled properly in baseldap.py:get_attributes function. Also, there were two logical bugs in details.js: 1) atttribute callback to update values were called for input elements instead of dt elements 2) it was always trying to update the primary key
* Enable a host to retrieve a keytab for all its services.Rob Crittenden2010-08-161-17/+53
| | | | | | | | | | | | | | | | | | | | | | | | Using the host service principal one should be able to retrieve a keytab for other services for the host using ipa-getkeytab. This required a number of changes: - allow hosts in the service's managedby to write krbPrincipalKey - automatically add the host to managedby when a service is created - fix ipa-getkeytab to return the entire prinicpal and not just the first data element. It was returning "host" from the service tgt and not host/ipa.example.com - fix the display of the managedby attribute in the service plugin This led to a number of changes in the service unit tests. I took the opportunity to switch to the Declarative scheme and tripled the number of tests we were doing. This shed some light on a few bugs in the plugin: - if a service had a bad usercertificate it was impossible to delete the service. I made it a bit more flexible. - I added a summary for the mod and find commands - has_keytab wasn't being set in the find output ticket 68
* Add support for client failover to the ipa command-line.Rob Crittenden2010-08-167-17/+142
| | | | | | | | | | | | This adds a new global option to the ipa command, -f/--no-fallback. If this is included then just the server configured in /etc/ipa/default.conf is used. Otherwise that is tried first then all servers in DNS with the ldap SRV record are tried. Create a new Local() Command class for local-only commands. The help command is one of these. It shouldn't need a remote connection to execute. ticket #15
* From: Pavel Zuna <pzuna@redhat.com>Adam Young2010-08-131-0/+65
| | | | | | | | | | | Date: Tue, 10 Aug 2010 16:41:28 -0400 Subject: [PATCH 2/6] Add a new INTERNAL plugin that exports plugin meta-data into JSON. This is required for the webUI, since we're dropping Genshi. *ehm* :) You can't use this command on the CLI. It takes one optional argument: the name of an IPA object. If not specified, meta-data for all objects are returned.
* Change the behaviour of addattr/setattr parameters.Adam Young2010-08-132-35/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | setattr and addattr can now be used both to set all values of ANY attribute. the last setattr always resets the attribute to the specified value and all addattr append to it. Examples: user-mod testuser --setattr=title=msc title: msc user-mod testuser --setattr=title=msb title: msb user-mod testuser --addattr=title=msc title: msb, msc user-mod testuser --setattr=title= title: user-mod testuser --setattr=title=msc --addattr=msb title: msc, msb user-mod testuser --setattr=title=ing --addattr=bc title: ing, bc user-mod testuser --setattr=title=doc title: doc It's not very user friendly, but it's going to be used very very rarely in special conditions in the CLI and we can use it to save lots of JSON-RPC roundtrips in the webUI. This version includes calling the validation of Params during the setting of the attrs.
* Improve serialization to JSON.Pavel Zuna2010-08-123-2/+27
| | | | | | - Make it recursive. - Make Param classes serializable. - Take python native data types into account.
* Fix bug: not found exc. handler was failing for singleton objectsPavel Zuna2010-08-121-1/+4
|
* Add new parameters to LDAPSearch: timelimit and sizelimit.Pavel Zuna2010-08-121-2/+23
|
* Make LDAPObject classes JSON serializable.Pavel Zuna2010-08-122-0/+23
|
* Allow decoupling of user-private groups.Rob Crittenden2010-08-102-0/+74
| | | | | | | | | | | To do this we need to break the link manually on both sides, the user and the group. We also have to verify in advance that the user performing this is allowed to do both. Otherwise the user could be decoupled but not the group leaving it in a quasi broken state that only ldapmodify could fix. ticket 75
* Properly show the members when an add/remove operation fails.Rob Crittenden2010-08-064-19/+20
| | | | | | | | | | | | The remove member function in baseldap was not returning failures at all. The add member function was only showing them in the group object. Most of the magic is handled in baseldap. Each plugin just needs to define object_name and object_name_plural. object_name must be all lower-case because fake-attributes are created so membership can be broken out per-object type. I left the plural name lower case as well. ticket 85
* Add optional error message to pattern validatorRob Crittenden2010-08-063-3/+15
| | | | | | | | | The pattern validator by default displays the pattern that is being matched against. This isn't helpful, particularly for very hairy patterns. This adds a new parameter, pattern_errmsg, that is displayed on errors if set. ticket #11
* Require that hosts be resolvable in DNS. Use --force to ignore warnings.Rob Crittenden2010-08-065-16/+46
| | | | | | | | | | | | | This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
* Have the env plugin print all attributes by defaultRob Crittenden2010-08-061-0/+11
| | | | ticket #113
* Fix replacing a certificate in a service.Rob Crittenden2010-08-061-11/+14
| | | | | | | | | | | | When a service has a certificate and the CA backend doesn't support revocation (like selfsign) then we simply drop the old certificate in preparation for adding a new one. We weren't setting the usercertificate attribute to None so there was nothing to do in ldap_update(). Added a test case for this situation to ensure that re-issuing a certificate works. ticket #88
* whoami plugin.Adam Young2010-08-051-0/+41
| | | | | | It returns the user prinicpal. This is required by the webui, as the Kerberos credential mechanism in http does not expose the cleartext prinicpal to the web browser.
generated by cgit (git 2.34.1) at 2024-05-20 14:13:30 +0000