summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* Replace IPAdmin.checkTask by replication.wait_for_taskPetr Viktorin2013-03-013-27/+24
| | | | | | The method was only used for waiting, not actual checking. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove IPAdmin.get_dns_sorted_by_lengthPetr Viktorin2013-03-012-48/+8
| | | | | | | A simple sort(key=len) is simpler both implementation-wise and semantics-wise. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove IPAdmin.updateEntry calls from fix_replica_agreementsPetr Viktorin2013-03-011-4/+2
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove dbdir, binddn, bindpwd from IPAdminPetr Viktorin2013-03-012-23/+15
| | | | | | | The dbdir logic was moved to replication.py, the only caller. The binddn and bindpwd attributes were unused. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Turn the LDAPError handler into a context managerPetr Viktorin2013-03-012-72/+45
| | | | | | | This has the advantage that the traceback is left intact if an error other than LDAPError is raised. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove unused bindcert and bindkey arguments to IPAdminPetr Viktorin2013-03-011-9/+2
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove unused imports from ipaserver/installPetr Viktorin2013-03-0112-55/+24
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Change {add,update,delete}_entry to take LDAPEntriesPetr Viktorin2013-03-011-27/+48
| | | | | | | | | These methods currently take (dn, entry_attrs, normalize=True) (or (dn, normalize=True) for delete). Change them to also accept just an LDAPEntry. For add and update, document the old style as deprecated. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace add_s and delete_s by their newer equivalentsPetr Viktorin2013-03-013-15/+15
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace entry.setValue/setValues by item assignmentPetr Viktorin2013-03-015-44/+21
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace entry.getValues() by entry.get()Petr Viktorin2013-03-014-14/+9
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Use update_entry with a single entry in adtrustinstancePetr Viktorin2013-03-011-10/+8
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Replace setValue by keyword arguments when creating entriesPetr Viktorin2013-03-017-157/+203
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove the Entry class.Jan Cholasta2013-03-012-49/+2
|
* Remove the Entity class.Jan Cholasta2013-03-012-39/+48
| | | | Move Entity functionality to LDAPEntry.
* Add make_entry factory method to LDAPConnection.Jan Cholasta2013-03-018-28/+33
| | | | Replace all occurences of Entry instantiation with calls to make_entry.
* Implement some of IPAdmin's legacy methods in terms of LDAPConnection methodsPetr Viktorin2013-03-011-57/+25
| | | | | | These will serve as templates for changes in the calling code. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move entry add, update, remove, rename to LDAPConnectionPetr Viktorin2013-03-012-142/+137
| | | | | | Also remove _FORCE_REPLACE_ON_UPDATE_ATTRS which was never used. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove unused proxydn functionality from IPAdminPetr Viktorin2013-03-011-46/+2
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move entry finding methods to LDAPConnectionPetr Viktorin2013-03-012-292/+328
| | | | | | | | | | | The get_ipa_config method relies on IPA being installed. Leave the implementation in ldap2, and add stub get_ipa_config that simply returns an empty dictionary to LDAPConnection. The get_members method contains an optimization that also relies on the api object. The optimization is disabled in base LDAPConfig. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move filter making methods to LDAPConnectionPetr Viktorin2013-03-012-121/+139
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move DN handling methods to LDAPConnectionPetr Viktorin2013-03-012-36/+40
| | | | | | | | ldap2 has "DN normalization" functionality, which silently adds the base DN to DNs that don't already end with it. This functionality is left in the ldap2 class only. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move schema-related methods to LDAPConnectionPetr Viktorin2013-03-012-57/+55
| | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Make IPAdmin not inherit from IPASimpleLDAPObjectPetr Viktorin2013-03-012-65/+24
| | | | | | | | | | | | | Instead of inheritance, the LDAPObject is kept in a `conn` attribute, as the ldap2 class does it. However, all IPASimpleLDAPObject methods are still available as before (using __getattr__-based proxying). Also, remove the IPAEntryLDAPObject class. The methods it overrode were never called in ways that would make them behave differently than the superclass. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Start LDAPConnection, a common base for ldap2 and IPAdminPetr Viktorin2013-03-012-123/+101
| | | | | | The first method to be extracted is handle_errors Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move SchemaCache and IPASimpleLDAPObject to ipaserver.ipaldapPetr Viktorin2013-03-012-545/+549
| | | | | | | The ldap2 plugin should only contain the actual CRUDBackend plugin. Common LDAP classes are moved to ipaldap. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move the decision to force schema updates out of IPASimpleLDAPObjectPetr Viktorin2013-03-013-9/+25
| | | | | | | This decision used the api object, which might not be available in installer code. Move the decision to callers. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove connection-creating code from ShemaCachePetr Viktorin2013-03-011-34/+3
| | | | | | | | | | The connection code depends on the api object. If we want to use the cache in installer code, where the api object is not always available, the dependency must be removed. Luckily, SchemaCache.get_schema is currently always given a connection. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Move LDAPEntry to ipaserver.ipaldap and derive Entry from itPetr Viktorin2013-03-012-167/+145
| | | | | | | | | | Legacy Entry methods such as setValue are added to LDAPEntry directly, so that we can use connection classes that return LDAPEntry with code that expects Entries. The Entry and its unique __init__ are still kept for compatibility. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Use explicit loggers in ldap2 codePetr Viktorin2013-03-012-22/+38
| | | | | | | | | This change makes it easier to see what is going on, in addition to getting rid of pylint exceptions. Also, make logging imports use explicit names instead of `import *`. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Derive Entity class from Entry, and move it to ldapupdatePetr Viktorin2013-03-012-6/+37
| | | | | | | The two classes were nearly identical, and the updater is the only code that uses Entity. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove unused methods from Entry, Entity, and IPAdminPetr Viktorin2013-03-011-108/+0
| | | | | | These classes are deprecated, there's no use keeping unused methods around. Part of the work for: https://fedorahosted.org/freeipa/ticket/2660
* Remove some unused importsPetr Viktorin2013-03-018-37/+19
| | | | | | Remove all unused LDAP-related imports, plus some other ones. This should make it easier to quickly check what uses which LDAP wrapper
* Add custom mapping object for LDAP entry data.Jan Cholasta2013-03-012-9/+97
|
* Add client capabilities, enable messagesPetr Viktorin2013-02-211-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The API version the client sends can now be used to check what the client expects or is capable of. All version tests IPA does will be be named and listed in one module, ipalib.capabilities, which includes a function to test a specific capability against an API version. Similarly to Python's __future__ module, capabilities.py also serves as documentation of backwards-incompatible changes to the API. The first capability to be defined is "messages". Recent enough clients can accept a list of warnings or other info under the "messages" key in the result dict. If a JSON client does not send the API version, it is assumed this is a testing client (e.g. curl from the command line). Such a client "has" all capabilities, but it will always receive a warning mentioning that forward compatibility is not guaranteed. If a XML client does not send the API version, it is assumed it uses the API version before capabilities were introduced. (This is to keep backwards compatibility with clients containing bug https://fedorahosted.org/freeipa/ticket/3294) Whenever a capability is added, the API version must be incremented. To ensure that, capabilities are written to API.txt and checked by `makeapi --validate`. Design page: http://freeipa.org/page/V3/Messages Ticket: https://fedorahosted.org/freeipa/ticket/2732
* Avoid internal error when user is not Trust adminMartin Kosek2013-02-201-4/+23
| | | | | | | | | | | | | | | When user tries to perform any action requiring communication with trusted domain, IPA server tries to retrieve a trust secret on his behalf to be able to establish the connection. This happens for example during group-add-member command when external user is being resolved in the AD. When user is not member of Trust admins group, the retrieval crashes and reports internal error. Catch this exception and rather report properly formatted ACIError. Also make sure that this exception is properly processed in group-add-member post callback. https://fedorahosted.org/freeipa/ticket/3390
* Implement the cert-find command for the dogtag CA backend.Rob Crittenden2013-02-192-0/+146
| | | | | | | | | | | | | | | | Use a new RESTful API provided by dogtag 10+. Construct an XML document representing the search request. The output is limited to whatever dogtag sends us, there is no way to request additional attributes other than to read each certificate individually. dogtag uses a boolean for each search term to indicate that it is used. Presense of the search item is not enough, both need to be set. The search operation is unauthenticated Design page: http://freeipa.org/page/V3/Cert_find https://fedorahosted.org/freeipa/ticket/2528
* Allow ipa-replica-conncheck and ipa-adtrust-install to read krb5 includedirJakub Hrozek2013-02-181-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/3132
* Add option to specify SID using domain name to idrange-add/modTomas Babej2013-02-181-0/+10
| | | | | | | | | | When adding/modifying an ID range for a trusted domain, the newly added option --dom-name can be used. This looks up SID of the trusted domain in LDAP and therefore the user is not required to write it down in CLI. If the lookup fails, error message asking the user to specify the SID manually is shown. https://fedorahosted.org/freeipa/ticket/3133
* Add support for AD users to hbactest commandMartin Kosek2013-02-141-0/+56
| | | | | | | | | | | | | | | | | | | | | How this works: 1. When a trusted domain user is tested, AD GC is searched for the user entry Distinguished Name 2. The user entry is then read from AD GC and its SID and SIDs of all its assigned groups (tokenGroups attribute) are retrieved 3. The SIDs are then used to search IPA LDAP database to find all external groups which have any of these SIDs as external members 4. All these groups having these groups as direct or indirect members are added to hbactest allowing it to perform the search LIMITATIONS: - only Trusted Admins group members can use this function as it uses secret for IPA-Trusted domain link - List of group SIDs does not contain group memberships outside of the trusted domain https://fedorahosted.org/freeipa/ticket/2997
* Generalize AD GC searchMartin Kosek2013-02-141-50/+95
| | | | | | | | | | | | | | Modify access methods to AD GC so that callers can specify a custom basedn, filter, scope and attribute list, thus allowing it to perform any LDAP search. Error checking methodology in these functions was changed, so that it rather raises an exception with a desription instead of simply returning a None or False value which would made an investigation why something does not work much more difficult. External membership method in group-add-member command was updated to match this approach. https://fedorahosted.org/freeipa/ticket/2997
* Test NetBIOS name clash before creating a trustMartin Kosek2013-02-131-0/+6
| | | | | | | Give a clear message about what is wrong with current Trust settings before letting AD to return a confusing error message. https://fedorahosted.org/freeipa/ticket/3193
* Add SID blacklist attributesMartin Kosek2013-02-121-0/+8
| | | | | | | | Update our LDAP schema and add 2 new attributes for SID blacklist definition. These new attributes can now be set per-trust with trustconfig command. https://fedorahosted.org/freeipa/ticket/3289
* Port ipa-replica-prepare to the admintool frameworkPetr Viktorin2013-02-011-0/+504
| | | | | | | | | | | | | Break the script into several smaller methods. Use modern idioms: os.path.join instead of string addition; the with statement for closing files. Add --quiet, --verbose, and --log-file options. Use logging instead of print statements. (http://freeipa.org/page/V3/Logging_and_output) Part of: https://fedorahosted.org/freeipa/ticket/2652 Fixes: https://fedorahosted.org/freeipa/ticket/3285
* Better logging for AdminTool and ipa-ldap-updaterPetr Viktorin2013-02-011-26/+22
| | | | | | | | | | | | | - Automatically add a "Logging and output options" group with the --quiet, --verbose, --log-file options. - Set up logging based on these options; details are in the setup_logging docstring and in the design document. - Don't bind log methods as individual methods of the class. This means one less linter exception. - Make the help for command line options consistent with optparse's --help and --version options. Design document: http://freeipa.org/page/V3/Logging_and_output
* Drop ipapython.compat.Jan Cholasta2013-02-012-5/+3
|
* Use fully qualified CCACHE namesMartin Kosek2013-02-011-3/+12
| | | | | | | | | | | | | | Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCACHE. We should always use both CCACHE type and name when referring to them to avoid these crashes. ldap2 backend was also updated to accept directly krbV.CCache object which contains everything we need to authenticate with ccache. https://fedorahosted.org/freeipa/ticket/3381
* Remove unused krbV importsMartin Kosek2013-02-011-2/+0
| | | | https://fedorahosted.org/freeipa/ticket/3381
* Fix migration for openldap DSMartin Kosek2013-02-011-2/+9
| | | | | | | | | | | | | | | | | openldap server does not store its schema in cn=schema entry, but rather in cn=subschema. Add a fallback to ldap2 plugin to read from this entry when cn=schema is not found. ldap2 plugin uses the schema when doing some of the automatic encoding, like an automatic encoding of DN object. IPA migration plugin DN attribute processing is now also more tolerant when it finds that some DN attribute was not autoencoded. It tries to convert it to DN on its own and report a warning and continue with user processing when the conversion fails instead of crashing with AssertionError and thus abandoning the whole migration run. https://fedorahosted.org/freeipa/ticket/3372
* Use new certmonger locking to prevent NSS database corruption.Rob Crittenden2013-01-291-13/+100
| | | | | | | | | | | | | | | | | | | | | | | | dogtag opens its NSS database in read/write mode so we need to be very careful during renewal that we don't also open it up read/write. We basically need to serialize access to the database. certmonger does the majority of this work via internal locking from the point where it generates a new key/submits a rewewal through the pre_save and releases the lock after the post_save command. This lock is held per NSS database so we're save from certmonger. dogtag needs to be shutdown in the pre_save state so certmonger can safely add the certificate and we can manipulate trust in the post_save command. Fix a number of bugs in renewal. The CA wasn't actually being restarted at all due to a naming change upstream. In python we need to reference services using python-ish names but the service is pki-cad. We need a translation for non-Fedora systems as well. Update the CA ou=People entry when he CA subsystem certificate is renewed. This certificate is used as an identity certificate to bind to the DS instance. https://fedorahosted.org/freeipa/ticket/3292 https://fedorahosted.org/freeipa/ticket/3322
generated by cgit (git 2.34.1) at 2025-09-03 12:05:47 +0000