summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Translate the membergroup dn into a group name.Rob Crittenden2010-12-202-21/+29
| | | | | | Drop filter from the output, it is superfluous. ticket 634
* Enable filtering search results by member attributes.Pavel Zuna2010-12-204-2/+37
| | | | | | | | | | | | | | LDAPSearch base class has now the ability to generate additional options for objects with member attributes. These options are used to filter search results - search only for objects without the specified members. Example: ipa group-find --no-users=admin Only direct members are taken into account. Ticket #288
* Allow RDN changes from CLIJakub Hrozek2010-12-203-1/+49
| | | | https://fedorahosted.org/freeipa/ticket/397
* Clarify ipa-replica-install error messageJakub Hrozek2010-12-201-2/+2
|
* Check the number of fields when importing automount mapsJakub Hrozek2010-12-201-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/359
* Make the IPA installer IPv6 friendlyJakub Hrozek2010-12-206-72/+127
| | | | | | | | | Notable changes include: * parse AAAA records in dnsclient * also ask for AAAA records when verifying FQDN * do not use functions that are not IPv6 aware - notably socket.gethostbyname() The complete list of functions was taken from http://www.akkadia.org/drepper/userapi-ipv6.html section "Interface Checklist"
* Correcting my name in Contributors file.Gowrishankar Rajaiyan2010-12-201-1/+1
|
* Fixing typos in man page of ipa-getkeytabGowrishankar Rajaiyan2010-12-201-2/+2
|
* import NSPRError in host.pyJakub Hrozek2010-12-201-0/+1
|
* Added option --no-reverse to add-hostJan Zeleny2010-12-201-14/+23
| | | | | | | | | When adding a host with specific IP address, the operation would fail in case IPA doesn't own the reverse DNS. This new option overrides the check for reverse DNS zone and falls back to different IP address existence check. https://fedorahosted.org/freeipa/ticket/417
* Allow renaming of object that have a parentJakub Hrozek2010-12-201-1/+2
| | | | Allow renaming of object that have a parent
* Make pkey always iterable when deletingJakub Hrozek2010-12-201-3/+5
|
* Fix delegation.ldif typoJakub Hrozek2010-12-201-1/+1
|
* Don't use camel-case LDAP attributes in ACI and don't clear enrolledByRob Crittenden2010-12-178-35/+34
| | | | | | | | | | | | We keep LDAP attributes lower-case elsewhere in the API we should do the same with all access controls. There were two ACIs pointing at the manage_host_keytab permission. This isn't allowed in general and we have decided separately to not clear out enrolledBy when a host is unenrolled so dropping it is the obvious thing to do. ticket 597
* Fix some doctestsRob Crittenden2010-12-171-8/+8
| | | | A few had bad formatting causing the doctests to fail.
* Catch ACI errors better when adding a permission.Rob Crittenden2010-12-171-3/+17
| | | | | | | | We create the aci with the --test flag to test its validity but it doesn't do the same level of tests that actually adding an aci to LDAP does. Catch any syntax errors that get thrown and clean up as best we can. ticket 621
* Verify that the replication plugin exists before setting up replicas.Rob Crittenden2010-12-173-0/+20
| | | | ticket 502
* Move automount, default HBAC services, netgroup and hostgroup bootstrapping.Rob Crittenden2010-12-176-121/+135
| | | | | There is no need for these to be done as updates, just add these entries to the bootstrapping.
* Fix the change_password permissions and the DNS access controls.Rob Crittenden2010-12-174-7/+32
| | | | | | | | | | The change_password permission was too broad, limit it to users. The DNS access controls rolled everything into a single ACI. I broke it out into separate ACIs for add, delete and add. I also added a new dns type for the permission plugin. ticket 628
* Remove principal as an option when updating an existing user.Rob Crittenden2010-12-171-0/+1
| | | | ticket 559
* Fix a slew of tests.Rob Crittenden2010-12-177-3/+44
| | | | | | | - Skip the DNS tests if DNS isn't configured - Add new attributes to user entries (displayname, cn and initials) - Make the nsaccountlock value consistent - Fix the cert subject for cert tests
* Properly quote passwords sent to pkisilent so special characters work.Rob Crittenden2010-12-172-7/+12
| | | | | | Also check for url-encoded passwords before logging them. ticket 324
* kinit typoAdam Young2010-12-171-1/+1
| | | | Was origially KInit but the command is kinit
* error linkAdam Young2010-12-171-2/+2
| | | | Change the link in the error message to the one that will actually fix the problem
* type prevented rendering on firefox4Adam Young2010-12-171-1/+1
|
* Add krb5-pkinit-openssl as a Requires on ipa-server packageRob Crittenden2010-12-164-24/+4
| | | | ticket 599
* Use nsContainer and not extensibleObject for masters entriesSimo Sorce2010-12-151-1/+1
|
* Account activation adjustmentEndi S. Dewata2010-12-147-118/+126
| | | | | | | | | | The user details facet has been modified such that when the account is activated/deactivated the page will be reloaded. Some methods in the framework have been changed: - The ipa_widget.clear() has been removed because it can be replaced by existing reset(). - The ipa_widget.set_values() has been renamed into update().
* Add metadata for the selfservice and delegation plugins.Rob Crittenden2010-12-142-0/+28
|
* Add group to group delegation plugin.Rob Crittenden2010-12-133-7/+470
| | | | | | | This is a thin wrapper around the ACI plugin that manages granting group A the ability to write a set of attributes of group B. ticket 532
* Give the memberof plugin time to work when adding/removing reverse members.Rob Crittenden2010-12-132-3/+79
| | | | | | | | | | | | When we add/remove reverse members it looks like we're operating on group A but we're really operating on group B. This adds/removes the member attribute on group B and the memberof plugin adds the memberof attribute into group A. We need to give the memberof plugin a chance to do its work so loop a few times, reading the entry to see if the number of memberof is more or less what we expect. Bail out if it is taking too long. ticket 560
* tests for sudo run as user or group https://fedorahosted.org/freeipa/ticket/570Jr Aquino2010-12-131-0/+72
|
* sudo run as user or group https://fedorahosted.org/freeipa/ticket/570Jr Aquino2010-12-131-0/+62
|
* managed entry hostgroup netgroup support ↵Jr Aquino2010-12-1310-4/+305
| | | | https://fedorahosted.org/freeipa/ticket/543
* relabel roleAdam Young2010-12-131-1/+1
| | | | no longer calling them role groups.
* Add --out option to service, host and cert-show to save the cert to a file.Rob Crittenden2010-12-134-1/+131
| | | | | | | Override forward() to grab the result and if a certificate is in the entry and the file is writable then dump the certificate in PEM format. ticket 473
* Better handle permission object updates versus aci object updates.Rob Crittenden2010-12-131-7/+10
| | | | | | | | | permissions are a real group pointed to by an aci, managed by the same plugin. Any given update can update one or both or neither. Do a better job at determining what it is that needs to be updated and handle the case where only the ACI is updated so that EmptyModList is not thrown. ticket 603
* Check for existence of the group when adding a user.Rob Crittenden2010-12-133-0/+58
| | | | | | | | | | | | | The Managed Entries plugin will allow a user to be added even if a group of the same name exists. This would leave the user without a private group. We need to check for both the user and the group so we can do 1 of 3 things: - throw an error that the group exists (but not the user) - throw an error that the user exists (and the group) - allow the uesr to be added ticket 567
* Fix typo in migration documentationRob Crittenden2010-12-131-1/+1
|
* Don't import from ipaserver when not in a server context.Rob Crittenden2010-12-111-1/+2
| | | | ticket 579
* Pass the DM password when trying to delete a replica.Rob Crittenden2010-12-111-1/+1
| | | | | | | If the ticket is expired or otherwise unusable it should fall back to the DM password. It was prompted for correctly but wasn't being passed on. ticket 549
* Save exception so it can be passed along.Rob Crittenden2010-12-111-1/+1
|
* Fixes for ipactl scriptSimo Sorce2010-12-101-20/+64
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/613
* Fix Install using dogtag.Simo Sorce2010-12-105-9/+29
| | | | | | | The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612
* Print expected error message in hbac-modJan Zeleny2010-12-101-1/+5
| | | | | | | This patch catches NotFound exception and calls handling function which then sends exception with unified error message. https://fedorahosted.org/freeipa/ticket/487
* Properly handle multi-valued attributes when using setattr/addattr.Rob Crittenden2010-12-104-4/+187
| | | | | | | | | | | | The problem was that the normalizer was returning each value as a tuple which we were then appending to a list, so it looked like [(u'value1',), (u'value2',),...]. If there was a single value we could end up adding a tuple to a list which would fail. Additionally python-ldap doesn't like lists of lists so it was failing later in the process as well. I've added some simple tests for setattr and addattr. ticket 565
* Set labels on all attributes in the config object.Rob Crittenden2010-12-102-2/+36
| | | | | | | Make the cert subject base read-only. This is here only so replicated servers know their base. ticket 466
* Move Selfsigned CA creation out of dsinstanceSimo Sorce2010-12-109-62/+62
| | | | | | | | This allows us to have the CA ready to serve out certs for any operation even before the dsinstance is created. The CA is independent of the dsinstance anyway. Also fixes: https://fedorahosted.org/freeipa/ticket/544
* Introduce ipa control script that reads configuration off ldapSimo Sorce2010-12-1010-129/+340
| | | | | | | | | | | This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
* Split dsinstance configurationSimo Sorce2010-12-103-67/+107
| | | | | This is so that master and replica creation can perform different operations as they need slightly diffeent settings to be applied.
generated by cgit (git 2.34.1) at 2024-06-18 16:13:04 +0000