summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Fix bug in HBAC and netgroup plugin get_primary_key_from_dn methods.Pavel Zuna2009-10-082-2/+8
|
* Fix bug in group plugin. Was using wrong variable for attributes.Pavel Zuna2009-10-081-1/+1
| | | | Fix bug #527537.
* Make the taskgroup plugin use baseldap classes.Pavel Zuna2009-10-071-135/+40
|
* Make the rolegroup plugin use baseldap classes.Pavel Zuna2009-10-051-46/+41
|
* Make the hostgroup plugin use baseldap classes.Pavel Zuna2009-10-051-173/+45
|
* Make the netgroup plugin use baseldap classes.Pavel Zuna2009-10-051-309/+116
|
* Make the user plugin use baseldap classes.Pavel Zuna2009-10-051-230/+76
|
* Make the service plugin use baseldap classes.Pavel Zuna2009-10-051-205/+66
|
* Fix unit tests for plugins using baseldap classes.Pavel Zuna2009-10-051-1/+4
|
* Make the group plugin use baseldap classes.Pavel Zuna2009-10-051-124/+65
|
* Make the config plugin use baseldap classes.Pavel Zuna2009-10-051-103/+33
|
* Add HBAC plugin and introduce GeneralizedTime parameter type.Pavel Zuna2009-10-053-1/+427
|
* Add support for per-group kerberos password policy.Rob Crittenden2009-10-051-17/+217
| | | | | | | | | | Use a Class of Service template to do per-group password policy. The design calls for non-overlapping groups but with cospriority we can still make sense of things. The password policy entries stored under the REALM are keyed only on the group name because the MIT ldap plugin can't handle quotes in the DN. It also can't handle spaces between elements in the DN.
* Make primary_key optional.Rob Crittenden2009-10-051-2/+4
| | | | | The pwpolicy plugin doesn't have a primary key but can still take advantage of other parts of the framework.
* Fix aci plugin, enhance aci parsing capabilities, add user group supportRob Crittenden2009-09-282-33/+135
| | | | | | | | | | | | - The aci plugin didn't quite work with the new ldap2 backend. - We already walk through the target part of the ACI syntax so skip that in the regex altogether. This now lets us handle all current ACIs in IPA (some used to be ignored/skipped) - Add support for user groups so one can do v1-style delegation (group A can write attributes x,y,z in group B). It is actually quite a lot more flexible than that but you get the idea) - Improve error messages in the aci library - Add a bit of documentation to the aci plugin
* Fix Python 2.6 deprecation warning with the md5 import. Use hashlib instead.Rob Crittenden2009-09-281-2/+5
|
* Make the host plugin use baseldap classes.Pavel Zuna2009-09-281-252/+90
|
* Enrollment for a host in an IPA domainRob Crittenden2009-09-242-152/+26
| | | | | | | | | | | | This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-153-11/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Explicitly set verbosity off in the XML-RPC clientRob Crittenden2009-09-141-0/+1
| | | | | This is so I don't have to hunt for where to set this to True when doing low-level client debugging.
* Raise more specific error when an Objectclass Violation occurs Fix the ↵Rob Crittenden2009-09-142-3/+18
| | | | virtual plugin to work with the new backend
* Fix typos and minor bugs in baseldap. Add --all to LDAPUpdate.Pavel Zuna2009-09-111-6/+17
| | | | | | | Also, member attributes are now mapped to 'member user', 'member group', etc. instead of 'member users', 'member groups'. In other words, the second word is now taken from LDAPObject.object_name instead of LDAPObject.object_name_plural.
* Many SELinux fixes: ldapi, ctypes and dogtagRob Crittenden2009-09-102-4/+11
| | | | | | | | | | | ldapi: grants httpd and krb5kdc to access the DS ldapi socket ctypes: the Python uuid module includes ctypes which makes httpd segfault due to SELinux problems. dogtag: remove the CRL publishing permissions. This only worked if you had dogtag installed. In the near future will publish elsewhere so for the time being CRL file publishing will be broken with SELinux enabled.
* Automatically generate an auto.master map for new automount location.Pavel Zuna2009-09-101-0/+12
| | | | Also, add the automountlocation-show command for completeness sake.
* Remove parent_key parameter kwarg.Pavel Zuna2009-09-101-7/+4
| | | | Also replace a TYPE_ERROR with ValidationError.
* Add support for different automount maps per location.Pavel Zuna2009-09-101-91/+139
|
* Fix: Object.params_minus_pk was invalid when there was no primary_key.Pavel Zuna2009-09-091-0/+2
|
* Improve ipalib.plugins.baseldap classes.Pavel Zuna2009-09-091-97/+72
| | | | | | | | | | - remove obsolete code related to PluginProxy - remove parent_key attribute, for the purpose of nested objects the parent's primary key is retrieved automatically - added support for auto-generating of UUIDs - make use of the improved attribute printing in CLI - make LDAPDelete delete all sub-entries, not just one-level - minor bug fixes
* Remove obsolete CRUD base classes as they aren't used anymore.Pavel Zuna2009-09-081-48/+0
|
* Improve attribute printing in the CLI.Pavel Zuna2009-09-081-5/+28
| | | | | - allow choice between single/multiple value per line - word wrapping
* Fix bug in dns_find - execute() returned different value than expected.Pavel Zuna2009-09-081-1/+1
|
* Fleshed out krb plugin and added example of scripting against Python APIJason Gerard DeRose2009-08-311-0/+90
|
* Enable ldapi connections in the management framework.Rob Crittenden2009-08-271-2/+0
| | | | | | If you don't want to use ldapi then you can remove the ldap_uri setting in /etc/ipa/default.conf. The default for the framework is to use ldap://localhost:389/
* Fix service_mod and add a test caseRob Crittenden2009-08-261-8/+7
|
* Remove Python 2.6 BaseException.message deprecation warningRob Crittenden2009-08-201-5/+5
|
* Clean up additional issues discovered with pylint and pycheckerRob Crittenden2009-08-203-2/+18
|
* Clean up some problems discovered with pylint and pycheckerRob Crittenden2009-08-121-0/+16
| | | | | Much of this is formatting to make pylint happy but it also fixes some real bugs.
* Add a new objectclass, ipaObject, that will add a UUID to many IPA objectsRob Crittenden2009-08-105-5/+16
| | | | | | | | | ipaObject is defined as an auxiliary objectclass so it is up to the plugin author to ensure that the objectclass is included an a UUID generated. ipaUniqueId is a MUST attribute so if you include the objectclass you must ensure that the uuid is generated. This also fixes up some unrelated unit test failures.
* Removed PluginProxy and all its usesJason Gerard DeRose2009-08-055-135/+21
|
* Add options in baseldap classes to display unaltered LDAP entries.Pavel Zuna2009-08-051-10/+44
| | | | The options in question is '--raw'.
* Fix three broken unit testsJason Gerard DeRose2009-08-043-10/+9
|
* All-around improvements to baseldap.py classes.Pavel Zuna2009-08-031-47/+245
| | | | | | | | | | | | | | - attribute re-mapping, ordering and hiding (Enables plugins to completely hide LDAP internals from users and full localisation of command output.) - translation of member DNs into object names (No more DNs when listing group members etc.) - support for "singleton" LDAP objects (Objects like "pwpolicy"; not accessed by primary key.) - new base classes for commands: LDAPModMember, LDAPAddMember and LDAPRemoveMember (Providing support for objects with 'member'-like attributes.) - LDAPSearch implicit exit code changed to 1 when nothing is found
* Prevent double encoding/decoding when processing compound types.Pavel Zuna2009-08-031-5/+10
|
* Enable attribute re-mapping and ordering when printing entries.Pavel Zuna2009-08-031-10/+22
| | | | Also print multiple values on one line separated by commas.
* Allow replicas of an IPA server using an internal dogtag server as the CARob Crittenden2009-07-151-1/+1
| | | | | | | | This involves creating a new CA instance on the replica and using pkisilent to create a clone of the master CA. Also generally fixes IPA to work with the latest dogtag SVN tip. A lot of changes to ports and configuration have been done recently.
* Catch and handle HTTP exceptions (like 401, 404, etc)Rob Crittenden2009-07-151-1/+3
|
* Require a password only once when it is passed in via a pipeRob Crittenden2009-07-101-21/+13
|
* Add a one-character option for parametersRob Crittenden2009-07-102-1/+12
|
* Add a return value to exceptions.Rob Crittenden2009-07-102-4/+13
| | | | | | | | Returning the exception value doesn't work because a shell return value is in the range of 0-255. The default return value is 1 which means "something went wrong." The only specific return value implemented so far is 2 which is "not found".
* Add textui function to display and prompt user for selection for *-find.Rob Crittenden2009-07-102-8/+66
| | | | | Since we may end up executing a *-show when an entry is selected we need to defer destroying the connection context.
generated by cgit (git 2.34.1) at 2024-11-14 17:24:44 +0000