summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* webui: apply PatternFly login theme on reset_password.htmlPetr Vobornik2014-06-062-70/+97
| | | | https://fedorahosted.org/freeipa/ticket/4282
* webui: add PaternFly cssPetr Vobornik2014-06-0633-2360/+1299
| | | | | | | | | | | | | | | | | | To update install/ui/css/patternfly.css you should: 1. clone Bootstrap 3, Font-Awesome, Bootstrap-Select and PatternFly to the same parent directory as for FreeIPA (or use symlinks) 2. checkout desired versions of each component 3. run install/ui/util/make-patternfly.css 4. when changing component versions, copy xxx/variables.less from each component to install/ui/less/xxx/ so we can use the variables in our less files This commit contain css made from component versions as follows: - PatternFly: 0.2.5 - Bootstrap: 3.1.1 - Bootstrap-select: 1.4.3 - Font-Awesome: 4.0.3
* webui: remove login.htmlPetr Vobornik2014-06-066-169/+0
| | | | https://fedorahosted.org/freeipa/ticket/4281
* webui: remove logout.htmlPetr Vobornik2014-06-063-32/+0
| | | | https://fedorahosted.org/freeipa/ticket/4281
* Add missing attributes to 'Modify Sudo rule' permissionPetr Viktorin2014-06-041-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4344 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Sudo rule default permissions to managedPetr Viktorin2014-06-042-26/+32
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add mechanism for updating permissions to managedPetr Viktorin2014-06-041-8/+135
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_permission_plugin: limit results in targetfilter find testPetr Viktorin2014-06-041-1/+1
| | | | | | | The test was finding recently added default permissions. Limit it to the test permission only. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* ipalib.aci: Fix bugs in comparisonPetr Viktorin2014-06-042-4/+70
| | | | | | | | | | | | - regression in be6edef6e48224e74344f48d25876b09cd263674: The __ne__ special method was named incorrectly - regression in 1ea6def129aa459ecc3d176a3b6aebdf75de2eb7: The targetattr operator was never compared Include some new comparison tests. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Test DNS: dnsrecord-* zone.test. zone.test. should workMartin Basti2014-06-031-0/+34
| | | | | | | | | | Old ipa versions allows only "dnsrecord-* zone.test. @" This issue was fixed in ticket: https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/4232 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix indentationMartin Basti2014-06-031-21/+21
| | | | | | There was 5 spaces instead of 4, my bad. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Test DNS: wildcard in RR ownerMartin Basti2014-06-031-0/+46
| | | | | | | | Only test, issue was fixed in https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/3148 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* PTR record target can be relativeMartin Basti2014-06-032-4/+3
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS new testsMartin Basti2014-06-031-41/+741
| | | | | | | | | | Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS modified testsMartin Basti2014-06-032-241/+283
| | | | | | | | | | | * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* move hostname validation from DNS to hostsMartin Basti2014-06-031-3/+11
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* _domain_name_validatord moved from DNS to realmdomainsMartin Basti2014-06-032-13/+7
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified record and zone class to support IDNMartin Basti2014-06-031-97/+307
| | | | | | | | | | | | | | * Records data are always returned as string * Attributes idnsname, idnssoamname, idnssoarname are returned as * DNSName, with option --raw as string * option --raw returns all IDN domains punycoded Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified records and zone parameters to use DNSNameParamMartin Basti2014-06-032-74/+65
| | | | | | | | | | | | | * Zone is stored as an absolute name (ipa never support relative * zonenames) * compatible with relative zone names as was before * PTR target can be relative domain name Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified dns related global functionsMartin Basti2014-06-034-117/+74
| | | | | | | | | | | * Modified functions to use DNSName type * Removed unused functions Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified has_output attributesMartin Basti2014-06-032-4/+10
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSName conversion in ipaldapMartin Basti2014-06-031-0/+7
| | | | | | | | | | Domain name has to be stored in LDAP in punycoded value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CLI conversion of DNSName typeMartin Basti2014-06-031-0/+3
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* get_ancestors_primary_keys cloneMartin Basti2014-06-032-29/+29
| | | | | | | | | | Fix: classes didnt inherite params from parent correctly Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dns_name_values capability addedMartin Basti2014-06-034-6/+27
| | | | | | | | | | Added capability to transfer DNSName type between server and client Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169i Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSNameParam parameterMartin Basti2014-06-033-1/+72
| | | | | | | | | | New param type for domain names Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSName typeMartin Basti2014-06-031-0/+100
| | | | | | | | | | Type used to store domain names based on dnspython Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allows to sort non text entriesMartin Basti2014-06-032-1/+7
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add read permissions for automember tasksPetr Viktorin2014-06-022-5/+19
| | | | | | | | | | | Permission to read all tasks is given to high-level admins. Managed permission for automember tasks is given to automember task admins. "targetattr=*" is used because tasks are extensibleObject with attributes that aren't in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* krbtpolicy plugin: Fix internal error when global policy is not readablePetr Viktorin2014-05-301-9/+27
| | | | | | | | | | | | | | | An ACIError is now raised if: - the user doesn't have permission to read any one of the ticket policy attributes on the requested entry (checked using attribute-level rights) - any ticket policy attribute from the default policy is not available (either not readable, or not there at all) (only checked if these are accessed, i.e. when the user entry doesn't override all of the defaults, or when requesting the global policy) https://fedorahosted.org/freeipa/ticket/4354 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* krbtpolicy plugin: Code cleanupPetr Viktorin2014-05-301-15/+15
| | | | | | | | | | - Use the new plugin registration API See: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration - Remove the star import from baseldap Part of the work for: https://fedorahosted.org/freeipa/ticket/2653 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Restore krbCanonicalName handlingNalin Dahyabhai2014-05-301-5/+1
| | | | | | | | | | | When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set, rewrite the principal name to the canonical value, else error out, instead of always returning an error if the requested name doesn't look like the canonical one. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Accept any alias, not just the last valueNalin Dahyabhai2014-05-301-0/+3
| | | | | | | | | If the entry's krbPrincipalName attribute is multi-valued, accept any of the values, not just the last one we happen to examine. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipa recursively adds old backupsGabe2014-05-301-0/+1
| | | | | | | | - Added exclude for the ipa backup folder to the files tar https://fedorahosted.org/freeipa/ticket/4331 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ldap2.has_upg: Raise an error if the UPG definition is not foundPetr Viktorin2014-05-291-13/+17
| | | | | | | | | | | | | | | | | The UPG Definition is always present in IPA; if it can not be read it's usually caused by insufficient privileges. Previously the code assumed the absence of the entry meant that UPG is disabled. With granular read permissions, this would mean that users that can add users but can't read UPG Definition would add users without UPG, and the reason for that would not be very clear. It is better to fail early if the definition can't be read. Raise an error if the UPG Definition is not available. This makes read access to it a prerequisite for adding users. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission for the UPG DefinitionPetr Viktorin2014-05-291-0/+17
| | | | | | | | | | | | Since user_add checks the UPG definition to see if UPG is enabled, user admins need read access to add users correctly. All attributes are allowed since UPG Definition is an extensibleObject; the needed attributes are not in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci plugin: Fix internal error when ACIs are not readablePetr Viktorin2014-05-291-1/+1
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* pwpolicy-mod: Fix crash when priority is changedPetr Viktorin2014-05-283-3/+77
| | | | | | | | | | | | | The exc_callback was expecting the old update_entry signature, (dn, attrs). This was changed to just (entry) for ticket #2660, see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API. Update the exc_callback to expect the entry as first argument, and add some tests. https://fedorahosted.org/freeipa/ticket/4309 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dns: Add idnsSecInlineSigning attribute, add --dnssec option to zonePetr Viktorin2014-05-284-7/+17
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Call generate-rndc-key.sh during ipa-server-installAdam Misnyovszki2014-05-273-1/+29
| | | | | | | | | | | | | | | | | | | | | | Since systemd has by default a 2 minute timeout to start a service, the end of ipa-server-install might fail because starting named times out. This patch ensures that generate-rndc-key.sh runs before named service restart. Also, warning message is displayed before KDC install and generate-rndc-key.sh, if there is a lack of entropy, to notify the user that the process could take more time than expected. Modifications done by Martin Kosek: - removed whitespace at the end of installutils.py - the warning in krbinstance.py moved right before the step requiring entropy - slightly reworded the warning message https://fedorahosted.org/freeipa/ticket/4210 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* admin tools: Log IPA versionPetr Viktorin2014-05-279-0/+9
| | | | | | | | | | | Add the IPA version, and vendor version if applicable, to the beginning of admintool logs -- both framework and indivitual tools that don't yet use the framework. This will make debugging easier. https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipalib.version: Add VENDOR_VERSIONPetr Viktorin2014-05-273-2/+12
| | | | | | | | | This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase Java stack size for Web UI build on aarch64Petr Vobornik2014-05-261-1/+1
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* rpcserver: login_password datetime fix in expiration checkPetr Vobornik2014-05-261-8/+2
| | | | | | | | | krbpasswordexpiration conversion to time failed because now we get datetime object instead of string. https://fedorahosted.org/freeipa/ticket/4339 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ldap2.find_entries: Do not modify attrs_list in-placePetr Viktorin2014-05-261-6/+9
| | | | | | | | | | | | | | | dap2.find_entries modified the passed in attrs_list to remove the virtual attributes memberindirect and memberofindirect before passing the list to LDAP. This means that a call like ldap2.get_entry(dn, attrs_list=some_framework_object.default_attributes) would permanently remove the virtual attributes from some_framework_object's definition. Create a copy of the list instead. https://fedorahosted.org/freeipa/ticket/4349 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove the global anonymous read ACIPetr Viktorin2014-05-266-115/+30
| | | | | | | | | | | | | | Also remove - the deny ACIs that implemented exceptions to it: - no anonymous access to roles - no anonymous access to member information - no anonymous access to hbac - no anonymous access to sudo (2×) - its updater plugin Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-262-0/+31
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* update_managed_permissions: Pass around anonymous ACI rather than its blacklistPetr Viktorin2014-05-261-17/+18
| | | | | | | | It turns out the ACI object of the anonymous read ACI, rather than just the list of its attributes, will be useful in the future. Change the plugin so that the ACI object is passed around. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default the token owner to the person adding the tokenNathaniel McCallum2014-05-231-1/+8
| | | | | | | | Creating tokens for yourself is the most common operation. Making this the default optimizes for the common case. Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 03:13:01 +0000