summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add TOTP watermark supportHEADmasterNathaniel McCallum2014-07-252-74/+88
| | | | | | | | | | | | | | | | This prevents the reuse of TOTP tokens by recording the last token interval that was used. This will be replicated as normal. However, this patch does not increase the number of writes to the database in the standard authentication case. This is because it also eliminates an unnecessary write during authentication. Hence, this patch should be write-load neutral with the existing code. Further performance enhancement is desired, but is outside the scope of this patch. https://fedorahosted.org/freeipa/ticket/4410 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Allow hashed passwords in DSMartin Kosek2014-07-252-2/+7
| | | | | | | | | Without nsslapd-allow-hashed-passwords being turned on, user password migration fails. https://fedorahosted.org/freeipa/ticket/4450 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ipa-getkeytab for pre-4.0 serversNathaniel McCallum2014-07-251-17/+21
| | | | | | | | | | Also, make the error messages for this fallback case less scary and clean up some indentation issues in the nearby code which made this code difficult to read. https://fedorahosted.org/freeipa/ticket/4446 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Improve password validity check.David Kupka2014-07-241-4/+31
| | | | | | | Allow use of characters that no longer cause troubles. Check for leading and trailing characters in case of 389 Direcory Manager password. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Do not require dogtag-pki-server-themeMartin Kosek2014-07-241-1/+0
| | | | | | | | | Theme package is contains resources for PKI web interface. This interface is not needed by FreeIPA as it rather utilizes it's API. As recommended in https://bugzilla.redhat.com/show_bug.cgi?id=1068029#c5, remove this hard dependency. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* baseldap: Remove redundant search from LDAPAddReverseMember and ↵Tomas Babej2014-07-231-6/+0
| | | | | | LDAPRemoveReverseMember Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Always record that pkicreate has been executed.David Kupka2014-07-221-3/+10
| | | | | | | | | Record that pkicreate/pkispawn has been executed to allow cleanup even if the installation did not finish correctly. https://fedorahosted.org/freeipa/ticket/2796 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update freeipa-server krb5-server dependency to 1.11.5-5Nathaniel McCallum2014-07-221-1/+1
| | | | | | | | Previous versions of libkrb5 can't handle expired passwords inside the FAST tunnel. This breaks the password change UI in FreeIPA. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix login password expiration detection with OTPNathaniel McCallum2014-07-212-31/+15
| | | | | | | | | | | | | | | | | | | | | The preexisting code would execute two steps. First, it would perform a kinit. If the kinit failed, it would attempt to bind using the same credentials to determine if the password were expired. While this method is fairly ugly, it mostly worked in the past. However, with OTP this breaks. This is because the OTP code is consumed by the kinit step. But because the password is expired, the kinit step fails. When the bind is executed, the OTP token is already consumed, so bind fails. This causes all password expirations to be reported as invalid credentials. After discussion with MIT, the best way to handle this case with the standard tools is to set LC_ALL=C and check the output from the command. This eliminates the bind step altogether. The end result is that OTP works and all password failures are more performant. https://fedorahosted.org/freeipa/ticket/4412 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fix disabled state of service's PAC typePetr Vobornik2014-07-211-31/+47
| | | | | | | | | | | Nested options (MS-PAC and PAD) of service's PAC type should be disabled if no value is supplied (default value is "Inherited from server configuration"). That was not the case - regression. This patch fixes it and along with it simplifies the update method of option_widget_base to be more comprehensible. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: disable ipapermbindruletype if permission in a privilegePetr Vobornik2014-07-211-1/+10
| | | | | | | User is not able to change Bind Rule Type if permission is already member of a privilege. Let's disable it and don't confuse user. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: fix selection of empty value in a select widgetPetr Vobornik2014-07-211-1/+1
| | | | | | | | | | Little regression - select widget could not handle empty or no array as an input value. It broke 'undo' operation in Permissions' 'Type' attribute while switching between '' and some value. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: show managed fields as readonly and not disabledPetr Vobornik2014-07-211-4/+2
| | | | | | | | | Visible read-only fields are no longer displayed as disabled in permission details facet. https://fedorahosted.org/freeipa/ticket/4254 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: fix add of input group classPetr Vobornik2014-07-211-1/+4
| | | | | | | | | | The input-group class was added based on visibility of child elements. This failed when it had to be determined *before* displaying the widget. Now it's added if the buttons are not hidden by `display: none` CSS rule. Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: reflect readonly statePetr Vobornik2014-07-211-27/+110
| | | | | | | | | | | Separate update of read-only state from update of value. It should be possible to switch from read-only UI to editable UI without value change. https://fedorahosted.org/freeipa/ticket/4254 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: option_widget_base: sort optionsPetr Vobornik2014-07-212-2/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: attr widget: get list of possible attrs from ipapermdefaultattrPetr Vobornik2014-07-211-0/+10
| | | | | | | | | | | | Very useful for managed permissions since the list of attrs in metadata might be smaller that default attributes. This smooths behavior if one removes an attr from effective attrs which is not in metadata. Without this it will disappear from the list and one has to add it manually through 'Add'. https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: custom attr in attributes widgetPetr Vobornik2014-07-214-13/+82
| | | | | | | | | | Web UI doesn't always know what are the possible attributes for target object. This will allow to add custom attributes if necessary. https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: optimize (re)creation of option widgetPetr Vobornik2014-07-211-11/+14
| | | | | | | | | | | | | | There is a case where attributes widget can contain > 1000 items. It's about 3000 nodes. It's slow in jQuery. Simple move to dojo speeds it up (is closer to native calls) while maintaining developer friendliness. Now the biggest lag is in browser's render. It's probably not worth developer time to optimize that. https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add filter to attributes widgetPetr Vobornik2014-07-213-0/+55
| | | | | | | | | | | Adds filter field to attribute box in permissions for better user experience. User can then quickly find the desired attribute. Initial version of the patch authored by: Adam Misnyovszki https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: improve usability of attributes widgetPetr Vobornik2014-07-216-96/+26
| | | | | | | | | | | | | | | Attributes widget layour was changed from tiny table which allowed to display only few options to a checkbox list with multiple columns (depends on container). Check all attributes option was removed to force the user to read through the attributes which he selects. Initial version authored by: Adam Misnyovszki https://fedorahosted.org/freeipa/ticket/4253 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* test_xmlrpc: Update testsPetr Viktorin2014-07-182-3/+13
| | | | | | | | | - The number of permissions in $SUFFIX changed. - A new ACI was added to realmdomains Update the tests. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Enable debug pid in smb.confGabe2014-07-181-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3485 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: Make cn=adtrust agents sysaccount nestedgroupTomas Babej2014-07-181-0/+1
| | | | | | | | | | Since recent permissions work references this entry, we need to be able to have memberOf attributes created on this entry. Hence we need to include the nestedgroup objectclass. https://fedorahosted.org/freeipa/ticket/4433 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix typos in dns.pyGabe2014-07-181-3/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4429 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipatests: tasks: Fix dns configuration for trustsTomas Babej2014-07-151-14/+3
| | | | | | | | | Properly configure forwarders to the AD zone with respect to newly created ipa dnsforwardzone commands. https://fedorahosted.org/freeipa/ticket/4401 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add missing breakLukas Slebodnik2014-07-141-0/+1
| | | | | | | | Wrong error message would be used for in case of RANGE_CHECK_DIFFERENT_TYPE_IN_DOMAIN. Missing break will cause fall through to the default section. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: Validate missing trust secret properlyTomas Babej2014-07-141-4/+6
| | | | | | | | | Detect the situation if the user passes empty trust secret and error out properly. https://fedorahosted.org/freeipa/ticket/4266 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ldap2 indirect membership processing: Use global limits if greater than ↵Petr Viktorin2014-07-141-6/+29
| | | | | | | | | | | | | | | | per-query ones Calling an ipa *-find command with --sizelimit=1 on an entry with more members would result in a LimitsExceeded error as the search for members was limited to 1 entry. For the memberof searches, only apply the global limit if it's larger than the requested one, so decreasing limits on the individual query only affects the query itself. https://fedorahosted.org/freeipa/ticket/4398 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix warning: Using uninitialized value ld.Lukas Slebodnik2014-07-141-1/+1
| | | | | | | If create_getkeytab_control fails variable uninitialized pointer 'ld' will be used. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* baseldap: Return empty string when no effective rights are foundPetr Viktorin2014-07-091-0/+4
| | | | | | | | | | DS returns the string "none" when no rights were found. All clients would need to special-case this value when checking the rights. Return empty string instead. https://fedorahosted.org/freeipa/ticket/4359 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: capitalize labels of undo and undo all buttonsPetr Vobornik2014-07-082-4/+4
| | | | | | | Make the label of these buttons consistent with other buttons which have capital first letters. Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix ipa-client-install --uninstall crashDavid Kupka2014-07-081-1/+4
| | | | | | | | Fix ipa-client-install crash when chronyd service fails to start. https://fedorahosted.org/freeipa/ticket/4273 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Become IPA 4.0.0Petr Viktorin2014-07-071-3/+3
|
* Update translationsPetr Viktorin2014-07-0720-1405/+1975
| | | | | Pull new translations from Transifex Thanks to all translators!
* webui: display messages contained in API responsesPetr Vobornik2014-07-074-57/+92
| | | | | | | | API responses can contain warnings in "messages" array. This patch also adds support for displaying multiple notifications at the same time in order to show the message and a status of finished operation. Reviewed-By: Petr Spacek <pspacek@redhat.com>
* makeaci: Use the DN where the ACI is stored, not the permission's DNPetr Viktorin2014-07-072-132/+132
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Prepare spec for 4.0 releaseMartin Kosek2014-07-041-48/+4
| | | | | | | | | | | | - Bump 389-ds-base requires to fix the deref call with new ACIs: https://fedorahosted.org/freeipa/ticket/4389 - Bump bind-dyndb-ldap Conflicts to fetch the DNSSEC capability - Bump selinux-policy to fix the CRL retrieval: https://fedorahosted.org/freeipa/ticket/4369 - Remove conditionals for Fedora < 20 as FreeIPA 4.0 is not planned to be released on these platforms. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Test DNS: add zone with consecutive dash charactersMartin Basti2014-07-041-1/+46
| | | | | | Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Test DNS: TLSA recordMartin Basti2014-07-041-0/+66
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Test DNS: test zone normalizationMartin Basti2014-07-041-1/+47
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: new navigation structurePetr Vobornik2014-07-049-109/+163
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4418 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow to add managed permission for reverse zonesMartin Basti2014-07-044-12/+44
| | | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4422 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow read access to services in cn=masters to auth'd usersPetr Viktorin2014-07-041-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4425 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ldapupdate: Restore 'replace' functionalityPetr Viktorin2014-07-041-0/+8
| | | | | | | The replace directive was made a no-op by mistake in commit 6381d76. Restore it. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Restore privileges after forward zones updateMartin Basti2014-07-041-1/+42
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix: Missing ACI for records in 40-dns.updateMartin Basti2014-07-042-2/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add Modify Realm Domains permissionMartin Kosek2014-07-042-0/+10
| | | | | | | | | The permission is required for DNS Administrators as realm domains object is updated when a master zone is added. https://fedorahosted.org/freeipa/ticket/4423 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix tests dns_realmdomains_integrationMartin Basti2014-07-041-0/+9
| | | | | | Added warning message about forwarders Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Non IDNA zonename should be normalized to lowercaseMartin Basti2014-07-041-0/+10
| | | | | | Before IDNA support zone was normalized. Reviewed-By: Petr Spacek <pspacek@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-24 14:25:06 +0000