summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Make sure member* attrs are always granted together in read permissionsPetr Viktorin2014-06-1111-9/+14
| | | | | | | | | | | | | | Memberofindirect processing of an entry doesn't work if the user doesn't have rights to any one of these attributes: - member - memberuser - memberhost Add all of these to any read permission that specifies any of them. Add a check to makeaci that will enforce this for any future permissions. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make 'permission' the default bind type for managed permissionsPetr Viktorin2014-06-118-22/+0
| | | | | | | | | | | This reduces typing (or copy/pasting), and draws a bit of attention to any non-default privileges (currently 'any' or 'anonymous'). Leaving the bindtype out by mistake isn't dangerous: by default a permission is not granted to anyone, since it is not included in any priviliges. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Sort rights when writing the ACIPetr Viktorin2014-06-111-1/+1
| | | | | | This makes the ACI independent on set/dict iteration order. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update all remaining plugins to the new Registry APINathaniel McCallum2014-06-1131-274/+333
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make zonenames absolute in host pluginMartin Basti2014-06-111-2/+3
| | | | | | | This is fix for regression caused by IDNA patch, zone names must be absolute. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Add missing attributes to User managed permissionsPetr Viktorin2014-06-101-2/+3
| | | | | | | | | | - Add nsAccountLock to the Unlock user accounts permission - Add member to Read User Membership - Add userClass and preferredLanguage to Modify Users https://fedorahosted.org/freeipa/ticket/3697 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert User default permissions to managedPetr Viktorin2014-06-101-0/+91
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Split long docstrings that were recently modifiedPetr Viktorin2014-06-104-52/+52
| | | | | | | | When the strings are changed again, translators will only need to re-translate the modified parts. See: https://fedorahosted.org/freeipa/ticket/3587 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui: move host action panel actions to action dropdownPetr Vobornik2014-06-101-0/+2
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: association adder dialog - change find label to filterPetr Vobornik2014-06-101-0/+2
| | | | | | also add filter placeholder Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add search box placeholder textPetr Vobornik2014-06-101-0/+1
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: improve paginationPetr Vobornik2014-06-101-0/+2
| | | | | | | | pagination now support: - styles updated to PatternFly + DataTables - added 'First' and 'Last' button Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: activity indicatorsPetr Vobornik2014-06-101-0/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/4177 https://fedorahosted.org/freeipa/ticket/4255 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add confirmation to action dropdown actionsPetr Vobornik2014-06-101-0/+1
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* Add version and API versionGabe2014-06-092-1/+6
| | | | | | | | | | - Add API version to constants.py - Add version option to plugable.py - Add version to ipa manpage and fix a couple of typos https://fedorahosted.org/freeipa/ticket/4316 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add missing attributes to 'Modify Sudo rule' permissionPetr Viktorin2014-06-041-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4344 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Sudo rule default permissions to managedPetr Viktorin2014-06-041-1/+32
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipalib.aci: Fix bugs in comparisonPetr Viktorin2014-06-041-3/+3
| | | | | | | | | | | | - regression in be6edef6e48224e74344f48d25876b09cd263674: The __ne__ special method was named incorrectly - regression in 1ea6def129aa459ecc3d176a3b6aebdf75de2eb7: The targetattr operator was never compared Include some new comparison tests. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix indentationMartin Basti2014-06-031-21/+21
| | | | | | There was 5 spaces instead of 4, my bad. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* PTR record target can be relativeMartin Basti2014-06-031-2/+1
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* move hostname validation from DNS to hostsMartin Basti2014-06-031-3/+11
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* _domain_name_validatord moved from DNS to realmdomainsMartin Basti2014-06-032-13/+7
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified record and zone class to support IDNMartin Basti2014-06-031-97/+307
| | | | | | | | | | | | | | * Records data are always returned as string * Attributes idnsname, idnssoamname, idnssoarname are returned as * DNSName, with option --raw as string * option --raw returns all IDN domains punycoded Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified records and zone parameters to use DNSNameParamMartin Basti2014-06-031-28/+19
| | | | | | | | | | | | | * Zone is stored as an absolute name (ipa never support relative * zonenames) * compatible with relative zone names as was before * PTR target can be relative domain name Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified dns related global functionsMartin Basti2014-06-033-115/+72
| | | | | | | | | | | * Modified functions to use DNSName type * Removed unused functions Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified has_output attributesMartin Basti2014-06-031-2/+8
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CLI conversion of DNSName typeMartin Basti2014-06-031-0/+3
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* get_ancestors_primary_keys cloneMartin Basti2014-06-031-1/+1
| | | | | | | | | | Fix: classes didnt inherite params from parent correctly Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dns_name_values capability addedMartin Basti2014-06-032-4/+24
| | | | | | | | | | Added capability to transfer DNSName type between server and client Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169i Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSNameParam parameterMartin Basti2014-06-032-1/+71
| | | | | | | | | | New param type for domain names Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allows to sort non text entriesMartin Basti2014-06-032-1/+7
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add read permissions for automember tasksPetr Viktorin2014-06-021-5/+16
| | | | | | | | | | | Permission to read all tasks is given to high-level admins. Managed permission for automember tasks is given to automember task admins. "targetattr=*" is used because tasks are extensibleObject with attributes that aren't in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* krbtpolicy plugin: Fix internal error when global policy is not readablePetr Viktorin2014-05-301-9/+27
| | | | | | | | | | | | | | | An ACIError is now raised if: - the user doesn't have permission to read any one of the ticket policy attributes on the requested entry (checked using attribute-level rights) - any ticket policy attribute from the default policy is not available (either not readable, or not there at all) (only checked if these are accessed, i.e. when the user entry doesn't override all of the defaults, or when requesting the global policy) https://fedorahosted.org/freeipa/ticket/4354 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* krbtpolicy plugin: Code cleanupPetr Viktorin2014-05-301-15/+15
| | | | | | | | | | - Use the new plugin registration API See: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration - Remove the star import from baseldap Part of the work for: https://fedorahosted.org/freeipa/ticket/2653 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add managed read permission for the UPG DefinitionPetr Viktorin2014-05-291-0/+17
| | | | | | | | | | | | Since user_add checks the UPG definition to see if UPG is enabled, user admins need read access to add users correctly. All attributes are allowed since UPG Definition is an extensibleObject; the needed attributes are not in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci plugin: Fix internal error when ACIs are not readablePetr Viktorin2014-05-291-1/+1
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* pwpolicy-mod: Fix crash when priority is changedPetr Viktorin2014-05-281-1/+1
| | | | | | | | | | | | | The exc_callback was expecting the old update_entry signature, (dn, attrs). This was changed to just (entry) for ticket #2660, see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API. Update the exc_callback to expect the entry as first argument, and add some tests. https://fedorahosted.org/freeipa/ticket/4309 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dns: Add idnsSecInlineSigning attribute, add --dnssec option to zonePetr Viktorin2014-05-281-1/+7
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-261-0/+17
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default the token owner to the person adding the tokenNathaniel McCallum2014-05-231-1/+8
| | | | | | | | Creating tokens for yourself is the most common operation. Making this the default optimizes for the common case. Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Only specify the ipatokenuniqueid default in the add operationNathaniel McCallum2014-05-231-2/+5
| | | | | | | | | | | Specifying the default in the LDAP Object causes the parameter to be specified for non-add operations. This is especially problematic when performing the modify operation as it causes the primary key to change for every modification. https://fedorahosted.org/freeipa/ticket/4227 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipalib.cli: Add filename argument to ipa consolePetr Viktorin2014-05-221-6/+25
| | | | | | | | | This allows writing simple IPA scripts using the shebang #! /usr/bin/ipa console https://fedorahosted.org/freeipa/ticket/4351 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* plugin registration refactoring for pwpolicyAdam Misnyovszki2014-05-061-24/+15
| | | | | | | | decorators used for plugin registration in pwpolicy according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Fix a typo in the otptoken doc stringNathaniel McCallum2014-05-061-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4289 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Expose krbPrincipalExpiration in CLITomas Babej2014-05-051-2/+7
| | | | | | | | | Adds a krbPrincipalExpiration attribute to the user class in user.py ipalib plugin as a DateTime parameter. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Add DateTime parameterTomas Babej2014-05-056-6/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a parameter that represents a DateTime format using datetime.datetime object from python's native datetime library. In the CLI, accepts one of the following formats: Accepts LDAP Generalized time without in the following format: '%Y%m%d%H%M%SZ' Accepts subset of values defined by ISO 8601: '%Y-%m-%dT%H:%M:%SZ' '%Y-%m-%dT%H:%MZ' '%Y-%m-%dZ' Also accepts above formats using ' ' (space) as a separator instead of 'T'. As a simplification, it does not deal with timezone info and ISO 8601 values with timezone info (+-hhmm) are rejected. Values are expected to be in the UTC timezone. Values are saved to LDAP as LDAP Generalized time values in the format '%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid confusion, in addition to subset of ISO 8601 values, the LDAP generalized time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the format user will see on the output). Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib.aci: Allow alternate "aci" keyword in ACIsPetr Viktorin2014-04-301-1/+1
| | | | | | | | | | | Dogtag adds some ACIs that use an alternate keyword: version 3.0; aci instead of version 3.0; acl Add support for this so the parser does not fail on these ACIs. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ACI tests to the testsuitePetr Viktorin2014-04-301-52/+0
| | | | | | Make old debug code into regression tests for ACI parsing and output. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipalib.aci: Add support for == and != operators to ACIPetr Viktorin2014-04-301-0/+6
| | | | | | This allows more natural comparisons. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 14:02:23 +0000