summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins/baseuser.py
Commit message (Collapse)AuthorAgeFilesLines
* ipa user-add: add optional objectclass for radius-usernameFlorence Blanc-Renaud2018-11-131-2/+16
| | | | | | | | | | | | | | | | | | The command "ipa user-add --radius-username" fails with ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed because it does not add the objectclass ipatokenradiusproxyuser that is required by the attribute ipatokenradiususername. The issue happens with ipa user-add / stageuser-add / user-mod / stageuser-mod. The fix adds the objectclass when needed in the pre_common_callback method of baseuser_add and baseuser_mod (ensuring that user and stageuser commands are fixed). Fixes https://pagure.io/freeipa/issue/7569 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Replace six.string_types with strChristian Heimes2018-09-271-2/+2
| | | | | | | | In Python 3, six.string_types is just an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Sprinkle raw strings across the code baseChristian Heimes2018-09-271-2/+6
| | | | | | | | | | | | | | | tox / pytest is complaining about lots and lots of invalid escape sequences in our code base. Sprinkle raw strings or backslash escapes across the code base to fix most occurences of: DeprecationWarning: invalid escape sequence There is still one warning that keeps repeating, though: source:264: DeprecationWarning: invalid escape sequence \d Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Revert "Don't allow OTP or RADIUS in FIPS mode"Nathaniel McCallum2018-03-121-3/+0
| | | | | | | | | | | | This reverts commit 16a952a0a44a0ebee97029ea1d2f6b7593dd2622. OTP now works in FIPS mode. RADIUS can be made to be compliant by wrapping traffic in a VPN. https://pagure.io/freeipa/issue/7168 https://pagure.io/freeipa/issue/7243 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* LGTM: raise handle_not_found()Christian Heimes2018-01-091-1/+1
| | | | | | | | | | | | | | Turn calls "handle_not_found()" into "raise handle_not_found()" to indicate control flow chance. It makes the code easier to understand, the control flow more obvious and helps static analyzers. It's OK to raise here because handle_not_found() always raises an exception. https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Don't allow OTP or RADIUS in FIPS modeStanislav Laznicka2017-11-081-0/+3
| | | | | | | | | | | RADIUS, which is also internally used in the process of OTP authentication by ipa-otpd, requires MD5 checksums which makes it impossible to be used in FIPS mode. Don't allow users setting OTP or RADIUS authentication if in FIPS mode. https://pagure.io/freeipa/issue/7168 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Create a Certificate parameterStanislav Laznicka2017-07-271-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | | Up until now, Bytes parameter was used for certificate parameters throughout the framework. However, the Bytes parameter does nothing special for certificates, like validation, so this had to be done for each of the parameters which were supposed to represent a certificate. This commit introduces a special Certificate parameter which takes care of certificate validation so this does not have to be done separately. It also makes sure that the certificates represented by this parameter are always converted to DER format so that we can work with them in a unified manner throughout the framework. This commit also makes it possible to pass bytes directly during instantiation of the Certificate parameter and they are still represented correctly after their conversion in the _convert_scalar() method. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-271-1/+1
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add --password-expiration to allow admin to force user password expirationGabe2017-03-311-0/+4
| | | | | | | - Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Reworked the renaming mechanismStanislav Laznicka2017-03-271-1/+1
| | | | | | | | | | | | | | | | | | | The rename operation on *_mod commands was only allowed when the primary key of an entry was also its RDN. With these changes, it should be possible to rename the rest of the entries as well. An attribute to the base LDAPObject was added to whitelist the objects we want to allow to be renamed. It replaced an old attribute rdn_is_primary_key which was used for the very same purpose but the name was confusing because it was not set correctly for certain objects. https://pagure.io/freeipa/issue/2466 https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-021-6/+168
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* stageuser: Add stageuser-{add,remove}-certDavid Kupka2017-02-071-1/+35
| | | | | | | | | Move {add,remove}-cert implementation from user to baseuser and inherit {,stage}user-{add,remove}-cert from it. https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_generate_password algorithm changePetr Spacek2017-01-061-6/+2
| | | | | | | | | | | | | | | | A change to the algorithm that generates random passwords for multiple purposes throught IPA. This spells out the need to assess password strength by the entropy it contains rather than its length. This new password generation should also be compatible with the NSS implementation of password requirements in FIPS environment so that newly created databases won't fail with wrong authentication. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Use constant for user and group patternsMartin Basti2016-09-201-1/+2
| | | | | | | | | | User and groups regexp are the same and constant should be used to avoid any future misconfigurations. https://fedorahosted.org/freeipa/ticket/5822 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix regexp patterns in parameters to not enforce lengthMartin Basti2016-09-201-1/+1
| | | | | | | | | | | Regexp should not enforce lenght of string, we have different checks for that. Secondly regexp with length specified produces an incorrect error message. https://fedorahosted.org/freeipa/ticket/5822 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase default length of auto generated passwordsMartin Basti2016-08-031-2/+3
| | | | | | | | | | | | | | | Installer/IPA generates passwords for warious purpose: * KRA * kerberos master key * NSSDB password * temporary passwords during installation Length of passwords should be increased to 22, ~128bits of entropy, to be safe nowadays. https://fedorahosted.org/freeipa/ticket/6116 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Preserve user principal aliases during rename operationMartin Babinsky2016-07-151-0/+46
| | | | | | | | | | | | | | | | When a MODRDN is performed on the user entry, the MODRDN plugin resets both krbPrincipalName and krbCanonicalName to the value constructed from uid. In doing so, hovewer, any principal aliases added to the krbPrincipalName are wiped clean. In this patch old aliases are fetched before the MODRDN operation takes place and inserted back after it is performed. This also preserves previous user logins which can be used further for authentication as aliases. https://fedorahosted.org/freeipa/ticket/6028 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Unify display of principal names/aliases across entitiesMartin Babinsky2016-07-011-1/+3
| | | | | | | | | | | | Since now users, hosts, and service all support assigning multiple principal aliases to them, the display of kerberos principal names should be consistent across all these objects. Principal aliases and canonical names will now be displayed in all add, mod, show, and find operations. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Provide API for management of host, service, and user principal aliasesMartin Babinsky2016-07-011-6/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...]) were added to manage principal aliases. 'add' commands will check the following: * the correct principal type is supplied as an alias * the principals have correct realm and the realm/alternative suffix (e.g. e-mail) do not overlap with those of trusted AD domains If the entry does not have canonical principal name, the first returned principal name will be set as one. This is mostly to smoothly operate on entries created on older servers. 'remove' commands will check that there is at least one principal alias equal to the canonical name left on the entry. See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases https://fedorahosted.org/freeipa/ticket/1365 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migrate management framework plugins to use Principal parameterMartin Babinsky2016-07-011-41/+16
| | | | | | | | | | | | All plugins will now use this parameter and common code for all operations on Kerberos principals. Additional semantic validators and normalizers were added to determine or append a correct realm so that the previous behavior is kept intact. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* user: add object plugin for user_statusJan Cholasta2016-06-301-18/+0
| | | | | | | | | | | Change user_status from a method of user to a method of a new userstatus class, which defines the extra attributes returned by user_status. This fixes user_status CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* server: define missing virtual attributesJan Cholasta2016-06-301-3/+4
| | | | | | | | | | | Move virtual attributes defined in output params of methods into params of the related object. This fixes the virtual attributes being ommited in CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* IPA API: set krbcanonicalname instead of ipakrbprincipalalias on new entitiesMartin Babinsky2016-06-231-0/+2
| | | | | | | | | | | Hosts, services, and (stage)-users will now have krbcanonicalname attribute set to the same value as krbprincipalname on creation. Moreover, new services will not have ipakrbprincipalalias set anymore. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-031-0/+663
Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 17:18:46 +0000