summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Move install script error handling to a common functionPetr Viktorin2012-05-3113-267/+243
| | | | | | | | | | | | | | All of our install/admin scripts had a try/except block calling the main function and handling common exceptions. These were copy-pasted from each other and modified to various levels of sophistication. This refactors them out of installers to a single function, which includes a final pass/fail message for all of the scripts. Non-install scripts that set up the same log handler levels for stderr and log file are not changed, as it's not possible to log to only the logfile without changing the logger configuration. https://fedorahosted.org/freeipa/ticket/2071
* If SELinux is enabled ensure we also have restorecon.Rob Crittenden2012-05-316-42/+107
| | | | | | | | | | | | We don't have a specific requires on the policycoreutils package. It gets pulled in as a dependency on the server anyway, but checking there is like a belt and suspenders. On the client we don't require SELinux at all. If SELinux is enabled however we need to set things up properly. This is provided by the policycoreutils package so fail if that isn't available. https://fedorahosted.org/freeipa/ticket/2368
* Add rename option for DNS recordsMartin Kosek2012-05-314-6/+47
| | | | | | | This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
* Enforce sizelimit in permission-find, post_callback returns truncatedRob Crittenden2012-05-3011-11/+110
| | | | | | | | | | | | | | | We actually perform two searches in permission-find. The first looks for matches within the permission object itself. The second looks at matches in the underlying aci. We need to break out in two places. The first is if we find enough matches in the permission itself. The second when we are appending matches from acis. The post_callback() definition needed to be modified to return the truncated value so a plugin author can modify that value. https://fedorahosted.org/freeipa/ticket/2322
* SSH configuration fixes.Jan Cholasta2012-05-301-2/+7
| | | | | | | | | | | | | Use GlobalKnownHostsFile instead of GlobalKnownHostsFile2 in ssh_config, as the latter has been deprecated in OpenSSH 5.9. If DNS host key verification is enabled, restrict the set of allowed host public key algorithms to ssh-rsa and ssh-dss, as DNS SSHFP records support only these algorithms. Make sure public key user authentication is enabled in both ssh and sshd. ticket 2769
* Fix setting domain_sidSimo Sorce2012-05-291-1/+1
| | | | | | | 'sid' is a stack variable, by assigning its address to the domain_sid pointer we were later referencing grabage (whatever on the stack ha[ppened to be at that address. Properly copy the sid and allocate it on the provided memory context.
* Provide a better error message when deleting nonexistent attributesPetr Viktorin2012-05-292-0/+43
| | | | | | | | | If --delattr is used on an attribute that's not present on an entry, and --{set,add}attr isn't being used on that same attribute, say that there's "no such attribute" instead of "<attribute> does not contain <value>". https://fedorahosted.org/freeipa/ticket/2699
* Disallow setattr on no_update/no_create paramsPetr Viktorin2012-05-2911-38/+128
| | | | | | | | | | | | | Make --{set,add,del}attr fail on parameters with the no_update/no_create flag for the respective command. For attributes that can be modified, but we just don't want to display in the CLI, use the 'no_option' flag. These are "locking" attributes (ipaenabledflag, nsaccountlock) and externalhost. Document the 'no_option' flag. Add some tests. https://fedorahosted.org/freeipa/ticket/2580
* Reset krbtpolicy when a unit test is finishedMartin Kosek2012-05-281-0/+1
| | | | | | | | | | Kerberos ticket maximum life was being set to 1 hour which then affected lifetime of Kerberos tickets returned by IPA server under the test. Make sure that the policy is reset before and after the unit test to keep the IPA server settings clean and not to disrupt development environment.
* Always set ipa_hostname for sssd.confOndrej Hamada2012-05-281-4/+3
| | | | | | | ipa-client-install will always set ipa_hostname for sssd.conf in order to prevent the client from getting into weird state. https://fedorahosted.org/freeipa/ticket/2527
* Fix the pwpolicy_find post_callbackPetr Viktorin2012-05-282-18/+33
| | | | | | | | | | | | | Always call convert_time_for_output so time gets reported correctly. That method has its own checks for whether the attributes are present; an additional check is unnecessary. Use a key function for sorting; cmp is deprecated, slower and more complicated. Add a test https://fedorahosted.org/freeipa/ticket/2726
* Normalize uid to lower case in winsync.Rob Crittenden2012-05-251-1/+32
| | | | | | This in effect fixes uid, krbPrincipalName and homeDir. https://fedorahosted.org/freeipa/ticket/2756
* Fix default_server configuration in ipapython.configMartin Kosek2012-05-241-1/+1
| | | | | | When default server was being parsed from IPA's default.conf configuration file, the parsed server was not appended correctly to the default_server list.
* Replace DNS client based on acutil with python-dnsMartin Kosek2012-05-2413-721/+200
| | | | | | | | | | | | | | | | | | | | | | | | | | IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
* Retry retrieving ldap principals when setting up replication.Rob Crittenden2012-05-221-18/+60
| | | | | | | | | | | | We've seen on a few occassions where one side or the other is missing the ldap principal. This causes replication to fail when trying to convert to using GSSAPI. If this happens force a synchronization again and try the retrieval again, up to 10 times. This should also make the error report clearer if even after the retries one of the principals doesn't exist. https://fedorahosted.org/freeipa/ticket/2737
* ipa-server-install reword messageOndrej Hamada2012-05-221-1/+1
| | | | | | | Output message of the 'read_domain_name' function in ipa-server-install was reworded. https://fedorahosted.org/freeipa/ticket/2704
* Remove LDAP limits from DNS serviceMartin Kosek2012-05-222-3/+71
| | | | | | | | | | | | bind-dyndb-ldap persistent search queries LDAP for all DNS records. The LDAP connection must have no size or time limits to work properly. This patch updates limits both for existing service principal on updated machine and for new service principals added as a part of DNS installation. https://fedorahosted.org/freeipa/ticket/2531
* Remove ipa-server-install LDAP update errorsMartin Kosek2012-05-172-2/+9
| | | | | | | | | | | | | | | | | | | python-ldap add_s method raises a NO_SUCH_OBJECT exception when a parent entry of the entry being added does not exist. This may not be an error, for example NIS entries are only added when NIS is enabled and thus the NIS entry container exists. The exception raised by python-ldap is also incorrectly processed in ipaldap's addEntry function and an irrelevant exception is re-raised instead. Fix LDAP updater to just log an information when an object cannot be added due to missing parent object. Also make sure that the addEntry function exception processing provides the right exception with a useful description. https://fedorahosted.org/freeipa/ticket/2520 https://fedorahosted.org/freeipa/ticket/2743
* Check for locked-out user before incrementing lastfail.Rob Crittenden2012-05-181-4/+6
| | | | | | | | | | | | | | | | | | | | | | If a user become locked due to too many failed logins and then were unlocked by an administrator, the account would not lock again. This was caused by two things: - We were incrementing the fail counter before checking to see if the account was already locked out. - The current fail count wasn't taken into consideration when deciding if the account is locked. The sequence was this: 1. Unlocked account, set failcount to 0 2. Failed login, increment failcount 3. Within lastfailed + lockout_duration, still locked. This skips update the last_failed date. So I reversed 2 and 3 and check to see if the fail count exceeds policy. https://fedorahosted.org/freeipa/ticket/2765
* Fix migration code password setting.Simo Sorce2012-05-171-0/+11
| | | | | | | | When we set a password we also need to make sure krbExtraData is set. If not kadmin will later complain that the object is corrupted at password change time. Ticket: https://fedorahosted.org/freeipa/ticket/2764
* During replication installation see if an agreement already exists.Rob Crittenden2012-05-172-10/+30
| | | | | | | | We were inferring that an agreement existed if the host was present as an IPA host. This was not enough if the replica installation failed early enough. https://fedorahosted.org/freeipa/ticket/2030
* permission-mod prompts for all parametersOndrej Hamada2012-05-173-21/+14
| | | | | | | | | ipa permission-mod was prompting for all parameters because they had specified flag 'ask_update'. The flag was removed. Additionally the exec_callback for permission-mod was updated to unify the behaviour with other ipa commands (raise exception when no modification was specified). https://fedorahosted.org/freeipa/ticket/2280
* Validate on the user-provided domain name in the installer.Rob Crittenden2012-05-171-2/+13
| | | | | | Wrap printing exceptions in unicode() to do Gettext conversion. https://fedorahosted.org/freeipa/ticket/2196
* Include more information when IP address is not local during installation.Rob Crittenden2012-05-171-1/+4
| | | | | | | | Provide the IP address we resolved when displaying the exception. Also handle the exception ourselves with sys.exit(). https://fedorahosted.org/freeipa/ticket/2654
* Correction of nested search facets tab labelsPetr Vobornik2012-05-152-0/+3
| | | | | | | | Nested search facets were using 'search' tab label instead of their nested entity name. This patch is fixing that regression. https://fedorahosted.org/freeipa/ticket/2744
* Improved calculation of max pkey length in facet headerPetr Vobornik2012-05-151-9/+55
| | | | | | | | | | | | Very long pkeys in facet header were limited to 60 characters. This magic number was good enough but with new action lists it isn't. This patch is adding calculation of maximum characters for pkey in facet header. It fixes regression introduced by Action Lists and also it uses effectively available space. Also this patch is changing limiting of breadcrumbs element to use as much space as possible. It works in three steps. First a threshold is set which is equal to length average. Then a total length of keys with length less than threshold is calculated. From this we can get remaining space for long keys and calculate new threshold. At last keys are limited to new threshold. https://fedorahosted.org/freeipa/ticket/2247 f
* Host page fixed to work with disabled DNS supportPetr Vobornik2012-05-153-0/+27
| | | | | | | | | | | | | | | | | When DNS support was disabled there were following errors in Web UI: 1) Host details page was not filled with data 2) Host adder dialog was broken -> unusable 3) DNS tab was displayed in navigation The bugs were fixed by: 1) Was caused by entity_link_widget. The widget was modified to do not show link if other_entity (in this case dnsrecord) is not present. 2) Was caused by host_fqdn_widget. The widget is unusable becouse withou DNS support it doesn't have access to DNS zone entity. The section with this widget was removed. Also IP address field was removed because it shouln't be used without DNS support. New 'fqdn' text box was added for specifying hostname. 3) New DNS config entity was initialized but it wasn't shown because it caused some JavaScript error. The dnsconfig's init method was modified to throw expected exception. Now no dns entity is initialized and therefore DNS tab in navigation is not displayed. https://fedorahosted.org/freeipa/ticket/2728
* Fix python Requires in Fedora 17 buildMartin Kosek2012-05-151-5/+7
| | | | | | | | | | | | | | | | When python's distutils build process prepares python scripts, it use current Python interpreter in an updated shebang for python scripts. Since Makefile did not use absolute path to python interpreter, it may be translated to "/bin/python" in Fedora 17 which is then taken by rpmbuild as freeipa-admintools dependency. This can break of F-17 python package which provides just "/usr/bin/python" This patch updates Makefile to use a correct absolute path to python interpreter which is then filled to freeipa scripts shebang and rpm Requires list. The value is taken from RPM __python macro so that we do not hardcode it. https://fedorahosted.org/freeipa/ticket/2727
* Instructions to generate cert use certutil instead of opensslPetr Vobornik2012-05-152-2/+2
| | | | | | Instructions to generate certificate were changed. Now they use certutil instead of openssl. In the example is also used option for specifying key size. https://fedorahosted.org/freeipa/ticket/2725
* Disallow '<' and non-ASCII characters in the DM passwordPetr Viktorin2012-05-151-6/+8
| | | | | | pkisilent does not handle these properly. https://fedorahosted.org/freeipa/ticket/2675
* Check for empty/single value parameters before calling callbacksPetr Viktorin2012-05-152-2/+11
| | | | https://fedorahosted.org/freeipa/ticket/2701
* Implement permission/aci find by subtreeRob Crittenden2012-05-152-1/+53
| | | | https://fedorahosted.org/freeipa/ticket/2321
* Do not use extra command options in ACI, permission, selfservicePetr Viktorin2012-05-144-37/+28
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for ACI-related plugins. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Fix overlapping cn param/option issue, pass cn as aciname in findRob Crittenden2012-05-142-0/+39
| | | | | | | | | | | | permission-find --name wasn't working for two reasons. The first was that the cn to search on in options ended up overlapping the primary key name causing the request to fail. The second reason was aci uses aciname, not cn, as its name field. So searching on --name matched everything because it was as if you were searching on nothing. https://fedorahosted.org/freeipa/ticket/2320
* Consistent change of entry status.Petr Vobornik2012-05-115-237/+215
| | | | | | | | | This patch adds action list and control buttons for consistent change of enty status for user, hbac rules, sudo rules, SELinux maps and dns zones. Action lists with 'enable' and 'disable' and 'delete' options were added to details facets. Two control buttons: 'enable' and 'disable' were added to search facets. https://fedorahosted.org/freeipa/ticket/2247
* General details facet actionsPetr Vobornik2012-05-114-0/+171
| | | | | | This patch adds common action button actions for enabling/disabling/deleting object. https://fedorahosted.org/freeipa/ticket/2707
* Batch action for search page control buttonsPetr Vobornik2012-05-111-0/+42
| | | | | | This patch implements a base action which can execute a batch of commands with single pkey as a parameter. https://fedorahosted.org/freeipa/ticket/2707
* Hide search facet add/delete buttons in self-servicePetr Vobornik2012-05-113-44/+78
| | | | | | Adds hiding/showing capabilities to action_button_widget. This patch is fixing regression caused replacing old details facet buttons with control_buttons_widget. The problem was that some buttons were not hidden in self-service mode. https://fedorahosted.org/freeipa/ticket/2707
* Redefined search control buttonsPetr Vobornik2012-05-112-72/+93
| | | | | | This patch replaces old search facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Redefined details control buttonsPetr Vobornik2012-05-111-68/+65
| | | | | | This patch replaces old details facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Control buttonsPetr Vobornik2012-05-111-1/+275
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Control buttons is a widget which contains action buttons. It is located in facet header and are supposed to replace old action buttons created by IPA.action_button(spec) call. The benefit is that now it is possible to define new buttons declaratively in spec definition without a need of inheriting facet and overriding create method. Action buttons are an entry poing for execution facet-wide action so they are tightly bound to facet. Action button options: name: string label: string, human readable label tooltip: string, human readable tooltip href: string, optional icon: string, icon class needs_confirm: boolean, default false confirm_msg: string, human readable confirmation message confirm_dialog: confirmation dialog, optional, custom confirmation dialog action: action, action which will be executed enabled: boolean, optional, default true Control buttons are define in facet spec in control_buttons property. Its a spec object with following attributes: all attributes which normal widget can have buttons: array of action_button specs state_listeners: array of state listener specs In init phase control_buttons_widget should assign a action_button a facet. control_buttons_widget are resposible for evaluation of action_button disable/enable state because they contain state_listeners which creates the state upon the enabled/disabled state is evaluated. State listeners are similar to state_evaluators. The differce is that the state is not evaluated from record set but from facet itself. The execution of evaluation is bound to a facet event. https://fedorahosted.org/freeipa/ticket/2247
* Action listsPetr Vobornik2012-05-116-18/+527
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch add support fo Action Lists. Action list is a select widget with actions as options located in facet header. Action can be selected and then executed by clickin on 'apply' button. Actions lists are defined on facet level. Facet header takes them from facet. Action list options actions: list of actions state_evaluator: a state evaluator which is needed for enabling/disabling options. Can encapsulate more evaluators. State evaluator object ---------------------- State evaluator is resposible for evaluating a state from result set. State is a array of strings. Each evaluator should inherit from IPA.state_evaluator and override evaluate method. Methods: evaluate(record): should return string array which represents the state get_description(): human readable representation of a state Action ------ Action is a object which can perform certain action on a facet. Action has enabling and disabling conditions. action options: name: string, required, name of the option label: string, required, human readable name of the option enable_cond: string array, states which need to be present in order to run this action disable_cond: string array, states which must not be present in order to run this action handler: function, contains action's logic needs_confirm: boolean, default false, indicates if action needs user confirmation confirm_msg: string, default generic message, human readable confirmation message. Action list should contain logic which enables/disables action based on facet state and action's enabling/disabling conditions. It should also enforce presence of confirmation. In this patch is also slightly modified facet header, mostly title part. It was revised to contain status icon, title and action list on single line. Facet header is using state evaluator's get_description method to properly set tooltip for state icon. https://fedorahosted.org/freeipa/ticket/2247
* General builder supportPetr Vobornik2012-05-111-0/+67
| | | | | | | | | | | | Web UI mainly uses declarative way of defining UI structure. When a new object type is created it is often required to create a new builder which would build the objects from spec file. The builders' logic is mostly the same. This patch adds a general builder with some extendability capabilities. Now it is possible to: 1) define spec for single object and build it by calling IPA.build(spec, /* optional */ builder_fac) 2) define an array of specs and build the objects by the same call Prerequisite for following action list patches. https://fedorahosted.org/freeipa/ticket/2707
* Return LDAP_SUCCESS on mods on a referral entry.Rob Crittenden2012-05-111-0/+9
| | | | | | | | | We currently return LDAP_REFERRAL which causes the mod to fail meaning that referral entries cannot be changed. All we really want to do is escape when we don't hvae an entry to modify. https://fedorahosted.org/freeipa/ticket/2237
* Validate externalhost (when added by --addattr/--setattr)Petr Viktorin2012-05-117-3/+105
| | | | | | | | | | | | Change the externalhost attribute of hbacrule, netgroup and sudorule into a full-fledged Parameter, and attach a validator to it. The validator is relaxed to allow underscores, so that some hosts with nonstandard names can be added. Tests included. https://fedorahosted.org/freeipa/ticket/2649
* Remove duplicate and unused utility codePetr Viktorin2012-05-0923-725/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Don't fail when adding default objectclasses using config-modPetr Viktorin2012-05-092-2/+57
| | | | | | | | | | The config plugin was adding together a list and a tuple, then converting to a set. Replace the operation with a set union. Regression test included. https://fedorahosted.org/freeipa/ticket/2706
* Redo boolean value encoding.Jan Cholasta2012-05-097-70/+10
| | | | | | | Move the code for encoding boolean values to LDAP boolean syntax from the Parameter class to the Encoder class, where the rest of LDAP encoding takes place. Remove encoding code from the Parameter class altogether, as all LDAP encoding should be done in the Encoder class.
* Do not crash on empty --setattr, --getattr, --addattrPetr Viktorin2012-05-072-9/+10
| | | | | | Also the unused `append` argument from _convert_2_dict. https://fedorahosted.org/freeipa/ticket/2680
* Do not crash on empty reverse member optionsPetr Viktorin2012-05-073-2/+88
| | | | | | | | | | | Calling a LDAP{Add,Remove}ReverseMember with an empty reverse_member caused an internal error, because empty values are converted to None, which is then iterated. Use an empty list instead of None (or other false falues, of which we only use the empty list). https://fedorahosted.org/freeipa/ticket/2681
generated by cgit (git 2.34.1) at 2025-09-03 13:16:49 +0000