summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add range-mod commandMartin Kosek2012-07-134-9/+76
| | | | | | | | | | | range plugin was missing range-mod command that could be used for example to fix a size for a range generated during upgrades. The range should be updated with a caution though, a misconfiguration could break trusts. iparangetype is now also handled better and filled in all commands instead of just range-show. objectclass attribute is deleted only when really needed now.
* Enable SOA serial autoincrementMartin Kosek2012-07-1310-51/+145
| | | | | | | | | | | | | | | | | | SOA serial autoincrement is a requirement for major DNS features, e.g. zone transfers or DNSSEC. Enable it by default in named.conf both for new and upgraded installations. Name of the bind-dyndb-ldap option is "serial_autoincrement". From now on, idnsSOAserial attribute also has to be put to replication agreement exclude list as serial will be incremented on each DNS server separately and won't be shared. Exclude list has to be updated both for new replication agreements and the current ones. Minimum number of connections for bind-dyndb-ldap has been rised to 4 connections, the setting will be updated during package upgrade. https://fedorahosted.org/freeipa/ticket/2554
* Improve address family handling in socketsMartin Kosek2012-07-136-162/+160
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many functions use low-level socket interface for connection or various checks. However, most of the time we don't respect automatic address family detection but rather try to force our values. This may cause either redundat connection tries when an address family is disabled on system tries or even crashes when socket exceptions are not properly caught. Instead of forcing address families to socket, rather use getaddrinfo interface to automatically retrieve a list of all relevant address families and other connection settings when connecting to remote/local machine or binding to a local port. Now, we will also fill correctly all connection parameters like flowinfo and scopeid for IPv6 connections which will for example prevent issues with scoped IPv6 addresses. bind_port_responder function was changed to at first try to bind to IPv6 wildcard address before IPv4 as IPv6 socket is able to accept both IPv4 and IPv6 connections (unlike IPv4 socket). nsslib connection was refactored to use nss.io.AddrInfo class to get all the available connections. Socket is now not created by default in NSSConnection class initializer, but rather when the actual connection is being made, becase we do not an address family where connection is successful. https://fedorahosted.org/freeipa/ticket/2913 https://fedorahosted.org/freeipa/ticket/2695
* Fix ipa-managed-entries man page typoMartin Kosek2012-07-121-2/+1
| | | | | Extra new line in .TH section of the man page caused invalid wrapping.
* Adding exit status 3 & 4 to ipa-client-install man pageGowrishankar Rajaiyan2012-07-121-0/+4
|
* Add automount map/key update permissionsMartin Kosek2012-07-102-2/+41
| | | | | | | | | | | | | Add missing permissions that can be used to delegate write access to existing automount maps or keys. Since automount key RDN has been changed in the past from "automountkey" to "description" and there can be LDAP entries with both RDNs, structure of relevant ACI need to be changed to different scheme. Now, it rather targets a DN of parent automount map object and uses targetfilter to limit the target to automount key objects only. https://fedorahosted.org/freeipa/ticket/2687
* Add and remove dns per-domain permission in Web UIPetr Vobornik2012-07-116-11/+285
| | | | | | | | | | | | | | This patch adds support for new per-domain permissions to Web UI. User with assigned permission (through role,priviledge) can edit DNS zone. These permissions can be added/remove by ipa dnszone-{add/remove}permission $dnszone command. For adding/removing of this permission in Web UI new actions in DNS zone action list were created. DNS zone object doesn't contain information about existance of related permission. Such information is required for enabling/disabling of new actions. Web UI has to search for the permission to get it. DNS zone facet was modified to use batch command, in a same way as user facet, for loading dnszone and the permission at the same time - on load. Batch command has a feature to report all errors. Such behavior is unwanted because we expect that permission-show command will fail when the permission doesn't exist. Batch command was therefore modified to not report commands which has retry attribute set to false. This attr was chosen because it has similar purpose in single command execution. New actions should be enabled only for users with appropriate rights. It is not possible to obtain rights for certain action in advance so an approximation is used: write right for dns zones' managedby attribute. https://fedorahosted.org/freeipa/ticket/2851
* Fix wrong option name in ipa-managed-entries man pagePetr Viktorin2012-07-111-1/+1
| | | | The page said `-y` but the actual option is `-p`.
* Fix batch command error reportingPetr Viktorin2012-07-112-12/+59
| | | | | | | | | | | | The Batch command did not report errors correctly: it reported the text of *all* errors, not just PublicError, used unicode(e) instead of e.strerror (which results in incorrect i18n), and only reported the text of error messages, not their type and code. Fix these problems. Update tests. https://fedorahosted.org/freeipa/ticket/2874 https://fedorahosted.org/freeipa/ticket/2901
* Indirect roles in WebUIDavid Spångberg2012-07-111-0/+3
| | | | | Add a check in the WebUI to use the admin navigation if a user is a indirect member of a role.
* Web UI: kerberos ticket policy measurement unitsPetr Vobornik2012-07-102-4/+12
| | | | | | Added measurement units for kerberos ticket policy. https://fedorahosted.org/freeipa/ticket/2444
* Password policy measurement units.Petr Vobornik2012-07-106-9/+44
| | | | | | | | | | | | When filling password policy it may be unclear what value to enter because user may not remember field's measurement unit. This patch adds support for declaring measurement units. It's done in field's/widget's spec by entering key for unit's string (which is in IPA.messages.measurement_units[key]). Measurement units in table layout are displayed in parenthesis after label. It is to be consistent with some fields which have measurement unit integrated in label. This patch defines measurement units for password policy's 'History size', 'Failure reset interval' and 'Lockout duration' fields. https://fedorahosted.org/freeipa/ticket/2437
* Display loginas information only after loginPetr Vobornik2012-07-104-5/+16
| | | | | | | | Message 'Logged in as: user@FREEIPA.ORG' was displayed before user was logged in. It was wrong. Now 'Logged in as: XXX' is displayed only when user XXX is logged in. So no more user@FREEIPA.ORG :) . https://fedorahosted.org/freeipa/ticket/2882
* Make client server option multi-valued, allow disabling DNS discoveryRob Crittenden2012-07-103-38/+70
| | | | | | | | | | | | | Let the --server option be specified multiple times on the command line. The first one passed in is the one we enroll against. Do additional verification before setting dnsok so we can be sure that the record(s) were actually discovered in DNS. If servers are provided on the CLI and --fixed-primary is set then _srv_ is not added to ipa_server in sssd.conf. https://fedorahosted.org/freeipa/ticket/2841
* Do not change LDAPObject objectclass listMartin Kosek2012-07-091-1/+1
| | | | | | | | | | | | | __json__ method of LDAPObject may inadvertently append a list of possible objectclasses to a list of basic objectclasses and thus change a behavior of all subsequent LDAPSearch command. The command may only return objects where all "possible" objectclasses are present and thus returning an incomplete list. Make sure that the LDAPObject object_class list is not modified during the __json__ method. https://fedorahosted.org/freeipa/ticket/2906
* Fix typoSumit Bose2012-07-091-1/+1
| | | | Signed-off-by: Simo Sorce <ssorce@redhat.com>
* Fix wrong check after allocation.Simo Sorce2012-07-071-1/+1
|
* Moved configuration to last position in navigationPetr Vobornik2012-07-061-2/+2
| | | | | | | | Configaration was the last navigation item in IPA server tab. Trusts changed it. It was wrong because configuration is like 'other settings' and so it should be last. This patch moves configuration navigation item to the last position again. https://fedorahosted.org/freeipa/ticket/2900
* reduce redundant checks in ldapsam_search_users() to a single statementAlexander Bokovoy2012-07-061-8/+1
|
* Use smb.conf 'dedicated keytab file' parameter instead of hard-coded valueAlexander Bokovoy2012-07-061-1/+2
|
* ipasam: replace testing codeSumit Bose2012-07-061-5/+5
|
* ipasam: fixes for clang warningsSumit Bose2012-07-061-28/+20
|
* Allow silent build if availableSumit Bose2012-07-061-0/+1
|
* ipasam: improve SASL bind callbackAlexander Bokovoy2012-07-062-43/+136
| | | | | | | | SASL bind callback due to refactoring was referencing local variable which didn't exist all the time. Fix that by including a copy of service principals into ipasam long term private struct. Rework ccache handling to avoid re-initing every time callback is called
* Centralize timeout for waiting for servers to start.Rob Crittenden2012-07-0216-105/+176
| | | | | | | | | | | | | All service start/restart currently go through ipapython/platform so move the "wait for service to start" code there as well. A dictionary of known services and ports to wait on is defined in base.py This is referenced by the platforms by instance name to determine what to wait for. For the case of dirsrv if we get that as a plain name (no specific instance) it is assumed to be the main IPA service. https://fedorahosted.org/freeipa/ticket/2375 https://fedorahosted.org/freeipa/ticket/2610
* Become IPA v3 beta 1 (3.0.0.pre1)beta_1-3-0-0Rob Crittenden2012-07-011-3/+3
|
* Use DN objects instead of strings in adtrustinstanceSumit Bose2012-07-011-16/+25
|
* Create default range entry after upgradeMartin Kosek2012-07-023-3/+95
| | | | | | | | | | Create default range both on new install and on upgrades. Also make sure that all range object classes are present for upgraded machines. Default range LDIF entry for new install was fixed so that new installation does not crash. https://fedorahosted.org/freeipa/ticket/2891
* Fix compatibility with Fedora 18.Rob Crittenden2012-07-023-5/+36
| | | | | | | | We need a Requires on openssl, the mod_rewrite syntax has changed so we can dump some unused configuration and we need a newer version of mod_auth_kerb to pick up the new location of delegated ccache. https://fedorahosted.org/freeipa/ticket/2839
* Explicitly filter options that permission-{add,mod} passes to aci-{add,mod}Petr Viktorin2012-07-025-15/+19
| | | | | | | | | | | Make permission commands not pass options that the underlying ACI commands do not understand. Update tests. Remove some extraneous imports of the `copy` module. https://fedorahosted.org/freeipa/ticket/2885
* Add missing option to range_add in API.txtRob Crittenden2012-06-301-2/+4
| | | | Fix build
* Add range check preop pluginSumit Bose2012-06-297-0/+510
| | | | | | | To make sure that ID ranges do not overlap this plugin checks new additions and changes for conflicts with existing ranges. https://fedorahosted.org/freeipa/ticket/2185
* Add CLI for ID rangesSumit Bose2012-06-294-1/+273
| | | | https://fedorahosted.org/freeipa/ticket/2185
* Set RID bases for local domain during ipa-adtrust-installSumit Bose2012-06-292-2/+96
|
* Add objects for initial ID rangeSumit Bose2012-06-294-0/+29
|
* Extend LDAP schemaSumit Bose2012-06-291-0/+8
| | | | | | | | | | | The objectclass ipaIDobject can be used to reserve local UIDs, GIDs or SIDs for objects that are no neither users nor groups. The ipa*IDRange objectclasses will be used to store the used Posix ID ranges of the local domains (ipaDomainIDRange) or the ranges reserved for AD domains (ipaTrustedADDomainRange). To be able to map the Posix IDs to a RID and back the corresponding ranges can be saved here as well.
* Use lower case names in LDAP to meet freeIPA conventionSumit Bose2012-06-291-11/+11
|
* Continuation of removing of not supported command options from Web UIPetr Vobornik2012-06-293-4/+2
| | | | | | | | | This patch removes following non-existing command options: * all,rights in host_disable * record_type in dns_record_add * all,rights in various xxx_remove_xxx commands used in rule_association_table_field (removing association) https://fedorahosted.org/freeipa/ticket/2878
* Refactored associatin facet to use facet buttons with actionsPetr Vobornik2012-06-292-45/+119
| | | | | | | Association facet was refactored to use new concept of control buttons. It is the last facet type which don't use this concept. It fixes regression introduced by previous refactoring of table facet (delete button was never enabled). https://fedorahosted.org/freeipa/ticket/2876
* Web UI password is going to expire in n days notificationPetr Vobornik2012-06-298-45/+217
| | | | | | | | This patch adds pending password expiration notification support to Web UI. When user's password is going to expire in less or equal than configure days a bold red text 'Your password expires in N days.' and a link 'Reset your password' are shown in Web UI's header (on the left next to 'Logged in as...'). Clicking on 'Reset your password link' opens IPA.user_password_dialog. Successful reset of own password will reload user's information (whoami) and update header (it will most likely hide the warning and link). https://fedorahosted.org/freeipa/ticket/2625
* Add support for external group membersAlexander Bokovoy2012-06-2811-29/+358
| | | | | | | | | When using ipaExternalGroup/ipaExternalMember attributes it is possible to add group members which don't exist in IPA database. This is primarily is required for AD trusts support and therefore validation is accepting only secure identifier (SID) format. https://fedorahosted.org/freeipa/ticket/2664
* Per-domain DNS record permissionsMartin Kosek2012-06-2811-24/+278
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
* Add missing libsss_idmap Requires on freeipa-server-trust-adMartin Kosek2012-06-281-0/+1
|
* Add external domain extop DS pluginSumit Bose2012-06-2812-7/+1225
| | | | | | This extop can be used by clients of the IPA domain, e.g. sssd, to retrieve data from trusted external domains. It can be used e.g. to map Windows SIDs to user or groups names and back.
* Add configure check for C Unit-Test framework checkSumit Bose2012-06-281-0/+10
| | | | The framework can be found at http://check.sourceforge.net.
* Filter groups in the PACSumit Bose2012-06-281-1/+452
| | | | | | If one or more of the external groups given in the PAC can be found in the ipaExternalGroup objects and these objects are members of local groups, the SIDs of the local groups are added to the PAC.
* Add sidgen postop and taskSumit Bose2012-06-2812-0/+1390
| | | | | | | | A postop plugin is added to create the SID for new created users and groups. A directory server task allows to set the SID for existing users and groups. Fixes https://fedorahosted.org/freeipa/ticket/2825
* Add error condition handling to the SASL bind callback in ipasamAlexander Bokovoy2012-06-281-12/+80
| | | | https://fedorahosted.org/freeipa/ticket/2877
* Support requests for DOMAIN$ account for trusted domains in ipasam moduleAlexander Bokovoy2012-06-281-13/+20
| | | | https://fedorahosted.org/freeipa/ticket/2870
* Defer adding ipa-cifs-delegation-targets until the Updates phase.Rob Crittenden2012-06-271-3/+5
| | | | | | | It was likely that this would fail being in an LDIF so let an update file add this potentially conflicting entry instead. https://fedorahosted.org/freeipa/ticket/2837
generated by cgit (git 2.34.1) at 2025-09-03 21:27:32 +0000