summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Redirection to PTR records from A,AAAA recordsPetr Voborník2012-02-153-2/+255
| | | | | | | | | | | | | | | | | | | Address column in A, AAAA DNS records was exented of redirection capabilities. Redirection dialog is shown after a click on a value. Dialog does following steps: 1) fetch all dns zones 2) find most accurate reverse zone for IP address 2 -fail) show error message, stop 3) checks if target record exists in the zone 3 -fail) show 'dns record create link', stop 4) redirects Click on 'dns record create link': 1) creates record 1 -fail) show error, stop 2) redirects https://fedorahosted.org/freeipa/ticket/1975
* UI support for ssh keysPetr Voborník2012-02-1515-26/+369
| | | | | | | | To user and host details pages was added ipasshpubkey attribute. New widget for ssh public keys was created. https://fedorahosted.org/freeipa/ticket/2340
* ipa-kdb: add AS auditing supportSimo Sorce2012-02-148-91/+257
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/2334
* Don't use sets when calculating the modlist so order is preserved.Rob Crittenden2012-02-131-4/+5
| | | | | | | | | | | | This is for the LDAP updater in particular. When adding new schema order can be important when one objectclass depends on another via SUP. This calculation will preserve the order of changes in the update file. Discovered trying to add SSH schema. https://fedorahosted.org/freeipa/ticket/754
* Move the compat module from ipalib to ipapython.Jan Cholasta2012-02-135-4/+4
| | | | | | Fixes import problems trying to import just ipalib/compat.py. https://fedorahosted.org/freeipa/ticket/754
* Add SSH service to platform-specific services.Jan Cholasta2012-02-133-4/+23
| | | | | | | | Add method for getting configuration directory path of a service, so that a different SSH configuration directory can be specified on different platforms. https://fedorahosted.org/freeipa/ticket/754
* Base64-decode unicode values in Bytes parameters.Jan Cholasta2012-02-133-9/+19
| | | | | | | | | | | Fix wrong handling of strings in --setattr/--addattr/--delattr. These changes make it possible to use Bytes in --setattr/--addattr/ --delattr without errors. Fixes managing SSH keys on command-line https://fedorahosted.org/freeipa/ticket/754
* Configure ssh and sshd during ipa-client-install.Jan Cholasta2012-02-136-0/+142
| | | | | | | | | | | For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns ipa-client-install option is used. For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM options are enabled (this can be disabled using --no-sshd ipa-client-install option). ticket 1634
* Update host SSH public keys on the server during client install.Jan Cholasta2012-02-137-3/+86
| | | | | | | | This is done by calling host-mod to update the keys on IPA server and nsupdate to update DNS SSHFP records. DNS update can be disabled using --no-dns-sshfp ipa-client-install option. https://fedorahosted.org/freeipa/ticket/1634
* Move the nsupdate functionality to separate function in ipa-client-install.Jan Cholasta2012-02-131-18/+26
| | | | | | Done as part of adding SSH support. https://fedorahosted.org/freeipa/ticket/1634
* Add API initialization to ipa-client-install.Jan Cholasta2012-02-132-10/+30
| | | | | | | | This change makes it possible to call IPA commands from ipa-client-install. Done to support adding SSH host keys to DNS. https://fedorahosted.org/freeipa/ticket/1634
* Add support for SSH public keys to user and host objects.Jan Cholasta2012-02-138-35/+192
| | | | | | | | | | | This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
* Add LDAP ACIs for SSH public key schema.Jan Cholasta2012-02-134-0/+52
| | | | https://fedorahosted.org/freeipa/ticket/754
* Add LDAP schema for SSH public keys.Jan Cholasta2012-02-135-0/+29
| | | | https://fedorahosted.org/freeipa/ticket/754
* Internationalization for HBAC and ipalib.outputPetr Viktorin2012-02-143-13/+13
| | | | | | | | | | | * hbacrule: Internationalize HBAC rule "all" category exceptions https://fedorahosted.org/freeipa/ticket/2267 * hbactest: Use internationalized names (doc) instead of names for output items Also don't convert result to bool, `not` does it implicitly * ipalib.output: Internationalize descriptions of some standard entries
* Removed question marks from field labelsPetr Voborník2012-02-142-4/+4
| | | | | | | In user group adder dialog, the "Is this a POSIX group?" was replaced with "POSIX group". In host search facet, the "Enrolled?" was replaced with "Enrolled". https://fedorahosted.org/freeipa/ticket/2353
* Fixed entity link disablingPetr Vobornik2012-02-141-2/+6
| | | | | | | | | | Problem: Entity link (eg: to hosts in dns record or to dns record in host) is not changing its state when linked record doesn't exist. The link can remain wrongly enabled from previous state. Fixed: The link is disabled when target doesn't exist. https://fedorahosted.org/freeipa/ticket/2364
* Add Petr Viktorín to Contributors.txtMartin Kosek2012-02-101-0/+1
|
* Clean up i18n stringsPetr Viktorin2012-02-105-19/+21
| | | | | | | | | | | This patch switches to named ("%(name)s") instead of positional ("%s") substitutions for internationalized strings, so translators can reorder the words. This fixes https://fedorahosted.org/freeipa/ticket/2179 (xgettext no longer gives warnings). Also, some i18n calls are rewritten to translate the template before substitutions, not after.
* Fixed ipa.js for sessions.Endi S. Dewata2012-02-091-8/+9
| | | | | | | | | | The patch fixes a problem in error_handler_login() when it gets an error other than 401. The login_url is not needed for fixtures because it does not need authentication. The patch also fixes jslint warnings and formatting issues.
* add session manager and cache krb authJohn Dennis2012-02-0912-31/+1843
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a session manager and support for caching authentication in the session. Major elements of the patch are: * Add a session manager to support cookie based sessions which stores session data in a memcached entry. * Add ipalib/krb_utils.py which contains functions to parse ccache names, format principals, format KRB timestamps, and a KRB_CCache class which reads ccache entry and allows one to extract information such as the principal, credentials, credential timestamps, etc. * Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so that all kerberos items are co-located. * Modify javascript in ipa.js so that the IPA.command() RPC call checks for authentication needed error response and if it receives it sends a GET request to /ipa/login URL to refresh credentials. * Add session_auth_duration config item to constants.py, used to configure how long a session remains valid. * Add parse_time_duration utility to ipalib/util.py. Used to parse the session_auth_duration config item. * Update the default.conf.5 man page to document session_auth_duration config item (also added documentation for log_manager config items which had been inadvertantly omitted from a previous commit). * Add SessionError object to ipalib/errors.py * Move Kerberos protection in Apache config from /ipa to /ipa/xml and /ipa/login * Add SessionCCache class to session.py to manage temporary Kerberos ccache file in effect for the duration of an RPC command. * Adds a krblogin plugin used to implement the /ipa/login handler. login handler sets the session expiration time, currently 60 minutes or the expiration of the TGT, whichever is shorter. It also copies the ccache provied by mod_auth_kerb into the session data. The json handler will later extract and validate the ccache belonging to the session. * Refactored the WSGI handlers so that json and xlmrpc could have independent behavior, this also moves where create and destroy context occurs, now done in the individual handler rather than the parent class. * The json handler now looks up the session data, validates the ccache bound to the session, if it's expired replies with authenicated needed error. * Add documentation to session.py. Fully documents the entire process, got questions, read the doc. * Add exclusions to make-lint as needed.
* Add ipa_memcached serviceJohn Dennis2012-02-098-0/+189
| | | | | | | | | | | | | | | | | | | | | | | * Adds ipa_memcached SystemV initscript * Adds ipa_memcached service file and tmpfiles.d/ipa.conf to recreate /var/run/ipa_memcached on reboot. * Adds ipa_memcached config file * Adds memcacheinstnace.py to manage ipa_memcaced as as SimpleService object. * Updates the IPA service list to include ipa_memcached, at service positon 39, httpd is position 40 * Updates the spec file: - requires the memcached daemon and python client - installs service or initscripts depending on OS - installs config file - creates /var/run/ipa_memcached directory * Modifies ipa-server-install to install ipa_memcached
* Adopt to python-ldap 2.4.6 by removing unused references which are not ↵Alexander Bokovoy2012-02-081-1/+1
| | | | available in python-ldap anymore
* Handle upgrade issues with systemd in Fedora 16 and aboveAlexander Bokovoy2012-02-083-21/+113
| | | | | | | | | | | | Since 389-ds-base-1.2.10-0.8.a7 Directory Server's systemd settings are configured via /etc/sysconfig/dirsrv.systemd. It means logic change in systemd/fedora16 platform of FreeIPA. Additionally, existing installs need to be handled during upgrade. Fixes: https://fedorahosted.org/freeipa/ticket/2117 https://fedorahosted.org/freeipa/ticket/2300
* Add management of inifiles to allow manipulation of systemd unitsAlexander Bokovoy2012-02-081-1/+99
| | | | | | | | | | | inifile_replace_variables() works similar to config_replace_variables() but allows to apply changes to specific section of an inifile. Inifiles are commonly used by freedesktop.org software and particularly used by systemd. When modifying inifile, all changes will be applied to specific section. Also fixes corner case in config_replace_variables() which would dublicate variables when adding them.
* Honor default home directory and login shell in user_addPetr Viktorin2012-02-093-13/+140
| | | | | | | | | | | | | | | | The homedirectory argument had a default_from '/home/<name>', ignoring the ipahomesrootdir config setting. This patch removes that default, and adds a test case for ipahomesrootdir. https://fedorahosted.org/freeipa/ticket/2332 The login shell had the same problem. Again this patch removes the client-side default and adds a test. Building the home directory from the default is changed to use posixpath.join instead of string formatting and ad-hoc cleanup, and to use '/home' instead of failing when the ipahomesrootdir setting is not present for some reason.
* Make ipaconfigstring modifiable by users.Rob Crittenden2012-02-093-6/+9
| | | | | | | | | | | Convert from a freeform string into a enumeration. Only values currently allowed are AllowLMhash and AllowNThash. To add more than one value on the command-line either specify --ipaconfigstring multiple times or add the values comma-separated. https://fedorahosted.org/freeipa/ticket/1433
* Memberof attribute control and updateOndrej Hamada2012-02-083-15/+90
| | | | | | | | | | | | | | | Checking of parameters used by _make_aci funcion was rewritten. Additional attributes of ACI(type, attribute, memberof, targetgroup, subtree, filter) could be unset. Permission plugin now allows to unset memberof value. https://fedorahosted.org/freeipa/ticket/2255 Added checking of existence of groups that are specified in permission and delegation module. https://fedorahosted.org/freeipa/ticket/2286 https://fedorahosted.org/freeipa/ticket/2305
* Consolidate external member code into two functions in baseldap.pyRob Crittenden2012-02-085-283/+95
| | | | | | | | | | External members (users and hosts) are assumed when doing member management on certain attributes. If the member isn't in IPA it is assumed to be external. When doing member management we need to sift through the list of failures and pull out all those that were simply not found in IPA. https://fedorahosted.org/freeipa/ticket/1734
* ignore generated services file.Adam Young2012-02-071-1/+1
|
* Remove delegation from browser configAdam Young2012-02-071-1/+0
|
* Remove unused options from ipa-managed-entriesMartin Kosek2012-02-071-3/+0
| | | | | | | ipa-managed-entries contain auto-generated options that are not used in the script and may just confuse users. Remove them. https://fedorahosted.org/freeipa/ticket/2347
* Fix/add options in ipa-managed-entries man pagePetr Viktorin2012-02-071-2/+5
| | | | | | | * The --entry option was wrongly listed as --entries; fix that. https://fedorahosted.org/freeipa/ticket/2277 * Add the --help option
* Automember UI - Fixed I18n labelsPetr Voborník2012-02-074-19/+49
| | | | | | | Hard-coded labels in Automember UI have been moved into internal.py to allow translation. https://fedorahosted.org/freeipa/ticket/2195
* Automember UI - default groupsPetr Voborník2012-02-079-2/+315
| | | | | | | | In this patch was implemented and added a control for defining default automember groups. There is a difference from UXD spec. In the spec the control was placed below table in the search facet. This was not working well with the combobox in the control. Open combobox requires some space below it. As it was placed at the bottom of the page it created unwanted blank space and forced showing scrollbars. Moving the control above the table solves the problem without rewriting combobox logic. It can be rewritten and moved down later. https://fedorahosted.org/freeipa/ticket/2195
* Require minimum SSF 56, confidentially. Also ensure minssf <= maxssf.Rob Crittenden2012-02-051-0/+9
| | | | | | | | | This ensures a correct configuration in case a user has created their own openldap config file and set SASL_SECPROPS to something bad. Note that this doesn't modify the 389-ds setting which by default is 0. https://fedorahosted.org/freeipa/ticket/2021
* Switch --group and --membergroup in example for delegationPetr Viktorin2012-02-061-2/+2
| | | | | | | | The example mistakenly showed how to allow "employees" to edit addresses of "managers". This fixes the example by switching the two options. https://fedorahosted.org/freeipa/ticket/2317
* Return proper DN in netgroup-addMartin Kosek2012-02-061-2/+2
| | | | | | | This patch fixes netgroup unit test failures which expect the original DN. https://fedorahosted.org/freeipa/ticket/2069
* Make submount automount maps work.Rob Crittenden2012-02-061-6/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Indirect automount nesting is achieved by adding a key that references another map. This isn't heirarchical, in fact, you can have multiple duplicate keys all pointing at the same map, which itself is mounted in other places. It can be a real mess if you want. In any case, a submount map has its information set to "-fstype=autofs <type>:<map>" The type can be any valid automount type: file, nis, yp, ldap, etc. We are going to hardcode ldap in when we create these using automountmap-add-indirect. If a user wants a different type they can create the key themselves (or edit it later). Here is an example of creating a submount: $ ipa automountlocation-add baltimore $ ipa automountmap-add-indirect baltimore auto.share --mount=/share $ ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.sub $ ipa automountkey-add baltimore auto.sub --key=share --info=attic:/share $ ls /share/sub/share builds lost+found This looks like: etc/auto.master: /- /etc/auto.direct /share /etc/auto.share --------------------------- /etc/auto.direct: --------------------------- /etc/auto.share: sub -fstype=autofs ldap:auto.sub maps not connected to /etc/auto.master: --------------------------- /etc/auto.sub: share attic:/share I've also added a catch-all when using the tofiles function. We were missing any maps that weren't attached to auto.master. They will now be shown along with whatever keys they have. https://fedorahosted.org/freeipa/ticket/1268
* Add argument help to CLIMartin Kosek2012-02-062-10/+84
| | | | | | | | | | | | CLI command help contains a documentation for all options that can be passed to commands. However, help strings for positional arguments are not included. This patch uses an OptionParser description field to list all command arguments as OptionParser does not have a native support to provide such information to user. https://fedorahosted.org/freeipa/ticket/1974
* Remove debug messagesMartin Kosek2012-02-061-4/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2323 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Improve password change error messageMartin Kosek2012-02-034-3/+29
| | | | | | | | | | | User always receives the same error message if he changes his password via "ipa passwd" command and the new password fails configured password policy. He then has to investigate on his own the actual reason why was the policy violated. This patch improves our SLAPI PWD plugins to provide a better error message explaining the violation reason. https://fedorahosted.org/freeipa/ticket/2067
* Fix raw format for ACI commandsMartin Kosek2012-02-036-66/+166
| | | | | | | | | | | | | ACI plugins (permission, selfservice and delegation) were not prepared to serve ACIs in a raw format, i.e. raw "aci" attribute taken from LDAP. This patch fixes all these plugins and their commands to provide provide this format. Few ACI raw format unit tests were added for all these plugins. https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2223 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Fix 'no-reverse' option descriptionOndrej Hamada2012-02-024-4/+4
| | | | | | | The description of 'no-reverse' option was fixed in both code and manpages of ipa-replica-install and ipa-dns-install. https://fedorahosted.org/freeipa/ticket/2161
* Improve migration helpMartin Kosek2012-02-032-9/+22
| | | | | | | | | Improve migration help topic so that it easier understandable: - Add missing list of Topic commands - Add one more example to demonstrate migration abilities - Add breaks to too long lines to improve readibility https://fedorahosted.org/freeipa/ticket/2174
* Improve dnszone-add error messageMartin Kosek2012-02-031-0/+7
| | | | | | | | | | When a new DNS record is being added to DNS zone via command ipa dnsrecord-add ZONE @ and the target ZONE does not exist it returns ObjectclassViolation which may confuse users. Make sure that standard DNS Zone NotFound exception is returned. https://fedorahosted.org/freeipa/ticket/2270
* Add data field for A6 recordMartin Kosek2012-02-033-6/+17
| | | | | | | | | | | | | Since A6 is an obsolete RR type, no DNS part option was created. This is, however, not consistent with the rest of per-type API and may cause problems. This patch adds at least a DNS part for raw A6 record data so that the record type is treated consistently. This patch also fixes interactive mode for A6 records. Their data were not detected correctly as dnsrecord_add didn't expect a number in DNS part option name. https://fedorahosted.org/freeipa/ticket/2309
* Add SRV record target validatorMartin Kosek2012-02-032-0/+16
| | | | | | | Add missing SRV record target validator to filter out possible user errors. https://fedorahosted.org/freeipa/ticket/2308
* Fix NSEC record conversionMartin Kosek2012-02-033-9/+41
| | | | | | | | | | | | | NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
* Fix TXT record parsingMartin Kosek2012-02-032-0/+24
| | | | | | | | | TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
generated by cgit (git 2.34.1) at 2025-09-03 14:18:48 +0000