summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Validate on the user-provided domain name in the installer.Rob Crittenden2012-05-171-2/+13
| | | | | | Wrap printing exceptions in unicode() to do Gettext conversion. https://fedorahosted.org/freeipa/ticket/2196
* Include more information when IP address is not local during installation.Rob Crittenden2012-05-171-1/+4
| | | | | | | | Provide the IP address we resolved when displaying the exception. Also handle the exception ourselves with sys.exit(). https://fedorahosted.org/freeipa/ticket/2654
* Correction of nested search facets tab labelsPetr Vobornik2012-05-152-0/+3
| | | | | | | | Nested search facets were using 'search' tab label instead of their nested entity name. This patch is fixing that regression. https://fedorahosted.org/freeipa/ticket/2744
* Improved calculation of max pkey length in facet headerPetr Vobornik2012-05-151-9/+55
| | | | | | | | | | | | Very long pkeys in facet header were limited to 60 characters. This magic number was good enough but with new action lists it isn't. This patch is adding calculation of maximum characters for pkey in facet header. It fixes regression introduced by Action Lists and also it uses effectively available space. Also this patch is changing limiting of breadcrumbs element to use as much space as possible. It works in three steps. First a threshold is set which is equal to length average. Then a total length of keys with length less than threshold is calculated. From this we can get remaining space for long keys and calculate new threshold. At last keys are limited to new threshold. https://fedorahosted.org/freeipa/ticket/2247 f
* Host page fixed to work with disabled DNS supportPetr Vobornik2012-05-153-0/+27
| | | | | | | | | | | | | | | | | When DNS support was disabled there were following errors in Web UI: 1) Host details page was not filled with data 2) Host adder dialog was broken -> unusable 3) DNS tab was displayed in navigation The bugs were fixed by: 1) Was caused by entity_link_widget. The widget was modified to do not show link if other_entity (in this case dnsrecord) is not present. 2) Was caused by host_fqdn_widget. The widget is unusable becouse withou DNS support it doesn't have access to DNS zone entity. The section with this widget was removed. Also IP address field was removed because it shouln't be used without DNS support. New 'fqdn' text box was added for specifying hostname. 3) New DNS config entity was initialized but it wasn't shown because it caused some JavaScript error. The dnsconfig's init method was modified to throw expected exception. Now no dns entity is initialized and therefore DNS tab in navigation is not displayed. https://fedorahosted.org/freeipa/ticket/2728
* Fix python Requires in Fedora 17 buildMartin Kosek2012-05-151-5/+7
| | | | | | | | | | | | | | | | When python's distutils build process prepares python scripts, it use current Python interpreter in an updated shebang for python scripts. Since Makefile did not use absolute path to python interpreter, it may be translated to "/bin/python" in Fedora 17 which is then taken by rpmbuild as freeipa-admintools dependency. This can break of F-17 python package which provides just "/usr/bin/python" This patch updates Makefile to use a correct absolute path to python interpreter which is then filled to freeipa scripts shebang and rpm Requires list. The value is taken from RPM __python macro so that we do not hardcode it. https://fedorahosted.org/freeipa/ticket/2727
* Instructions to generate cert use certutil instead of opensslPetr Vobornik2012-05-152-2/+2
| | | | | | Instructions to generate certificate were changed. Now they use certutil instead of openssl. In the example is also used option for specifying key size. https://fedorahosted.org/freeipa/ticket/2725
* Disallow '<' and non-ASCII characters in the DM passwordPetr Viktorin2012-05-151-6/+8
| | | | | | pkisilent does not handle these properly. https://fedorahosted.org/freeipa/ticket/2675
* Check for empty/single value parameters before calling callbacksPetr Viktorin2012-05-152-2/+11
| | | | https://fedorahosted.org/freeipa/ticket/2701
* Implement permission/aci find by subtreeRob Crittenden2012-05-152-1/+53
| | | | https://fedorahosted.org/freeipa/ticket/2321
* Do not use extra command options in ACI, permission, selfservicePetr Viktorin2012-05-144-37/+28
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for ACI-related plugins. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Fix overlapping cn param/option issue, pass cn as aciname in findRob Crittenden2012-05-142-0/+39
| | | | | | | | | | | | permission-find --name wasn't working for two reasons. The first was that the cn to search on in options ended up overlapping the primary key name causing the request to fail. The second reason was aci uses aciname, not cn, as its name field. So searching on --name matched everything because it was as if you were searching on nothing. https://fedorahosted.org/freeipa/ticket/2320
* Consistent change of entry status.Petr Vobornik2012-05-115-237/+215
| | | | | | | | | This patch adds action list and control buttons for consistent change of enty status for user, hbac rules, sudo rules, SELinux maps and dns zones. Action lists with 'enable' and 'disable' and 'delete' options were added to details facets. Two control buttons: 'enable' and 'disable' were added to search facets. https://fedorahosted.org/freeipa/ticket/2247
* General details facet actionsPetr Vobornik2012-05-114-0/+171
| | | | | | This patch adds common action button actions for enabling/disabling/deleting object. https://fedorahosted.org/freeipa/ticket/2707
* Batch action for search page control buttonsPetr Vobornik2012-05-111-0/+42
| | | | | | This patch implements a base action which can execute a batch of commands with single pkey as a parameter. https://fedorahosted.org/freeipa/ticket/2707
* Hide search facet add/delete buttons in self-servicePetr Vobornik2012-05-113-44/+78
| | | | | | Adds hiding/showing capabilities to action_button_widget. This patch is fixing regression caused replacing old details facet buttons with control_buttons_widget. The problem was that some buttons were not hidden in self-service mode. https://fedorahosted.org/freeipa/ticket/2707
* Redefined search control buttonsPetr Vobornik2012-05-112-72/+93
| | | | | | This patch replaces old search facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Redefined details control buttonsPetr Vobornik2012-05-111-68/+65
| | | | | | This patch replaces old details facet action buttons with new control_buttons_widget. https://fedorahosted.org/freeipa/ticket/2247
* Control buttonsPetr Vobornik2012-05-111-1/+275
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Control buttons is a widget which contains action buttons. It is located in facet header and are supposed to replace old action buttons created by IPA.action_button(spec) call. The benefit is that now it is possible to define new buttons declaratively in spec definition without a need of inheriting facet and overriding create method. Action buttons are an entry poing for execution facet-wide action so they are tightly bound to facet. Action button options: name: string label: string, human readable label tooltip: string, human readable tooltip href: string, optional icon: string, icon class needs_confirm: boolean, default false confirm_msg: string, human readable confirmation message confirm_dialog: confirmation dialog, optional, custom confirmation dialog action: action, action which will be executed enabled: boolean, optional, default true Control buttons are define in facet spec in control_buttons property. Its a spec object with following attributes: all attributes which normal widget can have buttons: array of action_button specs state_listeners: array of state listener specs In init phase control_buttons_widget should assign a action_button a facet. control_buttons_widget are resposible for evaluation of action_button disable/enable state because they contain state_listeners which creates the state upon the enabled/disabled state is evaluated. State listeners are similar to state_evaluators. The differce is that the state is not evaluated from record set but from facet itself. The execution of evaluation is bound to a facet event. https://fedorahosted.org/freeipa/ticket/2247
* Action listsPetr Vobornik2012-05-116-18/+527
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch add support fo Action Lists. Action list is a select widget with actions as options located in facet header. Action can be selected and then executed by clickin on 'apply' button. Actions lists are defined on facet level. Facet header takes them from facet. Action list options actions: list of actions state_evaluator: a state evaluator which is needed for enabling/disabling options. Can encapsulate more evaluators. State evaluator object ---------------------- State evaluator is resposible for evaluating a state from result set. State is a array of strings. Each evaluator should inherit from IPA.state_evaluator and override evaluate method. Methods: evaluate(record): should return string array which represents the state get_description(): human readable representation of a state Action ------ Action is a object which can perform certain action on a facet. Action has enabling and disabling conditions. action options: name: string, required, name of the option label: string, required, human readable name of the option enable_cond: string array, states which need to be present in order to run this action disable_cond: string array, states which must not be present in order to run this action handler: function, contains action's logic needs_confirm: boolean, default false, indicates if action needs user confirmation confirm_msg: string, default generic message, human readable confirmation message. Action list should contain logic which enables/disables action based on facet state and action's enabling/disabling conditions. It should also enforce presence of confirmation. In this patch is also slightly modified facet header, mostly title part. It was revised to contain status icon, title and action list on single line. Facet header is using state evaluator's get_description method to properly set tooltip for state icon. https://fedorahosted.org/freeipa/ticket/2247
* General builder supportPetr Vobornik2012-05-111-0/+67
| | | | | | | | | | | | Web UI mainly uses declarative way of defining UI structure. When a new object type is created it is often required to create a new builder which would build the objects from spec file. The builders' logic is mostly the same. This patch adds a general builder with some extendability capabilities. Now it is possible to: 1) define spec for single object and build it by calling IPA.build(spec, /* optional */ builder_fac) 2) define an array of specs and build the objects by the same call Prerequisite for following action list patches. https://fedorahosted.org/freeipa/ticket/2707
* Return LDAP_SUCCESS on mods on a referral entry.Rob Crittenden2012-05-111-0/+9
| | | | | | | | | We currently return LDAP_REFERRAL which causes the mod to fail meaning that referral entries cannot be changed. All we really want to do is escape when we don't hvae an entry to modify. https://fedorahosted.org/freeipa/ticket/2237
* Validate externalhost (when added by --addattr/--setattr)Petr Viktorin2012-05-117-3/+105
| | | | | | | | | | | | Change the externalhost attribute of hbacrule, netgroup and sudorule into a full-fledged Parameter, and attach a validator to it. The validator is relaxed to allow underscores, so that some hosts with nonstandard names can be added. Tests included. https://fedorahosted.org/freeipa/ticket/2649
* Remove duplicate and unused utility codePetr Viktorin2012-05-0923-725/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Don't fail when adding default objectclasses using config-modPetr Viktorin2012-05-092-2/+57
| | | | | | | | | | The config plugin was adding together a list and a tuple, then converting to a set. Replace the operation with a set union. Regression test included. https://fedorahosted.org/freeipa/ticket/2706
* Redo boolean value encoding.Jan Cholasta2012-05-097-70/+10
| | | | | | | Move the code for encoding boolean values to LDAP boolean syntax from the Parameter class to the Encoder class, where the rest of LDAP encoding takes place. Remove encoding code from the Parameter class altogether, as all LDAP encoding should be done in the Encoder class.
* Do not crash on empty --setattr, --getattr, --addattrPetr Viktorin2012-05-072-9/+10
| | | | | | Also the unused `append` argument from _convert_2_dict. https://fedorahosted.org/freeipa/ticket/2680
* Do not crash on empty reverse member optionsPetr Viktorin2012-05-073-2/+88
| | | | | | | | | | | Calling a LDAP{Add,Remove}ReverseMember with an empty reverse_member caused an internal error, because empty values are converted to None, which is then iterated. Use an empty list instead of None (or other false falues, of which we only use the empty list). https://fedorahosted.org/freeipa/ticket/2681
* Do not use extra command options in the automount pluginPetr Viktorin2012-05-072-23/+20
| | | | | | | | | | | Allowing Commands to be called with ignored unknown options opens the door to problems, for example with misspelled option names. Before we start rejecting them, we need to make sure IPA itself does not use them when it calls commands internally. This patch does that for the automount plugin and its tests. Part of the work for https://fedorahosted.org/freeipa/ticket/2509
* Allow one letter net/hostgroups namesOndrej Hamada2012-05-074-18/+87
| | | | | | | Changed regex validating net/hostgroup names to allow single letter names. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2671
* Update hostname validator error messages in testsPetr Viktorin2012-05-033-7/+8
| | | | | A recent patch changed the error message from the hostname validator. Update the tests to reflect this change.
* Make ipa 2.2 client capable of joining an older serverMartin Kosek2012-05-011-2/+24
| | | | | | | | | | | | | | | | | IPA server of version 2.2 and higher supports Kerberos S4U2Proxy delegation, i.e. ipa command no longer forwards Kerberos TGT to the server during authentication. However, when IPA client of version 2.2 and higher tries to join an older IPA server, the installer crashes because the pre-2.2 server expects the TGT to be forwarded. This patch adds a fallback to ipa-client-install which would detect this situation and tries connecting with TGT forwarding enabled again. User is informed about this incompatibility. Missing realm was also added to keytab kinit as it was reported to fix occasional install issues. https://fedorahosted.org/freeipa/ticket/2697
* Set the "KerberosAuthentication" option in sshd_config to "no" instead of "yes".Jan Cholasta2012-04-291-1/+1
| | | | | | Setting it to "yes" causes sshd to handle kinits itself, bypassing SSSD. ticket 2689
* Improve error message in zonemgr validatorMartin Kosek2012-04-291-18/+22
| | | | | | | | | This patch consolidates zonemgr function to move the most of the checks to common functions in order to provide consistent output. The error messages produced by the validator should now be more helpful when identifying the source of error. https://fedorahosted.org/freeipa/ticket/1966
* Revert "Validate attributes in permission-add"Rob Crittenden2012-04-292-121/+0
| | | | | | | | This reverts commit 1356988b7a40a60af39807db143860efb4a2f435. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Revert "Search allowed attributes in superior objectclasses"Rob Crittenden2012-04-292-38/+0
| | | | | | | | This reverts commit a58cbb985ec007c0ef83010b32408efb2f4784d2. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Paging disable for password policiesPetr Vobornik2012-04-261-1/+3
| | | | | | | | | | Password policies are sorted by priority. When paging is enabled, table facet uses pwpolicy-find --pkey-only to get all pwpolicies keys. Those keys are sorted on server by priority but table facet sorts them again. This breaks the priority sorting. This patch disables the paging in passord policy serch page so the keys are sorted by priority. TODO: we should inspect sorting in table facet more deeply and disable it if it don't break anything. https://fedorahosted.org/freeipa/ticket/2676
* Additional tests for pwpolicyPetr Viktorin2012-04-261-1/+34
| | | | | | | Test that `pwpolicy_find --pkey-only` works as expected Test that deleting a group removes its password policy Rename the test module to be consistent with other plugin tests.
* Sort password policies properly with --pkey-onlyMartin Kosek2012-04-262-12/+31
| | | | | | | | | | | | | | | | | | | | | | Password policy plugin sorts password policies by its COS priority. However, when the pwpolicy-find command is run with --pkey-only, the resulting entries do not contain COS priority and the sort function crashes. This patch makes sure that cospriority is present in the time of the result sorting process and removes the cospriority again when the sorting is done. This way, the entries are sorted properly both with and without --pkey-only flag. Previous entries_sortfn member attribute of LDAPSearch class containing custom user sorting function was replaced just with a flag indicating if a sorting in LDAPSearch shall be done at all. This change makes it possible to sort entries in a custom post_callback which is much more powerful (and essential for sorting like in pwpolicy plugin) approach than a plain sorting function. https://fedorahosted.org/freeipa/ticket/2676
* validate i18n strings when running "make lint"John Dennis2012-04-263-29/+137
| | | | | | | | | | | | | | | | | | | | | | | | * Add bootstrap-autogen depdenency to lint target to force generated files to be created. * Add validate-src-strings to lint rules * Add validate-src-strings as dependency to lint targett * Remove obsolete test_lang frm test target * Add diagnostic message to validation command in i18n.py that outputs how many objects were scanned. Formerly it only output a message if there were errors. This made it impossible to distinguish an empty file from one with no errors. * While adding the validation counts it was discovered plurals had been omitted for some of the validation checks. Added the missing checks for plural forms. * Also distinguished between errors and warnings. Permit warnings to be emitted but do not fail the validatition unless actual errors were also detected.
* Refactor exc_callback invocation.Jan Cholasta2012-04-266-182/+179
| | | | | | | | | Replace _call_exc_callbacks with a function wrapper, which will automatically call exception callbacks when an exception is raised from the function. This removes the need to specify the function and its arguments twice (once in the function call itself and once in _call_exc_callbacks). Add some extra checks to existing exception callbacks.
* - add a pair of ethers maps for computers with hardware addresses on fileNalin Dahyabhai2012-04-262-0/+46
|
* - create a "cn=computers" compat area populated with ieee802Device entries ↵Nalin Dahyabhai2012-04-262-0/+29
| | | | corresponding to computers with fqdn and macAddress attributes
* - index the fqdn and macAddress attributes for the sake of the compat pluginNalin Dahyabhai2012-04-262-0/+35
|
* Update docs for user-status, always show disabled, time for each server.Rob Crittenden2012-04-231-2/+31
| | | | | | | | | | | | Provide some guidance on how to read and understand the output. Some manual work is needed to identify which master the user is locked on. Always display the enabled/disabled status. Include the time that the master was contacted in the output for each master as lockout is very time sensitive. https://fedorahosted.org/freeipa/ticket/2162
* Use mixed-case for Read DNS Entries permissionRob Crittenden2012-04-232-6/+6
| | | | https://fedorahosted.org/freeipa/ticket/2569
* Fix help of --hostname option in ipa-client-installMartin Kosek2012-04-191-1/+1
| | | | | | | | Replace word "server" with "machine" to clearly distinguish between IPA server and other machines (clients) and to also match the help with ipa-client-install man pages. https://fedorahosted.org/freeipa/ticket/1967
* Fix name error in hbactestJohn Dennis2012-04-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Ticket #2512 In hbactest.py there is a name error wrapped inside a try/except block that ignores all errors so the code block exits prematurely leaving a critical variable uninitialized. The name error is the result of a cut-n-paste error that references a variable that had never been initialized in the scope of the code block. Python generates an exception when this variable is referenced but because it's wrapped in a try/except block that catches all errors and ignores all errors there is no evidence that something went wrong. The fix is to use the correct variables. At some point we may want to revist if ignoring all errors and proceding as if nothing happened is actually correct. Alexander tells me this mimics what SSSD does in the hbac rule processing, thus the ignoring of errors is intentional. But in a plugin whose purpose is to test and exercise hbac rules I'm not sure ignoring all errors is really the right behavior.
* Added permission field to delegationPetr Vobornik2012-04-171-0/+11
| | | | | | | | | | Permission field is missing in delegation so it can't be set/modified. It was added to delegation details facet and adder dialog. The field is using checkboxes instead of multivalued textbox because it can have only two effective values: 'read' and 'write'. https://fedorahosted.org/freeipa/ticket/2635
* Fix internal error when renaming user with an empty string.Jan Cholasta2012-04-181-1/+1
| | | | ticket 2629
generated by cgit (git 2.34.1) at 2025-09-02 23:12:23 +0000