summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Raise proper exception when given a bad DN attribute.Rob Crittenden2012-08-161-1/+4
|
* Use DN object for Directory Manager in ipa-replica-manage connect commandRob Crittenden2012-08-161-1/+1
|
* Convert PKCS#11 subject to string before passing to ipapython.DNRob Crittenden2012-08-151-1/+1
|
* Add internationalization to DCE RPC codeAlexander Bokovoy2012-08-141-10/+20
| | | | https://fedorahosted.org/freeipa/ticket/2964
* Raise Base64DecodeError instead of ConversionError when base64 decoding ↵Jan Cholasta2012-08-141-3/+3
| | | | | | fails in Bytes parameters. ticket 2962
* Improves exception handling in ipa-replica-prepare.Tomas Babej2012-08-142-1/+10
| | | | | | | | A backtrace is no longer displayed when trying to prepare a replica file with the local LDAP server down. Also adds --debug option and no longer displays info messages without it. https://fedorahosted.org/freeipa/ticket/2939
* Corrects help description of selinuxusermap.Tomas Babej2012-08-141-6/+6
| | | | https://fedorahosted.org/freeipa/ticket/2959
* Handle SSSD restart crash more gently.Tomas Babej2012-08-141-1/+4
| | | | | | | | In ipa-client-install, failure of restart of sssd service no longer causes the crash of the install process. Adds a warning message to the root logger instead. https://fedorahosted.org/freeipa/ticket/2827
* Update other facets on delete from search pagePetr Vobornik2012-08-142-3/+27
| | | | | | | | When an object in search facet was deleted, other facets were not notified that they need to refresh. If one crated object with same pkey as deleted object and then navigated to it's details he could see old object's data. This notification was added. https://fedorahosted.org/freeipa/ticket/2618
* Disable caching of Web UI login_kerberos requestPetr Vobornik2012-08-141-0/+1
| | | | | | IE caches login_kerberos request so SSO doesn't work after logout. This patch disables the caching. https://fedorahosted.org/freeipa/ticket/2991
* Handle case when trusted domain user access the Web UIPetr Vobornik2012-08-141-1/+21
| | | | | | WebUI catches the fact that the user can't access LDAP server with a current ticket. It shows form-based auth login dialog. Previoustly an ugly error was returned on an almost empty page, and user had no recourse. https://fedorahosted.org/freeipa/ticket/2897
* Read-only external facet for non-external groupsPetr Vobornik2012-08-142-1/+57
| | | | | | | Added evaluators to decide if attribute facet should be read-only based on attribute level rights. Default values serves well for group's external member. https://fedorahosted.org/freeipa/ticket/2895
* Group external member facetPetr Vobornik2012-08-141-0/+15
| | | | | | Added 'external' attribute facet to group entity. It serves for displaying group's externalmember attribute. https://fedorahosted.org/freeipa/ticket/2895
* Attribute facetPetr Vobornik2012-08-144-9/+276
| | | | | | Created new type of facet: attribute facet. This facet is similar to association facet but it serves for displaying object's multivalued attributes which behaves like association attributes. It will serve as a basis for displaying group's externalmember attribute. https://fedorahosted.org/freeipa/ticket/2895
* Display group typePetr Vobornik2012-08-143-9/+71
| | | | | | | | Created new value_map_widget which serves for displaying values based on a map. It is added to group for displaying its type. The decision is based on group's objectclass. https://fedorahosted.org/freeipa/ticket/2895
* Make group posixPetr Vobornik2012-08-143-1/+20
| | | | | | New option for creating plain user group posix group. External group can't be made posix. https://fedorahosted.org/freeipa/ticket/2338
* Make group externalPetr Vobornik2012-08-145-1/+67
| | | | | | New action for creating plain group external. Posix group can't be made external. https://fedorahosted.org/freeipa/ticket/2895
* Add external groupPetr Vobornik2012-08-143-28/+52
| | | | | | Group can be normal, posix and external. Posix checkbox was removed and was replaced by radio for selecting group type. This adds possibility of adding of external group. https://fedorahosted.org/freeipa/ticket/2895
* Fix winsync agreements creationMartin Kosek2012-08-124-7/+18
| | | | | | | | | | | | | | Due to recent addition of ID range support to DsInstance, the class could no longer be instantiated when realm_name was passed but ID range parameters were not. This condition broke winsync agreements creation in ipa-replica-manage. Make sure that ID range computation in DsInstance does not crash in this cases so that winsync replica can be created. Also convert --binddn option of ipa-replica-manage script to IPA native DN type so that setup_agreement does not crash. https://fedorahosted.org/freeipa/ticket/2987
* Use DN objects instead of stringsJohn Dennis2012-08-12123-4157/+5498
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Convert every string specifying a DN into a DN object * Every place a dn was manipulated in some fashion it was replaced by the use of DN operators * Add new DNParam parameter type for parameters which are DN's * DN objects are used 100% of the time throughout the entire data pipeline whenever something is logically a dn. * Many classes now enforce DN usage for their attributes which are dn's. This is implmented via ipautil.dn_attribute_property(). The only permitted types for a class attribute specified to be a DN are either None or a DN object. * Require that every place a dn is used it must be a DN object. This translates into lot of:: assert isinstance(dn, DN) sprinkled through out the code. Maintaining these asserts is valuable to preserve DN type enforcement. The asserts can be disabled in production. The goal of 100% DN usage 100% of the time has been realized, these asserts are meant to preserve that. The asserts also proved valuable in detecting functions which did not obey their function signatures, such as the baseldap pre and post callbacks. * Moved ipalib.dn to ipapython.dn because DN class is shared with all components, not just the server which uses ipalib. * All API's now accept DN's natively, no need to convert to str (or unicode). * Removed ipalib.encoder and encode/decode decorators. Type conversion is now explicitly performed in each IPASimpleLDAPObject method which emulates a ldap.SimpleLDAPObject method. * Entity & Entry classes now utilize DN's * Removed __getattr__ in Entity & Entity clases. There were two problems with it. It presented synthetic Python object attributes based on the current LDAP data it contained. There is no way to validate synthetic attributes using code checkers, you can't search the code to find LDAP attribute accesses (because synthetic attriutes look like Python attributes instead of LDAP data) and error handling is circumscribed. Secondly __getattr__ was hiding Python internal methods which broke class semantics. * Replace use of methods inherited from ldap.SimpleLDAPObject via IPAdmin class with IPAdmin methods. Directly using inherited methods was causing us to bypass IPA logic. Mostly this meant replacing the use of search_s() with getEntry() or getList(). Similarly direct access of the LDAP data in classes using IPAdmin were replaced with calls to getValue() or getValues(). * Objects returned by ldap2.find_entries() are now compatible with either the python-ldap access methodology or the Entity/Entry access methodology. * All ldap operations now funnel through the common IPASimpleLDAPObject giving us a single location where we interface to python-ldap and perform conversions. * The above 4 modifications means we've greatly reduced the proliferation of multiple inconsistent ways to perform LDAP operations. We are well on the way to having a single API in IPA for doing LDAP (a long range goal). * All certificate subject bases are now DN's * DN objects were enhanced thusly: - find, rfind, index, rindex, replace and insert methods were added - AVA, RDN and DN classes were refactored in immutable and mutable variants, the mutable variants are EditableAVA, EditableRDN and EditableDN. By default we use the immutable variants preserving important semantics. To edit a DN cast it to an EditableDN and cast it back to DN when done editing. These issues are fully described in other documentation. - first_key_match was removed - DN equalty comparison permits comparison to a basestring * Fixed ldapupdate to work with DN's. This work included: - Enhance test_updates.py to do more checking after applying update. Add test for update_from_dict(). Convert code to use unittest classes. - Consolidated duplicate code. - Moved code which should have been in the class into the class. - Fix the handling of the 'deleteentry' update action. It's no longer necessary to supply fake attributes to make it work. Detect case where subsequent update applies a change to entry previously marked for deletetion. General clean-up and simplification of the 'deleteentry' logic. - Rewrote a couple of functions to be clearer and more Pythonic. - Added documentation on the data structure being used. - Simplfy the use of update_from_dict() * Removed all usage of get_schema() which was being called prior to accessing the .schema attribute of an object. If a class is using internal lazy loading as an optimization it's not right to require users of the interface to be aware of internal optimization's. schema is now a property and when the schema property is accessed it calls a private internal method to perform the lazy loading. * Added SchemaCache class to cache the schema's from individual servers. This was done because of the observation we talk to different LDAP servers, each of which may have it's own schema. Previously we globally cached the schema from the first server we connected to and returned that schema in all contexts. The cache includes controls to invalidate it thus forcing a schema refresh. * Schema caching is now senstive to the run time context. During install and upgrade the schema can change leading to errors due to out-of-date cached schema. The schema cache is refreshed in these contexts. * We are aware of the LDAP syntax of all LDAP attributes. Every attribute returned from an LDAP operation is passed through a central table look-up based on it's LDAP syntax. The table key is the LDAP syntax it's value is a Python callable that returns a Python object matching the LDAP syntax. There are a handful of LDAP attributes whose syntax is historically incorrect (e.g. DistguishedNames that are defined as DirectoryStrings). The table driven conversion mechanism is augmented with a table of hard coded exceptions. Currently only the following conversions occur via the table: - dn's are converted to DN objects - binary objects are converted to Python str objects (IPA convention). - everything else is converted to unicode using UTF-8 decoding (IPA convention). However, now that the table driven conversion mechanism is in place it would be trivial to do things such as converting attributes which have LDAP integer syntax into a Python integer, etc. * Expected values in the unit tests which are a DN no longer need to use lambda expressions to promote the returned value to a DN for equality comparison. The return value is automatically promoted to a DN. The lambda expressions have been removed making the code much simpler and easier to read. * Add class level logging to a number of classes which did not support logging, less need for use of root_logger. * Remove ipaserver/conn.py, it was unused. * Consolidated duplicate code wherever it was found. * Fixed many places that used string concatenation to form a new string rather than string formatting operators. This is necessary because string formatting converts it's arguments to a string prior to building the result string. You can't concatenate a string and a non-string. * Simplify logic in rename_managed plugin. Use DN operators to edit dn's. * The live version of ipa-ldap-updater did not generate a log file. The offline version did, now both do. https://fedorahosted.org/freeipa/ticket/1670 https://fedorahosted.org/freeipa/ticket/1671 https://fedorahosted.org/freeipa/ticket/1672 https://fedorahosted.org/freeipa/ticket/1673 https://fedorahosted.org/freeipa/ticket/1674 https://fedorahosted.org/freeipa/ticket/1392 https://fedorahosted.org/freeipa/ticket/2872
* Permissions of replica files changed to 0600.Tomas Babej2012-08-071-1/+3
| | | | | | | File system permissions on replica files in /var/lib/ipa were changed to 0600. https://fedorahosted.org/freeipa/ticket/2847
* Adds check for ipa-join.Tomas Babej2012-08-031-3/+12
| | | | | | | | If the executable ipa-client/ipa-join is not found, the relevant tests are skipped. Implemented in setUpClass() method, also moved the mkstemp() call there. https://fedorahosted.org/freeipa/ticket/2905
* Make --{set,add,del}attr more robust.Jan Cholasta2012-08-032-43/+131
| | | | | | | This fixes --addattr on single value attributes in add commands and --delattr on non-unicode attributes in mod commands. ticket 2954
* Create /etc/sysconfig/network if it doesn't existPetr Viktorin2012-08-032-4/+16
| | | | | | | | | | When the --hostname option is given to ipa-client-install, we write HOSTNAME to /etc/sysconfig/network. When that file didn't exist, the installer crashed. Create the file if it doesn't exist and we need to write to it. https://fedorahosted.org/freeipa/ticket/2840
* Handle exceptions when establishing trustsAlexander Bokovoy2012-08-031-15/+60
| | | | | | | | | | | | | | | | | | | | | | | | Translate exceptions produced by DCERPC bindings when establishing trusts. There are two types of errors that may be produced by DCERPC bindings: - RuntimeError with a text (RuntimeError('NT_STATUS_OBJECT_NAME_NOT_FOUND') - RuntimeError with a numeric code and 'friendly' message Error codes could have two prefixes: - NT error codes, start with NT_STATUS_ prefix - Windows error codes, start with WERR_ prefix Full list of errors is available in Samba source code: libcli/util/ntstatus.h: NT_STATUS error codes libcli/util/werror.h: Windows error codes Majority of errors returned when dealing with trusts are of NT_STATUS type, these also include all typical POSIX errors mapped to corresponding NT errors. Unfortunately, in the textual RuntimeError case very little can be done to get better clarification of the error. More error paths will need to be added as they will be discovered -- DCERPC error messaging is complex. https://fedorahosted.org/freeipa/ticket/2868
* Add --{set,add,del}attr options to commands which are missing them.Jan Cholasta2012-08-036-11/+23
| | | | ticket 2963
* Add PAC filteringSimo Sorce2012-08-021-8/+100
| | | | | | | | This check the PAC we receive is consistent. realm, flat name and domain sid must much our understanding or the trustd realm and no additional sids beyond the own realm ones must be present. Ticket #2849
* Split out manipulation of logon_info blobSimo Sorce2012-08-021-40/+69
| | | | | This way multiple functions can manipulate the logon info structure until all operations we want to do on it are done and then fold it back once.
* Properly name function to add ipa external groupsSimo Sorce2012-08-021-35/+39
| | | | | | | | | The function filter_pac was not filtering the pac at all, it was merely augmenting it with additional data relevant to the IPA server. Change the name of the function to avoid confusion. While there I also simplified and cleaed up the code a bit with regard to variable names and usage.
* Load list of trusted domain on connecting to ldapSimo Sorce2012-08-021-6/+104
| | | | This list is used to validate data in mspac filtering
* Move mspac structure to be a private pointerSimo Sorce2012-08-022-25/+33
| | | | | By keeping it's definition in the mspac file it is easier to modify and make sure any opertion on it is handled in the same file.
* Bump bind-dyndb-ldap version for F18Martin Kosek2012-08-021-0/+8
| | | | | | | | | bind-dyndb-ldap with SOA serial autoincrement was released. Bump the package version in the spec file. The version is bumped for F18 only as it was released only to rawhide and we don't want to break development on F17. https://fedorahosted.org/freeipa/ticket/2554
* Avoid redundant info message during RPM updateMartin Kosek2012-08-022-4/+10
| | | | | | | | | | | | | | A change to ipa-ldap-updater (and thus an RPM update %post scriptlet) avoiding redundat "IPA is not configured" message in stderr introdocued in c20d4c71b87365b3b8d9c53418a79f992e68cd00 was reverted in another patch (b5c1ce88a4a3b35adb3b22bc68fb10b49322641a). Return the change back to avoid this message during every RPM update when IPA is not configured. admintool framework was also fixed to avoid print an empty line when an exception without an error message is raised. https://fedorahosted.org/freeipa/ticket/2892
* Replace use of attr with prop for booleansPetr Vobornik2012-08-025-41/+33
| | | | | | | | Recommened way of setting boolean HTML attributes is by $.prop(boolean) method not $.attr(boolean) because it sets DOM object property not an attribute. Latter works because of jquery's backward compatibility. This patch makes things clearer. Some info about prop and attr: http://stackoverflow.com/a/5876747 https://fedorahosted.org/freeipa/ticket/2817
* Fixed incorrect use of jQuery.attr for setting disabled attributePetr Vobornik2012-08-021-4/+2
| | | | | | | | Occurance: select_widget Update to latest version of jQuery uncovered this issue. https://fedorahosted.org/freeipa/ticket/2817
* Web UI tests fixPetr Vobornik2012-08-022-3/+4
| | | | | | | ACI tests were crashing because of misconfigured facet. Entity link test were crashing because of incorrect jquery selector. https://fedorahosted.org/freeipa/ticket/2817
* Unified buttonsPetr Vobornik2012-08-022-12/+28
| | | | | | Buttons in association dialog and action list have different style and behavior than buttons in dialogs. This patch unifies it by using jquery.button widget. https://fedorahosted.org/freeipa/ticket/2817
* Removal of unnecessary overrides of jquery-ui stylesPetr Vobornik2012-08-021-69/+14
| | | | | | | | | | | | | | | | ipa.css had to be updated to work with updated jquery-ui. This patch removes several duplicate styles. Following issues were fixed: * dialogs titles in IE and Opera were black instead of green * no black line in first navigation level in IE and Opera * all browsers (FF, IE, Chrome, Opera) have the same style for buttons and headers * dialogs has borders again (should we remove its shadow?) Known issues: * selected tab-1 in Chrome and Opera doesn't overlaps background line as in IE and FF. Not sure how to fix without breaking (there are border overlaps) the latter ones. I think it looks good enough. * some buttons are missing padding. Will be fixed in next patch. https://fedorahosted.org/freeipa/ticket/2817
* Fix for incorrect event handler definitionPetr Vobornik2012-08-021-2/+2
| | | | | | Clicks events should be better defined by jquery calls (usually addEventListener) not as elements attributes. Definition as element attribute causes problems after upgrade to jquery 1.7.2. Two occurances were removed. https://fedorahosted.org/freeipa/ticket/2817
* Update to jquery-ui-1.8.21.customPetr Vobornik2012-08-029-829/+184
| | | | | | | | jquery-ui was regenerated to up to date version. Border radius and IPA custom colors were added to theme so we don't have to override them in ipa.css. https://fedorahosted.org/freeipa/ticket/2817
* Update to jquery.1.7.2.minPetr Vobornik2012-08-021-8374/+4
| | | | | | jquery library wasn't updated for a long time. https://fedorahosted.org/freeipa/ticket/2817
* PAC Type options for services in Web UIPetr Vobornik2012-08-026-5/+840
| | | | | | | | | | Following options were added to Web UI * PAC Type in service * PAC Type in configuration Testing metadata for objects and commands were regenerated. https://fedorahosted.org/freeipa/ticket/2958
* Add per-service option to store the types of PAC it supportsRob Crittenden2012-08-0110-11/+64
| | | | | | Create a per-service default as well. https://fedorahosted.org/freeipa/ticket/2184
* Fixed: combobox stacking in service adder dialogPetr Vobornik2012-08-011-2/+4
| | | | | | | First select's content is displayed under second comboxes content when select is opened when second combobox is opened Bonus for: https://fedorahosted.org/freeipa/ticket/2834
* Fixed: Unable to select option in combobox in IE and ChromePetr Vobornik2012-08-012-7/+8
| | | | | | | | | There's probably a bug regarding z-index stacking in Chrome and IE. It appears when combobox is used in dialog. Combobox's select area had z-index=1010. When first jquery dialogs is open it has z-index=1000. Further dialogs have higher z-index. When dialog's z-index exceeds 1010 option in select control can't be selected. IMO it is a browser bug because select control lies in dialog content's stacking context so it should be functional even with z-index=1. This patch raises select area's z-index to 9000000 which should prevent the issue for some time. Also it make's combobox's z-index configurable so we can solve combobox stacking (ie in service-add dialog). Second part of: https://fedorahosted.org/freeipa/ticket/2834
* Ensure ipa-adtrust-install is run with Kerberos ticket for admin userAlexander Bokovoy2012-07-318-78/+117
| | | | | | | | | | | | When setting up AD trusts support, ipa-adtrust-install utility needs to be run as: - root, for performing Samba configuration and using LDAPI/autobind - kinit-ed IPA admin user, to ensure proper ACIs are granted to fetch keytab As result, we can get rid of Directory Manager credentials in ipa-adtrust-install https://fedorahosted.org/freeipa/ticket/2815
* Update translationsPetr Viktorin2012-07-3127-173658/+11180
| | | | | | | | | | | | Update the pot file to match current source, and pull translations from Transifex The commands used to create this commit were: tx pull -fa # needs an account and transifex client setup cd install/po make update-pot (update LINGUAS to contain all languages with translations, and no empty ones) make update-po
* When ipaNTHash is missing, ask IPA to generate it from kerberos keysAlexander Bokovoy2012-07-301-3/+93
| | | | Signed-off-by: Simo Sorce <ssorce@redhat.com>
* Add special modify op to regen ipaNTHashSimo Sorce2012-07-301-3/+143
| | | | | | The NT Hash is the same thing as the RC4-HMAC key, so we add a function to extract it from krb5 keys if they are available to avoid forcing a password change when configuring trust relationships.
* Improve loops around slapi modsSimo Sorce2012-07-301-68/+62
| | | | | Avoid the need to allocate/free a Slapi_Mod and avoid checking for attribute equvalence after a match (use if/else)
generated by cgit (git 2.34.1) at 2025-09-02 10:45:17 +0000