summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix NSEC record conversionMartin Kosek2012-02-033-9/+41
| | | | | | | | | | | | | NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
* Fix TXT record parsingMartin Kosek2012-02-032-0/+24
| | | | | | | | | TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
* Improve netgroup-add error messagesMartin Kosek2012-02-031-7/+11
| | | | | | | | | | | | These two situations in netgroup-add need to be distinguished: 1) Netgroup cannot be added because a hostgroup with the same name created a colliding managed netgroup 2) Another native netgroup with the same name exists This patch checks the colliding netgroup and raise appropriate error message based on this finding. https://fedorahosted.org/freeipa/ticket/2069
* Automember UIPetr Voborník2012-02-0116-4/+1039
| | | | | | | | | | | | | | | | New UI for automember. Implemented: * search facet core * rule details facet * attribute_table_widget - new base class for tables which contains multivalued attribute with special add/remove commands * adding/removing conditions in details facet TODO: * label translations * UI for defining default rules https://fedorahosted.org/freeipa/ticket/2195
* Navigation and redirection to various facetsPetr Voborník2012-02-013-33/+95
| | | | | | | | | | | | In current implementation target facet of navigation(from menu) and redirection is always one exact facet per entity. There isn't a way to navigate to different facet from menu or redirect to different facets from various facets. This patch adds: * possibility to define menu items which can navigate to different facets of various entities. This also means that now current menu tree can contain leafs with the same entity. * possibility to define redirection target per facet - it is needed to keep breadcrumb navigation consistent with various navigation tree patch leading to same entity leafs. This functionality is needed for Automember UI. Automember UI is designed as if it was for two entities but it is in fact only one. https://fedorahosted.org/freeipa/ticket/2195
* Show password expiration date.Endi Sukma Dewata2012-02-017-54/+78
| | | | | | | | | | | The user details page was modified to show the password expiration date next to the existing password field. Fixed problem resetting password in self-service mode. The JSON interface for the passwd command requires the username to be specified although the equivalent CLI command doesn't require it. Ticket #2064
* Use fixed font when displaying certificate.Endi Sukma Dewata2012-02-012-10/+16
| | | | | | | The textareas used to display certificates were modified to use fixed font. Ticket #2017
* Hide Add/Delete buttons in self-service mode.Endi Sukma Dewata2012-02-011-0/+7
| | | | | | | Users do not have add/delete permission in self-service mode, so the search facet was modified to hide the Add/Delete buttons. Ticket #2188
* Added icons for status column.Endi Sukma Dewata2012-02-0111-28/+61
| | | | | | | | | | | The status formatter was modified to show enabled/disabled icon before the status text. The format classes were renamed to formatter to avoid confusion with the format() method. A new parameter 'type' was added to the formatter to determine the output type (e.g. text/html). Ticket #1996
* %ghost the UI files that we install/create on the flyRob Crittenden2012-01-311-0/+15
| | | | https://fedorahosted.org/freeipa/ticket/1764
* Fixed host managed-by adder dialog.Endi Sukma Dewata2012-01-311-0/+2
| | | | | | | The host managed-by adder dialog has been fixed to use the new --not-man-hosts option to filter out hosts that are already added. Ticket #1675
* Added paging to DNS record search facetPetr Voborník2012-01-312-51/+74
| | | | | | | | Paging in DNS record search facet was disabled because there was a mismatch between primary keys sent by server and values displayed in the facet. The facet was modified to enable paging. To preserve amount of information which was displayed before, current rows have variable height - they can contain more that one line depending on number of values in the record. Each record has a checkbox and indsname in its first line to distinguish one record from others. Because there is only one checkbox for record, delete command is called with --rem-all option which causes that entire record is removed. Individual values can be deleted in record's details facet. https://fedorahosted.org/freeipa/ticket/2094
* Modifying DNS UI to benefit from new DNS APIPetr Voborník2012-01-3011-262/+5247
| | | | | | DNS UI was modified to offer structured way of defining DNS records. https://fedorahosted.org/freeipa/ticket/2208
* Added refresh button for UIPetr Voborník2012-01-305-15/+51
| | | | | | | | | | | | | | Web UI is caching records. Currently only possible ways how to display updated record which was changed elsewhere - ie. in CLI are: * refresh page in browser (takes really long on slow vpns) * search facet: change filter, find, change filter back, find * entity details: go to search, select other entry, go back to search, select original entry * association facet: same as entity details These are unconvenient methods. This patch adds Refresh button to search, details and association facet. This button executes facets refresh method. https://fedorahosted.org/freeipa/ticket/2051
* Check for the existence of a replication agreement before deleting it.Rob Crittenden2012-01-303-22/+56
| | | | | | | | | | | | | When using ipa-replica-manage or ipa-csreplica-manage to delete an agreement with a host we would try to make a connection to that host prior to tryign to delete it. This meant that the trying to delete a host we don't have an agreement with would return a connection error instead of a "no agreement with host foo" error. Also display a completed message when an agreement is removed. https://fedorahosted.org/freeipa/ticket/2048 https://fedorahosted.org/freeipa/ticket/2125
* Don't try to bind on TLS failureRob Crittenden2012-01-301-1/+3
| | | | | | | | | We have bind code that can handle the case where a server hasn't come up yet. It needs to handle a real connection failure such as the TLS hostname not matching. If we try to bind anyway we end up with a segfault in openldap. https://fedorahosted.org/freeipa/ticket/2301
* Add missing managing hosts filtering optionsMartin Kosek2012-01-265-25/+111
| | | | | | | | | | | Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
* Fix ldap2 combine_filters for ldap2.MATCH_NONEMartin Kosek2012-01-261-14/+10
| | | | | | | | "!" is a unary LDAP filter operator and cannot be treated in the same way as binary operators ("&", "|"). Otherwise, an invalid LDAP filter is created. https://fedorahosted.org/freeipa/ticket/1675
* Add support for storing MAC address in host entries.Rob Crittenden2012-01-265-5/+94
| | | | | | | | | | | | | | | | macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
* Leave nsds5replicaupdateschedule parameter unsetOndrej Hamada2012-01-241-11/+8
| | | | | | | | The nsDS5ReplicaUpdateSchedule parameter is omited what results in replication being run all the time. The parameter is still used for forcing replica update but after that action it is always deleted. https://fedorahosted.org/freeipa/ticket/1482
* Fix deletion of HBAC Rules when there are SELinux user maps definedRob Crittenden2012-01-243-8/+52
| | | | | | | | | | | | When deleting an HBAC rule we need to ensure that an SELinux user map isn't pointing at it. We need to take what is the cn of the HBAC rule and see if that rule exists, then return the dn to that rule. The search was not being done properly and wasn't enforcing uniqueness. It could have returned partial matches as well (so tests for the search test). https://fedorahosted.org/freeipa/ticket/2269
* Mark optional DNS record partsMartin Kosek2012-01-241-7/+21
| | | | | | | | | | | | | | | All DNS record part options in dnsrecord commands need to be optional so that all of them are not required in every dnsrecord command. However, FreeIPA API then does not include an information which DNS record part options are optional in term of creating a new DNS record. For example, LOC record option "latitude seconds" is not needed to add a new LOC record. This patch adds a flag "dnsrecord_optional" to all such options so that this information is available for any other UI reading the FreeIPA API. https://fedorahosted.org/freeipa/ticket/2208
* Fix selfservice-find crashesMartin Kosek2012-01-243-13/+32
| | | | | | | | | Ignore empty options when performing an ACI search so that the find command does not crash. Update ipa(1) man page to mention this common behavior of find commands. https://fedorahosted.org/freeipa/ticket/2011 https://fedorahosted.org/freeipa/ticket/2012
* Fix ipa-server-install for dual NICsMartin Kosek2012-01-226-74/+138
| | | | | | | | | | | | | A server may have 2 or more NICs and its hostname may thus resolve to 2 and more forward addresses. IP address checks in install scripts does not expect this setup and may fail or crash. This script adds a support for multiple forward addresses for a hostname. The install scripts do not crash now. When one IP address is needed, user is asked to choose from all detected server IP addresses. https://fedorahosted.org/freeipa/ticket/2154
* localhost.localdomain clients refused to joinOndrej Hamada2012-01-222-0/+9
| | | | | | | | | Machines with hostname 'localhost' or 'localhost.localdomain' are refused from joining IPA domain and proper error message is shown. The hostname check is done both in 'ipa-client-install' script and in 'ipa-join'. https://fedorahosted.org/freeipa/ticket/2112
* Update and package ipa-upgradeconfig man page.Rob Crittenden2012-01-234-1/+8
| | | | | | | Require that the tool be run as root to avoid a permission-related backtrace. https://fedorahosted.org/freeipa/ticket/1758
* Fixed inconsistent status labels.Endi Sukma Dewata2012-01-2311-72/+138
| | | | | | | | | This patch modifies the status attributes in users, DNS zones, HBAC/sudo rules, HBAC test, and SELinux User Map to use the same label (i.e. Status) and values (i.e. Enabled/Disabled). The method to change the status will be modified separately. Ticket #2247
* Show disabled entries in gray.Endi Sukma Dewata2012-01-2314-16/+239
| | | | | | | | The users, HBAC/sudo rules, HBAC test, and SELinux list pages have been modified to show disabled entries in gray. Icons will be added separately. Ticket #1996
* Enabled paging on automount keys.Endi Sukma Dewata2012-01-239-95/+122
| | | | | | | | | | | The automount keys search facet has been modified to support paging. Since the automountkey-find command doesn't support --pkey-only option, the facet is configured such that during a refresh operation it will retrieve all entries (including the key and info attributes) and then display only the ones that are supposed to be visible in the current page. Ticket #2093
* Improve host-add error messageMartin Kosek2012-01-201-2/+2
| | | | | | | | | | | | | host-add command allows to add a host and its IP address via --ip-address option. When the address is invalid, it throws an error and refuses to operate. However, the invalid IP address error message is always the same which is not right as it forces a user to guess the reason of rejection (loopback address, link-local address or invalid address at all was passed, etc.). This patch changes host-add validator to print the error message. https://fedorahosted.org/freeipa/ticket/2229
* Replace float with DecimalMartin Kosek2012-01-2011-88/+160
| | | | | | | | | | | | | | | | | | | | Having float type as a base type for floating point parameters in ipalib introduces several issues, e.g. problem with representation or value comparison. Python language provides a Decimal type which help overcome these issues. This patch replaces a float type and Float parameter with a decimal.Decimal type in Decimal parameter. A precision attribute was added to Decimal parameter that can be used to limit a number of decimal places in parameter representation. This approach fixes a problem with API.txt validation where comparison of float values may fail on different architectures due to float representation error. In order to safely transfer the parameter value over RPC it is being converted to string which is then converted back to decimal.Decimal number on a server side. https://fedorahosted.org/freeipa/ticket/2260
* UI for SELinux user mappingPetr Voborník2012-01-1820-768/+7020
| | | | | | This patch adds UI for SELinux user mapping. Its design is based on HBAC Rule design. https://fedorahosted.org/freeipa/ticket/2145
* In sudo when the category is all do not allow members, and vice versa.Rob Crittenden2012-01-183-7/+177
| | | | | | | | | | This is what we already do in the HBAC plugin, this ports it to Sudo. If a category (user, host, etc) is u'all' then we don't allow individual members be added. Conversely if there are members we don't allow the category be set to u'all'. https://fedorahosted.org/freeipa/ticket/1440
* Use correct template variable for hosts, FQDN.Rob Crittenden2012-01-171-2/+2
| | | | https://fedorahosted.org/freeipa/ticket/2268
* Enabled paging on self-service permissions and delegations.Endi Sukma Dewata2012-01-166-4/+135
| | | | | | | | Paging has been enabled on self-service permissions and delegations list pages. The search facet's get_pkeys() has been fixed to handle non-array value. New test data files have been added as well. Ticket #2092
* Add missing --pkey-only option for selfservice and delegationMartin Kosek2012-01-169-68/+106
| | | | | | | | | | | | pkey-only functionality has to be implemented separately for these modules as they are based on crud.Search instead of standard LDAPSearch. Delegation moduled was also fixed to support new format of ACI's memberof attribute introduced in patch "Display the value of memberOf ACIs in permission plugin." https://fedorahosted.org/freeipa/ticket/2092
* Add labels so HBAC and Sudo rules show under hosts/hostgroups.Rob Crittenden2012-01-162-4/+18
| | | | | | Also fix a bunch of trailing whitespace. https://fedorahosted.org/freeipa/ticket/1751
* Fixed problem removing automount keys and DNS records.Endi Sukma Dewata2012-01-163-55/+61
| | | | | | | | | Due to a recent change the deleting automount keys and DNS records no longer worked. The functions that are supposed to get the selected values has been fixed to use the correct names and element type. They also have been converted into methods of the search facets. Ticket #2256
* Restore ACI when aci_mod failsMartin Kosek2012-01-132-4/+43
| | | | | | | | | | aci_mod command is composed of 2 ACI commands: aci_del which deletes the old ACI and aci_add which adds the new modified ACI. However, if aci_add command fails then both new and the old ACI are lost. Old ACI must be restored in this case. https://fedorahosted.org/freeipa/ticket/2013 https://fedorahosted.org/freeipa/ticket/2014
* slapi-plugins: use thread-safe ldap librarySimo Sorce2012-01-132-2/+2
|
* Added instructions to generate CSR.Endi Sukma Dewata2012-01-13109-527/+484
| | | | | | | | | | The certificate request dialog box has been modified to show the OpenSSL commands for generating a CSR. The realm and entry names in the test data have been fixed to be more consistent. Ticket #1012
* Fix some typos in automember help and paramters.Rob Crittenden2012-01-121-5/+5
| | | | | | Contributed by Jérôme Fenal https://fedorahosted.org/freeipa/ticket/2261
* Allow hbactest to work with HBAC rules exceeding default IPA limitsAlexander Bokovoy2012-01-132-4/+27
| | | | | | | | | | | | | When multiple HBAC rules are defined, IPA default limits to retrieve objects may limit the scope of HBAC testing. To allow full range of rules to be tested support for --sizelimit option is added. In addition, when --rules option is specified, make sure only those rules are retrieved regardless total number of rules defined. This should also speed up HBAC test performance for real life scenarios when few new rules are added to large collection of rules. https://fedorahosted.org/freeipa/ticket/2230
* Fix replication setupSimo Sorce2012-01-132-10/+20
| | | | | | Changes to add a cs-replication management tool mistakenly always set a flag that caused replicas to not add the list of attribute we exclude from replication.
* Let replicas install without DNSMartin Kosek2012-01-136-64/+76
| | | | | | | | | | | | | | | | | Let ipa-replica-prepare and ipa-replica-install work without proper DNS records as records in /etc/hosts are sufficient for DS replication. 1) ipa-replica-prepare now just checks if the replica hostname is resolvable (DNS records are not required). It is now able to prepare a replica file even when the replica IP address is present in /etc/hosts only. 2) ipa-replica-install is now able to proceed when the hostname is not resolvable. It uses an IP address passed in a new option --ip-address to create a record in /etc/hosts in the same way as ipa-server-install does. https://fedorahosted.org/freeipa/ticket/2139
* Fix LDAP updates in ipa-replica-installMartin Kosek2012-01-131-1/+1
| | | | | | | | ipalib API needs to be bootstrapped in 'installer' context otherwise LDAP update plugins don't get initialized and ipa-replica-install crashes. https://fedorahosted.org/freeipa/ticket/2139
* Prevent service restart failures in ipa-replica-installMartin Kosek2012-01-131-5/+16
| | | | | | | | | | Call restart() methods of appropriate services instead of calling the system service restart command directly as service() method has a capability to wait until the service is fully up. Without this patch ipa-replica-install crashed on F-16 because krb5kdc service was started before dirsrv service was fully up. https://fedorahosted.org/freeipa/ticket/2139
* Fix LDAP add calls in replication moduleMartin Kosek2012-01-131-11/+11
| | | | | | | Replace conn.add_s(entry) with conn.addEntry(entry) to avoid function calls with an invalid number of parameters. https://fedorahosted.org/freeipa/ticket/2139
* Validate sudo RunAsUser/RunAsGroup argumentsAlexander Bokovoy2012-01-131-1/+38
| | | | | | | | | | | | | FreeIPA SUDO rules use --usercat/--groupcat to specify that rule applies to all users or groups. Thus, sudorule-add-runasuser and sudorule-add-runasgroup accept specific groups and users and do not accept ALL reserved word. The patch validates user and group passed to these commands and reports appropriate errors when these are ALL. Ticket #1496 https://fedorahosted.org/freeipa/ticket/1496
* Catch exception when trying to list missing managed entries definitionsRob Crittenden2012-01-121-3/+7
| | | | | | | On the off chance that the definitions cannot be found we should catch the error and not raise a backtrace. https://fedorahosted.org/freeipa/ticket/1912
generated by cgit (git 2.34.1) at 2025-09-03 14:35:36 +0000