summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ignore generated services file.Adam Young2012-02-071-1/+1
|
* Remove delegation from browser configAdam Young2012-02-071-1/+0
|
* Remove unused options from ipa-managed-entriesMartin Kosek2012-02-071-3/+0
| | | | | | | ipa-managed-entries contain auto-generated options that are not used in the script and may just confuse users. Remove them. https://fedorahosted.org/freeipa/ticket/2347
* Fix/add options in ipa-managed-entries man pagePetr Viktorin2012-02-071-2/+5
| | | | | | | * The --entry option was wrongly listed as --entries; fix that. https://fedorahosted.org/freeipa/ticket/2277 * Add the --help option
* Automember UI - Fixed I18n labelsPetr Voborník2012-02-074-19/+49
| | | | | | | Hard-coded labels in Automember UI have been moved into internal.py to allow translation. https://fedorahosted.org/freeipa/ticket/2195
* Automember UI - default groupsPetr Voborník2012-02-079-2/+315
| | | | | | | | In this patch was implemented and added a control for defining default automember groups. There is a difference from UXD spec. In the spec the control was placed below table in the search facet. This was not working well with the combobox in the control. Open combobox requires some space below it. As it was placed at the bottom of the page it created unwanted blank space and forced showing scrollbars. Moving the control above the table solves the problem without rewriting combobox logic. It can be rewritten and moved down later. https://fedorahosted.org/freeipa/ticket/2195
* Require minimum SSF 56, confidentially. Also ensure minssf <= maxssf.Rob Crittenden2012-02-051-0/+9
| | | | | | | | | This ensures a correct configuration in case a user has created their own openldap config file and set SASL_SECPROPS to something bad. Note that this doesn't modify the 389-ds setting which by default is 0. https://fedorahosted.org/freeipa/ticket/2021
* Switch --group and --membergroup in example for delegationPetr Viktorin2012-02-061-2/+2
| | | | | | | | The example mistakenly showed how to allow "employees" to edit addresses of "managers". This fixes the example by switching the two options. https://fedorahosted.org/freeipa/ticket/2317
* Return proper DN in netgroup-addMartin Kosek2012-02-061-2/+2
| | | | | | | This patch fixes netgroup unit test failures which expect the original DN. https://fedorahosted.org/freeipa/ticket/2069
* Make submount automount maps work.Rob Crittenden2012-02-061-6/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Indirect automount nesting is achieved by adding a key that references another map. This isn't heirarchical, in fact, you can have multiple duplicate keys all pointing at the same map, which itself is mounted in other places. It can be a real mess if you want. In any case, a submount map has its information set to "-fstype=autofs <type>:<map>" The type can be any valid automount type: file, nis, yp, ldap, etc. We are going to hardcode ldap in when we create these using automountmap-add-indirect. If a user wants a different type they can create the key themselves (or edit it later). Here is an example of creating a submount: $ ipa automountlocation-add baltimore $ ipa automountmap-add-indirect baltimore auto.share --mount=/share $ ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.sub $ ipa automountkey-add baltimore auto.sub --key=share --info=attic:/share $ ls /share/sub/share builds lost+found This looks like: etc/auto.master: /- /etc/auto.direct /share /etc/auto.share --------------------------- /etc/auto.direct: --------------------------- /etc/auto.share: sub -fstype=autofs ldap:auto.sub maps not connected to /etc/auto.master: --------------------------- /etc/auto.sub: share attic:/share I've also added a catch-all when using the tofiles function. We were missing any maps that weren't attached to auto.master. They will now be shown along with whatever keys they have. https://fedorahosted.org/freeipa/ticket/1268
* Add argument help to CLIMartin Kosek2012-02-062-10/+84
| | | | | | | | | | | | CLI command help contains a documentation for all options that can be passed to commands. However, help strings for positional arguments are not included. This patch uses an OptionParser description field to list all command arguments as OptionParser does not have a native support to provide such information to user. https://fedorahosted.org/freeipa/ticket/1974
* Remove debug messagesMartin Kosek2012-02-061-4/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2323 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Improve password change error messageMartin Kosek2012-02-034-3/+29
| | | | | | | | | | | User always receives the same error message if he changes his password via "ipa passwd" command and the new password fails configured password policy. He then has to investigate on his own the actual reason why was the policy violated. This patch improves our SLAPI PWD plugins to provide a better error message explaining the violation reason. https://fedorahosted.org/freeipa/ticket/2067
* Fix raw format for ACI commandsMartin Kosek2012-02-036-66/+166
| | | | | | | | | | | | | ACI plugins (permission, selfservice and delegation) were not prepared to serve ACIs in a raw format, i.e. raw "aci" attribute taken from LDAP. This patch fixes all these plugins and their commands to provide provide this format. Few ACI raw format unit tests were added for all these plugins. https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2223 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Fix 'no-reverse' option descriptionOndrej Hamada2012-02-024-4/+4
| | | | | | | The description of 'no-reverse' option was fixed in both code and manpages of ipa-replica-install and ipa-dns-install. https://fedorahosted.org/freeipa/ticket/2161
* Improve migration helpMartin Kosek2012-02-032-9/+22
| | | | | | | | | Improve migration help topic so that it easier understandable: - Add missing list of Topic commands - Add one more example to demonstrate migration abilities - Add breaks to too long lines to improve readibility https://fedorahosted.org/freeipa/ticket/2174
* Improve dnszone-add error messageMartin Kosek2012-02-031-0/+7
| | | | | | | | | | When a new DNS record is being added to DNS zone via command ipa dnsrecord-add ZONE @ and the target ZONE does not exist it returns ObjectclassViolation which may confuse users. Make sure that standard DNS Zone NotFound exception is returned. https://fedorahosted.org/freeipa/ticket/2270
* Add data field for A6 recordMartin Kosek2012-02-033-6/+17
| | | | | | | | | | | | | Since A6 is an obsolete RR type, no DNS part option was created. This is, however, not consistent with the rest of per-type API and may cause problems. This patch adds at least a DNS part for raw A6 record data so that the record type is treated consistently. This patch also fixes interactive mode for A6 records. Their data were not detected correctly as dnsrecord_add didn't expect a number in DNS part option name. https://fedorahosted.org/freeipa/ticket/2309
* Add SRV record target validatorMartin Kosek2012-02-032-0/+16
| | | | | | | Add missing SRV record target validator to filter out possible user errors. https://fedorahosted.org/freeipa/ticket/2308
* Fix NSEC record conversionMartin Kosek2012-02-033-9/+41
| | | | | | | | | | | | | NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
* Fix TXT record parsingMartin Kosek2012-02-032-0/+24
| | | | | | | | | TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
* Improve netgroup-add error messagesMartin Kosek2012-02-031-7/+11
| | | | | | | | | | | | These two situations in netgroup-add need to be distinguished: 1) Netgroup cannot be added because a hostgroup with the same name created a colliding managed netgroup 2) Another native netgroup with the same name exists This patch checks the colliding netgroup and raise appropriate error message based on this finding. https://fedorahosted.org/freeipa/ticket/2069
* Automember UIPetr Voborník2012-02-0116-4/+1039
| | | | | | | | | | | | | | | | New UI for automember. Implemented: * search facet core * rule details facet * attribute_table_widget - new base class for tables which contains multivalued attribute with special add/remove commands * adding/removing conditions in details facet TODO: * label translations * UI for defining default rules https://fedorahosted.org/freeipa/ticket/2195
* Navigation and redirection to various facetsPetr Voborník2012-02-013-33/+95
| | | | | | | | | | | | In current implementation target facet of navigation(from menu) and redirection is always one exact facet per entity. There isn't a way to navigate to different facet from menu or redirect to different facets from various facets. This patch adds: * possibility to define menu items which can navigate to different facets of various entities. This also means that now current menu tree can contain leafs with the same entity. * possibility to define redirection target per facet - it is needed to keep breadcrumb navigation consistent with various navigation tree patch leading to same entity leafs. This functionality is needed for Automember UI. Automember UI is designed as if it was for two entities but it is in fact only one. https://fedorahosted.org/freeipa/ticket/2195
* Show password expiration date.Endi Sukma Dewata2012-02-017-54/+78
| | | | | | | | | | | The user details page was modified to show the password expiration date next to the existing password field. Fixed problem resetting password in self-service mode. The JSON interface for the passwd command requires the username to be specified although the equivalent CLI command doesn't require it. Ticket #2064
* Use fixed font when displaying certificate.Endi Sukma Dewata2012-02-012-10/+16
| | | | | | | The textareas used to display certificates were modified to use fixed font. Ticket #2017
* Hide Add/Delete buttons in self-service mode.Endi Sukma Dewata2012-02-011-0/+7
| | | | | | | Users do not have add/delete permission in self-service mode, so the search facet was modified to hide the Add/Delete buttons. Ticket #2188
* Added icons for status column.Endi Sukma Dewata2012-02-0111-28/+61
| | | | | | | | | | | The status formatter was modified to show enabled/disabled icon before the status text. The format classes were renamed to formatter to avoid confusion with the format() method. A new parameter 'type' was added to the formatter to determine the output type (e.g. text/html). Ticket #1996
* %ghost the UI files that we install/create on the flyRob Crittenden2012-01-311-0/+15
| | | | https://fedorahosted.org/freeipa/ticket/1764
* Fixed host managed-by adder dialog.Endi Sukma Dewata2012-01-311-0/+2
| | | | | | | The host managed-by adder dialog has been fixed to use the new --not-man-hosts option to filter out hosts that are already added. Ticket #1675
* Added paging to DNS record search facetPetr Voborník2012-01-312-51/+74
| | | | | | | | Paging in DNS record search facet was disabled because there was a mismatch between primary keys sent by server and values displayed in the facet. The facet was modified to enable paging. To preserve amount of information which was displayed before, current rows have variable height - they can contain more that one line depending on number of values in the record. Each record has a checkbox and indsname in its first line to distinguish one record from others. Because there is only one checkbox for record, delete command is called with --rem-all option which causes that entire record is removed. Individual values can be deleted in record's details facet. https://fedorahosted.org/freeipa/ticket/2094
* Modifying DNS UI to benefit from new DNS APIPetr Voborník2012-01-3011-262/+5247
| | | | | | DNS UI was modified to offer structured way of defining DNS records. https://fedorahosted.org/freeipa/ticket/2208
* Added refresh button for UIPetr Voborník2012-01-305-15/+51
| | | | | | | | | | | | | | Web UI is caching records. Currently only possible ways how to display updated record which was changed elsewhere - ie. in CLI are: * refresh page in browser (takes really long on slow vpns) * search facet: change filter, find, change filter back, find * entity details: go to search, select other entry, go back to search, select original entry * association facet: same as entity details These are unconvenient methods. This patch adds Refresh button to search, details and association facet. This button executes facets refresh method. https://fedorahosted.org/freeipa/ticket/2051
* Check for the existence of a replication agreement before deleting it.Rob Crittenden2012-01-303-22/+56
| | | | | | | | | | | | | When using ipa-replica-manage or ipa-csreplica-manage to delete an agreement with a host we would try to make a connection to that host prior to tryign to delete it. This meant that the trying to delete a host we don't have an agreement with would return a connection error instead of a "no agreement with host foo" error. Also display a completed message when an agreement is removed. https://fedorahosted.org/freeipa/ticket/2048 https://fedorahosted.org/freeipa/ticket/2125
* Don't try to bind on TLS failureRob Crittenden2012-01-301-1/+3
| | | | | | | | | We have bind code that can handle the case where a server hasn't come up yet. It needs to handle a real connection failure such as the TLS hostname not matching. If we try to bind anyway we end up with a segfault in openldap. https://fedorahosted.org/freeipa/ticket/2301
* Add missing managing hosts filtering optionsMartin Kosek2012-01-265-25/+111
| | | | | | | | | | | Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
* Fix ldap2 combine_filters for ldap2.MATCH_NONEMartin Kosek2012-01-261-14/+10
| | | | | | | | "!" is a unary LDAP filter operator and cannot be treated in the same way as binary operators ("&", "|"). Otherwise, an invalid LDAP filter is created. https://fedorahosted.org/freeipa/ticket/1675
* Add support for storing MAC address in host entries.Rob Crittenden2012-01-265-5/+94
| | | | | | | | | | | | | | | | macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
* Leave nsds5replicaupdateschedule parameter unsetOndrej Hamada2012-01-241-11/+8
| | | | | | | | The nsDS5ReplicaUpdateSchedule parameter is omited what results in replication being run all the time. The parameter is still used for forcing replica update but after that action it is always deleted. https://fedorahosted.org/freeipa/ticket/1482
* Fix deletion of HBAC Rules when there are SELinux user maps definedRob Crittenden2012-01-243-8/+52
| | | | | | | | | | | | When deleting an HBAC rule we need to ensure that an SELinux user map isn't pointing at it. We need to take what is the cn of the HBAC rule and see if that rule exists, then return the dn to that rule. The search was not being done properly and wasn't enforcing uniqueness. It could have returned partial matches as well (so tests for the search test). https://fedorahosted.org/freeipa/ticket/2269
* Mark optional DNS record partsMartin Kosek2012-01-241-7/+21
| | | | | | | | | | | | | | | All DNS record part options in dnsrecord commands need to be optional so that all of them are not required in every dnsrecord command. However, FreeIPA API then does not include an information which DNS record part options are optional in term of creating a new DNS record. For example, LOC record option "latitude seconds" is not needed to add a new LOC record. This patch adds a flag "dnsrecord_optional" to all such options so that this information is available for any other UI reading the FreeIPA API. https://fedorahosted.org/freeipa/ticket/2208
* Fix selfservice-find crashesMartin Kosek2012-01-243-13/+32
| | | | | | | | | Ignore empty options when performing an ACI search so that the find command does not crash. Update ipa(1) man page to mention this common behavior of find commands. https://fedorahosted.org/freeipa/ticket/2011 https://fedorahosted.org/freeipa/ticket/2012
* Fix ipa-server-install for dual NICsMartin Kosek2012-01-226-74/+138
| | | | | | | | | | | | | A server may have 2 or more NICs and its hostname may thus resolve to 2 and more forward addresses. IP address checks in install scripts does not expect this setup and may fail or crash. This script adds a support for multiple forward addresses for a hostname. The install scripts do not crash now. When one IP address is needed, user is asked to choose from all detected server IP addresses. https://fedorahosted.org/freeipa/ticket/2154
* localhost.localdomain clients refused to joinOndrej Hamada2012-01-222-0/+9
| | | | | | | | | Machines with hostname 'localhost' or 'localhost.localdomain' are refused from joining IPA domain and proper error message is shown. The hostname check is done both in 'ipa-client-install' script and in 'ipa-join'. https://fedorahosted.org/freeipa/ticket/2112
* Update and package ipa-upgradeconfig man page.Rob Crittenden2012-01-234-1/+8
| | | | | | | Require that the tool be run as root to avoid a permission-related backtrace. https://fedorahosted.org/freeipa/ticket/1758
* Fixed inconsistent status labels.Endi Sukma Dewata2012-01-2311-72/+138
| | | | | | | | | This patch modifies the status attributes in users, DNS zones, HBAC/sudo rules, HBAC test, and SELinux User Map to use the same label (i.e. Status) and values (i.e. Enabled/Disabled). The method to change the status will be modified separately. Ticket #2247
* Show disabled entries in gray.Endi Sukma Dewata2012-01-2314-16/+239
| | | | | | | | The users, HBAC/sudo rules, HBAC test, and SELinux list pages have been modified to show disabled entries in gray. Icons will be added separately. Ticket #1996
* Enabled paging on automount keys.Endi Sukma Dewata2012-01-239-95/+122
| | | | | | | | | | | The automount keys search facet has been modified to support paging. Since the automountkey-find command doesn't support --pkey-only option, the facet is configured such that during a refresh operation it will retrieve all entries (including the key and info attributes) and then display only the ones that are supposed to be visible in the current page. Ticket #2093
* Improve host-add error messageMartin Kosek2012-01-201-2/+2
| | | | | | | | | | | | | host-add command allows to add a host and its IP address via --ip-address option. When the address is invalid, it throws an error and refuses to operate. However, the invalid IP address error message is always the same which is not right as it forces a user to guess the reason of rejection (loopback address, link-local address or invalid address at all was passed, etc.). This patch changes host-add validator to print the error message. https://fedorahosted.org/freeipa/ticket/2229
* Replace float with DecimalMartin Kosek2012-01-2011-88/+160
| | | | | | | | | | | | | | | | | | | | Having float type as a base type for floating point parameters in ipalib introduces several issues, e.g. problem with representation or value comparison. Python language provides a Decimal type which help overcome these issues. This patch replaces a float type and Float parameter with a decimal.Decimal type in Decimal parameter. A precision attribute was added to Decimal parameter that can be used to limit a number of decimal places in parameter representation. This approach fixes a problem with API.txt validation where comparison of float values may fail on different architectures due to float representation error. In order to safely transfer the parameter value over RPC it is being converted to string which is then converted back to decimal.Decimal number on a server side. https://fedorahosted.org/freeipa/ticket/2260
generated by cgit (git 2.34.1) at 2025-09-03 14:17:29 +0000