summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Check whether the default user group is POSIX when adding new user with ↵Jan Cholasta2012-04-051-4/+8
| | | | | | --noprivate. ticket 2572
* Make revocation_reason required when revoking a certificate.Rob Crittenden2012-04-051-1/+1
| | | | | | | This will prevent errors if an empty reason is provided and it is set by default one doesn't have to always set it on the command-line. https://fedorahosted.org/freeipa/ticket/2597
* Defer conversion and validation until after --{add,del,set}attr are handledPetr Viktorin2012-04-031-17/+35
| | | | | | | | | | | | | | | | | | | | | --addattr & friends that modified attributes known to Python sometimes used converted and validated Python values instead of LDAP strings. This caused a problem for --delattr, which searched for a converted integer in a list of raw strings (ticket 2407). With this patch we work on raw strings, converting only when done. Deferring validation ensures the end result is valid, so proper errors are raised instead of failing later (ticket 2405). Tests included. Replaces previous fix for: https://fedorahosted.org/freeipa/ticket/2418 Fixes: https://fedorahosted.org/freeipa/ticket/2405 https://fedorahosted.org/freeipa/ticket/2407 https://fedorahosted.org/freeipa/ticket/2408
* Test the batch pluginPetr Viktorin2012-04-031-7/+4
| | | | | | | | | This adds tests for the batch plugin, and changes its output declaration to allow results as tuples (this tripped validation). The assert_deepequal function ignores the order of items in lists. Document this in its docstring, and use a custom checker for the batch plugin results.
* Don't create private groups for migrated users, check for valid gidnumberRob Crittenden2012-04-031-31/+67
| | | | | | | | | | | | | | | | | Migrated users don't get a private group, there is no safe way to verify that the namespace is correct without redoing the uidnumber as well. Verify that the GID at least points to a valid group on the remote server and warn if it doesn't (this doesn't guarantee that the group gets migrated but at least we try). If the remote entry has no gidNumber then don't migrate that user. We don't know why that user is non-POSIX, it could be a special user used for auth, for example. Add a loginshell if the remote user doesn't have one. https://fedorahosted.org/freeipa/ticket/2562
* Improve automount indirect map error messageMartin Kosek2012-03-281-0/+4
| | | | | | | | | | When user does not pass a name of parent map in automountmap-add-indirect command, auto.master is used as a default. However, when auto.master does not exist in a given location, we raise NotFound error with a name of a location instead of a name of the missing automount map. https://fedorahosted.org/freeipa/ticket/2387
* Netgroup nisdomain and hosts validationOndrej Hamada2012-03-284-6/+42
| | | | | | | | | | | | | | | | | | | | | | | | nisdomain validation: Added pattern to the 'nisdomain' parameter to validate the specified nisdomain name. According to most common use cases the same pattern as for netgroup should fit. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2448 'add_external_pre_callback' function was created to allow validation of all external members. Validation is based on usage of objects primary key parameter. The 'add_external_pre_callback' fucntion has to be called directly from in the 'pre_callback' function. This change affects netgroup, hbacrule and sudorule commands. For hostname, the validator allows non-fqdn and underscore characters. validate_hostname function in ipalib.util was modified and contains additional option that allows hostname to contain underscore characters. This option is disabled by default. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2447
* Change parameters to use only default_from for dynamic default values.Jan Cholasta2012-03-282-3/+3
| | | | | | | | | Replace all occurences of create_default with equivalent default_from and remove create_default from the framework. This is needed for proper parameter validation, as there is no way to tell which parameters to validate prior to calling create_default, because create_default does not provide information about which parameters are used for generating the default value.
* Fix the procedure for getting default values of command parameters.Jan Cholasta2012-03-281-16/+6
| | | | | | | The parameters used in default_from of other parameters are now properly validated before the default_from is called. ticket 1847
* Fix dnsrecord-del interactive modeMartin Kosek2012-03-271-2/+1
| | | | | | | User was not able to select multiple values in dnsrecord-del interactive mode. https://fedorahosted.org/freeipa/ticket/2581
* Improve user awareness about dnsconfigMartin Kosek2012-03-261-0/+22
| | | | | | | | | | | | Global DNS configuration is a nice tool to maintain a common DNS settings stored in LDAP which are then used for all enrolled IPA servers. However, the settings stored in LDAP override local settings in named.conf on DNS servers. This patch adds more information about global DNS configuration options in install scripts and DNS module help. https://fedorahosted.org/freeipa/ticket/2525
* Typos in FreeIPA messagesOndrej Hamada2012-03-232-2/+2
| | | | | | | Rebased patch sent by Yuri Chornoivan (yurchor@ukr.net). Fixes 'occured' and 'commond' typos in FreeIPA messages. https://fedorahosted.org/freeipa/ticket/2526
* Fix default SOA serial formatMartin Kosek2012-03-231-2/+2
| | | | | | RFC 1912 recommends format YYYYMMDDnn, we used YYYYDDMMnn. https://fedorahosted.org/freeipa/ticket/2567
* Avoid deleting DNS zone when a context is reusedMartin Kosek2012-03-231-5/+12
| | | | | | | | | | | | | | | | | | | When dnsrecord-del pre_callback detects that the record does not contain any records, it sets a flag to connection context and deletes the record object later. However, when more dnsrecord-del commands share the same context (and this is the case of "ipa-replica-manage del $MASTER" DNS cleanup), it may reuse a positive flag from previous dnsrecord-del command and delete the root DNS zone record and thus effectively delete the zone. This patch makes sure that this flag is always initialized to a sane value in dnsrecord-del pre_callback to make sure that the DNS zone is not deleted. It also fixes pre_callback function definition to prevent adding attrs_list to "keys" parameter and thus confuse developers. https://fedorahosted.org/freeipa/ticket/2503
* Normalize the primary key value to lowercase during migration.Rob Crittenden2012-03-221-0/+1
| | | | https://bugzilla.redhat.com/show_bug.cgi?id=804609
* Fix attributes that contain DNs when migrating.Rob Crittenden2012-03-222-2/+52
| | | | | | | Some attributes, like secretary and manager, may point to other LDAP entries. We need to fix these during migration. https://fedorahosted.org/freeipa/ticket/2562
* Harden raw record processing in DNS pluginMartin Kosek2012-03-221-12/+18
| | | | | | | | | | | | | | | | There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
* Fix precallback validators in DNS pluginMartin Kosek2012-03-221-28/+32
| | | | | | | | | | | | | | | DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
* DNS forwarder validatorPetr Vobornik2012-03-201-0/+1
| | | | | | | | DNS forwarder's value can consist of IP address and a port. The syntax is '<IP ADDRESS> port <PORT>'. A new validator was created for this purpose. It is based on IP address validator. https://fedorahosted.org/freeipa/ticket/2490
* Add missing global options in dnsconfigMartin Kosek2012-03-201-1/+20
| | | | | | | | | | | Add a support for new global options in bind-dyndb-ldap, that is: * idnsforwardpolicy: Default policy for conditional forwarding * idnsallowsyncptr: Allow globaly PTR synchronization for dynamic updates * idnszonerefresh: Default interval between regular polls of the name server for new DNS zones https://fedorahosted.org/freeipa/ticket/2439
* Allow port numbers for idnsForwardersMartin Kosek2012-03-201-4/+24
| | | | | | | | Let user enter custom ports for zone conditional forwarders or global forwarders in dnsconfig. Ports can be specified in a standard BIND format: IP_ADDRESS [port PORT] https://fedorahosted.org/freeipa/ticket/2462
* Use a consistent parameter name in errors, defaulting to cli_name.Rob Crittenden2012-03-201-2/+3
| | | | | | | | For general command-line errors we want to use the cli_name on output. The exception is when using *attr, we want to return that attribute name in the exception. https://fedorahosted.org/freeipa/ticket/1418
* Content is no more overwritten by error messagePetr Vobornik2012-03-191-0/+8
| | | | | | | | | | | | | | | | | When an error which caused calling of report_error occurt, the content of a facet got replaced by error message. There was no way how to force the facet to recreate its content and the facet became unusable. This patch creates a containter for an error message. On error, report_error writes its content to error container, content container is hidden and error container is shown. Older comment in a code suggested to move the error message to facet's footer. A message in a footer could be missed by the user and on top of that a footer is sometimes used by various facet and we would have to solve the same problem again. From experience the cause of an error is usually a missing pkey in a path. Therefore error information suggests user to navigate to top level. It causes to load default facets with default values so errors in navigation state shouldn't happen. Facet content is displayed back on facet_show. If user tries to display same object as before facet's need_update() would return false, therefore need_update was modified to always return true if error is displayed. Reproduction: 1) display any nested entity - ie DNS record 2) delete its parent pkey from path - &dnszone-pkey=example.com 3) reload the page with this path https://fedorahosted.org/freeipa/ticket/2449
* Don't allow hosts and services of IPA masters to be disabled.Rob Crittenden2012-03-193-7/+19
| | | | https://fedorahosted.org/freeipa/ticket/2487
* Better hbactest validation messagePetr Vobornik2012-03-151-0/+1
| | | | | | | | HBAC Test validation message contains all missing values in form of list of links instead of general 'missing values' message and redirection to first missing value's facet. When a link is clicked user is redirected to value's facet. https://fedorahosted.org/freeipa/ticket/2182
* Display serial number as HEX (DECIMAL) when showing certificates.Rob Crittenden2012-03-144-19/+25
| | | | https://fedorahosted.org/freeipa/ticket/1991
* Don't crash when searching with empty relationship optionsPetr Viktorin2012-03-131-22/+14
| | | | | | | | | | | | | | | | Empty sequences (and sequences of empty strings) are normalized to None, but the member filter code expected a list. This patch extends a test for missing options to also catch false values. The functional change is from `if param_name in options:` to `if options.get(param_name):`; the rest of the patch is code de-duplication and tests. These are CSV params with csv_skipspace set, so on the CLI, empty set is given as a string with just spaces and commas (including the empty string). https://fedorahosted.org/freeipa/ticket/2479
* Fix migration plugin compat checkMartin Kosek2012-03-111-3/+7
| | | | | | | | | | | | Ticket #2274 implements a check for compat plugin and warns user if it is enabled. However, there are 2 issues connected with the plugin: 1) The check is performed against the remote (migrated) LDAP server and not the local LDAP server, which does not make much sense 2) When the compat plugin is missing in cn=plugins,cn=config, it raises an error and thus breaks the migration This patch fixes both issues. https://fedorahosted.org/freeipa/ticket/2508
* Mark most config options as requiredPetr Viktorin2012-03-121-15/+15
| | | | | | | IPA assumes most config options are present, but allowed the user to delete them. This patch marks them as required. https://fedorahosted.org/freeipa/ticket/2159
* Allow removing sudo commands with special characters from command groupsPetr Viktorin2012-03-121-2/+2
| | | | | | | | | Previously the commands were compared as serialized strings. Differences in serializations meant commands with special characters weren't found in the checked list. Use the DN class to compare DNs correctly. https://fedorahosted.org/freeipa/ticket/2483
* Improve dnsrecord interactive helpMartin Kosek2012-03-011-19/+104
| | | | | | | | | | | | | | | | | | | | | Add 2 new features to DNS record interactive help to increase its usability and also make its behavior more consistent with standard parameter interactive help: 1) Ask for missing DNS parts When a required part of a newly added DNS record was missing, we just returned a ValidationError. Now, the interactive help rather asks for all missing required parts of all DNS records that were being added by its parts. 2) Let user amend invalid part When an interactive help asked for a DNS record part value and user enters an invalid value, the entire interactive help exits with an error. This may upset a user if he already entered several correct DNS record part values. Now, the help rather tells user what's wrong and give him an opportunity to amend the value. https://fedorahosted.org/freeipa/ticket/2386
* Add help for new structured DNS frameworkMartin Kosek2012-03-011-4/+31
| | | | | | | | | | DNS Test Day shown that the new RR specific DNS options and the concepts behind them may not be easily understood. This patch adds an explanation of the new DNS framework for structured options to make it easier for the user to understand and use the new options. https://fedorahosted.org/freeipa/ticket/2382
* Fix encoding for setattr/addattr/delattrMartin Kosek2012-03-011-0/+2
| | | | | | | | | | Attribute values passed by --{set,add,del}attr parameters were normalized and validated using appropriate parameter, but were never encoded for the backend. This make prevents manipulation with dirsvr BOOL attributes where framework tries to pass boolean value instead of encoded "TRUE"/"FALSE" values. https://fedorahosted.org/freeipa/ticket/2418
* Add support for sudoOrderRob Crittenden2012-03-011-0/+41
| | | | | | | | | | Update ipaSudoRule objectClass on upgrades to add new attributes. Ensure uniqueness of sudoOrder in rules. The attributes sudoNotBefore and sudoNotAfter are being added to schema but not as Params. https://fedorahosted.org/freeipa/ticket/1314
* Add status command to retrieve user lockout statusRob Crittenden2012-03-021-1/+112
| | | | | | | This information is not replicated so pull from all IPA masters and display the status across all servers. https://fedorahosted.org/freeipa/ticket/2162
* Forms based authentication UIPetr Voborník2012-03-021-0/+6
| | | | | | | | | | | | | | | | | | | | Support for forms based authentication was added to UI. It consist of: 1) new login page Page url is [ipa server]/ipa/ui/login.html Page contains a login form. For authentication it sends ajax request at [ipa server]/session/json/login_password. If authentication is successfull page is redirected to [ipa server]/ipa/ui if it fails from whatever reason a message is shown. 2) new enhanced error dialog - authorization_dialog. This dialog is displayed when user is not authorized to perform action - usually when ticket and session expires. It is a standard error dialog which shows kerberos ticket related error message and newly offers (as a link) to use form based authentication. If user click on the link, the dialog content and buttons switch to login dialog which has same functionality as 'new login page'. User is able to return back to the error message by clicking on a back button. login.html uses same css styles as migration page -> ipa-migration.css was merged into ipa.css. https://fedorahosted.org/freeipa/ticket/2450
* Migration warning when compat enabledOndrej Hamada2012-02-291-2/+28
| | | | | | | | | | | Added check into migration plugin to warn user when compat is enabled. If compat is enabled, the migration fails and user is warned that he must turn the compat off or run the script with (the newly introduced) option '--with-compat'. '--with-compat' is new flag. If it is set, the compat status is ignored. https://fedorahosted.org/freeipa/ticket/2274
* Only apply validation rules when adding and updating.Rob Crittenden2012-02-297-16/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There may be cases, for whatever reason, that an otherwise illegal entry gets created that doesn't match the criteria for a valid user/host/group name. If this happens (i.e. migration) there is no way to remove this using the IPA tools because we always applied the name pattern. So you can't, for example, delete a user with an illegal name. Primary keys are cloned with query=True in PKQuery which causes no rules to be applied on mod/show/find. This reverts a change from commit 3a5e26a0 which applies class rules when query=True (for enforcing no white space). Replace rdnattr with rdn_is_primary_key. This was meant to tell us when an RDN change was necessary to do a rename. There could be a disconnect where the rdnattr wasn't the primary key and in that case we don't need to do an RDN change, so use a boolean instead so that it is clear that RDN == primary key. Add a test to ensure that nowhitespace is actually enforced. https://fedorahosted.org/freeipa/ticket/2115 Related: https://fedorahosted.org/freeipa/ticket/2089 Whitespace tickets: https://fedorahosted.org/freeipa/ticket/1285 https://fedorahosted.org/freeipa/ticket/1286 https://fedorahosted.org/freeipa/ticket/1287
* Added logout buttonPetr Voborník2012-02-281-1/+3
| | | | | | | | | | Logout button was added to Web UI. Click on logout button executes session_logout command. If command succeeds or xhr stutus is 401 (unauthorized - already logged out) page is redirected to logout.html. logout.html is a simple page with "You have been logged out" text and a link to return back to main page. https://fedorahosted.org/freeipa/ticket/2363
* Improve FQDN handling in DNS and host pluginsMartin Kosek2012-02-292-31/+40
| | | | | | | | | | | | | | | | | | | | | DNS and host plugin does not work well with domain names ending with dot. host plugin creates a record with two fqdn attributes when such hostname is created which then has to be manually fixed. DNS plugin handled zones with and without trailing dot as two distinct zones, which may lead to issues when both zones are created. This patch sanitizes approach to FQDNs in both DNS and host plugin. Hostnames are now always normalized to the form without trailing dot as this form did not work before and it would keep hostname form consistent without changes in our server/client enrollment process. As DNS zones always worked in both forms this patch rather makes sure that the plugin works with both forms of one zone and prevents creating 2 identical zones with just different format. https://fedorahosted.org/freeipa/ticket/2420
* Improve hostname and domain name validationMartin Kosek2012-02-292-25/+35
| | | | | | | | | | | | | | | DNS plugin did not check DNS zone and DNS record validity and user was thus able to create domains like "foo bar" or other invalid DNS labels which would really confuse both user and bind-dyndb-ldap plugin. This patch at first consolidates hostname/domain name validators so that they use common functions and we don't have regular expressions and other checks defined in several places. These new cleaned validators are then used for zone/record name validation. https://fedorahosted.org/freeipa/ticket/2384
* Improve dnsrecord-add interactive modeMartin Kosek2012-02-291-4/+9
| | | | | | | | | | | When an invalid record type is entered during dnsrecord-add interactive mode, user is provided with a list of allowed values (record types). However, the provided list contains also unsupported record types (APL, DHCID, etc.) and any attempt to add such records would end with error. This patch limits the list to supported record types only. https://fedorahosted.org/freeipa/ticket/2378
* Don't set migrated user's GID to that of default users group.Rob Crittenden2012-02-291-3/+8
| | | | | | The GID should be the UID unless UPG is disabled. https://fedorahosted.org/freeipa/ticket/2430
* Validate attributes in permission-addOndrej Hamada2012-02-281-0/+55
| | | | | | | | | | | When adding or modifying permission with both type and attributes specified, check whether the attributes are allowed for specified type. In case of disallowed attributes raises the ObjectclassViolation exception. New tests were also added to the unit-tests. https://fedorahosted.org/freeipa/ticket/2293
* Add support defaultNamingContext and add --basedn to migrate-dsRob Crittenden2012-02-291-13/+28
| | | | | | | | | | | | | | | | | | | | There are two sides to this, the server and client side. On the server side we attempt to add a defaultNamingContext on already installed servers. This will fail on older 389-ds instances but the failure is not fatal. New installations on versions of 389-ds that support this attribute will have it already defined. On the client side we need to look for both defaultNamingContext and namingContexts. We still need to check that the defaultNamingContext is an IPA server (info=IPAV2). The migration change also takes advantage of this and adds a new option which allows one to provide a basedn to use instead of trying to detect it. https://fedorahosted.org/freeipa/ticket/1919 https://fedorahosted.org/freeipa/ticket/2314
* Added unsupported_validatorPetr Voborník2012-02-291-0/+1
| | | | | | | | dnszone attributes idnsallowquery and idnsallowtransfer have valid but currently unsupported values: 'localhost' and 'localnets'. New validator was introduced for unsuported values. By using this validator user can see that the value is currently unsupported instead of showing 'invalid value' or passing the value to server and creating error there. https://fedorahosted.org/freeipa/ticket/2351
* New UI for DNS global configurationPetr Voborník2012-02-291-0/+3
| | | | | | UI for DNS global configuration was implemented. https://fedorahosted.org/freeipa/ticket/2350
* DNS Zone UI: added new attributesPetr Voborník2012-02-291-0/+1
| | | | | | | | | | | | | | | | | New attributes were added to DNS zone details facet. Attributes: idnsallowquery idnsallowtransfer idnsforwarders idnsforwardpolicy idnsallowsyncptr New network address validator created for idnsallowquery and idnsallowtransfer attributes. Network address validator also added to dnszone adder dialog - from_ip field. https://fedorahosted.org/freeipa/ticket/2351
* Use stricter semantics when checking IP address for DNS recordsPetr Viktorin2012-02-291-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2379
* Improve dns error messageMartin Kosek2012-02-281-2/+8
| | | | | | | | | | Improve AttrValueNotFound exception error message raised in the DNS module when a deleted (modified) attribute value is not found in a record. In order to be consistent with previous DNS module implementation this error message should include an attribute label instead of an attribute name. https://fedorahosted.org/freeipa/ticket/2377
generated by cgit (git 2.34.1) at 2025-09-03 21:30:15 +0000