summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Switch --group and --membergroup in example for delegationPetr Viktorin2012-02-061-2/+2
| | | | | | | | The example mistakenly showed how to allow "employees" to edit addresses of "managers". This fixes the example by switching the two options. https://fedorahosted.org/freeipa/ticket/2317
* Return proper DN in netgroup-addMartin Kosek2012-02-061-2/+2
| | | | | | | This patch fixes netgroup unit test failures which expect the original DN. https://fedorahosted.org/freeipa/ticket/2069
* Make submount automount maps work.Rob Crittenden2012-02-061-6/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Indirect automount nesting is achieved by adding a key that references another map. This isn't heirarchical, in fact, you can have multiple duplicate keys all pointing at the same map, which itself is mounted in other places. It can be a real mess if you want. In any case, a submount map has its information set to "-fstype=autofs <type>:<map>" The type can be any valid automount type: file, nis, yp, ldap, etc. We are going to hardcode ldap in when we create these using automountmap-add-indirect. If a user wants a different type they can create the key themselves (or edit it later). Here is an example of creating a submount: $ ipa automountlocation-add baltimore $ ipa automountmap-add-indirect baltimore auto.share --mount=/share $ ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.sub $ ipa automountkey-add baltimore auto.sub --key=share --info=attic:/share $ ls /share/sub/share builds lost+found This looks like: etc/auto.master: /- /etc/auto.direct /share /etc/auto.share --------------------------- /etc/auto.direct: --------------------------- /etc/auto.share: sub -fstype=autofs ldap:auto.sub maps not connected to /etc/auto.master: --------------------------- /etc/auto.sub: share attic:/share I've also added a catch-all when using the tofiles function. We were missing any maps that weren't attached to auto.master. They will now be shown along with whatever keys they have. https://fedorahosted.org/freeipa/ticket/1268
* Add argument help to CLIMartin Kosek2012-02-062-10/+84
| | | | | | | | | | | | CLI command help contains a documentation for all options that can be passed to commands. However, help strings for positional arguments are not included. This patch uses an OptionParser description field to list all command arguments as OptionParser does not have a native support to provide such information to user. https://fedorahosted.org/freeipa/ticket/1974
* Remove debug messagesMartin Kosek2012-02-061-4/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2323 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Fix raw format for ACI commandsMartin Kosek2012-02-033-66/+69
| | | | | | | | | | | | | ACI plugins (permission, selfservice and delegation) were not prepared to serve ACIs in a raw format, i.e. raw "aci" attribute taken from LDAP. This patch fixes all these plugins and their commands to provide provide this format. Few ACI raw format unit tests were added for all these plugins. https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2223 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Improve migration helpMartin Kosek2012-02-032-9/+22
| | | | | | | | | Improve migration help topic so that it easier understandable: - Add missing list of Topic commands - Add one more example to demonstrate migration abilities - Add breaks to too long lines to improve readibility https://fedorahosted.org/freeipa/ticket/2174
* Improve dnszone-add error messageMartin Kosek2012-02-031-0/+7
| | | | | | | | | | When a new DNS record is being added to DNS zone via command ipa dnsrecord-add ZONE @ and the target ZONE does not exist it returns ObjectclassViolation which may confuse users. Make sure that standard DNS Zone NotFound exception is returned. https://fedorahosted.org/freeipa/ticket/2270
* Add data field for A6 recordMartin Kosek2012-02-031-2/+10
| | | | | | | | | | | | | Since A6 is an obsolete RR type, no DNS part option was created. This is, however, not consistent with the rest of per-type API and may cause problems. This patch adds at least a DNS part for raw A6 record data so that the record type is treated consistently. This patch also fixes interactive mode for A6 records. Their data were not detected correctly as dnsrecord_add didn't expect a number in DNS part option name. https://fedorahosted.org/freeipa/ticket/2309
* Add SRV record target validatorMartin Kosek2012-02-031-0/+7
| | | | | | | Add missing SRV record target validator to filter out possible user errors. https://fedorahosted.org/freeipa/ticket/2308
* Fix NSEC record conversionMartin Kosek2012-02-031-6/+18
| | | | | | | | | | | | | NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
* Fix TXT record parsingMartin Kosek2012-02-031-0/+6
| | | | | | | | | TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
* Improve netgroup-add error messagesMartin Kosek2012-02-031-7/+11
| | | | | | | | | | | | These two situations in netgroup-add need to be distinguished: 1) Netgroup cannot be added because a hostgroup with the same name created a colliding managed netgroup 2) Another native netgroup with the same name exists This patch checks the colliding netgroup and raise appropriate error message based on this finding. https://fedorahosted.org/freeipa/ticket/2069
* Show password expiration date.Endi Sukma Dewata2012-02-011-0/+1
| | | | | | | | | | | The user details page was modified to show the password expiration date next to the existing password field. Fixed problem resetting password in self-service mode. The JSON interface for the passwd command requires the username to be specified although the equivalent CLI command doesn't require it. Ticket #2064
* Modifying DNS UI to benefit from new DNS APIPetr Voborník2012-01-301-0/+2
| | | | | | DNS UI was modified to offer structured way of defining DNS records. https://fedorahosted.org/freeipa/ticket/2208
* Added refresh button for UIPetr Voborník2012-01-301-0/+1
| | | | | | | | | | | | | | Web UI is caching records. Currently only possible ways how to display updated record which was changed elsewhere - ie. in CLI are: * refresh page in browser (takes really long on slow vpns) * search facet: change filter, find, change filter back, find * entity details: go to search, select other entry, go back to search, select original entry * association facet: same as entity details These are unconvenient methods. This patch adds Refresh button to search, details and association facet. This button executes facets refresh method. https://fedorahosted.org/freeipa/ticket/2051
* Add missing managing hosts filtering optionsMartin Kosek2012-01-262-23/+74
| | | | | | | | | | | Host object has a virtual attribute "managing" containing all hosts it manages (governed by managedBy attribute). This patch also adds standard membership filtering options: --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host in HOSTS are returned https://fedorahosted.org/freeipa/ticket/1675
* Add support for storing MAC address in host entries.Rob Crittenden2012-01-261-1/+21
| | | | | | | | | | | | | | | | macaddress is a multi-valued attribute and we allow multiple entries. This is from the objectclass ieee802device. This is added manually when doing a mod or add and not as a default to support existing host entries that do not have this objectclass. If this were added to the defaults then existing hosts missing this objectclass would not be found by host-find. It is possible to get ethers data out of nss by configuring nsswitch.conf to use ldap for ethers and running getent ethers <hostname> I tested nslcd and it only returned one macaddress value. https://fedorahosted.org/freeipa/ticket/1132
* Fix deletion of HBAC Rules when there are SELinux user maps definedRob Crittenden2012-01-242-8/+17
| | | | | | | | | | | | When deleting an HBAC rule we need to ensure that an SELinux user map isn't pointing at it. We need to take what is the cn of the HBAC rule and see if that rule exists, then return the dn to that rule. The search was not being done properly and wasn't enforcing uniqueness. It could have returned partial matches as well (so tests for the search test). https://fedorahosted.org/freeipa/ticket/2269
* Mark optional DNS record partsMartin Kosek2012-01-241-7/+21
| | | | | | | | | | | | | | | All DNS record part options in dnsrecord commands need to be optional so that all of them are not required in every dnsrecord command. However, FreeIPA API then does not include an information which DNS record part options are optional in term of creating a new DNS record. For example, LOC record option "latitude seconds" is not needed to add a new LOC record. This patch adds a flag "dnsrecord_optional" to all such options so that this information is available for any other UI reading the FreeIPA API. https://fedorahosted.org/freeipa/ticket/2208
* Fix selfservice-find crashesMartin Kosek2012-01-241-11/+11
| | | | | | | | | Ignore empty options when performing an ACI search so that the find command does not crash. Update ipa(1) man page to mention this common behavior of find commands. https://fedorahosted.org/freeipa/ticket/2011 https://fedorahosted.org/freeipa/ticket/2012
* Fixed inconsistent status labels.Endi Sukma Dewata2012-01-231-10/+9
| | | | | | | | | This patch modifies the status attributes in users, DNS zones, HBAC/sudo rules, HBAC test, and SELinux User Map to use the same label (i.e. Status) and values (i.e. Enabled/Disabled). The method to change the status will be modified separately. Ticket #2247
* Improve host-add error messageMartin Kosek2012-01-201-2/+2
| | | | | | | | | | | | | host-add command allows to add a host and its IP address via --ip-address option. When the address is invalid, it throws an error and refuses to operate. However, the invalid IP address error message is always the same which is not right as it forces a user to guess the reason of rejection (loopback address, link-local address or invalid address at all was passed, etc.). This patch changes host-add validator to print the error message. https://fedorahosted.org/freeipa/ticket/2229
* Replace float with DecimalMartin Kosek2012-01-205-41/+109
| | | | | | | | | | | | | | | | | | | | Having float type as a base type for floating point parameters in ipalib introduces several issues, e.g. problem with representation or value comparison. Python language provides a Decimal type which help overcome these issues. This patch replaces a float type and Float parameter with a decimal.Decimal type in Decimal parameter. A precision attribute was added to Decimal parameter that can be used to limit a number of decimal places in parameter representation. This approach fixes a problem with API.txt validation where comparison of float values may fail on different architectures due to float representation error. In order to safely transfer the parameter value over RPC it is being converted to string which is then converted back to decimal.Decimal number on a server side. https://fedorahosted.org/freeipa/ticket/2260
* UI for SELinux user mappingPetr Voborník2012-01-181-0/+8
| | | | | | This patch adds UI for SELinux user mapping. Its design is based on HBAC Rule design. https://fedorahosted.org/freeipa/ticket/2145
* In sudo when the category is all do not allow members, and vice versa.Rob Crittenden2012-01-182-4/+82
| | | | | | | | | | This is what we already do in the HBAC plugin, this ports it to Sudo. If a category (user, host, etc) is u'all' then we don't allow individual members be added. Conversely if there are members we don't allow the category be set to u'all'. https://fedorahosted.org/freeipa/ticket/1440
* Add missing --pkey-only option for selfservice and delegationMartin Kosek2012-01-164-64/+47
| | | | | | | | | | | | pkey-only functionality has to be implemented separately for these modules as they are based on crud.Search instead of standard LDAPSearch. Delegation moduled was also fixed to support new format of ACI's memberof attribute introduced in patch "Display the value of memberOf ACIs in permission plugin." https://fedorahosted.org/freeipa/ticket/2092
* Add labels so HBAC and Sudo rules show under hosts/hostgroups.Rob Crittenden2012-01-161-4/+16
| | | | | | Also fix a bunch of trailing whitespace. https://fedorahosted.org/freeipa/ticket/1751
* Restore ACI when aci_mod failsMartin Kosek2012-01-131-4/+18
| | | | | | | | | | aci_mod command is composed of 2 ACI commands: aci_del which deletes the old ACI and aci_add which adds the new modified ACI. However, if aci_add command fails then both new and the old ACI are lost. Old ACI must be restored in this case. https://fedorahosted.org/freeipa/ticket/2013 https://fedorahosted.org/freeipa/ticket/2014
* Added instructions to generate CSR.Endi Sukma Dewata2012-01-131-1/+1
| | | | | | | | | | The certificate request dialog box has been modified to show the OpenSSL commands for generating a CSR. The realm and entry names in the test data have been fixed to be more consistent. Ticket #1012
* Fix some typos in automember help and paramters.Rob Crittenden2012-01-121-5/+5
| | | | | | Contributed by Jérôme Fenal https://fedorahosted.org/freeipa/ticket/2261
* Allow hbactest to work with HBAC rules exceeding default IPA limitsAlexander Bokovoy2012-01-131-3/+25
| | | | | | | | | | | | | When multiple HBAC rules are defined, IPA default limits to retrieve objects may limit the scope of HBAC testing. To allow full range of rules to be tested support for --sizelimit option is added. In addition, when --rules option is specified, make sure only those rules are retrieved regardless total number of rules defined. This should also speed up HBAC test performance for real life scenarios when few new rules are added to large collection of rules. https://fedorahosted.org/freeipa/ticket/2230
* Validate sudo RunAsUser/RunAsGroup argumentsAlexander Bokovoy2012-01-131-1/+38
| | | | | | | | | | | | | FreeIPA SUDO rules use --usercat/--groupcat to specify that rule applies to all users or groups. Thus, sudorule-add-runasuser and sudorule-add-runasgroup accept specific groups and users and do not accept ALL reserved word. The patch validates user and group passed to these commands and reports appropriate errors when these are ALL. Ticket #1496 https://fedorahosted.org/freeipa/ticket/1496
* Document the ping plugin.Rob Crittenden2012-01-121-1/+25
| | | | https://fedorahosted.org/freeipa/ticket/1903
* Fix maxvalue in DNS pluginMartin Kosek2012-01-121-1/+0
| | | | | | | | | | | | Having a Parameter maxvalue larger that 2G makes Python convert it to "long" type instead of "int" type. Our framework than fails to bootstrap the API when it detects long integer in Parameter maxvalue. Remove the clashing maxvalue out entirely as we can't transfer values larger than 2G anyway (xmlrpc limitation). https://fedorahosted.org/freeipa/ticket/2082
* Create per-type DNS APIMartin Kosek2012-01-121-47/+383
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use new structured DNSRecord parameters to generate per-type API for all supported DNS RR types. This should help significantly the end-user with manipulating complex DNS record type (MX, LOC, etc.). All enhancements are integrated to current DNS record commands: 1) dnsrecord-add - Records can be either entered as a raw value (e.g. --mx-rec= "1 srv1.example.com" for MX record) or per-part: --mx-preference=1 --mx-exchanger=srv1.example.com - CLI interactive help behavior was changed. It will ask for a record type and then ask for all DNS record part values (e.g. MX Preference value, MX Exchanger value). 2) dnsrecord-mod - This command can now operate in 2 modes. When only a raw DNS record is entered (e.g. --mx-rec="1 srv1.example.com") it operates in standard mode and replaces any previous mxrecord value with the --mx-rec value. When any structured parameter (e.g. --mx-preference) is passed it modifies just the specified parts of one mxrecord value referred by --mx-rec: --mx-rec="1 srv1.example.com" --mx-preference=2 - New interactive help has been implemented. It will ask for a record to be modified (in the same manner as dnsrecord-del) and then let user change DNS record part(s) for chosen records. 3) All dnsrecord-* commands have now --structured option - When this option is passed, instead of displaying raw DNS values all DNS records are parsed and displayed per-part. Example: $ ipa dnsrecord-show example.com @ --structured Record name: @ Records: Record type: MX Record data: 0 server1.example.com. MX Preference: 0 MX Exchanger: server1.example.com. Record type: NS Record data: ns1.example.com. NS Hostname: ns1.example.com. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Improve CLI output for complex commandsMartin Kosek2012-01-122-4/+24
| | | | | | | | | | | | | | | Complex commands may have many options or non-standard output. This patch adds 2 improvements to handle these commands better: 1) Add "option_group" parameter attribute Make command help more readable by specifying an option group for the parameter. All parameters in the same option group are then placed to one named option group 2) Allow nested entries in the output Current CLI output module cannot handle a list of nested entries (dictionaries) contained in an entry attribute. Make sure they are printed properly (with indentation) https://fedorahosted.org/freeipa/ticket/2082
* Fix Parameter csv parsingMartin Kosek2012-01-121-4/+10
| | | | | | | CSV values were not parsed in ipalib.parameters.normalize method properly when passed as a list and not as a basestring. Based on Jan Cholasta's contribution.
* Refactor dnsrecord processingMartin Kosek2012-01-122-551/+812
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Added policies into user details page.Endi Sukma Dewata2012-01-101-1/+1
| | | | | | | | The user details page has been modified to show the password policy and Kerberos ticket policy that apply to the user. The policies are currently displayed as read-only. Ticket #703
* HBAC test optional sourcehost optionOndrej Hamada2012-01-111-26/+40
| | | | | | | | | | | | | | | New version of SSSD begins ignoring sourcehost value of HBAC rules by default. In order to match this behaviour the sourcehost option in hbactest is optional now, but the value of sourcehost is ignored in all rules. Every rule's sourcehost value is set to 'ALL' what turns sourchost value comparation off. If srchost option is used, warning is displayed to inform the user about changes. Text of plugin help was also updated. Also the unit tests for hbactest plugin were updated. Every test was doubled. The second ones test the plugin without sourcehost option. They are supposed to have the same result. https://fedorahosted.org/freeipa/ticket/2085
* Display the value of memberOf ACIs in permission plugin.Rob Crittenden2012-01-112-6/+9
| | | | | | | | | | | | | | | | There were two problems: 1. memberof wasn't in the list of things we looked for in the return value from aci_show() 2. The value wasn't being translated into a group name. Use the DN class to retrieve the group name from the memberof URI. Note that I changed the parsing for targetgroup as well. We now save a lookup and potentially returning a NotFound if an aci points to a group that no longer exists. https://fedorahosted.org/freeipa/ticket/2100
* Added client-side validation of A and AAAA DNS recordsPetr Vobornik2012-01-111-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/1466
* Fix attempted write to attribute of read-only object.Jan Cholasta2012-01-113-4/+38
| | | | | | | | | Add new class "cachedproperty" for creating property-like attributes that cache the return value of a method call. Also fix few issues in the unit tests to enable them to succeed. ticket 1959
* Reload UI on server upgrade.Endi Sukma Dewata2012-01-111-0/+3
| | | | | | | | | | The JSON server has been modified to return the version number in all responses. The UI has been modified to keep the version obtained during env operation and check the version returned in subsequent operations. If the version changes the UI will reload itself. Ticket #946
* User-add random password supportOndrej Hamada2012-01-111-0/+36
| | | | | | | | | | | | | | | | | | | | | | I've used code from ipalib/plugins/host.py to add support for random password generation. The '--random' option is now available in user-add and user-mod commands. If both the 'password' and 'random' options are used the 'random' option will be ignored. Two test cases were added to unit test's module test_user_plugin.py - they test creating and modifying user with random password. Two fuzzy tests were added: test for password(string that doesn't start or end with whitespace and doesn't containt other whitespace than ' ') and for whatever string(because of krbextradata). I've slightly modified ipa_generate_password in order to make passwords for users more user-friendly(reduce number of non-letters). It has two optional parameters now - first one is string of characters that should be used for generating the passwd and second one is length of password. If none parameter is set default values will be used so there's no need to modify other plugins that use random password generator. https://fedorahosted.org/freeipa/ticket/1979
* Add SELinux user mapping framework.Rob Crittenden2012-01-115-1/+506
| | | | | | | | This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
* Removed HBAC deny rule warning.Endi S. Dewata2012-01-111-2/+0
| | | | | | | The HBAC deny rule is no longer supported so it's no longer necessary to show the warning. Ticket #1444
* Fixed I18n labels for HBAC TestEndi Sukma Dewata2012-01-111-0/+10
| | | | | | | Hard-coded labels in HBAC Test have been moved into internal.py to allow translation. Ticket #388
* Added commands into metadata.Endi S. Dewata2012-01-112-5/+64
| | | | | | | | | The json_metadata command has been modified to accept some new options and return the commands metadata. The API.txt has been updated as well. The UI has been modified to use commands metadata instead of methods metadata. Ticket #388
generated by cgit (git 2.34.1) at 2024-06-19 14:45:50 +0000