summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Replace float with DecimalMartin Kosek2012-01-205-41/+109
| | | | | | | | | | | | | | | | | | | | Having float type as a base type for floating point parameters in ipalib introduces several issues, e.g. problem with representation or value comparison. Python language provides a Decimal type which help overcome these issues. This patch replaces a float type and Float parameter with a decimal.Decimal type in Decimal parameter. A precision attribute was added to Decimal parameter that can be used to limit a number of decimal places in parameter representation. This approach fixes a problem with API.txt validation where comparison of float values may fail on different architectures due to float representation error. In order to safely transfer the parameter value over RPC it is being converted to string which is then converted back to decimal.Decimal number on a server side. https://fedorahosted.org/freeipa/ticket/2260
* UI for SELinux user mappingPetr Voborník2012-01-181-0/+8
| | | | | | This patch adds UI for SELinux user mapping. Its design is based on HBAC Rule design. https://fedorahosted.org/freeipa/ticket/2145
* In sudo when the category is all do not allow members, and vice versa.Rob Crittenden2012-01-182-4/+82
| | | | | | | | | | This is what we already do in the HBAC plugin, this ports it to Sudo. If a category (user, host, etc) is u'all' then we don't allow individual members be added. Conversely if there are members we don't allow the category be set to u'all'. https://fedorahosted.org/freeipa/ticket/1440
* Add missing --pkey-only option for selfservice and delegationMartin Kosek2012-01-164-64/+47
| | | | | | | | | | | | pkey-only functionality has to be implemented separately for these modules as they are based on crud.Search instead of standard LDAPSearch. Delegation moduled was also fixed to support new format of ACI's memberof attribute introduced in patch "Display the value of memberOf ACIs in permission plugin." https://fedorahosted.org/freeipa/ticket/2092
* Add labels so HBAC and Sudo rules show under hosts/hostgroups.Rob Crittenden2012-01-161-4/+16
| | | | | | Also fix a bunch of trailing whitespace. https://fedorahosted.org/freeipa/ticket/1751
* Restore ACI when aci_mod failsMartin Kosek2012-01-131-4/+18
| | | | | | | | | | aci_mod command is composed of 2 ACI commands: aci_del which deletes the old ACI and aci_add which adds the new modified ACI. However, if aci_add command fails then both new and the old ACI are lost. Old ACI must be restored in this case. https://fedorahosted.org/freeipa/ticket/2013 https://fedorahosted.org/freeipa/ticket/2014
* Added instructions to generate CSR.Endi Sukma Dewata2012-01-131-1/+1
| | | | | | | | | | The certificate request dialog box has been modified to show the OpenSSL commands for generating a CSR. The realm and entry names in the test data have been fixed to be more consistent. Ticket #1012
* Fix some typos in automember help and paramters.Rob Crittenden2012-01-121-5/+5
| | | | | | Contributed by Jérôme Fenal https://fedorahosted.org/freeipa/ticket/2261
* Allow hbactest to work with HBAC rules exceeding default IPA limitsAlexander Bokovoy2012-01-131-3/+25
| | | | | | | | | | | | | When multiple HBAC rules are defined, IPA default limits to retrieve objects may limit the scope of HBAC testing. To allow full range of rules to be tested support for --sizelimit option is added. In addition, when --rules option is specified, make sure only those rules are retrieved regardless total number of rules defined. This should also speed up HBAC test performance for real life scenarios when few new rules are added to large collection of rules. https://fedorahosted.org/freeipa/ticket/2230
* Validate sudo RunAsUser/RunAsGroup argumentsAlexander Bokovoy2012-01-131-1/+38
| | | | | | | | | | | | | FreeIPA SUDO rules use --usercat/--groupcat to specify that rule applies to all users or groups. Thus, sudorule-add-runasuser and sudorule-add-runasgroup accept specific groups and users and do not accept ALL reserved word. The patch validates user and group passed to these commands and reports appropriate errors when these are ALL. Ticket #1496 https://fedorahosted.org/freeipa/ticket/1496
* Document the ping plugin.Rob Crittenden2012-01-121-1/+25
| | | | https://fedorahosted.org/freeipa/ticket/1903
* Fix maxvalue in DNS pluginMartin Kosek2012-01-121-1/+0
| | | | | | | | | | | | Having a Parameter maxvalue larger that 2G makes Python convert it to "long" type instead of "int" type. Our framework than fails to bootstrap the API when it detects long integer in Parameter maxvalue. Remove the clashing maxvalue out entirely as we can't transfer values larger than 2G anyway (xmlrpc limitation). https://fedorahosted.org/freeipa/ticket/2082
* Create per-type DNS APIMartin Kosek2012-01-121-47/+383
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use new structured DNSRecord parameters to generate per-type API for all supported DNS RR types. This should help significantly the end-user with manipulating complex DNS record type (MX, LOC, etc.). All enhancements are integrated to current DNS record commands: 1) dnsrecord-add - Records can be either entered as a raw value (e.g. --mx-rec= "1 srv1.example.com" for MX record) or per-part: --mx-preference=1 --mx-exchanger=srv1.example.com - CLI interactive help behavior was changed. It will ask for a record type and then ask for all DNS record part values (e.g. MX Preference value, MX Exchanger value). 2) dnsrecord-mod - This command can now operate in 2 modes. When only a raw DNS record is entered (e.g. --mx-rec="1 srv1.example.com") it operates in standard mode and replaces any previous mxrecord value with the --mx-rec value. When any structured parameter (e.g. --mx-preference) is passed it modifies just the specified parts of one mxrecord value referred by --mx-rec: --mx-rec="1 srv1.example.com" --mx-preference=2 - New interactive help has been implemented. It will ask for a record to be modified (in the same manner as dnsrecord-del) and then let user change DNS record part(s) for chosen records. 3) All dnsrecord-* commands have now --structured option - When this option is passed, instead of displaying raw DNS values all DNS records are parsed and displayed per-part. Example: $ ipa dnsrecord-show example.com @ --structured Record name: @ Records: Record type: MX Record data: 0 server1.example.com. MX Preference: 0 MX Exchanger: server1.example.com. Record type: NS Record data: ns1.example.com. NS Hostname: ns1.example.com. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Improve CLI output for complex commandsMartin Kosek2012-01-122-4/+24
| | | | | | | | | | | | | | | Complex commands may have many options or non-standard output. This patch adds 2 improvements to handle these commands better: 1) Add "option_group" parameter attribute Make command help more readable by specifying an option group for the parameter. All parameters in the same option group are then placed to one named option group 2) Allow nested entries in the output Current CLI output module cannot handle a list of nested entries (dictionaries) contained in an entry attribute. Make sure they are printed properly (with indentation) https://fedorahosted.org/freeipa/ticket/2082
* Fix Parameter csv parsingMartin Kosek2012-01-121-4/+10
| | | | | | | CSV values were not parsed in ipalib.parameters.normalize method properly when passed as a list and not as a basestring. Based on Jan Cholasta's contribution.
* Refactor dnsrecord processingMartin Kosek2012-01-122-551/+812
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Added policies into user details page.Endi Sukma Dewata2012-01-101-1/+1
| | | | | | | | The user details page has been modified to show the password policy and Kerberos ticket policy that apply to the user. The policies are currently displayed as read-only. Ticket #703
* HBAC test optional sourcehost optionOndrej Hamada2012-01-091-26/+40
| | | | | | | | | | | | | | | New version of SSSD begins ignoring sourcehost value of HBAC rules by default. In order to match this behaviour the sourcehost option in hbactest is optional now, but the value of sourcehost is ignored in all rules. Every rule's sourcehost value is set to 'ALL' what turns sourchost value comparation off. If srchost option is used, warning is displayed to inform the user about changes. Text of plugin help was also updated. Also the unit tests for hbactest plugin were updated. Every test was doubled. The second ones test the plugin without sourcehost option. They are supposed to have the same result. https://fedorahosted.org/freeipa/ticket/2085
* Fix two typos in role help.Rob Crittenden2012-01-041-2/+2
| | | | Contributed by Jérôme Fenal
* Display the value of memberOf ACIs in permission plugin.Rob Crittenden2012-01-042-6/+9
| | | | | | | | | | | | | | | | There were two problems: 1. memberof wasn't in the list of things we looked for in the return value from aci_show() 2. The value wasn't being translated into a group name. Use the DN class to retrieve the group name from the memberof URI. Note that I changed the parsing for targetgroup as well. We now save a lookup and potentially returning a NotFound if an aci points to a group that no longer exists. https://fedorahosted.org/freeipa/ticket/2100
* Added client-side validation of A and AAAA DNS recordsPetr Vobornik2012-01-031-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/1466
* Fix attempted write to attribute of read-only object.Jan Cholasta2012-01-023-4/+38
| | | | | | | | | Add new class "cachedproperty" for creating property-like attributes that cache the return value of a method call. Also fix few issues in the unit tests to enable them to succeed. ticket 1959
* Reload UI on server upgrade.Endi Sukma Dewata2011-12-211-0/+3
| | | | | | | | | | The JSON server has been modified to return the version number in all responses. The UI has been modified to keep the version obtained during env operation and check the version returned in subsequent operations. If the version changes the UI will reload itself. Ticket #946
* Require an HTTP Referer header in the server. Send one in ipa tools.Rob Crittenden2011-12-122-0/+20
| | | | | | | | | | This is to prevent a Cross-Site Request Forgery (CSRF) attack where a rogue server tricks a user who was logged into the FreeIPA management interface into visiting a specially-crafted URL where the attacker could perform FreeIPA oonfiguration changes with the privileges of the logged-in user. https://bugzilla.redhat.com/show_bug.cgi?id=747710
* User-add random password supportOndrej Hamada2011-12-121-0/+36
| | | | | | | | | | | | | | | | | | | | | | I've used code from ipalib/plugins/host.py to add support for random password generation. The '--random' option is now available in user-add and user-mod commands. If both the 'password' and 'random' options are used the 'random' option will be ignored. Two test cases were added to unit test's module test_user_plugin.py - they test creating and modifying user with random password. Two fuzzy tests were added: test for password(string that doesn't start or end with whitespace and doesn't containt other whitespace than ' ') and for whatever string(because of krbextradata). I've slightly modified ipa_generate_password in order to make passwords for users more user-friendly(reduce number of non-letters). It has two optional parameters now - first one is string of characters that should be used for generating the passwd and second one is length of password. If none parameter is set default values will be used so there's no need to modify other plugins that use random password generator. https://fedorahosted.org/freeipa/ticket/1979
* Add SELinux user mapping framework.Rob Crittenden2011-12-095-1/+506
| | | | | | | | This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
* Fixed I18n labels for HBAC TestEndi Sukma Dewata2011-12-071-0/+10
| | | | | | | Hard-coded labels in HBAC Test have been moved into internal.py to allow translation. Ticket #388
* Added commands into metadata.Endi S. Dewata2011-12-062-5/+64
| | | | | | | | | The json_metadata command has been modified to accept some new options and return the commands metadata. The API.txt has been updated as well. The UI has been modified to use commands metadata instead of methods metadata. Ticket #388
* Mark some attributes required to match the schema.Rob Crittenden2011-12-053-10/+23
| | | | | | | | | This makes no changes to the functionality in the command-line or GUI because these all have defaults anyway. This is mostly to show them properly in the UI and prevent someone from trying to erase the value (and getting a nasty schema error in response). https://fedorahosted.org/freeipa/ticket/2015
* Sort password policy by priorityOndrej Hamada2011-12-012-3/+22
| | | | | | | | | | | | | | | | | 'ipa pwpolicy-find' output is now sorted by priority of the policies. Lower position means lower priority. Global policy is then at the bottom. The changes has also affected LDAPSearch class in baseldap.py: LDAPSearch class sorts the search results by primary key be default (which is usually 'cn'). Therefor a function pointer entries_sortfn was added. If no sorting function exists, default sorting by primary key is used. Sorting function had to be introduced due to the fact that pwpolicy's primary key is also it's 'cn' and global policy is not allowed to have any priority. https://fedorahosted.org/freeipa/ticket/2045
* Fix config migration optionMartin Kosek2011-11-301-5/+0
| | | | | | | Make sure that --enable-migration in config plugin works correctly and user can use to both enable and disable migration. https://fedorahosted.org/freeipa/ticket/2150
* Restore default log level in server to INFOJohn Dennis2011-12-011-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The default log level for server messages captured by httpd's error_log historically was INFO. The log_manager patch had it set to ERROR, this patch resets it back to INFO. Although it would have been trival to set the default_level to INFO in IPALogManager.configure_from_env() that is not logically the correct place. It would be much better if the default_level can be reset by simply assigning it to the log_mgr. To accomplish that LogManager.default_level was converted to a property with a getter and setter. The setter runs LogManager.apply_configuratin() after the default_level is modified. LogManager.set_default_level() was also added to allow simultaneously updating the configure_state. While testing some minor problems were observed and also fixed: * Removed some print statement which had been left in by mistake * Removed the ability to set the handler level in the config file because of chicken-and-egg issues of when handlers get created. The Env config file format is too inflexible to support detailed logging configuration. If the Env config format is ever made more flexible we can come back and add this back in. The handler config setting in Env had never been used and never worked so there is no issue in removing it.
* Parse comma-separated lists of values in all parameter types. This can be ↵Jan Cholasta2011-11-3013-99/+112
| | | | | | | | | | | | | enabled for a specific parameter by setting the "csv" option to True. Remove "List" parameter type and replace all occurences of it with appropriate multi-valued parameter ("Str" in most cases) with csv enabled. Add new parameter type "Any", capable of holding values of any type. This is needed by the "batch" command, as "Str" is not suitable type for the "methods" parameter. ticket 2007
* Change default DNS zone manager to hostmasterMartin Kosek2011-11-291-1/+1
| | | | | | | Change our default zone manager to hostmaster@<domain> (as per RFC 2142 recommendation). https://fedorahosted.org/freeipa/ticket/1981
* Improve zonemgr validator and normalizerMartin Kosek2011-11-292-19/+42
| | | | | | | | | | The validator has been improved to support better both SOA format (e-mail address in a domain name format, without '@') and standard e-mail format. Allow '\.' character in a SOA format encoding the standard '.' in the local-part of an e-mail. Normalization code has been moved to one common function. https://fedorahosted.org/freeipa/ticket/2053
* Add --delattr option to complement --setattr/--addattrMartin Kosek2011-11-292-122/+175
| | | | | | | | | | | | | | | | | | | | | Add a --delattr option to round out multi-valued attribute manipulation. The new option is available for all LDAPUpdate based commands. --delattr is evaluated last, it can remove any value present either in --addattr/--setattr option or in current LDAP object. --*attr processing was completely refactored and placed to one independent function available for all baseldap commands. For this purpose a missing common base class for all baseldap commands has been implemented. The new class should serve not only for --*attr processing but also for other common baseldap methods and attributes. This approach will also benefit other custom commands based neither on LDAPCreate nor LDAPUpdate. They can easily integrate --*attr option processing when needed. https://fedorahosted.org/freeipa/ticket/1929
* Add plugin framework to LDAP updates.Rob Crittenden2011-11-223-5/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | There are two reasons for the plugin framework: 1. To provide a way of doing manual/complex LDAP changes without having to keep extending ldapupdate.py (like we did with managed entries). 2. Allows for better control of restarts. There are two types of plugins, preop and postop. A preop plugin runs before any file-based updates are loaded. A postop plugin runs after all file-based updates are applied. A preop plugin may update LDAP directly or craft update entries to be applied with the file-based updates. Either a preop or postop plugin may attempt to restart the dirsrv instance. The instance is only restartable if ipa-ldap-updater is being executed as root. A warning is printed if a restart is requested for a non-root user. Plugins are not executed by default. This is so we can use ldapupdate to apply simple updates in commands like ipa-nis-manage. https://fedorahosted.org/freeipa/ticket/1789 https://fedorahosted.org/freeipa/ticket/1790 https://fedorahosted.org/freeipa/ticket/2032
* ticket 2022 - modify codebase to utilize IPALogManager, obsoletes loggingJohn Dennis2011-11-236-66/+31
| | | | | | | | | | | | change default_logger_level to debug in configure_standard_logging add new ipa_log_manager module, move log_mgr there, also export root_logger from log_mgr. change all log_manager imports to ipa_log_manager and change log_manager.root_logger to root_logger. add missing import for parse_log_level()
* Finalize plugin initialization on demand.Jan Cholasta2011-11-225-33/+126
| | | | | | | | | | | | This patch changes the way plugins are initialized. Instead of finalizing all the plugins at once, plugins are finalized only after they are accessed (currently applies to Command, Object and Attribute subclasses, only in CLI by default). This change provides significant performance boost, as only the plugins that are actually used are finalized. ticket 1336
* Clarify usage of --posix argument in group plugin.Rob Crittenden2011-11-161-2/+2
| | | | Contributed by Jérôme Fenal
* Let PublicError accept Gettext objectsMartin Kosek2011-11-161-1/+4
| | | | | | | | Make sure that PublicError does not crash when it receives Gettext/NGettext object. Instead of throwing a type error, do the translation to receive the required unicode text. https://fedorahosted.org/freeipa/ticket/2096
* Fix LDAP object parameter encodingMartin Kosek2011-11-156-32/+95
| | | | | | | | | | | | | | | Parameters in LDAP objects missed an information if they are real LDAP attributes or not. Real LDAP attributes are written to entry_attrs dictionary in plugin callbacks and are being encoded. This causes issues when plugin callbacks does not expect that the parameters values are already encoded for submission to LDAP. This patch introduces a new flag "noattribute" used to mark that a parameter is not an LDAP attribute and thus should not be encoded or added to entry_attrs. Param documentation is improved to describe the meaning of this and other Param flags or attributes. https://fedorahosted.org/freeipa/ticket/2097
* Refactored permission target section.Endi S. Dewata2011-11-141-4/+0
| | | | | | | The permission target section has been modified to use widgets to create the target selection and handle multiple fields. Ticket #2098
* Polish ipa config helpMartin Kosek2011-11-101-47/+40
| | | | | | | | | | | Remove config-mod options help from config module help to keep the option doc on one place and without unnecessary redundancy. The new format is more consistent with the rest of the plugins. Also fix several inconsistencies in the labels/doc, including: - using abbreviation when not needed - using '.' at the end of options help https://fedorahosted.org/freeipa/ticket/1906
* Fix copy/paste error in parameter description.Rob Crittenden2011-11-101-1/+1
| | | | Contributed by Jérôme Fenal
* Improve DNS record data validationMartin Kosek2011-11-102-23/+374
| | | | | | | | | | | | | Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
* Misleading Keytab fieldOndrej Hamada2011-11-104-3/+22
| | | | | | | | | | | | The 'Keytab' field in output of all 'user-*' commands was changed to 'Kerberos keys available'. In order to do this change for 'user-*' commands only, the flag 'has_keytab' had to be removed from common output parametrs in ipalib/baseldap.py. This change also affected the host.py and service.py, where the 'has_keytab' flag was added to their local output params. Both host.py and service.py holds the old field caption - 'Keytab' - because of compatibility with older clients. https://fedorahosted.org/freeipa/ticket/1961
* Fix DNS zone --allow-dynupdate option behaviorMartin Kosek2011-11-091-10/+10
| | | | | | | | | | | | --allow-dynupdate was implemented as a Flag parameter type, which is not convenient for LDAP attributes. When a DNS zone with permitted dynamic updates was modified and the --allow-dynupdate flag was not set, dynamic updates were turned off. This patch changes the option type to Bool parameter type which behaves according to user expectations when modifying the zone. https://fedorahosted.org/freeipa/ticket/2039
* Allow custom server backend encodingMartin Kosek2011-11-092-0/+39
| | | | | | | | | | | | | | Server framework does not support encoding of native Python type values stored in Param classes and sub-classes. When backend (LDAP) value encoding differs from Python type value representation user has to has to hard-code the encoders in his processing. This patch introduces a method Param.encode which is used in server context to encode native Python Param values. The new encode method is used for Bool parameter to convert native Python bool type value (True, False) to LDAP value ("TRUE", "FALSE"). https://fedorahosted.org/freeipa/ticket/2039
* Don't allow default objectclass list to be empty.Rob Crittenden2011-11-091-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/1945
generated by cgit (git 2.34.1) at 2024-09-25 23:54:53 +0000