Permission field is missing in delegation so it can't be set/modified.

It was added to delegation details facet and adder dialog.

The field is using checkboxes instead of multivalued textbox because it can have only two effective values: 'read' and 'write'.

https://fedorahosted.org/freeipa/ticket/2635

Forms-based login procedure detects if 401 unauthorized response contains
'X-IPA-Rejection-Reason' http header with 'password-expired' value. If so
it displays an error message that user needs to reset his password.

https://fedorahosted.org/freeipa/ticket/2608

Mutually exclusive checkboxes were unusual. They are not in use anymore. The functionality is removed.

https://fedorahosted.org/freeipa/ticket/2599

DNS forward policy fields were using mutually exclusive checkboxes. Such behavior is unusual for users.

Checkboxes were changed to radios.

https://fedorahosted.org/freeipa/ticket/2599

Permission form was missing attrs field for target=subtree. All other target types have it.

It uses multivalued text widget, same as filter, because we can't predict the target type.

https://fedorahosted.org/freeipa/ticket/2592

It could lead to state where attributes from other object type were displayed instead of the correct ones.

https://fedorahosted.org/freeipa/ticket/2590

This patch is changing netgroup web ui to look more like hbac or sudo rule UI. This change allows to define and display user category, host category and external host.

The core of the change is changing member attributes (user, group, host, hostgroup) to use rule_details_widget instead of separate association facets. In host case it allows to display and add external hosts.

https://fedorahosted.org/freeipa/ticket/2578

Problem:

When some facet perform action which modifies data, some other facet may become expired.

Example: User modifies group's description. Now group search facet contains old data and has to be refreshed.

Solution:

New event was added to facet: on_update. It should be executed when facet performs action which modifies data ie: details facet update or add entry to dnsrecord.

Then entity policies were introduced. Entity policies are a objects which are stored in entity.policies. They have similar function as facet_policies - performing communications and other functionality between facets. This way facets don't have to contain such logic and thus they aren't dependant on each other.

This patch adds IPA.facet_update_policy, IPA.adder_facet_update_policy, IPA.search_facet_update_policy, IPA.details_facet_update_policy.

IPA.facet_update_policy: On facets_created it bind itself to [current entity].[source facet].[event]. Default event is on_update. When the event is executed it sets expiration flag to [dest entity].[dest facet].

IPA.search_facet_update_policy: IPA.facet_update_policy where source facet = search, dest facet = details, dest entity = current entity. Its a default policy for updatein changes from search facet to details facet. Right now it isn't needed but it will be needed when action lists come to play.

IPA.details_facet_update_policy: same as IPA.search_facet_update_policy just reversed. Very important.

IPA.adder_facet_update_policy: similar functionality, just source of the event is dialog. Default event is added (new event in entity_adder_dialog).

Entity policies should be specified in entity's spec object. If none are specified a default ones are used. Default policies are: IPA.search_facet_update_policy and IPA.details_facet_update_policy.

https://fedorahosted.org/freeipa/ticket/2075

Problem:

For performance reason a facet may cache the data in browser's memory. There should be a flag to indicate whether a facet has expired and should be refreshed. The expired flag could be set by these events:

 1) any update operation
 2) changing search filter in search facet
 3) switching page in a multi-paged search/association facet
 4) switching direct/indirect view in association facet
 5) facet expiration time
A facet should be able to use these methods to refresh itself:
 6) on demand: an expired facet should be refreshed when a user opens it.
 7) automatic: an open facet should automatically refresh itself when it expires.

Solution:

This patch solves cases: #2, #3, #5, #6. Case #4 works without any change. Case #1 will be solved later. Case #7 is deffered.

Default expiration timeout was set to 10 minutes.

In this patch are also updated facet.needs_update methods to reflect changes in containing facets.

https://fedorahosted.org/freeipa/ticket/2075

Rebased patch sent by Yuri Chornoivan (yurchor@ukr.net). Fixes 'occured'
and 'commond' typos in FreeIPA messages.

https://fedorahosted.org/freeipa/ticket/2526