summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix incorrect check for principal type when evaluating CA ACLsMartin Babinsky2016-07-011-1/+3
| | | | | | | | This error prevented hosts to request certificates for themselves. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Become IPA 4.4.0Petr Vobornik2016-07-011-1/+1
|
* IPA 4.4.0 TranslationsMartin Basti2016-07-0122-2718/+3786
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow unexpiring passwordsDavid Kupka2016-07-015-12/+33
| | | | | | | | | | Treat maxlife=0 in password policy as "never expire". Delete krbPasswordExpiration in user entry when password should never expire. https://fedorahosted.org/freeipa/ticket/2795 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3Fraser Tweedale2016-07-012-4/+12
| | | | | | | | | | | | | | ipa-server-upgrade from pre-lightweight CAs version fails when Dogtag is also being upgraded from pre-lightweight CAs version, because Dogtag needs to be restarted after adding the lightweight CAs container, before requesting information about the host authority. Move the addition of the Dogtag lightweight CAs container entry a bit earlier in the upgrade procedure, ensuring restart. Fixes: https://fedorahosted.org/freeipa/ticket/6011 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix internal errors in host-add and other commands caused by DNS resolutionPetr Spacek2016-07-013-78/+96
| | | | | | | | | | | | | | | | | | Previously resolver was returning CheckedIPAddress objects. This internal server error in cases where DNS actually returned reserved IP addresses. Now the resolver is returning UnsafeIPAddress objects which do syntactic checks but do not filter IP addresses. From now on we can decide if some IP address should be accepted as-is or if it needs to be contrained to some subset of IP addresses using CheckedIPAddress class. This regression was caused by changes for https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused is_local(), interface, and defaultnet from CheckedIPAddressPetr Spacek2016-07-011-9/+0
| | | | | | | | All these were unused so I'm removing them to keep the code clean and easier to read. At this point it is clear that only difference between netaddr.IPAddress and CheckedIPAddress is prefixlen attribute. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Bump SSSD version in requiresMartin Basti2016-07-012-3/+3
| | | | | | | | | This is required by commit aa734da49440c5d12c0f8d4566505adaeef254e8 for function sss_nss_getnamebycert() https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* schema: Perform the check for schema update when force_schema_check is TrueDavid Kupka2016-07-011-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add --cn option to cert-statusFraser Tweedale2016-07-013-11/+12
| | | | | | | | | Add the 'cacn' option to the cert-status command. Right now there is nothing we need to (or can) do with it, but we add it anyway for future use. Fixes: https://fedorahosted.org/freeipa/ticket/5999 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add widget for kerberos aliases to service pagePavel Vomacka2016-07-011-5/+12
| | | | | | | | | Also changes the name of option which is send during adding new service from 'krbprincipalname' to 'krbcanonicalname'. https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add widget for kerberos aliases to hosts pagePavel Vomacka2016-07-011-1/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add widget for kerberos aliases to user pagePavel Vomacka2016-07-011-1/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add widgets for kerberos aliasesPavel Vomacka2016-07-013-0/+120
| | | | | | | | Create own custom_command_multivalued_widget for kerberos aliases. https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Set default confirmation button label to 'Remove'Pavel Vomacka2016-07-011-1/+2
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/5831 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Change error handling in custom_command_multivalued_widgetPavel Vomacka2016-07-011-3/+11
| | | | | | | | | | | The custom_command_multivalued_widget now handles remove and add commands errors correctly and shows error message. Part of: https://fedorahosted.org/freeipa/ticket/5381 add_error Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Unify display of principal names/aliases across entitiesMartin Babinsky2016-07-0111-17/+57
| | | | | | | | | | | | Since now users, hosts, and service all support assigning multiple principal aliases to them, the display of kerberos principal names should be consistent across all these objects. Principal aliases and canonical names will now be displayed in all add, mod, show, and find operations. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Provide API for management of host, service, and user principal aliasesMartin Babinsky2016-07-018-42/+299
| | | | | | | | | | | | | | | | | | | | | | | | | | New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...]) were added to manage principal aliases. 'add' commands will check the following: * the correct principal type is supplied as an alias * the principals have correct realm and the realm/alternative suffix (e.g. e-mail) do not overlap with those of trusted AD domains If the entry does not have canonical principal name, the first returned principal name will be set as one. This is mostly to smoothly operate on entries created on older servers. 'remove' commands will check that there is at least one principal alias equal to the canonical name left on the entry. See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases https://fedorahosted.org/freeipa/ticket/1365 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make framework consider krbcanonicalname as service primary keyMartin Babinsky2016-07-013-20/+97
| | | | | | | | | | | | | | The framework does not allow single param to appear as both positional argument and option in a single command, or to represent two different positional arguments for that matter. Since principal aliases shall go to krbprincipalname attribute, the framework has to be tricked to believe krbcanonicalname is the service's primary key. The entry DN stored in LDAP remains the same. https://fedorahosted.org/freeipa/ticket/1365 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow for commands that use positional parameters to add/remove attributesMartin Babinsky2016-07-017-41/+90
| | | | | | | | | | | | | | | Commands that modify a single multivalued attribute of an entry should use positional parameters to specify both the primary key and the values to add/remove. Named options are redundant in this case. The `--certificate option` of `*-add/remove-cert` commands was turned mandatory to avoid EmptyModlist when it is omitted. https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replace an ACI relying on presence of deprecated objectclassMartin Babinsky2016-07-011-1/+2
| | | | | Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ACI for admins to modify principal attributesMartin Babinsky2016-07-011-0/+2
| | | | | | | | | | | | This is required for admins to utilize the APIs that enable them to add/remove principal aliases to entities. https://fedorahosted.org/freeipa/ticket/3864 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migrate management framework plugins to use Principal parameterMartin Babinsky2016-07-0112-239/+213
| | | | | | | | | | | | All plugins will now use this parameter and common code for all operations on Kerberos principals. Additional semantic validators and normalizers were added to determine or append a correct realm so that the previous behavior is kept intact. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: introduce Principal parameterMartin Babinsky2016-07-016-1/+54
| | | | | | | | | | | This patch introduces a separate Principal parameter that allows the framework to syntactically validate incoming/outcoming principals by using a single shared codebase. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Test suite for `ipapython/kerberos.py`Martin Babinsky2016-07-011-0/+137
| | | | | | | | | Low-level unittests checking the correctness principal parsing. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipapython module for Kerberos principal manipulation and parsingMartin Babinsky2016-07-011-0/+208
| | | | | | | | | | | | This module implements a shared codebase to handle various types of Kerberos principal names encountered during management of users, hosts nad services. Common codebase aims to replace various ad-hoc functions and routines scattered along the management framework. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client: add support for pre-schema serversJan Cholasta2016-07-01198-105/+139695
| | | | | | | | | | | | | | | Bundle remote plugin interface definitions for servers which lack API schema support. These server API versions are included: * 2.49: IPA 3.1.0 on RHEL/CentOS 6.5+, * 2.114: IPA 4.1.4 on Fedora 22, * 2.156: IPA 4.2.0 on RHEL/CentOS 7.2 and IPA 4.2.4 on Fedora 23, * 2.164: IPA 4.3.1 on Fedora 23. For servers with other API versions, the closest lower API version is used. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: do not crash when overriding remote command as methodJan Cholasta2016-07-012-8/+21
| | | | | | | | | Do not crash during API initialization when overriding remote command that is not a method with MethodOverride. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: Decrease schema TTL to one hourDavid Kupka2016-07-011-1/+4
| | | | | | | | | | Since checking schema is relatively cheap operation (one round-trip with almost no data) we can do it offten to ensure schema will fetched by client ASAP after it was updated on server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Do not log to file in remote conncheck sideMartin Basti2016-07-011-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add option --no-log for ipa-replica-conncheck scriptMartin Basti2016-07-011-1/+3
| | | | | | | | When option is sued, ipa-replica-conncheck will not log into file https://fedorahosted.org/freeipa/ticket/5757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Do not log error when removing a non-existing fileFlorence Blanc-Renaud2016-07-011-4/+11
| | | | | | | | | When the uninstaller tries to remove /etc/systemd/system/httpd.d/ipa.conf and the file does not exist, only log to debug instead of error. https://fedorahosted.org/freeipa/ticket/6012 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix migration from pre-lightweight CAs masterFraser Tweedale2016-07-011-1/+30
| | | | | | | | | Some container objects are not added when migrating from a pre-lightweight CAs master, causing replica installation to fail. Make sure that the containers exist and add an explanatory comment. Fixes: https://fedorahosted.org/freeipa/ticket/5963 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Split CA replica installation steps for domain level 0Fraser Tweedale2016-07-011-1/+6
| | | | | | | | | | | Installation from replica file is broken because lightweight CA replication setup is attempted before Kerberos is set up. To fix the issue, explicitly execute step 1 before Kerberos setup, and step 2 afterwards. Part of: https://fedorahosted.org/freeipa/ticket/5963 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* webui: prevent infinite reload for users with krbbprincipal alias setPetr Vobornik2016-07-011-1/+5
| | | | | | | | | | | | | | | | | | Web UI has inbuilt mechanism to reload in case response from a server contains a different principal than the one loaded during Web UI startup. see rpc.js:381 With kerberos aliases support the loaded principal could be different because krbprincipalname contained multiple values. In such case krbcanonicalname should be used - it contains the same principal as the one which will be in future API responses. https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix minor typoYuri Chornoivan2016-07-011-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add --ca option to cert-revoke and cert-remove-holdFraser Tweedale2016-07-013-21/+40
| | | | | | | | | | | | | | Implement the --ca option for cert-revoke and cert-remove-hold. Defaults to the IPA CA. Raise NotFound if the cert with the given serial was not issued by the nominated CA. Also default the --ca option of cert-show to the IPA CA. Add commentary to cert-status to explain why it does not use the --ca option. Fixes: https://fedorahosted.org/freeipa/ticket/5999 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* service: Added permissions for auth. indicators read/modifyStanislav Laznicka2016-06-302-4/+4
| | | | | | | Added permissions for Kerberos authentication indicators reading and modifying to service objects. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* host: Added permissions for auth. indicators read/modifyStanislav Laznicka2016-06-302-3/+4
| | | | | | | | | Added permissions for Kerberos authentication indicators reading and modifying to host objects. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* server: exclude Local commands from RPCJan Cholasta2016-06-303-10/+23
| | | | | | | | | | Local API commands are not supposed to be executed over RPC but only locally on the server. They are already excluded from API schema, exclude them also from RPC and `batch` and `json_metadata` commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: add placeholders for required remote pluginsJan Cholasta2016-06-303-3/+78
| | | | | | | | | | | | Add placeholders for remote plugins which are required by client-side commands. They are used when the remote plugins are not available. This fixes API initialization error when the remote server does not have the plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: ignore override errors in command overridesJan Cholasta2016-06-3022-43/+43
| | | | | | | | | This fixes API initialization errors when the remote server does not have the overriden command. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: add option to ignore override errorsJan Cholasta2016-06-301-13/+19
| | | | | | | | | Add new `no_fail` option to API.add_plugin. When set to True, override errors are ignored and the affected plugins are skipped. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: fix CLI output of cert_remove_holdJan Cholasta2016-06-302-9/+13
| | | | | | | | | | cert_remove_hold uses output params instead of exceptions to convey unsuccessful result. Move the output params to the client side before the command is fixed to use exceptions. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not ignore client-side output paramsJan Cholasta2016-06-301-1/+12
| | | | | | | | Do not ignore output params defined in client-side overrides. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* user: add object plugin for user_statusJan Cholasta2016-06-305-32/+50
| | | | | | | | | | | Change user_status from a method of user to a method of a new userstatus class, which defines the extra attributes returned by user_status. This fixes user_status CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* server: define missing virtual attributesJan Cholasta2016-06-3012-166/+147
| | | | | | | | | | | Move virtual attributes defined in output params of methods into params of the related object. This fixes the virtual attributes being ommited in CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Check for CA subject name collision before attempting creationFraser Tweedale2016-06-301-0/+7
| | | | | | | | | | Lightweight CA subject name collisions are prevented by Dogtag (response code 409 Conflict), however, we do not want to expose the Dogtag error. Perform the check in the IPA framework as well, raising DuplicateEntry on collision. Fixes: https://fedorahosted.org/freeipa/ticket/5981 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Fix `Conflicts` with ipa-pythonPetr Spacek2016-06-301-2/+2
| | | | | | | | | The conflicts should have constant version in it because it is related to package split. https://fedorahosted.org/freeipa/ticket/6004 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* cert-request: better error msg when 'add' not supportedFraser Tweedale2016-06-302-3/+28
| | | | | | | | | | | | cert-request supports adding service principals that don't exist. If add is requested for other principal types, the error message just says "the principal doesn't exist". Add a new error type with better error message to explain that 'add' is not supported for host or user principals. Fixes: https://fedorahosted.org/freeipa/ticket/5991 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-08 14:51:01 +0000