summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* fix stageuser tests (removal of has_keytab and has_password from find)Martin Basti2016-05-051-2/+5
| | | | | | | | | User tests has been fixed, but stageuser tests was forgotten, this commit fixes it. https://fedorahosted.org/freeipa/ticket/5281 Reviewed-By: David Kupka <dkupka@redhat.com>
* Updated ipa command man pageAbhijeet Kasurde2016-05-031-7/+3
| | | | | | | | | Updated references and ipa command example in IPA man page https://fedorahosted.org/freeipa/ticket/5871 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Test fix: Cleanup for host certificateLenka Doudova2016-05-032-1/+17
| | | | | | | This fix provides means to remove certificates from host that were added during tests, but not removed. Ticket: https://fedorahosted.org/freeipa/ticket/5839 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_kdb: add krbPrincipalAuthInd handlingMatt Rogers2016-05-022-2/+174
| | | | | | | | | | Store and retrieve the authentication indicator "require_auth" string in the krbPrincipalAuthInd attribute. Skip storing auth indicators to krbExtraData. https://fedorahosted.org/freeipa/ticket/5782 Reviewed-By: Sumit Bose <sbose@redhat.com>
* spec: Add python-sssdconfig dependency for python-ipatests packageMilan Kubík2016-04-291-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5843 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-nis-manage: mention return code 3 in man pagePetr Spacek2016-04-291-0/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-nis-manage: Replace text references to compat plugin with NISPetr Spacek2016-04-291-2/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Auto-detect default value for --forward-policy option in installersPetr Spacek2016-04-286-5/+25
| | | | | | | | | | | | | Forward policy defaults to 'first' if no IP address belonging to a private or reserved ranges is detected on local interfaces (RFC 6303). Defaults to only if a private IP address is detected. This prevents problems with BIND automatic empty zones because conflicting zones cannot be disabled unless forwarding policy == only. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add function ipapython.dnsutil.inside_auto_empty_zone()Petr Spacek2016-04-281-0/+25
| | | | | | | | It allows to test if given DNS name belongs to an automatic empty zone. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use shared sanity check and tests ipapython.dnsutil.is_auto_empty_zone()Petr Spacek2016-04-281-2/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move function is_auto_empty_zone() into ipapython.dnsutilPetr Spacek2016-04-282-7/+7
| | | | | | | | | | I'm going to extend this so it is better to have it in module. At the same time it is now using shared assert_absolute_dnsname() helper. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add assert_absolute_dnsname() helper to ipapython.dnsutilPetr Spacek2016-04-281-0/+19
| | | | | | | | | Sanity check for zone names and such should be the same everywhere. This new function will be a replacement for ad-hoc checks. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move automatic empty zone list into ipapython.dnsutil and make it reusablePetr Spacek2016-04-282-53/+60
| | | | | | https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend installers with --forward-policy optionPetr Spacek2016-04-289-7/+32
| | | | | | | | | This option specified forward policy for global forwarders. The value is put inside /etc/named.conf. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove function ipapython.ipautil.host_exists()Petr Spacek2016-04-282-18/+8
| | | | | | | The function duplicated ipalib.util.verify_host_resolvable() in slightly incompatible way because it used NSS while rest of IPA is using only DNS. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Moved password check from clean_dangling_ruvStanislav Laznicka2016-04-281-10/+2
| | | | | | | | The proper password check is now done elsewhere https://fedorahosted.org/freeipa/ticket/4987 Reviewed-By: Martin Basti <mbasti@redhat.com>
* abort-clean/list/clean-ruv now work for both suffixesStanislav Laznicka2016-04-282-29/+100
| | | | | | | | | | The rid passed to abort-clean-ruv and clean-ruv is now searched for in both ipaca and domain trees as well as list-ruv now displays both RUVs and CS-RUVs https://fedorahosted.org/freeipa/ticket/4987 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-manage refactoringStanislav Laznicka2016-04-281-28/+38
| | | | | | | | | | | get_ruv does not call sys.exit anymore, instead it raises RuntimeError for better error handling Also removed duplicit code from abort_clean_ruv https://fedorahosted.org/freeipa/ticket/4987 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replica-manage: fail nicely when DM psswd requiredStanislav Laznicka2016-04-281-1/+5
| | | | | | | | | Some commands do not allow anonymous bind and would fail with misleading message. https://fedorahosted.org/freeipa/ticket/4987 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added fix for notifying user about locked user account in WebUIAbhijeet Kasurde2016-04-284-2/+24
| | | | | | | | | | | | User in now notified about "Locked User account" message instead of "The password or username you entered is incorrect" or any generic error message Fixes : https://fedorahosted.org/freeipa/ticket/5076 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* sysrestore: Iterate over a list of dict keysPetr Viktorin2016-04-281-1/+1
| | | | | | | | | | | In Python 3, dict.keys() returns a key view. It is not safe to delete dict keys when iterating over this view. Convert the keys to list first. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns plugin: Fix zone normalization under Python 3Petr Viktorin2016-04-281-1/+3
| | | | | | | | | | | | | | In Python 3, str.encode('ascii') converts to bytes, and str() (nicknamed unicode() in IPA) returns the string representation of an object, which is b'...' for bytes. So, unicode('...'.encode('ascii')) results in "b'...'". Change the code to only call encode() for the error. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Makefile: replace perl with sedPetr Spacek2016-04-281-6/+6
| | | | | | | Perl was missing in BuildRequires anyway and it is used only on one place, all other places are using sed. Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Added warning to user for Internet ExplorerAbhijeet Kasurde2016-04-281-0/+1
| | | | | | | | | | | As Internet Explorer is not a supported browser anymore, browser Kerberos configuration page shows warning to user about the same. Fixes : https://fedorahosted.org/freeipa/ticket/5656 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Tasks: raise NotImplementedError for not implemented methodsMartin Basti2016-04-261-15/+15
| | | | | | | | | | | | Is safer to raise error than trying to find what is wrong with method that is not correctly overriden The new method set_hostname has been added which should be overriden on other platforms. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Log errors from backup_and_replace hostname to loggerMartin Basti2016-04-261-2/+5
| | | | | | | | Without logging errors to logger is hard to debug issue from logfile. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove unused hostname variablesMartin Basti2016-04-261-3/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove deprecated hostname restoration from Fedora18Martin Basti2016-04-263-14/+1
| | | | | | | | This is not needed on new Fedora, because restore will not be effective. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Always set hostnameMartin Basti2016-04-266-64/+36
| | | | | | | | | | | This prevents cases when hostname on system is set inconsistently (transient and static hostname differs) and may cause IPA errors. This commit ensures that all hostnames are set properly. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Do not do extra search for ipasshpubkey to generate fingerprintsMartin Basti2016-04-266-35/+115
| | | | | | | | | | | | | | | | | | | | Host, user and idview commands do unnnecessary extra search for ipasshpubkey attribute to generate fingerprints. Note: Host and user plugins shows ipasshpubkey only when the attribute is changed, idviews show ipasshpubkey always. This behavior has been kept by this commit. common_pre/post_callbacks were fixed in [base|stage]user modules. common_callbacks requires the same arguments as pre/post_callbacks now (except baseuser_find.post_common_callback) Note2: in *-add commands there is no need for managing ipasshpubkey as this attribute should be shown always there. https://fedorahosted.org/freeipa/ticket/3376 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Performace: don't download password attributes in host/user-findMartin Basti2016-04-225-11/+11
| | | | | | | | | | | | For each entry in user/host-find was executed an extra search for password attributes what has significant impact on performance (for 2000 users there were 2000 additional searches) http://www.freeipa.org/page/V4/Performance_Improvements https://fedorahosted.org/freeipa/ticket/5281 Reviewed-By: David Kupka <dkupka@redhat.com>
* BUILD: Remove detection of libcheckLukas Slebodnik2016-04-222-12/+1
| | | | | | | | | | The unit test framework check has not been used in freeipa for long time (if ever) but there was still conditional check for this framework. It just produced confusing warning: Without the 'CHECK' library, you will be unable to run all tests in the 'make check' suite Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Configure httpd service from installer instead of directly from RPMMartin Basti2016-04-229-9/+60
| | | | | | | | | | | | | | File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add 'skip overlap check' checkbox to the add dns forward zone dialogPavel Vomacka2016-04-221-0/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5773 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add 'skip overlap check' checkbox into add zone dialogPavel Vomacka2016-04-223-0/+15
| | | | | | https://fedorahosted.org/freeipa/ticket/5773 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-client-install: fix typo in nslcd service namePetr Vobornik2016-04-221-1/+1
| | | | | | related but does not implement https://fedorahosted.org/freeipa/ticket/5806 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: Add test case for requesting a certificate with full principal.Milan Kubík2016-04-211-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5733 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipatests: fix for change_principal context managerMilan Kubík2016-04-211-9/+10
| | | | | | | | | | The context manager was leaving API object disconnected when an exception was raised inside of it. This led to resource leak in the tests. https://fedorahosted.org/freeipa/ticket/5733 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* caacl: correctly handle full user principal nameFraser Tweedale2016-04-201-2/+2
| | | | | | | | The caacl HBAC request is correct when just the username is given, but the full 'user@REALM' form was not handled correctly. Fixes: https://fedorahosted.org/freeipa/ticket/5733 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Bugfixes in managed topology testsOleg Fayans2016-04-201-3/+6
| | | | | | | Fixed a false negative related to replication taking some time: added wait_for_replication call before checking for new object in replicas. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Improve reporting of failed tests in topology test suiteOleg Fayans2016-04-201-18/+21
| | | | | | https://fedorahosted.org/freeipa/ticket/5772 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added description related to 'status' in ipactl man pageAbhijeet Kasurde2016-04-201-0/+3
| | | | | | | Fixes : https://fedorahosted.org/freeipa/ticket/5768 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Increase API version for 'ipamaxusernamelength' attribute changeMartin Basti2016-04-202-3/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5774 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica-prepare: do not add PTR records if there is no IPA managed reverse zoneMartin Babinsky2016-04-191-0/+5
| | | | | | | | | | | ipa-replica-prepare could crash during addition of replica's PTR records if there was no reverse zone managed by IPA and 'bindinstance.find_reverse_zone' returns an unhandled None. The code will now issue a warning and skip the PTR record addition in this case. https://fedorahosted.org/freeipa/ticket/5740 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Refactor test_automember_plugin, create AutomemberTrackerFilip Skola2016-04-192-1556/+945
| | | | Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
* Added fix for notifying user about Kerberos principal expiration in WebUIAbhijeet Kasurde2016-04-154-7/+34
| | | | | | | | | | | | - User is now notified about "Kerberos Principal expiration" message instead of "Wrong username or password" message. - User is also notified about "Invalid password" message instead of generic error message. https://fedorahosted.org/freeipa/ticket/5077 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add activate option to stage user details pagePavel Vomacka2016-04-153-1/+31
| | | | | | | | Add activate option to the action menu on stage user details page. https://fedorahosted.org/freeipa/ticket/5369 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add X-Frame-Options and frame-ancestors optionsPavel Vomacka2016-04-151-1/+3
| | | | | | | | | | These two options allow preventing clickjacking attacks. They don't allow open FreeIPA in frame, iframe or object element. https://fedorahosted.org/freeipa/ticket/4631 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Add test if replica is working after domain upgradeOleg Fayans2016-04-152-0/+27
| | | | | | | | | | Corresponds to the testcase described in http://www.freeipa.org/page/V4/Replica_Promotion/Test_plan#Test_case: _Replica_created_using_old_workflow_is_functional_after_domain_upgrade https://fedorahosted.org/freeipa/ticket/5723 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Limit max username length to 255 in config-modMartin Basti2016-04-151-0/+1
| | | | | | | | This value is same as is used in user and stageuser commands. https://fedorahosted.org/freeipa/ticket/5774 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-02 08:26:28 +0000