summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* account for added krbcanonicalname attribute during xmlrpc testsMartin Babinsky2016-06-237-7/+19
| | | | | | | https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* set krbcanonicalname on host entry during krbinstance configurationMartin Babinsky2016-06-231-0/+1
| | | | | | | part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* IPA API: set krbcanonicalname instead of ipakrbprincipalalias on new entitiesMartin Babinsky2016-06-235-8/+20
| | | | | | | | | | | Hosts, services, and (stage)-users will now have krbcanonicalname attribute set to the same value as krbprincipalname on creation. Moreover, new services will not have ipakrbprincipalalias set anymore. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-enrollment: set krbCanonicalName attribute on enrolled host entryMartin Babinsky2016-06-231-0/+15
| | | | | | | Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* ipa-kdb: set krbCanonicalName when creating new principalsMartin Babinsky2016-06-231-3/+1
| | | | | | | | | | Additionally, stop setting ipakrbprincipalalias attribute during principal creation. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* add krbCanonicalName to attributes watched by MODRDN pluginMartin Babinsky2016-06-231-0/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* add case-insensitive matching rule to krbprincipalname indexMartin Babinsky2016-06-232-0/+12
| | | | | | | Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* mark 'ipaKrbPrincipalAlias' attribute as deprecated in schemaMartin Babinsky2016-06-231-1/+1
| | | | | | | part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* perform case-insensitive principal search when canonicalization is requestedMartin Babinsky2016-06-231-1/+12
| | | | | | | | | | | | | When canonicalization is requested, the krbprincipalname attribute is searched for case-insensitively. In the case that krbcanonicalname is not set, the matched alias is returned with the casing stored in backend, not the one input by client. Part of https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Require Dogtag >= 10.3.3Fraser Tweedale2016-06-231-3/+3
| | | | | | | | | | Dogtag 10.3.3 fixes a lightweight CA initialisation issue that caused existing lightweight CAs to not be initialised on CA replicas on first run (see https://fedorahosted.org/pki/ticket/2359). Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Report missing certificate in external trust chainFlorence Blanc-Renaud2016-06-231-2/+3
| | | | | | | | | | | | | When ipa-server-install is called with an external CA, but the cert chain is incomplete, the command exits with the following error: ERROR CA certificate chain in <list of --external-cert-file> is incomplete The fix adds in the log the name of the missing certificate: ERROR CA certificate chain in <list of --external-cert-file> is incomplete: missing certificate with subject '<dn of the missing certificate>' https://fedorahosted.org/freeipa/ticket/5792 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Topology plugins sigsev/heap corruption when adding a managed hostroot2016-06-221-0/+1
| | | | | | | | | | | | | | | A managed host may handle several ipaReplTopoManagedSuffix. Removing (from the topology) such host, loops over the replicated suffixes array to retrieve, in the hosts list, the host record and delete it. The problem is that a variable used to manage a hosts list is not reset when looking at the next suffix. That will messup the lists, keeping freed elements in the lists. The fix is to reset the variable inside the replicated suffix loop https://fedorahosted.org/freeipa/ticket/5977 Reviewed-By: Ludwig Krispenz <lkrispen@redhat.com>
* host/service-show/find shouldn't fail on invalid certificateStanislav Laznicka2016-06-223-5/+70
| | | | | | | | | | | host/service-show/find methods would have failed if the first certificate they had in userCertificate attribute were invalid. Expected behavior is that they just show the rest of the reqested attributes. https://fedorahosted.org/freeipa/ticket/5797 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: harden check for last rolesMartin Babinsky2016-06-221-28/+34
| | | | | | | | | | | | | The current implementation of check for last CA/DNS server and DNSSec key master in `server-del` is quite fragile and wroks with quite a few assumptions which may not be always true (CA and DNS is always configured etc.). This patch hardens the check so that it does not break when the above assuptions do not hold. https://fedorahosted.org/freeipa/ticket/5960 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Become IPA 4.4.0 Alpha 1Petr Vobornik2016-06-211-3/+3
|
* Replica promotion: use the correct IPA domain for replicaMartin Basti2016-06-211-0/+29
| | | | | | | | | | | | | | | | | | IPA domain is detected from LDAP for replica promote installation. If local domain and IPA domain does not match, installer refuses to install replica. IPA versions 4.3.0 and 4.3.1 allow to specify different domain for replica. Only one IPA domain is allowed (domain used with master) and different domain may cause issues. This commit prevents to install new replica if multiple domains was used in past. User action is required to fix this issue and remove incorrect IPA domains from LDAP. https://fedorahosted.org/freeipa/ticket/5976 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Servers: Web UI partPavel Vomacka2016-06-212-0/+55
| | | | | | | | | | Adds new page with DNS Servers and details page about each server. It is counterpart of dnsserver-{find,show,mod} CLI commands. Part of: https://fedorahosted.org/freeipa/ticket/5905 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Update Developers in Contributors.txtMartin Kosek2016-06-211-0/+8
| | | | | | Add the most recent development contributors to FreeIPA. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow to set weight of a server without locationPavel Vomacka2016-06-211-1/+2
| | | | | | | | | | There was a bug when a new server was added it was not possible to set weight until a location was set. This change corrects it and allows user to set a weight of server without location. Part of: https://fedorahosted.org/freeipa/ticket/5905 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* schema: return fingerprint as unicode textDavid Kupka2016-06-211-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add DNS default TTL fieldPavel Vomacka2016-06-211-0/+1
| | | | | | | | DNS default TTL is new field on DNS Zone Settings page. WebUI counterpart of: https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: Cache schema in api instanceDavid Kupka2016-06-211-3/+11
| | | | | | | | | To avoid generating schema for every schema command call store schema in api instance when first generated and reuse it in next calls. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* schema: Add known_fingerprints option to schema commandDavid Kupka2016-06-215-3/+39
| | | | | | | | | | When client requests schema it can list fingerprints of cached schemas and server responds with SchemaUpToDate exception specifying fingeprint of schema to use. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* schema: Add fingerprint and TTLDavid Kupka2016-06-211-0/+36
| | | | | | | | | | Calculate fingerprint for schema in deterministic way. Send fingerprint value together with schema. Send TTL with schema to inform client about caching interval. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add placeholder to add segment dialogPavel Vomacka2016-06-213-0/+3
| | | | | | | | 'Autogenerated' placeholder is shown when adding new segment. https://fedorahosted.org/freeipa/ticket/5867 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add listener which opens add segment dialogPavel Vomacka2016-06-211-73/+107
| | | | | | | | | The event is emited by clicking on the second node when adding segment by mouse. The listener opens dialog and prefill values. Part of: https://fedorahosted.org/freeipa/ticket/5648 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add creating a segment using mousePavel Vomacka2016-06-212-24/+382
| | | | | | | | | | | Create new semicircles around the node after mouseover. These work as buttons to create arrow and after clicking on another node the Add topology segment dialog is opened. Also selecting segment works, if the segment already exists then the segment is selected instead of opening the dialog. https://fedorahosted.org/freeipa/ticket/5648 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* pylint: fix: multiple-statementsJan Barta2016-06-213-3/+6
| | | | Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* DNS: Fix realm domains integration with DNS zone add.Petr Spacek2016-06-211-2/+1
| | | | | | | | | | | | Realmdomains integration into DNS commands pre-dates split of DNS forward zones and DNS master zones into two distinct commands. There was an forgotten condition in dnszone_add command which caused omission of DNS master zones with non-empty forwarders from realmdomain list. https://fedorahosted.org/freeipa/ticket/5980 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend trust config pagePavel Vomacka2016-06-211-0/+10
| | | | | | | | Add list of AD trust agents and controllers to trust config page. Part of: https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend DNS config pagePavel Vomacka2016-06-211-0/+9
| | | | | | | | Add DNS servers list and DNSSEC key master to DNS config page in webui. Part of: https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make Actions string translatablePavel Vomacka2016-06-212-3/+4
| | | | | | | | Remove hardcoded strings 'Actions ' and substitute them by strings from translatable strings. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Do not update result of *-config-show with empty server attributesMartin Babinsky2016-06-211-3/+5
| | | | | | | | | | | | If a server attribute such as DNSSec Key master is unset, None is passed as the attribute value into the upper API layers and displayed in the output of `dnsconfig-show` et al. We should not show this and leave the attribute empty instead. https://fedorahosted.org/freeipa/ticket/5960 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: fix dns_update_system_records to work with thin clientJan Cholasta2016-06-214-14/+20
| | | | | | | https://fedorahosted.org/freeipa/ticket/2008 https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Updated IPA translationsMartin Basti2016-06-2123-7486/+16062
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNS: Warn about restart when default TTL setting DNS is changedPetr Spacek2016-06-211-0/+13
| | | | | | | | | bind-dyndb-ldap 10.0 has to be restarted after each change to default TTL. https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Support default TTL setting for master DNS zonesPetr Spacek2016-06-215-12/+23
| | | | | | https://fedorahosted.org/freeipa/ticket/2956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: allow search by certificateJan Cholasta2016-06-214-11/+67
| | | | | | | | | Allow search by certificate data or file in cert-find. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* cert: add owner informationJan Cholasta2016-06-213-35/+254
| | | | | | | | | | Get owner information from LDAP in cert-show and cert-find. Allow search by owner in cert-find. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* cert: add object pluginJan Cholasta2016-06-214-265/+327
| | | | | | | | | | Implement cert as an object with methods rather than a bunch of loosely related commands. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* ldap: fix handling of binary data in search filtersJan Cholasta2016-06-211-1/+6
| | | | | | | | | | This fixes a UnicodeDecodeError when passing non-UTF-8 binary data to LDAPClient.make_filter() and friends. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* restart scripts: bootstrap api with in_server=TrueFraser Tweedale2016-06-214-4/+4
| | | | | | | | renew_ca_cert fails because it cannot access the 'config' plugin. Bootstrap all the restart scripts to avoid such issues. Fixes: https://fedorahosted.org/freeipa/ticket/5968 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix possibly undefined variable in ipa_smb_conf_exists()Martin Basti2016-06-201-0/+2
| | | | | | | There was missing else statement what may result in undefined conf_fd variable. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DNS Locations: make ipa-ca record generation more robustPetr Spacek2016-06-201-1/+20
| | | | | | | | | | | | | | __add_ca_records_from_hostname() now skips over DNS exceptions and retries resolution until timeout of 120 seconds is reached. Luckily current logic fails safe: In cases where resolution failed for all the CA servers, the resulting zone object will not contain ipa-ca record at all and the update logic will skip update for this name. I.e. the original values in ipa-ca record set will be left in place. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Increased certmonger timeoutOleg Fayans2016-06-201-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5758 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Make sure ipapwd_extop takes precedence over passwd_modify_extopThierry Bordaz2016-06-203-2/+11
| | | | | | | | | | | | DS core server provides a default plugin (passwd_modify_extop) to handle 1.3.6.1.4.1.4203.1.11.1 extended op (https://www.ietf.org/rfc/rfc3062.txt) IPA delivers ipa_pwd_extop plugin that should take precedence over the default DS plugin (passwd_modify_extop) In addition make sure that slapi-nis has a low precedence Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* replica install: fix thin client regressionJan Cholasta2016-06-201-22/+28
| | | | | | | | | | | Fix a regression introduced by commit 3157eec28ff35e3c407a9552d6b59bef9891b555. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: remove `no_cli` from command schemaJan Cholasta2016-06-203-20/+15
| | | | | | | | | Instead, support excluding commands from specified contexts and exclude commands with NO_CLI set from the 'cli' context. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: remove redundant informationJan Cholasta2016-06-203-90/+23
| | | | | | | | | | | | | | | | | | | | Remove the `autofill` kwarg from param schema. On the server, include default value only if autofill is set. On the client, set autofill if param has a default value. Remove the `deprecated_cli_aliases`, `hint` and `sortorder` kwargs, and the `dnsrecord_extra`, `dnsrecord_part` and `suppress_empty` flags from param schema, as they are now handled exclusively on the client. Replace the `no_option` and `no_output` flags in param schema with exclusion of the param in 'cli' and 'webui' contexts. Remove the `no_display` flag from output schema, as it is now handled exclusively on the client. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: merge command args and optionsJan Cholasta2016-06-203-25/+17
| | | | | | | | | | Rather than having args and options separately in command schema, merge them together and use new `positional` param flag to differentiate between them. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 01:06:18 +0000