summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix minor typosYuri Chornoivan2016-06-164-5/+5
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Increase nsslapd-db-locks to 50000Stanislav Laznicka2016-06-151-5/+10
| | | | | | | | | | Sometimes the lock table would run out of available locks. This should improve the lock table default configuration. https://fedorahosted.org/freeipa/ticket/5914 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Fixes CA always being presented as runningStanislav Laznicka2016-06-153-4/+21
| | | | | | | | | | Even after manually stopping the pki-tomcatd service instance the service's is_running() method would still return True. https://fedorahosted.org/freeipa/ticket/5898 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: do not try to start CA if not configuredFraser Tweedale2016-06-151-6/+8
| | | | | | | | The upgrade script always attempts to start the CA, even on instances where the CA is not configured. Add guards. Fixes: https://fedorahosted.org/freeipa/ticket/5958 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: fix client-side dynamic defaultsJan Cholasta2016-06-151-3/+3
| | | | | | | | Call command_defaults with properly typed arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: exclude local commandsJan Cholasta2016-06-151-8/+14
| | | | | | | | | Commands inherited from Local can't be executed remotely, so exclude them from API schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: call `execute` rather than `forward` in LocalJan Cholasta2016-06-151-0/+3
| | | | | | | | This allows properly subclassing from both Local and other Command classes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns, passwd: fix outputs of `dns_resolve` and `passwd` commandsJan Cholasta2016-06-154-4/+10
| | | | | | | | Use proper output type for the `value` output of the commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: fix empty CLI output of `env` and `plugins` commandsJan Cholasta2016-06-151-0/+24
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch, schema: use Dict instead of AnyJan Cholasta2016-06-155-17/+16
| | | | | | | | | Add new Dict parameter class and use it in the batch and command_defaults plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: generate client-side commands on demandJan Cholasta2016-06-151-7/+28
| | | | | | | | | | Instead of pre-generating all command classes from API schema on API initialization and using them as plugins, use placeholder objects which generate the classes on demand. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: initialize plugins on demandJan Cholasta2016-06-155-34/+74
| | | | | | | | | Use a new API namespace class which does not initialize plugins until they are accessed. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: allow plugins to be non-classesJan Cholasta2016-06-152-18/+53
| | | | | | | | | Allow registering any object that is callable and has `name` and `bases` attributes as a plugin. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Introduce "NTP server" roleMartin Babinsky2016-06-152-5/+14
| | | | | | | | | | | | | This makes IPA servers that publish their NTP services in LDAP searchable by `server-role-find` and `server-find` command. The list of active IPA NTP servers will be displayed in to output of `ipa config-show` command. https://fedorahosted.org/freeipa/ticket/5815 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add NTP to the list of services stored in IPA masters LDAP subtreeMartin Babinsky2016-06-155-1/+33
| | | | | | | | | | | | | | | | IPA masters can be configured as NTP servers but the status of this service can not be determined centrally from querying relevant LDAP subtree. This patch makes IPA master and replica publish the newly configured NTP service in their service container during installation. If the master was configured as NTP server, the NTP service entry will be created upon upgrade. https://fedorahosted.org/freeipa/ticket/5815 https://fedorahosted.org/freeipa/ticket/5826 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: optimize forest root LDAP filterAlexander Bokovoy2016-06-151-5/+3
| | | | | | | | | | | | | | | | | | | | | | `ipa trust-find' command should only show trusted forest root domains The child domains should be visible via ipa trustdomain-find forest.root The difference between forest root (or external domain) and child domains is that root domain gets ipaIDObject class to allow assigning a POSIX ID to the object. This POSIX ID is used by Samba when an Active Directory domain controller connects as forest trusted domain object. Child domains can only talk to IPA via forest root domain, thus they don't need POSIX ID for their TDOs. This allows us a way to differentiate objects for the purpose of 'trust-find' / 'trustdomain-find' commands. Fixes https://fedorahosted.org/freeipa/ticket/5942 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Extend caacl entityPavel Vomacka2016-06-155-4/+80
| | | | | | | | | | | There is new checkbox in adding new caacl which can set whether the ACL applies on all CAs or not. Also there is a new table with CAs on which is current ACL applied. User can add and remove CAs from this table. Part of: https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend certificate entity pagePavel Vomacka2016-06-153-5/+76
| | | | | | | | | | Add field for choosing CA when issuing new certificate. Add new item to action menu on cert details page which allows user to download the certificate as file. Part of: https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add new webui plugin - caPavel Vomacka2016-06-153-0/+97
| | | | | | | | | Whole new entity for CAs. https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* replica-install: configure key retriever before starting DogtagFraser Tweedale2016-06-151-2/+2
| | | | | | | | | | | | After installing a replica, Dogtag's Lightweight CA key retrieval fails until Dogtag is restarted, because the already-running instance doesn't pick up the changes to CS.cfg. Configure the key retriever before the instance is started. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add issuer options to cert-show and cert-findFraser Tweedale2016-06-154-4/+63
| | | | | | | | | | | | Add options to cert-show and cert-find for specifying the issuer as a DN, or a CA name. Also add the issuer DN to the output of cert-find. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update cert-request to allow specifying CAFraser Tweedale2016-06-153-6/+19
| | | | | | | | | | Add the '--ca' option to the 'ipa cert-request' command, for specifying the CA to which to direct the request. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add CA argument to ra.request_certificateFraser Tweedale2016-06-154-11/+18
| | | | | | | | | | Add the optional 'ca_id' argument to ra.request_certificate(), for passing an Authority ID to Dogtag. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update 'caacl' plugin to support lightweight CAsFraser Tweedale2016-06-154-41/+99
| | | | | | | | | | For backwards compatibility, an ACL that has no CAs and no CA category allows access to the IPA CA (host authority) only. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add IPA CA entry on install / upgradeFraser Tweedale2016-06-152-0/+38
| | | | | | | | | | | In addition to user-created lightweight CAs, CA ACLs need to be able to refer to the "main" CA. Add an entry for the IPA CA on installation and upgrade. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-1513-6/+385
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add ability to review cert request dialogPavel Vomacka2016-06-141-1/+4
| | | | | | | | | | The request dialog is not closed directly after clicking 'Issue' button, but only after successful issuing or after clicking 'Close' button. So, the user can check inputed data. https://fedorahosted.org/freeipa/ticket/5652 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Search facet can be without search fieldPavel Vomacka2016-06-141-2/+9
| | | | | | | | | Add attribute 'disable_search_field' which hides search field on search or nested_search facet. Part of: https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add server roles on topology pagePavel Vomacka2016-06-145-0/+149
| | | | | | | | | Adds new tab on topology page which shows server roles. Also extends server details page and server config page (setting of ca renewal server). https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend table facetPavel Vomacka2016-06-141-14/+57
| | | | | | | | | | There is new attribute of table facet which allows to set which column of table will be its primary key. This patch also move some code into separate method - it will be easier to overide some functionality in child classes. Part of: https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Association table can be read onlyPavel Vomacka2016-06-141-0/+3
| | | | | | | | When it is read only it does not show Add and Delete buttons. Part of: https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Use python2 for ipa cliMartin Basti2016-06-141-0/+5
| | | | | | | | | Switch 'ipa' command to py3 has been done prematurely, this commit sets python2 as interpreter for ipa cli. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Revert "Switch /usr/bin/ipa to Python 3"Martin Basti2016-06-142-12/+1
| | | | | | | | | | | | | This reverts commit 1ebd8334bc7da95f1edd64fc930e9cd6e3650534. Switch 'ipa' command to py3 has been done prematurely, thus this commit reverts it from IPA 4.3.2 and temporarily from master because it is blocker for developing of the new features. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* batch command can be used to trigger internal errors on serverFlorence Blanc-Renaud2016-06-141-3/+21
| | | | | | | | | | | | | | | In ipalib, the batch command expects a specific format for arguments. The code did not check the format of the parameters, which could trigger internal errors on the server. With this fix: - a ConversionError is raised if the arg passed to batch() is not a list of dict - the result appended to the batch results is a ConversionError if the 'params' does not contain a tuple(list,dict) https://fedorahosted.org/freeipa/ticket/5810 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* installer: index() raises ValueErrorDavid Kupka2016-06-131-2/+2
| | | | | | | | | Expecting IndexError instead of ValueError led to traceback instead of correctly reporting the error situation. https://fedorahosted.org/freeipa/ticket/5945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* installer: positional_arguments must be tuple or list of stringsDavid Kupka2016-06-131-1/+1
| | | | | | | | | Setting string here was causing search for substring instead of search for value in tuple or list. https://fedorahosted.org/freeipa/ticket/5945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Server Roles: provide an API for setting CA renewal masterMartin Babinsky2016-06-133-4/+26
| | | | | | | | | | | | | `ipa config-mod` gained '--ca-renewal-master' options which can be used to set CA renewal master to a different server. Obviously, this server has to have CA role enabled. https://fedorahosted.org/freeipa/ticket/5689 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make *config-show consume relevant roles/attributesMartin Babinsky2016-06-135-6/+117
| | | | | | | | | | | | | | | | | | | | | This patch modifies config objects so that the roles/attributes relevant to the configuration are shown in the output: * config-{show,mod} will show list of all IPA masters, CA servers and CA renewal master * dnsconfig-{show,mod} will list all DNS server and DNS key master * trustconfig-{show,mod} will list all AD trust controllers and agents * vaultconfig-show will list all Key Recovery Agents http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make server-{show,find} utilize role informationMartin Babinsky2016-06-133-7/+78
| | | | | | | | | | | | | | | server-show command will now display list of roles enabled on the master (unless `--raw` is given). server-find gained `--servroles` options which facilitate search for server having one or more enabled roles. http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: public API for server rolesMartin Babinsky2016-06-133-2/+205
| | | | | | | | | | | | | | | | | | | This patch implements the `serverroles` API plugin which introduces the following commands: * server-role-show SERVER ROLE: show status of a single role on a server * server-role-find [--server SERVER [--role SERVROLE [--status=STATUS]]]: find role(s) SERVROLE and return their status on IPA masters. If --server option is given, the query is limited to this server. --status options filters the output by status [enabled vs. configurer vs. absent] https://fedorahosted.org/freeipa/ticket/5181 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Test suite for `serverroles` backendMartin Babinsky2016-06-131-0/+745
| | | | | | | | | | | Tests retrieving roles/attributes and setting server attributes in various scenarios. https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: Backend plugin to query roles and attributesMartin Babinsky2016-06-131-0/+149
| | | | | | | | | | | | | | `serverroles` backend consumes the role/attribute instances defined in `ipaserver/servroles.py` module to provide low-level API for querying role/attribute status in the topology. This plugin shall be used to implement higher-level API commands. https://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: definitions of server roles and attributesMartin Babinsky2016-06-131-0/+586
| | | | | | | | | | | | | | | | This patch introduces classes which define the properties of server roles and attributes and their relationship to LDAP attributes representing the role/attribute. A brief documentation about defining and using roles is given at the beginning of the module. http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* v2 - avoid crash in topology plugin when host list contains host with no ↵Ludwig Krispenz2016-06-131-1/+10
| | | | | | | | | | | hostname ticket #5928 prevent a crash when dereferncing a NULL hostnam, log an error to help debugging fix an incorrect order of statement when freeing a host list Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Fix: Local variable s_indent might be referenced before definedMartin Basti2016-06-131-0/+1
| | | | | | | | | Sanity fix to make sure we do not hit UnboundLocalError and fail terribly https://fedorahosted.org/freeipa/ticket/5921 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Correct a jslint warningPavel Vomacka2016-06-131-1/+1
| | | | | | | | | This patch removes comma at the end of list, just because of jslint warning. It does not have any impact on functionality. https://fedorahosted.org/freeipa/ticket/5937 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: support external flag to trust-addAlexander Bokovoy2016-06-111-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5904 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: show UPN suffixes in trust propertiesAlexander Bokovoy2016-06-112-1/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/5937 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-118-73/+142
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: support GSSAPI authentication to LDAP as Active Directory userAlexander Bokovoy2016-06-103-0/+29
| | | | | | | | | | | | | | | In case an ID override was created for an Active Directory user in the default trust view, allow mapping the incoming GSSAPI authenticated connection to the ID override for this user. This allows to self-manage ID override parameters from the CLI, for example, SSH public keys or certificates. Admins can define what can be changed by the users via self-service permissions. Part of https://fedorahosted.org/freeipa/ticket/2149 Part of https://fedorahosted.org/freeipa/ticket/3242 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 05:27:48 +0000