summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Turn verify_host_resolvable() into a wrapper around ipapython.dnsutilPetr Spacek2016-05-303-61/+72
| | | | | | | | | | | | | The code was duplicate and less generic anyway. As a side-effect I had to re-wrap dns.exception.DNSException into a PublicError so it can be displayed to the user. DNSError is now a super class for other DNS-related errors. Errors from DNS resolver are re-raised as DNSResolverError. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move IP address resolution from ipaserver.install.installutils to ↵Petr Spacek2016-05-303-25/+76
| | | | | | | | | | | ipapython.dnsutil This is to make it reusable from other modules and to avoid future code duplication. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use root_logger for verify_host_resolvable()Petr Spacek2016-05-308-14/+16
| | | | | | | | | | After discussion with Martin Basti we decided to standardize on root_logger with hope that one day we will use root_logger.getLogger('module') to make logging prettier and tunable per module. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move check_zone_overlap() from ipapython.ipautil to ipapython.dnsutilPetr Spacek2016-05-306-42/+44
| | | | | | | | | This is preparatory work to avoid (future) cyclic import between ipapython.dnsutil and ipapython.ipautil. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Warn if forwarding policy conflicts with automatic empty zonesPetr Spacek2016-05-303-0/+57
| | | | | | | | | | | | | | | | | | Forwarding policy "first" or "none" may conflicts with some automatic empty zones. Queries for zones specified by RFC 6303 will ignore forwarding and recursion and always result in NXDOMAIN answers. This is not detected and warned about. Global forwarding is equivalent to forward zone ".". Example: Forward zone 1.10.in-addr.arpa with policy "first" will not forward anything because BIND will automatically prefer automatic empty zone "10.in-addr.arpa." which is authoritative. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* test_ipaserver.test_ldap: Adjust tests to Python 3's KeyViewPetr Viktorin2016-05-301-4/+16
| | | | | | | | | | | In Python 3, the keys() method of mappings returns a KeyView object that reflects the mapping's state. In LDAPEntry, this means that the collection returned by keys() is case-insensitive and supports aliases. Part of the fix for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaldap: Convert dict items to list before iteratingPetr Viktorin2016-05-301-1/+1
| | | | | | | | | In Python 3, dict.items() returns a view. When such a view is iterated over, the dict cannot change size. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* test_ipaserver.test_ldap: Use bytestrings for raw LDAP valuesPetr Viktorin2016-05-301-10/+10
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform.redhat: Use bytestrings when calling rpm.so for version comparisonPetr Viktorin2016-05-301-2/+6
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* test_rpcserver: Expect updated error message under Python 3Petr Viktorin2016-05-301-1/+4
| | | | | | | | | Python 3's JSON module provides line number information in its parsing error. Update the test to expect this. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* test_topology_plugin: Don't rely on order of an attribute's valuesPetr Viktorin2016-05-301-1/+1
| | | | | | | | | | | Order of Python dicts/sets was always unreliable, but in Python 3 it's usually different every time. This affects the order in which values of a LDAP attribute appear. LDAP values are also specified to be unordered. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipapython.secrets.kem: Use ConfigParser from six.movesPetr Viktorin2016-05-301-2/+2
| | | | | | | | | In Python 3, the module name changed from 'ConfigParser' to 'configparser'. Use the appropriate location from six. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaldap: Keep attribute names as text, not bytesPetr Viktorin2016-05-301-2/+2
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added some attributes to Modify Users permissionStanislav Laznicka2016-05-292-4/+5
| | | | | | | | | Added 'employeenumber', 'departmentnumber' and 'mail' to Modify Users permission https://fedorahosted.org/freeipa/ticket/5911#comment:2 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Migrate from #ifndef guards to #pragma onceNathaniel McCallum2016-05-2914-54/+14
| | | | | | | | | | | | Using a pragma instead of guards is easier to write, less error prone and avoids name clashes (a source of very subtle bugs). This pragma is supported on almost all compilers, including all the compilers we care about: https://en.wikipedia.org/wiki/Pragma_once#Portability. This patch does not change the autogenerated files: asn1/asn1c/*.h. Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add missing CA options to the manpage for ipa-replica-installFlorence Blanc-Renaud2016-05-281-1/+34
| | | | | | | | | | CA-less options were missing, as well as --allow-zone-overlap and --auto-reverse. Fix short option for --realm which was displayed as -d instead of -r. https://fedorahosted.org/freeipa/ticket/5835 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Added pyusb as a dependencyStanislav Laznicka2016-05-281-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5886 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix pylint false positive errorsMartin Basti2016-05-271-0/+2
| | | | | | | | | pylint 1.5 reports 'kw' as 'no-member' for PublicError and PublicMessage. It is false positive in both cases. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable authentication indicators for OTP and RADIUSNathaniel McCallum2016-05-261-2/+8
| | | | | | | | | If the user is configured for OTP or RADIUS authentication, insert the relevant authentication indicator. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Return password-only preauth if passwords are allowedNathaniel McCallum2016-05-261-4/+2
| | | | | | | | | | Before this patch, if either password or password+otp were permitted, only the otp preauth mech would be returned to the client. Now, the client will receive either enc_ts or enc_chl in addition to otp. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Ensure that ipa-otpd bind auths validate an OTPNathaniel McCallum2016-05-263-6/+15
| | | | | | | | | | | | | | | | | | | | | | Before this patch, if the user was configured for either OTP or password it was possible to do a 1FA authentication through ipa-otpd. Because this correctly respected the configuration, it is not a security error. However, once we begin to insert authentication indicators into the Kerberos tickets, we cannot allow 1FA authentications through this code path. Otherwise the ticket would contain a 2FA indicator when only 1FA was actually performed. To solve this problem, we have ipa-otpd send a critical control during the bind operation which informs the LDAP server that it *MUST* validate an OTP token for authentication to be successful. Next, we implement support for this control in the ipa-pwd-extop plugin. The end result is that the bind operation will always fail if the control is present and no OTP is validated. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Rename syncreq.[ch] to otpctrl.[ch]Nathaniel McCallum2016-05-264-13/+13
| | | | | | | | | | | | This gives us a place to handle all OTP related controls. Also, genericize otpctrl_present() so that the OID can be specified as an argument to the function call. These changes are preparatory for the subsequent patches. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com>
* Remove unused variables in automount pluginMartin Basti2016-05-261-8/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Upgrade: always start CAMartin Basti2016-05-251-0/+11
| | | | | | | | | | | Some CA upgrade steps in upgrader requires running CA. We have to always start CA and wait for running status using http, because systemd may return false positive result that CA is running even if CA is just starting and unable to serve. https://fedorahosted.org/freeipa/ticket/5868 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* frontend: allow commands to have an argument named `name`Jan Cholasta2016-05-251-4/+4
| | | | | | | | | Rename the `name` argument of Command.get_default_of to `_name` to avoid conflicts with keyword arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: use relative imports for cross-plugin importsJan Cholasta2016-05-2543-76/+76
| | | | | | | | | This will make it possible to move the plugin modules between ipalib, ipaclient and ipaserver without having to change the imports. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: copy arguments of client commands from server counterpartsJan Cholasta2016-05-253-61/+89
| | | | | | | | | | | | | Copy arguments of vault_{add,mod,archive,retrieve} from vault_{add,mod,archive,retrieve}_internal. Also add missing LDAPCreate arguments to vault_add_internal. This will make it possible to move the commands to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: move client-side code to the module levelJan Cholasta2016-05-251-94/+96
| | | | | | | | | | | Move client-side code from the vault class to module-level functions. This will make it possible to move the code to ipaclient without the vault class bits. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* otptoken_yubikey: fix otptoken_add_yubikey argumentsJan Cholasta2016-05-253-37/+46
| | | | | | | | Copy args, options and output of otptoken_add_yubikey from otptoken_add. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* otptoken: fix import of DNJan Cholasta2016-05-251-1/+2
| | | | | | | | | | Import DN from ipapython.dn rather than ipalib.plugins.baseldap. This will make it possible to move otptoken_sync to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: do not rely on server data structures in code called on clientJan Cholasta2016-05-253-50/+86
| | | | | | | | | | | | | | | | Replace code which references the DNSRecord and dnsrecord classes with equivalent code which uses only generic data structures. This will make it possible to move client code to ipaclient without dnsrecord bits, DNSRecord and all its subclasses. The conversion from record value to structured record can't be done on the client without DNSRecord and subclasses. Introduce a new internal command dnsrecord_split_parts to do the job on the server when necessary. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: move code called on client to the module levelJan Cholasta2016-05-251-120/+130
| | | | | | | | | | | | Move DNSRecord and dnsrecord code called on client to module-level functions. This will make it possible to move the code to ipaclient without the DNSRecord and dnsrecord class bits. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* automount: do not inherit automountlocation_import from LDAPQueryJan Cholasta2016-05-251-1/+8
| | | | | | | | | | | | automountlocation_import is a client-side command which does not use LDAP directly. Inherit it from Command rather than LDAPQuery and copy its arguments from automountlocation_show. This will make it possible to move automountlocation_import to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: move the interactive_prompt callback type to CommandJan Cholasta2016-05-252-37/+10
| | | | | | | | | | | | Move interactive_prompt callback type from baseldap.BaseLDAPCommand to Command. This will make it possible to move all interactive_prompt callbacks to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: merge baseldap.CallbackRegistry into CommandJan Cholasta2016-05-253-58/+63
| | | | | | | | Also make it possible for subclasses to introduce new callback types. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: switch API to Registry-based plugin discoveryJan Cholasta2016-05-253-82/+62
| | | | | | | | | | | | | Merge Registrar into Registry. Use the Registry instance of each plugin module to discover plugins in the module instead of the global Registrar instance. This removes the side-effect of all plugins in a module being re-registered every time the module is imported. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: remove the unused deprecated API.register methodJan Cholasta2016-05-251-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: fix incorrect API.register calls in docstringsJan Cholasta2016-05-255-31/+31
| | | | | | | | | | | | Use API.add_plugin to load specific plugins into API objects. Use Registry to register plugins. This fixes doctests. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5115 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: migrate all plugins to Registry-based registrationJan Cholasta2016-05-2519-81/+99
| | | | | | | | Do not use the deprecated API.register method. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: replace API.import_plugins with new API.add_packageJan Cholasta2016-05-253-35/+34
| | | | | | | | | | | | | | | Replace API.import_plugins with a new method API.add_package which allows loading plugin packages into an API object from a package object. This makes loading of plugin packages loading consistent with loading of plugin modules and classes. Rename API.modules to API.packages and use package objects where implemented to reflect the change. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* makeaci: load additional plugins using API.add_moduleJan Cholasta2016-05-251-2/+7
| | | | | | | | | Load the ldap2 and update_managed_permissions modules using API.add_module rather than API.import_plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: remove the unused `csv` argument of ParamJan Cholasta2016-05-2519-61/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* makeapi: optimize API.txtJan Cholasta2016-05-254-4607/+4668
| | | | | | | | | | | | | | | | | | | | Change Param formatting to: * always use quantified names rather than the `required` and `multivalue` kwargs, * ignore kwargs with default value, * ignore kwargs related to validation, as validation is now strictly server-side, * ignore the `attribute` and `primary_key` kwargs, as they are relevant only on object params, * ignore the `include` and `exclude` kwargs, as makeapi takes into account only params available in the 'cli' context, * ignore the unused `csv` kwarg. Format optional Output arguments as kwargs. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not forward argument defaults to serverJan Cholasta2016-05-252-2/+5
| | | | | | | | | | | When forwarding a command call to a server, use only arguments which were explicitly specified by the caller. This increases compatibility between new clients and old servers. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* user: do not assume the preserve flags have value in user_delJan Cholasta2016-05-251-5/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not forward unspecified positional arguments to serverJan Cholasta2016-05-251-1/+14
| | | | | | | | | When forwarding a command call to a server, do not use a value of None in place of unspecified positional arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: make optional positional command arguments actually optionalJan Cholasta2016-05-2513-23/+44
| | | | | | | | | Fix several plugins not to assume optional positional arguments have a value of None when not specified. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch: do not crash when no argument is specifiedJan Cholasta2016-05-251-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: perform argument value validation only on serverJan Cholasta2016-05-253-5/+16
| | | | | | | | | | | | | | | | Do not validate values of command arguments on the client and let the server handle validation. This will make the client more lightweight by not having it to carry validation code and metadata with itself for the price of increasing network traffic in case the validation fails. Types of the arguments are still validated on both the client and the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: remove the unused Command.soft_validate methodJan Cholasta2016-05-252-43/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-27 07:06:54 +0000