summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Add activate option to stage user details pagePavel Vomacka2016-04-152-1/+30
| | | | | | | | Add activate option to the action menu on stage user details page. https://fedorahosted.org/freeipa/ticket/5369 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add X-Frame-Options and frame-ancestors optionsPavel Vomacka2016-04-151-1/+3
| | | | | | | | | | These two options allow preventing clickjacking attacks. They don't allow open FreeIPA in frame, iframe or object element. https://fedorahosted.org/freeipa/ticket/4631 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* differentiate between limit types when LDAP search exceeds configured limitsMartin Babinsky2016-04-132-8/+4
| | | | | | | | | | | When LDAP search fails on exceeded limits, we should raise an specific exception for the type of limit raised (size, time, administrative) so that the consumer can distinguish between e.g. searches returning too many entries and those timing out. https://fedorahosted.org/freeipa/ticket/5677 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Look up HTTPD_USER's UID and GID during installation.David Kupka2016-03-231-2/+2
| | | | | | | | | Those values differ among distributions and there is no guarantee that they're reserved. It's better to look them up based on HTTPD_USER's name. https://fedorahosted.org/freeipa/ticket/5712 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix kdc.conf.template to use ipaplatform.paths.Timo Aaltonen2016-03-231-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use ODS_USER/ODS_GROUP in opendnssec_conf.templateTimo Aaltonen2016-03-231-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaplatform: Move remaining user/group constants to ipaplatform.constants.Timo Aaltonen2016-03-231-1/+2
| | | | | | | | | Use ipaplatform.constants in every corner instead of importing other bits or calling some platform specific things, and remove most of the remaining hardcoded uid's. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* Resize topology graph canvas according to window sizePavel Vomacka2016-03-222-4/+57
| | | | | | | | | | The size of svg element is calculated when the topology graph facet is load and then every time when the window is resized. The resize event listener is removed after the topology graph facet emits hide event. https://fedorahosted.org/freeipa/ticket/5647 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-replica-manage: print traceback on unexpected error when in verbose modeMartin Babinsky2016-03-221-5/+13
| | | | | | | | Print the traceback to stdout to maintain backwards compatibility. https://fedorahosted.org/freeipa/ticket/5380 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move user/group constants for PKI and DS into ipaplatformChristian Heimes2016-03-221-4/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Pylint: import max one module per lineMartin Basti2016-03-221-1/+2
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: fix definition of global variablesMartin Basti2016-03-221-1/+0
| | | | | | | | | | Global variables should be defined in the outer space, not just marked as global inside functions. Removes unused global variables Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-222-6/+6
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* DS deadlock when memberof scopes topology plugin updatesThierry Bordaz2016-03-181-0/+2
| | | | | | | | | | | | | | | | | Topology plugin may merge (aka DEL) segments that would trigger internal search for groups owning that segment. The problem is that it is searching those groups into the full suffix and so need the schema compat map lock. If any other operation holding schema compat map lock need to access the page involved in the DEL, there is a deadlock. This fix is to prevent useless group searching if the target entry is a segment or is in compat tree. https://fedorahosted.org/freeipa/ticket/5637 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add field for group id in user add dialogPavel Vomacka2016-03-102-2/+14
| | | | | | | | | | Add new field in user add dialog. This combo box lists all posix groups so user can choose one. It is also possible to fill a GID number which is not in the list. https://fedorahosted.org/freeipa/ticket/5505 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Nodes stay fixed after initial animation.Pavel Vomacka2016-03-101-0/+16
| | | | | | | | | | There is an animation of nodes layout after first load of graph or adding new node. Then all nodes of the graph are set to the fixed state. The node is set to fixed even after manual turn off of fixed state. https://fedorahosted.org/freeipa/ticket/5649 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add pan and zoom functionality to the topology graphPavel Vomacka2016-03-101-8/+109
| | | | | | | | | | Add zooming and panning functionality to the topology graph. Also the page rememberes the old setting of the graph position and size. So, after refreshing the graph has the same position and size as it had before. https://fedorahosted.org/freeipa/ticket/5502 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* krb5conf: use 'true' instead of 'yes' for forwardable optionMartin Basti2016-03-092-2/+2
| | | | | | | | | 'yes' is also valid value in krb5.conf but we should be consistent and use only 'true' as we do for other options. https://fedorahosted.org/freeipa/ticket/5518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-1/+1
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Configure 389ds with "default" cipher suiteMartin Basti2016-03-091-3/+3
| | | | | | | | | nsSSLCiphers: "default" provides only secure ciphers that should be used when connecting to DS https://fedorahosted.org/freeipa/ticket/5684 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* CONFIGURE: Replace obsolete macrosLukas Slebodnik2016-03-081-1/+0
| | | | | | | | | The AC_PROG_LIBTOOL macro is obsoleted by since libtool-2.0 which is already in rhel6+ https://fedorahosted.org/FedoraReview/wiki/AutoTools Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: fail nicely if cookies are disabledPetr Vobornik2016-03-031-6/+20
| | | | | | | | | | | Reworks also sessionStorage test because disablement of cookies might be connected with sessionStorage and localStorage. E.g. Chrome raises exception when *Storage is accessed with "Block sites from setting any data" settings set in "Content Settings/Cookies" section. https://fedorahosted.org/freeipa/ticket/4338 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* pylint: supress false positive no-member errorsMartin Basti2016-03-021-2/+2
| | | | | | | | | pylint 1.5 prints many false positive no-member errors which are supressed by this commit. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix URL for reporting bugs in stringsPetr Spacek2016-03-011-1/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* slapi-nis: update configuration to allow external members of IPA groupsAlexander Bokovoy2016-03-012-0/+4
| | | | | | | | | | | | | | Currently in an environment with trust to AD the compat tree does not show AD users as members of IPA groups. The reason is that IPA groups are read directly from the IPA DS tree and external groups are not handled. slapi-nis project has added support for it in 0.55, make sure we update configuration for the group map if it exists and depend on 0.55 version. https://fedorahosted.org/freeipa/ticket/4403 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-adtrust-install: Allow dash in the NETBIOS nameTomas Babej2016-02-291-2/+4
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-261-1/+1
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-254-1/+18
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-231-0/+2
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: fixed showing of success message after password change on loginPetr Vobornik2016-02-231-1/+1
| | | | | | | | | | similar issue and cause as in https://fedorahosted.org/freeipa/ticket/5567 root cause is that binding triggers validation which clears messages in validation summary. Maybe it could be refactored in a future to not use the same validation summary field for API calls and fields. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: use API call ca_is_enabled instead of enable_ra env variable.Petr Vobornik2016-02-233-1/+15
| | | | | | | | To be consistent with backend code. https://fedorahosted.org/freeipa/ticket/5622 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* replica promotion: fix AVC denials in remote connection checkJan Cholasta2016-02-111-1/+1
| | | | | | | | Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add validation to Issue new certificate dialogPavel Vomacka2016-02-022-20/+45
| | | | | | | | | 'Issue new certificate' dialog now validates whether user fills 'principal' and 'csr' field. In case that one of these fields is empty then it does not allow to submit the dialog. https://fedorahosted.org/freeipa/ticket/5432 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Automatically detect and remove dangling RUVsStanislav Laznicka2016-02-022-0/+163
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Listing and cleaning RUV extended for CA suffixStanislav Laznicka2016-02-021-15/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-011-0/+1
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix standalone installation of externally signed CA on IPA masterMartin Babinsky2016-01-281-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: remove moot error from webui buildPetr Vobornik2016-01-271-1/+2
| | | | | | | | | | add module 'libs/d3' to a list of modules provided by third party libraries it is provided by d3 library in libs directory https://fedorahosted.org/freeipa/ticket/5641 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* cert renewal: import all external CA certs on IPA CA cert renewalJan Cholasta2016-01-271-19/+9
| | | | | | | | | | Import all external CA certs to the Dogtag NSS database on IPA CA cert renewal. This fixes Dogtag not being able to connect to DS which uses 3rd party server cert after ipa-certupdate. https://fedorahosted.org/freeipa/ticket/5595 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: crash nicely if sessionStorage is not availablePetr Vobornik2016-01-272-6/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5643 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add support for the 'user' url parameter for the reset_password.htmlPavel Vomacka2016-01-271-0/+4
| | | | | | | | The /ipa/ui/reset_password.html page is now able to use url paramater 'user'. The value of this parameter is used for pre-filling the username field. https://fedorahosted.org/freeipa/ticket/5001 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add tool tips for Revert, Refresh, Undo, and Undo AllPavel Vomacka2016-01-273-0/+8
| | | | | | | | | | | | Add tool tips for buttons in detail view. New tooltips: Reload - Reload current settings from the server. Revert - Undo all unsaved changes. Undo - Undo this change. Undo all - Undo all changes in this field. https://fedorahosted.org/freeipa/ticket/5428 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)Petr Viktorin2016-01-271-3/+5
| | | | | | | | | | | | | | | | Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Exclude o=ipaca subtree from Retro Changelog (syncrepl)Martin Basti2016-01-211-0/+1
| | | | | | | | | | CA and DS have issues with Retro Changelog plugin. CA subtree should be excluded from syncrepl. This should improve speed of CA related operations too. https://fedorahosted.org/freeipa/ticket/5538 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Set close button type attribute to 'button'.James Groffen2016-01-201-0/+1
| | | | | | Stops IE10 from closing the dialog on an enter keypress. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fixed login error message box in LoginScreen pageAbhijeet Kasurde2016-01-201-4/+4
| | | | | | | | | | | Fix added for showing error message returned from server to client browser. User is now notified with proper error messages returned by server. https://bugzilla.redhat.com/show_bug.cgi?id=1293870 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: dislay server suffixes in server search pagePetr Vobornik2016-01-202-1/+12
| | | | | | | | | | | | | | There was a change where suffixes in server are not longer returned as DNs but rather a cn of related topology suffix. I.e. they share "memberof" logic. This caused that search page doesn't get the data because it uses "no_member: true" option by default. This patch overrides the behavior because it is OK for server search page to fetch also member data - it is not so costly as e.g. in users. https://fedorahosted.org/freeipa/ticket/5609 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-181-5/+5
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* IPA upgrade: move replication ACIs to the mapping tree entryMartin Babinsky2016-01-181-1/+9
| | | | | | | | | | | | | | | During IPA server upgrade from pre-4.3 versions, the ACIs permitting manipulation of replication agreements are removed from the 'cn="$SUFFIX",cn=mapping tree,cn=config' and 'cn=o\3Dipaca,cn=mapping tree,cn=config'. However they are never re-added breaking management and installation of replicas. This patch modifies the update process so that the ACIs are first added to the 'cn=mapping tree,cn=config' and then removed from the child entries. https://fedorahosted.org/freeipa/ticket/5575 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix: uninstall does not stop named-pkcs11 and ipa-ods-exporterMartin Basti2016-01-182-0/+7
| | | | | | | | | | | ipactl is not aware of new services installed later, if ipactl restart or start has not been executed. This commit is workaround, proper fix may need to improve ipactl. https://fedorahosted.org/freeipa/ticket/5262 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 16:35:01 +0000