summaryrefslogtreecommitdiffstats
path: root/ipalib/messages.py
Commit message (Collapse)AuthorAgeFilesLines
* host/service-show/find shouldn't fail on invalid certificateStanislav Laznicka2016-06-221-0/+10
| | | | | | | | | | | host/service-show/find methods would have failed if the first certificate they had in userCertificate attribute were invalid. Expected behavior is that they just show the rest of the reqested attributes. https://fedorahosted.org/freeipa/ticket/5797 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: perform full master removal in managed topologyMartin Babinsky2016-06-171-1/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements most of the del_master_managed() functionality as a part of `server-del` command. `server-del` nows performs these actions: * check topology connectivity * check that at least one CA/DNS server and DNSSec masters are left after removal * cleanup all LDAP entries/attributes exposing information about the master * cleanup master DNS records * remove master and service principals * remove master entry from LDAP * check that all segments pointing to the master were removed `server-del` now accepts the following options: * `--force`: force master removal even if it doesn't exist * `--ignore-topology-disconnect`: ignore errors arising from disconnected topology before and after master removal * `--ignore-last-of-role`: remove master even if it is last DNS server, and DNSSec key master. The last CA will *not* be removed regardless of this option. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-171-0/+9
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-171-0/+9
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: server-mod: add automatic records updateMartin Basti2016-06-171-0/+10
| | | | | | | | | For any location or server weight change is required to update records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: command dns-update-system-recordsMartin Basti2016-06-171-0/+23
| | | | | | | | | | | | | | command dns-update-system-records updates/fixes DNS records for IPA services: * updating A, AAAA records for CA * updating SRV records for LDAP, kerberos and AD trust * updating TXT record in _kerberos with proper realm * updating dns locations if used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS: Warn if forwarding policy conflicts with automatic empty zonesPetr Spacek2016-05-301-0/+17
| | | | | | | | | | | | | | | | | | Forwarding policy "first" or "none" may conflicts with some automatic empty zones. Queries for zones specified by RFC 6303 will ignore forwarding and recursion and always result in NXDOMAIN answers. This is not detected and warned about. Global forwarding is equivalent to forward zone ".". Example: Forward zone 1.10.in-addr.arpa with policy "first" will not forward anything because BIND will automatically prefer automatic empty zone "10.in-addr.arpa." which is authoritative. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpc: include structured error information in responsesJan Cholasta2016-05-251-0/+7
| | | | | | | | | | | | | | Include keyword arguments of exceptions in RPC responses. This is limited to JSON-RPC, as XML-RPC does not support additional data in error responses. Include keyword arguments of messages in RPC responses. Include keyword arguments of exceptions in batch command result. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* specify type of exceeded limit when warning about truncated search resultsMartin Babinsky2016-04-131-1/+1
| | | | | | | | | API commands inheriting from LDAPSearch should mention which limit was exceeded in the warning message sent with truncated results. https://fedorahosted.org/freeipa/ticket/5677 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* host-del --updatedns: print warnings instead of errorMartin Basti2016-04-131-0/+11
| | | | | | | | When DNS records do not exist, print warnings instead of hard error https://fedorahosted.org/freeipa/ticket/5627 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* otptoken-add: improve the robustness of QR code printingMartin Babinsky2016-03-241-0/+8
| | | | | | | | | | | The python-qrcode print_ascii() method does not work in terminals with non-UTF-8 encoding. When this is the case do not render QR code but print a warning instead. Also print a warning when the QR code size is greater that terminal width if the output is a tty. https://fedorahosted.org/freeipa/ticket/5700 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Warn user if trust is brokenMartin Basti2016-02-231-0/+11
| | | | | | | | | | Detect missing ipaNTSecurityIdentifier and print message for a user, that the trust is broken as result of trust-show and trust-find commands. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Warn user when ipa *-find reach limitMartin Basti2016-01-271-0/+10
| | | | | | | | | Truncated entries were silently ignored, now a user receives warning. https://fedorahosted.org/freeipa/ticket/4022 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-111-0/+10
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Make command dns-resolve deprecated.Martin Basti2015-11-251-0/+10
| | | | | | | | | | | | | | | | | To debug DNS issues other commands should be used like 'dig', 'host', 'nslookup' instead of command 'ipa dns-resolve'. This command is executed on server side, what may not be helpful with debugging clients. 'ipa dns-resolve' command is worse copy of host command, users should use 'host' command instead. dns-resolve is removed from CLI https://fedorahosted.org/freeipa/ticket/5466 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS record-add warns when a suspicious DNS name is detectedPetr Spacek2015-11-101-0/+17
| | | | | | | | Relative name "record.zone" is being added into zone "zone.", which is probably a mistake. User probably wanted to either specify relative name "record" or use FQDN "record.zone.". Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipalib.messages: Add "message" property to PublicMessagePetr Viktorin2015-10-221-0/+5
| | | | | | | In Python 3, the "message" property was removed in favor of calling str(). Add it to PublicMessage, since IPA code depends on it. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: warn user if DNSSEC key master is not installedMartin Basti2015-10-221-0/+12
| | | | | | | | | Warning user that DNSSEC key master is not installed when commands dnszone-add, dnszone-mod, dnszone-show when option dnssec=true https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* realmdomains: Issue a warning when automated management of realmdomains failedTomas Babej2015-10-121-0/+31
| | | | | | https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-171-0/+2
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use the print functionPetr Viktorin2015-09-011-2/+3
| | | | | | | | | In Python 3, `print` is no longer a statement. Call it as a function everywhere, and include the future import to remove the statement in Python 2 code as well. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Replace uses of map()Petr Viktorin2015-09-011-1/+1
| | | | | | | | | | In Python 2, map() returns a list; in Python 3 it returns an iterator. Replace all uses by list comprehensions, generators, or for loops, as required. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Python3-compatible dict method namesPetr Viktorin2015-09-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Python 2 has keys()/values()/items(), which return lists, iterkeys()/itervalues()/iteritems(), which return iterators, and viewkeys()/viewvalues()/viewitems() which return views. Python 3 has only keys()/values()/items(), which return views. To get iterators, one can use iter() or a for loop/comprehension; for lists there's the list() constructor. When iterating through the entire dict, without modifying the dict, the difference between Python 2's items() and iteritems() is negligible, especially on small dicts (the main overhead is extra memory, not CPU time). In the interest of simpler code, this patch changes many instances of iteritems() to items(), iterkeys() to keys() etc. In other cases, helpers like six.itervalues are used. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use six.string_types instead of "basestring"Petr Viktorin2015-09-011-1/+3
| | | | | Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSSEC: Detect zone shadowing with incorrect DNSSEC signatures.Petr Spacek2015-06-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: validate forward zone forwardersMartin Basti2015-06-111-0/+12
| | | | | | | | | | Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: Improve global forwarders validationMartin Basti2015-06-111-4/+19
| | | | | | | | | | Validation now provides more detailed information and less false positives failures. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Detect and warn about invalid DNS forward zone configurationMartin Basti2015-01-151-0/+13
| | | | | | | | | Shows warning if forward and parent authoritative zone do not have proper NS record delegation, which can cause the forward zone will be ineffective and forwarding will not work. Ticket: https://fedorahosted.org/freeipa/ticket/4721 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix warning message should not contain CLI commandsMartin Basti2014-11-191-2/+2
| | | | | | | Message is now universal for both CLI and WebUI Ticket: https://fedorahosted.org/freeipa/ticket/4647 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNSSEC: validate forwardersMartin Basti2014-10-211-0/+22
| | | | | | | | | | | | Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Deprecation of --name-server and --ip-address option in DNSMartin Basti2014-09-251-0/+22
| | | | | | | | | | | | | Option --name-server is changing only SOA MNAME, this option has no more effect to NS records Option --ip-addres is just ignored A warning message is sent after use these options Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add DNSSEC experimental support warning messageMartin Basti2014-07-031-0/+10
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4408 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add warning about semantic change for zonesMartin Basti2014-07-031-0/+12
| | | | | | | | | --forwarder have different semantic since forward zones support. Add warning if zone contains forwarders. Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add client capabilities, enable messagesPetr Viktorin2013-02-211-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The API version the client sends can now be used to check what the client expects or is capable of. All version tests IPA does will be be named and listed in one module, ipalib.capabilities, which includes a function to test a specific capability against an API version. Similarly to Python's __future__ module, capabilities.py also serves as documentation of backwards-incompatible changes to the API. The first capability to be defined is "messages". Recent enough clients can accept a list of warnings or other info under the "messages" key in the result dict. If a JSON client does not send the API version, it is assumed this is a testing client (e.g. curl from the command line). Such a client "has" all capabilities, but it will always receive a warning mentioning that forward compatibility is not guaranteed. If a XML client does not send the API version, it is assumed it uses the API version before capabilities were introduced. (This is to keep backwards compatibility with clients containing bug https://fedorahosted.org/freeipa/ticket/3294) Whenever a capability is added, the API version must be incremented. To ensure that, capabilities are written to API.txt and checked by `makeapi --validate`. Design page: http://freeipa.org/page/V3/Messages Ticket: https://fedorahosted.org/freeipa/ticket/2732
* Add ipalib.messagesPetr Viktorin2013-02-211-0/+151
The messages module contains message classes that can be added to a RPC response to provide additional information or warnings. This patch adds only the module with a single public message, VersionMissing, and unit tests. Since message classes are very similar to public errors, some functionality and unit tests were shared. Design page: http://freeipa.org/page/V3/Messages Ticket: https://fedorahosted.org/freeipa/ticket/2732
generated by cgit (git 2.34.1) at 2024-06-25 20:46:23 +0000