summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* Extend certificate entity pagePavel Vomacka2016-06-151-0/+2
| | | | | | | | | | Add field for choosing CA when issuing new certificate. Add new item to action menu on cert details page which allows user to download the certificate as file. Part of: https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add issuer options to cert-show and cert-findFraser Tweedale2016-06-152-0/+56
| | | | | | | | | | | | Add options to cert-show and cert-find for specifying the issuer as a DN, or a CA name. Also add the issuer DN to the output of cert-find. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update cert-request to allow specifying CAFraser Tweedale2016-06-151-3/+15
| | | | | | | | | | Add the '--ca' option to the 'ipa cert-request' command, for specifying the CA to which to direct the request. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add CA argument to ra.request_certificateFraser Tweedale2016-06-153-10/+17
| | | | | | | | | | Add the optional 'ca_id' argument to ra.request_certificate(), for passing an Authority ID to Dogtag. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update 'caacl' plugin to support lightweight CAsFraser Tweedale2016-06-152-36/+69
| | | | | | | | | | For backwards compatibility, an ACL that has no CAs and no CA category allows access to the IPA CA (host authority) only. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-152-1/+270
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add server roles on topology pagePavel Vomacka2016-06-141-0/+4
| | | | | | | | | Adds new tab on topology page which shows server roles. Also extends server details page and server config page (setting of ca renewal server). https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* batch command can be used to trigger internal errors on serverFlorence Blanc-Renaud2016-06-141-3/+21
| | | | | | | | | | | | | | | In ipalib, the batch command expects a specific format for arguments. The code did not check the format of the parameters, which could trigger internal errors on the server. With this fix: - a ConversionError is raised if the arg passed to batch() is not a list of dict - the result appended to the batch results is a ConversionError if the 'params' does not contain a tuple(list,dict) https://fedorahosted.org/freeipa/ticket/5810 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Server Roles: provide an API for setting CA renewal masterMartin Babinsky2016-06-131-1/+22
| | | | | | | | | | | | | `ipa config-mod` gained '--ca-renewal-master' options which can be used to set CA renewal master to a different server. Obviously, this server has to have CA role enabled. https://fedorahosted.org/freeipa/ticket/5689 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make *config-show consume relevant roles/attributesMartin Babinsky2016-06-134-4/+111
| | | | | | | | | | | | | | | | | | | | | This patch modifies config objects so that the roles/attributes relevant to the configuration are shown in the output: * config-{show,mod} will show list of all IPA masters, CA servers and CA renewal master * dnsconfig-{show,mod} will list all DNS server and DNS key master * trustconfig-{show,mod} will list all AD trust controllers and agents * vaultconfig-show will list all Key Recovery Agents http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make server-{show,find} utilize role informationMartin Babinsky2016-06-131-4/+74
| | | | | | | | | | | | | | | server-show command will now display list of roles enabled on the master (unless `--raw` is given). server-find gained `--servroles` options which facilitate search for server having one or more enabled roles. http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: public API for server rolesMartin Babinsky2016-06-131-0/+178
| | | | | | | | | | | | | | | | | | | This patch implements the `serverroles` API plugin which introduces the following commands: * server-role-show SERVER ROLE: show status of a single role on a server * server-role-find [--server SERVER [--role SERVROLE [--status=STATUS]]]: find role(s) SERVROLE and return their status on IPA masters. If --server option is given, the query is limited to this server. --status options filters the output by status [enabled vs. configurer vs. absent] https://fedorahosted.org/freeipa/ticket/5181 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: Backend plugin to query roles and attributesMartin Babinsky2016-06-131-0/+149
| | | | | | | | | | | | | | `serverroles` backend consumes the role/attribute instances defined in `ipaserver/servroles.py` module to provide low-level API for querying role/attribute status in the topology. This plugin shall be used to implement higher-level API commands. https://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: show UPN suffixes in trust propertiesAlexander Bokovoy2016-06-111-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5937 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-111-19/+50
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-101-4/+0
| | | | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Part of https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Revert "adtrust: remove nttrustpartner parameter"Martin Basti2016-06-101-0/+4
| | | | | | | | | | This reverts commit 185806432d6dfccc5cdd73815471ce60a575b073. The wrong version of patch has been pushed. https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-101-4/+0
| | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-091-14/+47
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* schema: fix topic command outputJan Cholasta2016-06-091-5/+11
| | | | | | | | | | Return topic names as text instead of binary blob. This fixes ipa help topic display. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-091-1/+1
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: do not validate unrequested params in command_defaultsJan Cholasta2016-06-091-2/+1
| | | | | | | | | | | | Request specific params when getting the defaults instead of getting defaults for all params and filtering the result. This fixes command_defaults failing with validation errors on unrequested params. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Auth Indicators WebUI partPavel Vomacka2016-06-071-2/+9
| | | | | | | | | | Add custom_checkbox_widget on service page. The old aci.attribute_widget now inherits from the new base class custom_checkboxes_widget and overrides the populate method. https://fedorahosted.org/freeipa/ticket/5872 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend the certificate request dialogPavel Vomacka2016-06-061-1/+2
| | | | | | | | | The command for requesting certificate for hosts and services is extended. There is added how to add DNS name as subjectAltName. https://fedorahosted.org/freeipa/ticket/5645 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Removed dead code from LDAP{Remove,Add}ReverseMemberStanislav Laznicka2016-06-061-16/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5892 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-062-8/+0
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change 'Restore' to 'Remove Hold'Pavel Vomacka2016-06-031-4/+6
| | | | | | | | | To be consistent with CLI the restoring certificate is renamed to removing certificate hold in all WebUI components. https://fedorahosted.org/freeipa/ticket/5878 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add option to stage user from details pagePavel Vomacka2016-06-031-0/+1
| | | | | | | | Add 'stage' option to the activity dropdown menu on preserved user details page. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add ability to stage multiple usersPavel Vomacka2016-06-031-0/+3
| | | | | | | | Add 'Stage' button on search page where preserved users are listed. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS Locations: when removing location remove it from servers firstMartin Basti2016-06-031-0/+8
| | | | | | | | | | | | Locations should be removed from server by using server-mod during location-del (future patches will handle DNS records in server-mod) Referint plugin is configured to remove references of deleted locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Location: location-show: return list of servers in locationMartin Basti2016-06-032-2/+69
| | | | | | | | | location-show returns list of servers curently assigned to the location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: extend server-* command with locationsMartin Basti2016-06-032-6/+100
| | | | | | | | | Server find, server show, server mod should work with IPA locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to use non-Str attributes as keys for membersMartin Basti2016-06-031-6/+8
| | | | | | | | | | | Locations use DNSNameParam as pkey_value, but implementation of searches for members was able to use only Str param. This commit allows to use other param classes for search. Required for: https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: location-* commandsMartin Basti2016-06-031-0/+149
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-0359-6/+34784
| | | | | | | | | | Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: turn Plugin attributes into propertiesJan Cholasta2016-06-031-9/+9
| | | | | | | | | | | | | | Implement the `name`, `doc` and `summary` Plugin attributes as properties to allow them to be overriden in sub-classes. Always use .doc rather than .__doc__ to access plugin documentation. Remove the mostly unused `module`, `fullname`, `bases` and `label` attributes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: fix incorrect API.register calls in docstringsJan Cholasta2016-05-251-2/+1
| | | | | | | | | | | | Use API.add_plugin to load specific plugins into API objects. Use Registry to register plugins. This fixes doctests. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5115 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: migrate all plugins to Registry-based registrationJan Cholasta2016-05-254-24/+27
| | | | | | | | Do not use the deprecated API.register method. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Added exception handling for mal-formatted XML ParsingAbhijeet Kasurde2016-05-111-2/+7
| | | | | | | | | | In order to handle mal-formatted XML returned from Dogtag, added exception handling around etree.fromstring function. https://fedorahosted.org/freeipa/ticket/5885 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* differentiate between limit types when LDAP search exceeds configured limitsMartin Babinsky2016-04-131-2/+3
| | | | | | | | | | | When LDAP search fails on exceeded limits, we should raise an specific exception for the type of limit raised (size, time, administrative) so that the consumer can distinguish between e.g. searches returning too many entries and those timing out. https://fedorahosted.org/freeipa/ticket/5677 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Pylint: import max one module per lineMartin Basti2016-03-221-1/+2
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: enable reimported checkMartin Basti2016-03-221-2/+1
| | | | | | | Fixes current reimports and enables pylint check for them Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-221-1/+1
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Do not decode HTTP reason phrase from DogtagFraser Tweedale2016-01-131-22/+22
| | | | | | | | | | | | | | The HTTP reason phrase sent by Dogtag is assumed to be encoded in UTF-8, but the encoding used by Tomcat is dependent on system locale, causing decode errors in some locales. The reason phrase is optional and will not be sent in a future version of Tomcat[1], so do not bother decoding and returning it. [1] https://github.com/apache/tomcat/commit/707ab1c77f3bc189e1c3f29b641506db4c8bce37 Fixes: https://fedorahosted.org/freeipa/ticket/5578 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-232-5/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Upgrade: increase time limit for upgradesMartin Basti2015-12-011-29/+43
| | | | | | | | | | | | | | | | Default ldap search limit is now 30 sec by default during upgrade. Limits must be changed for the whole ldap2 connection, because this connection is used inside update plugins and commands called from upgrade. Together with increasing the time limit, also size limit should be unlimited during upgrade. With sizelimit=None we may get the TimeExceeded exception from getting default value of the sizelimit from LDAP. https://fedorahosted.org/freeipa/ticket/5267 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-251-1/+3
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* fix caching in get_ipa_configMartin Basti2015-11-191-1/+1
| | | | | | | | | Different opbject types were compared thus always result of comparation was False and caching does not work. https://fedorahosted.org/freeipa/ticket/5463 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* vault: select a server with KRA for vault operationsJan Cholasta2015-10-081-1/+21
| | | | | | | | This uses the same mechanism which is used for the CA. https://fedorahosted.org/freeipa/ticket/5302 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.urllib instead of urllib/urllib2/urlparsePetr Viktorin2015-10-071-6/+6
| | | | | | | | In Python 3, these modules are reorganized. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 16:22:48 +0000