freeipa.git/ipaserver/plugins, branch fix_ber_scanf

Modify webUI to adhere to new IPA server API

2019-09-10T09:33:21+00:00

Given the changes in IPA server API changes, whebUI is modified to
utilize new authentication indicators, and disabled custom indicators
for services' white list.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Extend the list of supported pre-auth mechanisms in IPA server API

2019-09-10T09:33:21+00:00

As new authentication indicators implemented, we also modified server
API to support those new values. Also, "krbprincipalauthind" attribute
is modified to use a pre-defined set of values instead of arbitrary
strings.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

config plugin: replace 'is 0' with '== 0'

2019-09-04T06:28:14+00:00

Since python3.8, identity checks with literal produce syntax warnings.
Replace the check 'if .. is 0' with 'if .. == 0'

Related: https://pagure.io/freeipa/issue/8057
Signed-off-by: Florence Blanc-Renaud 
Reviewed-By: Christian Heimes

Allow insecure binds for migration

2019-08-13T16:43:58+00:00

Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind
over an insecure connection. Password logins were only allowed over LDAPS
or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases.

This commit lifts the restriction and permits insecure binds over plain
LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA
certificate is configured with a plain LDAP connection.

Fixes: https://pagure.io/freeipa/issue/8040
Signed-off-by: Christian Heimes 
Reviewed-By: Thomas Woerner

Don't return SSH keys with ipa host-find --pkey-only

2019-08-07T06:35:28+00:00

This was introduced in 14ee02dcbd6cbb6c221ac7526e471a9fc58fcc82

https://pagure.io/freeipa/issue/8029

Reviewed-By: Alexander Bokovoy

user-stage: transfer all attributes from preserved to stage user

2019-07-31T06:34:34+00:00

The user-stage command is internally implemented as:
- user_show(all=True) in order to read the user attributes
- loop on the attributes defined as possible to add using stageuser-add and
transform them into new options for stageuser_add (for instance stageuser-add
provides the option --shell for the attribute loginshell, but there is no
option for the attribute businesscategory).
- call stageuser_add in order to create a new entry in the active users subtree
- user-del to remove the previous entry in the staged users subtree

The issue is in the 2nd step. Only the attributes with a stageuser-add option
are processed.
The logic of the code should be slightly modified, so that all the attributes
read in the first step are processed:
- if they correspond to an option of stageuser-add, process them like it's
currently done. For instance if the entry contains displayname, then it
should be processed as --displayName=value in the stageuser-add cmd
- if they do not correspond to an option of stageuser-add, add them with
--setattr==

Note that some attributes may need to be filtered, for instance user-show
returns has_password or has_keytab, which do not correspond to attributes
in the LDAP entry.

Fixes: https://pagure.io/freeipa/issue/7597
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

WebUI: Add PKINIT status field to 'Configuration' page

2019-07-26T16:10:02+00:00

- Add 'Server Options' section to the page
- Add 'IPA master capable of PKINIT' field to the 'Server Options'

Ticket: https://pagure.io/freeipa/issue/7305

Signed-off-by: Serhii Tsymbaliuk 
Reviewed-By: Florence Blanc-Renaud

Remove posixAccount from service_find search filter

2019-07-19T17:13:34+00:00

This will allow cifs principals to be found. They were suppressed
because they include objectclass=posixAccount.

This is a bit of a historical anomaly. This was included in the
filter from the initial commit (though it was person, not
posixAccount). I believe it was a mistake from the beginning but
it wasn't noticed because it didn't cause any obvious issues.

https://pagure.io/freeipa/issue/8013

Reviewed-By: Alexander Bokovoy

certmap rules: altSecurityIdentities should only be used for trusted domains

2019-07-17T14:50:07+00:00

IPA LDAP has no altSecurityIdentities in use, it only should apply to
identities in trusted Active Directory domains.

Add checks to enforce proper certmap rule attribution for specific
Active Directory domains.

Related: https://pagure.io/freeipa/issue/7932
Reviewed-By: Florence Blanc-Renaud

Make use of single configuration point for SELinux

2019-07-01T11:44:57+00:00

For now, FreeIPA supports SELinux things as they are in RedHat/Fedora.
But different distributions may have their own SELinux customizations.

This moves SELinux configuration out to platform constants:
- SELINUX_MCS_MAX
- SELINUX_MCS_REGEX
- SELINUX_MLS_MAX
- SELINUX_MLS_REGEX
- SELINUX_USER_REGEX
- SELINUX_USERMAP_DEFAULT
- SELINUX_USERMAP_ORDER

and applies corresponding changes to the test code.

Fixes: https://pagure.io/freeipa/issue/7996
Signed-off-by: Stanislav Levin 
Reviewed-By: Rob Crittenden 
Reviewed-By: Alexander Bokovoy