summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Use the same certmonger configuration for both CA masters and clones.Jan Cholasta2014-03-252-102/+48
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Merge restart_httpd functionality to renew_ra_cert.Jan Cholasta2014-03-252-10/+12
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Merge restart_pkicad functionality to renew_ca_cert and remove restart_pkicad.Jan Cholasta2014-03-254-93/+32
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Make the default dogtag-ipa-ca-renew-agent behavior depend on CA setup.Jan Cholasta2014-03-252-5/+8
| | | | | | | On CA masters, a certificate is requested and stored to LDAP. On CA clones, the certificate is retrieved from LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Store information about which CA server is master for renewals in LDAP.Jan Cholasta2014-03-255-3/+98
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use dogtag-ipa-ca-renew-agent to track certificates on master CA.Jan Cholasta2014-03-254-119/+51
| | | | | | | | | Before, dogtag-ipa-renew-agent was used to track the certificates and the certificates were stored to LDAP in renew_ca_cert and renew_ra_cert. Since dogtag-ipa-ca-renew-agent can store the certificates itself, the storage code was removed from renew_ca_cert and renew_ra_cert. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Support storing renewed certificates to LDAP in dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-251-4/+127
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove dogtag-ipa-retrieve-agent-submit.Jan Cholasta2014-03-253-94/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use dogtag-ipa-ca-renew-agent to retrieve renewed certificates from LDAP.Jan Cholasta2014-03-252-16/+27
| | | | | | Before, this was done by dogtag-ipa-retrieve-agent-submit. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Support retrieving renewed certificates from LDAP in dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-251-2/+69
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add function for parsing friendly name from certificate requests.Jan Cholasta2014-03-251-0/+50
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove unused function get_subjectaltname from the cert plugin.Jan Cholasta2014-03-251-14/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Update pkcs10 module functions to always load CSRs and allow selecting format.Jan Cholasta2014-03-253-29/+31
| | | | | | This change makes the pkcs10 module more consistent with the x509 module. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add new certmonger CA helper dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-253-0/+83
| | | | | | The helper will be used to handle CA-related certificate renewal requests. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use certmonger D-Bus API to configure certmonger in CA install.Jan Cholasta2014-03-254-22/+25
| | | | | | Before, certmonger was configured by modifying its internal database directly. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Show progress when enabling SSL in DS in ipa-server-install output.Jan Cholasta2014-03-252-7/+12
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove unused method export_ca_cert of dsinstance.Jan Cholasta2014-03-251-5/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Upload CA certificate from DS NSS database in CA-less server install.Jan Cholasta2014-03-252-18/+7
| | | | | | | | | | Before, the file provided in the --root-ca-file option was used directly for the upload. However, it is the same file which is imported to the NSS database, so the second code path is not necessary. Also removed now unused upload_ca_dercert method of dsinstance. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use LDAP API to upload CA certificate instead of ldapmodify command.Jan Cholasta2014-03-253-13/+18
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Do not create CA certificate files in CA-less server install.Jan Cholasta2014-03-251-15/+4
| | | | | | | | | | The files are created later by ipa-client-install, there's no need to do it twice. This also fixes a bug in CA-less, where the CA certificate is not removed from /etc/pki/nssdb after client uninstall, because it has a different nickname. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Move CACERT definition to a single place.Jan Cholasta2014-03-2517-23/+24
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix certificate renewal scripts to work with separate CA DS instance.Jan Cholasta2014-03-253-22/+44
| | | | | | https://fedorahosted.org/freeipa/ticket/3805 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permission plugin: Add 'top' to the list of object classesPetr Viktorin2014-03-251-1/+3
| | | | | | | | | | | The 'top' objectclass is added by DS if not present. On every update the managed permission updater compared the object_class list with the state from LDAP, saw that there's an extra 'top' value, and tried deleting it. Add 'top' to the list to match the entry in LDAP. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add Object metadata and update plugin for managed permissionsPetr Viktorin2014-03-253-0/+180
| | | | | | | | The default read permission is added for Netgroup as an example. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Design: http://www.freeipa.org/page/V3/Managed_Read_permissions Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow modifying permissions with ":" in the namePetr Viktorin2014-03-254-11/+63
| | | | | | | | | | | | | | The ":" character will be reserved for default permissions, so that users cannot create a permission with a name that will later be added as a default. Allow the ":" character modifying/deleting permissions*, but not when creating them. Also do not allow the new name to contain ":" when renaming. (* modify/delete have unrelated restrictions on managed permissions) Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_permission_plugin: Fix tests that make too broad assumptionsPetr Viktorin2014-03-252-44/+28
| | | | | | | | | | | | | | The test that searches with a limit of 1 assumes a specific order LDAP returns entries in. Future patches will change this order. Do not check the specific entry returned. The test that searched for --bindtype assumed that no anonymous permissions exist in a clean install. Again, this will be changed in future patches. Add a name to the bindtype test, and add a negatitive test to verify the filtering works. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission-find: Fix handling of the search term for legacy permissionsPetr Viktorin2014-03-251-17/+24
| | | | | | | Previously the search term was only applied to the name. Fix it so that it filters results based on any attribute. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow indexing API object types by classPetr Viktorin2014-03-252-4/+23
| | | | | | | | | | | | | | This allows code like: from ipalib.plugins.dns import dnszone_mod api.Command[dnszone_mod] This form should be preferred when getting specific objects because it ensures that the appropriate plugin is imported. https://fedorahosted.org/freeipa/ticket/4185 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Proxy PKI clone /ca/ee/ca/profileSubmit URIMartin Kosek2014-03-251-2/+2
| | | | | | | | | | | | PKI change done in ticket https://fedorahosted.org/pki/ticket/816 requires the PKI Clone's SSL Server certificate to be issued by it's associated PKI master. Allow this call on IPA master. https://fedorahosted.org/freeipa/ticket/4265 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* extdom: do not return results from the wrong domainSumit Bose2014-03-251-0/+12
| | | | | Resolves: https://fedorahosted.org/freeipa/ticket/4264 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* permission plugin: Do not add the ipapermissionv2 for outputPetr Viktorin2014-03-243-7/+6
| | | | | | | | | As with the flags, the objectclass should be returned as it is on the entry. https://fedorahosted.org/freeipa/ticket/4257 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui-ci: fix test_rebuild_membership_hosts on server without DNSPetr Vobornik2014-03-241-19/+5
| | | | | | | Host adder dialog differs on installations with and without DNS. Previous test used values for adding hosts which were suitable only for IPA servers installed with DNS. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipatests: test_trust: Change expected home directories for posix usersTomas Babej2014-03-242-4/+5
| | | | | | | | | | | | | | Information from the AD about the home directories is not leveraged at all, but is generated from the username and domain. Fix the assumptions in the tests. Also changes 'Subdomain Test User' to 'Subdomaintest User' to be more consistent. https://fedorahosted.org/freeipa/ticket/4184 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix typo in ipa -v migrate-dsGabe2014-03-212-2/+2
| | | | | | | | Remove 'u' from .po files as it is a typo and has been removed from other files. https://fedorahosted.org/freeipa/ticket/2546 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* permission CLI: rename --permissions to --rightPetr Viktorin2014-03-213-7/+8
| | | | | | | | The old name is kept as a deprecated alias. https://fedorahosted.org/freeipa/ticket/4231 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* cli: Add mechanism for deprecated option name aliasesPetr Viktorin2014-03-212-14/+30
| | | | | | | | | Add a new Param kwarg, deprecated_cli_aliases, that lists deprecated aliases. The aliases will appear in a "Deprecated options" in the help, and otherwise act as the normal variant. Preparation for: https://fedorahosted.org/freeipa/ticket/4231
* cli: Show list of values in --help for all EnumsPetr Viktorin2014-03-211-4/+4
| | | | | | Previously only the StrEnum param type had the list of values listed in the help. Extend the functionality to any kind of Enum.
* cli: Clean up importsPetr Viktorin2014-03-211-6/+3
|
* test_integration.tasks: Do not fail cleanup if backup directory does not existPetr Viktorin2014-03-201-1/+2
| | | | | | | | | If the test backup directory was never created (for example if there was an early failure, or install was never run), we don't want the test to fail. Do not restore if the backup dir is not there. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix order of synchronizing time when running ipa-client-installGabe2014-03-201-17/+19
| | | | | | | | | | When running ipa-client-install, it asks for user name, synchronizes time, then asks for user password which the order could be confusing to some users. This changes ipa-client-install to synchronize time before prompting for user kerberos authentication. https://fedorahosted.org/freeipa/ticket/3957 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: update license information of used third party codePetr Vobornik2014-03-201-49/+211
| | | | | | | | | Reflects: - adding of RCUE styles along with Bootstrap 2.0. - removal of jQuery BBQ plugin - removal of rhino enviroment for selenium which was used in old UI tests Reviewed-By: Simo Sorce <ssorce@redhat.com>
* webui: change permissions UI to v2Petr Vobornik2014-03-2011-296/+396
| | | | | | | | | | | | | | reflect ipalib permission changes in Web UI. - http://www.freeipa.org/page/V4/Permissions_V2 - http://www.freeipa.org/page/V4/Anonymous_and_All_permissions - http://www.freeipa.org/page/V4/Managed_Read_permissions - http://www.freeipa.org/page/V4/Multivalued_target_filters_in_permissions https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: reflect enabled state in child widgets of a multivalued widgetPetr Vobornik2014-03-201-6/+33
| | | | | | | | | | | Child widgets are disabled when main widget is disabled. Also main widget won't show "add" button. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not create <hr> delimiter between sectionsPetr Vobornik2014-03-201-4/+0
| | | | | | | | | | | | | - section delimiter don't look good and limits UI Their removal will allow: - section hiding (needed in aci v2 UI) - fluid section layout prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: better check for existing options in attributes_widgetsPetr Vobornik2014-03-201-3/+9
| | | | | | | https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: fix unit testsPetr Vobornik2014-03-2012-56/+29
| | | | | | | | UI unit tests were broken since main RCUE work. This patch fixes them all except aci, which will be fixed along with update of aci UI. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui-static: update metadata filesPetr Vobornik2014-03-203-11508/+6192
| | | | | | | | | | | | Update JSON metadata files for static presentation of FreeIPA UI and some tests. This regeneration did not happen for very long time and an update is needed for upcoming ACI patch. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not use dom for getting selected automount keysPetr Vobornik2014-03-202-10/+15
| | | | | | | | | | | Old implementation crawled DOM for gathering data from DOM. Such code is very error prone. Little visual change somewhere else can break it - as happened in main patch for #4217. prerequisite for: https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-css: improve radio,checkbox keyboard support and colorPetr Vobornik2014-03-206-23/+56
| | | | | | | | | | | | | checkboxes and radio buttons: - do not change color on hover when disabled - are focusable and checkable be keyboard again. This uses a little trick where the real checkbox is hidden under the artificial checkbox. That way it has the same position and therefore it works even in containers with overflow set. https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: remove hover effect from disabled action buttonPetr Vobornik2014-03-171-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4256 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 19:38:12 +0000