summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* permission CLI: Rename filter to rawfilter, extratargetfilter to filterPetr Viktorin2014-03-143-11/+13
| | | | | | | Since extratargetfilter is shown by default, change it to also have the "default" (i.e. shorter) option name. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Write support for extratargetfilterPetr Viktorin2014-03-141-47/+88
| | | | | | | | | Extend the permission-add and permission-mod commands to process extratargetfilter. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Output the extratargetfilter virtual attributePetr Viktorin2014-03-146-140/+52
| | | | | | | | | | | | | | | | | | The --filter, --type, and --memberof options interact in a way that's difficult to recreate in the UI: type and memberof are "views" on the filter, they affect it and are affected by it Add a "extratagretfilter" view that only contains the filters not linked to type or memberof. Show extra target filter, and not the full target filter, by default; show both with --all, and full filter only with --raw. Write support will be added in a subsequent patch. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix idrange unit test failureMartin Kosek2014-03-141-1/+1
| | | | | | | This is a follow up to patch for ticket 4247 - the raised errors.DependentEntry changed, test needs to be change as well. https://fedorahosted.org/freeipa/ticket/4247
* ipaserver.install.service: Fix estimated time displayPetr Viktorin2014-03-132-13/+53
| | | | | | | | | | Use basic math rather than timezone conversion to get minutes and seconds. Break out the message generation into a small tested function. https://fedorahosted.org/freeipa/ticket/4242 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Prohibit deletion of active subdomain rangeTomas Babej2014-03-131-5/+17
| | | | | | | | | | Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: Datetime parsing and formattingPetr Vobornik2014-03-1314-71/+448
| | | | | | | | | | | | | | | this patch implements: - output_formatter in field. It should be used in par with formatter. Formatter serves for datasource->widget conversion, output_formatter for widget->datasource format conversion. - datetime module which parses/format strings in subset of ISO 8601 and LDAP generalized time format to Date. - utc formatter replaced with new datetime formatter - datetime_validator introduced - new datetime field, extension of text field, which by default uses datetime formatter and validator Dojo was regenerated to include dojo/string module https://fedorahosted.org/freeipa/ticket/4194 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Do not hardcode path to ipa-getkeytab in testsPetr Viktorin2014-03-133-4/+14
| | | | | | | | | | | Using the in-tree binary makes testing outside the source tree impossible. Use ipa-getkeytab from $PATH, and add the directory to $PATH when running the in-tree tests. Part of the work for https://fedorahosted.org/freeipa/ticket/3654 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui: use unique ids for checkboxesPetr Vobornik2014-03-131-4/+1
| | | | | | | | Checkboxes have not used unique ids across the whole UI. It broke checking by clicking on label for later displayed instances. It became serious problem when rcue introduced new checkbox styles with 'label clicking' as default check method. https://fedorahosted.org/freeipa/ticket/3904 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* trust: do not fetch subdomains in case shared secret was used to set up the ↵Alexander Bokovoy2014-03-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | trust Until incoming trust is validated from AD side, we cannot run any operations against AD using the trust. Also, Samba currently does not suport verifying trust against the other party (returns WERR_NOT_SUPPORTED). This needs to be added to the documentation: When using 'ipa trust-add ad.domain --trust-secret', one has to manually validate incoming trust using forest trust properties in AD Domains and Trusts tool. Once incoming trust is validated at AD side, use IPA command 'ipa trust-fetch-domains ad.domain' to retrieve topology of the AD forest. From this point on the trust should be usable. https://fedorahosted.org/freeipa/ticket/4246 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipaserver/dcerpc: make sure to always return unicode SID of the trust domainAlexander Bokovoy2014-03-121-1/+1
| | | | | | | | | | Trusted domain SID could be obtained through different means. When it is fetched from the AD DC via LDAP, it needs to be extracted from a default context and explicitly converted to unicode. https://fedorahosted.org/freeipa/ticket/4246 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Support OTP in form based authPetr Vobornik2014-03-121-6/+32
| | | | | | | | OTP requires to use kerberos FAST channel. Ccache with ticket obtained using ipa.keytab is used as an armor. https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Added QRcode generation to Web UIPetr Vobornik2014-03-129-7/+246
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for managing user-auth typesPetr Vobornik2014-03-122-0/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for radius proxyPetr Vobornik2014-03-126-1/+147
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for OTP tokensPetr Vobornik2014-03-127-11/+361
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fix handling of action visibility change in action panelPetr Vobornik2014-03-121-0/+18
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Use general password dialog for host OTPPetr Vobornik2014-03-121-136/+16
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Password DialogPetr Vobornik2014-03-124-1/+351
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fixed doc examples in Spec_modPetr Vobornik2014-03-121-1/+3
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Declarative replacement of array item in specification objectPetr Vobornik2014-03-121-1/+49
| | | | | | | | This patch adds option to define which item of which array attribute of specification object will be replaced by a new value. The difference between combination of $add and $del is that it keeps position of that item in the array. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Added empty value meaning to boolean formatterPetr Vobornik2014-03-122-4/+20
| | | | | | | | | Boolean object properties can have different default meaning for not defined value. This patch allows to defined this meaning to `boolean_formatter` by introduction of `emty_value` property. `boolean_state_evaluator` was modified to leverage it as well. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipa-sam: cache gid to sid and uid to sid requests in idmap cacheJason Woods2014-03-121-14/+114
| | | | | | | | | | | | | | | | | | | | | | Add idmap_cache calls to ipa-sam to prevent huge numbers of LDAP calls to the directory service for gid/uid<->sid resolution. Additionally, this patch further reduces number of queries by: - fast fail on uidNumber=0 which doesn't exist in FreeIPA, - return fallback group correctly when looking up user primary group as is done during init, - checking for group objectclass in case insensitive way Patch by Jason Woods <devel@jasonwoods.me.uk> Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> https://fedorahosted.org/freeipa/ticket/4234 and https://bugzilla.redhat.com/show_bug.cgi?id=1073829 https://bugzilla.redhat.com/show_bug.cgi?id=1074314 Reviewed-By: Sumit Bose <sbose@redhat.com>
* permission_add: Remove permission entry if adding the ACI failsPetr Viktorin2014-03-122-1/+45
| | | | | | https://fedorahosted.org/freeipa/ticket/4187 Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
* ipa-replica-install never checks for 7389 portMartin Kosek2014-03-114-31/+32
| | | | | | | | | | | | | | | When creating replica from a Dogtag 9 based IPA server, the port 7389 which is required for the installation is never checked by ipa-replica-conncheck even though it knows that it is being installed from the Dogtag 9 based FreeIPA. If the 7389 port would be blocked by firewall, installation would stuck with no hint to user. Make sure that the port configuration parsed from replica info file is used consistently in the installers. https://fedorahosted.org/freeipa/ticket/4240 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Avoid passing non-terminated string to is_master_hostMartin Kosek2014-03-111-1/+2
| | | | | | | | | | | When string is not terminated, queries with corrupted base may be sent to LDAP: ... cn=ipa1.example.com<garbage>,cn=masters... https://fedorahosted.org/freeipa/ticket/4214 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* permission-find: Cache the root entry for legacy permissionsPetr Viktorin2014-03-111-8/+23
| | | | | | | | | This makes searching faster if there are many legacy permissions present. The root entry (which contains all legacy permission ACIs) is only looked up once. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Log unhandled exceptions in certificate renewal scripts.Jan Cholasta2014-03-107-211/+262
| | | | | | https://fedorahosted.org/freeipa/ticket/4093 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permissions plugin: Don't crash with empty targetfilterPetr Viktorin2014-03-072-1/+48
| | | | | | https://fedorahosted.org/freeipa/ticket/4206 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Allow multiple values for memberofPetr Viktorin2014-03-074-11/+55
| | | | | | | Design: http://www.freeipa.org/page/V3/Multivalued_target_filters_in_permissions Additional fix for: https://fedorahosted.org/freeipa/ticket/4074 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission-mod: Remove attributelevelrights before reverting entryPetr Viktorin2014-03-072-1/+29
| | | | | | | | | LDAPUpdate adds the display-only 'attributelevelrights' attribute, which doesn't exist in LDAP. Remove it before reverting entry. https://fedorahosted.org/freeipa/ticket/4212 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa-kdb: do not fetch client principal if it is the same as existing entryAlexander Bokovoy2014-03-061-6/+13
| | | | | | | | | | | | | | | When client principal is the same as supplied client entry, don't fetch it again. Note that when client principal is not NULL, client entry might be NULL for cross-realm case, so we need to make sure to not dereference NULL pointer here. Also fix reverted condition for case when we didn't find the client principal in the database, preventing a memory leak. https://fedorahosted.org/freeipa/ticket/4223 Reviewed-By: Sumit Bose <sbose@redhat.com>
* tests: Create the testing service certificate on demandPetr Viktorin2014-03-066-166/+121
| | | | | | | | | Replace the make-testcert command with a module that creates the certificate when it is first needed. As a result the tests are more self-contained, and can be run from a read-only location (such as installed from a system package). Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib.plugable: Always set the parser in bootstrap()Petr Viktorin2014-03-051-4/+6
| | | | | | | | | | In cases where logging was already configured by the time API.bootstrap() was called, saving the argument parser was mistakenly skipped along with the logging configuration. Always set the argument parser on the API object. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* man: sshd should be run at least once before client enrollmentTomas Babej2014-03-051-0/+3
| | | | | | | | | | If SSH keys have not been generated prior to enrolling the client to the IPA server, they will not be uploaded to the server, since they're not present. Clarify this issue in the man pages. https://fedorahosted.org/freeipa/ticket/4055 Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
* fix filtering of subdomain-based trust usersAlexander Bokovoy2014-03-051-9/+32
| | | | | | https://fedorahosted.org/freeipa/ticket/4207 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Fix token secret length RFC complianceNathaniel McCallum2014-03-051-1/+1
| | | | | | | | | RFC 4226 states the following in section 4: R6 - The algorithm MUST use a strong shared secret. The length of the shared secret MUST be at least 128 bits. This document RECOMMENDs a shared secret length of 160 bits. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Rework how otptoken defaults are handledNathaniel McCallum2014-03-053-57/+58
| | | | | | | | | | | | We had originally decided to provide defaults on the server side so that they could be part of a global config for the admin. However, on further reflection, only certain defaults really make sense given the limitations of Google Authenticator. Similarly, other defaults may be token specific. Attempting to handle defaults on the server side also makes both the UI and the generated documentation unclear. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add tests for integration test configurationPetr Viktorin2014-03-051-0/+437
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Convert some text values to strPetr Viktorin2014-03-052-8/+8
| | | | | | | When loading from file, some strings are loaded as unicode, which would throw off assert_deepequal. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-test-config: Add --json and --yaml output optionsPetr Viktorin2014-03-052-2/+40
| | | | | | | | Also update the man page. Part of the work for: https://fedorahosted.org/freeipa/ticket/3938 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Add environment variables for JSON/YAMLPetr Viktorin2014-03-051-1/+18
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3938 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Load/store from/to dictsPetr Viktorin2014-03-053-5/+93
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3938 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Do not store the index in Domain and Host objectsPetr Viktorin2014-03-052-31/+35
| | | | | | | The index is a detail of the environment variable method of configuration, it should only be used there. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Use a more declarative approach to test-wide settingsPetr Viktorin2014-03-051-57/+50
| | | | | | | | The list of options was duplicated too many times. Consolidate. Part of the work for: https://fedorahosted.org/freeipa/ticket/3938 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Do not save the input environmentPetr Viktorin2014-03-052-36/+25
| | | | | | | | | | | | | Using the input environment saved in self._session_env outside of the config loading meant that methods of configuration other than environment variables wouldn't be possible. Restructure the roles/extra_roles to not depend on _session_env. Part of the work for: https://fedorahosted.org/freeipa/ticket/3938 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_integration.config: Fix crash in to_env when no replica is definedPetr Viktorin2014-03-051-4/+10
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: Don't act on keyboard events which originated in different dialogPetr Vobornik2014-03-051-2/+33
| | | | | | | | | | | | | | | | | | Fixes issue when: 1. 2 dialogs are opened 2. top dialog's close button is focused 3. user presses enter to execute 'close' action 4. dialog is immediately closed (enter key is still pressed) 5. second dialog automatically receives focus (it's top dialog now) 6. user releases the key 7. second dialog reacts to keyup event - which is by default confirmation mixin's confirm event 8. UNDESIRED behavior occurs Now confirmation mixin remembers which keys were pressed and released and reacts only to those which originated there. https://fedorahosted.org/freeipa/ticket/4098 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Typo in warning message where IPA realm and domain name differGabe2014-03-051-1/+1
| | | | | | | | Removed 'y' from warning message. https://fedorahosted.org/freeipa/ticket/4211 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Test fixed modlist generation codePetr Viktorin2014-03-032-1/+17
| | | | | https://fedorahosted.org/freeipa/ticket/4138 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-06-08 22:14:06 +0000