summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* test_integration.tasks: Do not fail cleanup if backup directory does not existPetr Viktorin2014-03-201-1/+2
| | | | | | | | | If the test backup directory was never created (for example if there was an early failure, or install was never run), we don't want the test to fail. Do not restore if the backup dir is not there. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix order of synchronizing time when running ipa-client-installGabe2014-03-201-17/+19
| | | | | | | | | | When running ipa-client-install, it asks for user name, synchronizes time, then asks for user password which the order could be confusing to some users. This changes ipa-client-install to synchronize time before prompting for user kerberos authentication. https://fedorahosted.org/freeipa/ticket/3957 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: update license information of used third party codePetr Vobornik2014-03-201-49/+211
| | | | | | | | | Reflects: - adding of RCUE styles along with Bootstrap 2.0. - removal of jQuery BBQ plugin - removal of rhino enviroment for selenium which was used in old UI tests Reviewed-By: Simo Sorce <ssorce@redhat.com>
* webui: change permissions UI to v2Petr Vobornik2014-03-2011-296/+396
| | | | | | | | | | | | | | reflect ipalib permission changes in Web UI. - http://www.freeipa.org/page/V4/Permissions_V2 - http://www.freeipa.org/page/V4/Anonymous_and_All_permissions - http://www.freeipa.org/page/V4/Managed_Read_permissions - http://www.freeipa.org/page/V4/Multivalued_target_filters_in_permissions https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: reflect enabled state in child widgets of a multivalued widgetPetr Vobornik2014-03-201-6/+33
| | | | | | | | | | | Child widgets are disabled when main widget is disabled. Also main widget won't show "add" button. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not create <hr> delimiter between sectionsPetr Vobornik2014-03-201-4/+0
| | | | | | | | | | | | | - section delimiter don't look good and limits UI Their removal will allow: - section hiding (needed in aci v2 UI) - fluid section layout prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: better check for existing options in attributes_widgetsPetr Vobornik2014-03-201-3/+9
| | | | | | | https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: fix unit testsPetr Vobornik2014-03-2012-56/+29
| | | | | | | | UI unit tests were broken since main RCUE work. This patch fixes them all except aci, which will be fixed along with update of aci UI. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui-static: update metadata filesPetr Vobornik2014-03-203-11508/+6192
| | | | | | | | | | | | Update JSON metadata files for static presentation of FreeIPA UI and some tests. This regeneration did not happen for very long time and an update is needed for upcoming ACI patch. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not use dom for getting selected automount keysPetr Vobornik2014-03-202-10/+15
| | | | | | | | | | | Old implementation crawled DOM for gathering data from DOM. Such code is very error prone. Little visual change somewhere else can break it - as happened in main patch for #4217. prerequisite for: https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-css: improve radio,checkbox keyboard support and colorPetr Vobornik2014-03-206-23/+56
| | | | | | | | | | | | | checkboxes and radio buttons: - do not change color on hover when disabled - are focusable and checkable be keyboard again. This uses a little trick where the real checkbox is hidden under the artificial checkbox. That way it has the same position and therefore it works even in containers with overflow set. https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: remove hover effect from disabled action buttonPetr Vobornik2014-03-171-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4256 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add Nathaniel McCallum to .mailmapPetr Viktorin2014-03-171-0/+1
|
* Add missing dependencyNalin Dahyabhai2014-03-141-0/+1
| | | | | | | We use Java classes which are bundled with rhino when uglifying Javascript sources at build-time, so we need rhino at build-time. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Update Dogtag 9 database during replica installationMartin Kosek2014-03-144-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create other clones. Add an update file to do the database update. Content is based on recommendation from PKI team: * https://bugzilla.redhat.com/show_bug.cgi?id=1075118#c9 This update file can be removed when Dogtag database upgrades are done in PKI component. Upstream tickets: * https://fedorahosted.org/pki/ticket/710 (database upgrade framework) * https://fedorahosted.org/pki/ticket/906 (checking database version) Also make sure that PKI service is restarted in the end of the installation as the other services to make sure it picks changes done during LDAP updates. https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permission plugin: Do not change extra target filters by "views"Petr Viktorin2014-03-142-4/+172
| | | | | | | | | | | | | Previously, setting/deleting the "--type" virtual attribute removed all (objectclass=...) target filters. Change so that only the filter associated with --type is removed. The same change applies to --memberof: only filters associated with the option are removed when --memberof is (un-)set. Follow-up to https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Do not fail on non-DN memberof filtersPetr Viktorin2014-03-141-1/+5
| | | | | | | | | | The --memberof logic tried to convert the value of a (memberof=...) filter to a DN, which failed with filters like (memberof=*). Do not try to set memberof if the value is not a DN. A test will be added in a subsequent patch. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Support searching by extratargetfilterPetr Viktorin2014-03-142-1/+43
| | | | | | | | | | The extratargetfilter behaves exactly like targetfilter, so that e.g. ipa permission-find --filter=(objectclass=ipausergroup) finds all permissions with that filter in the ACI. Part of the work for https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Add tests for extratargetfilterPetr Viktorin2014-03-141-0/+317
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission CLI: Rename filter to rawfilter, extratargetfilter to filterPetr Viktorin2014-03-143-11/+13
| | | | | | | Since extratargetfilter is shown by default, change it to also have the "default" (i.e. shorter) option name. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Write support for extratargetfilterPetr Viktorin2014-03-141-47/+88
| | | | | | | | | Extend the permission-add and permission-mod commands to process extratargetfilter. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Output the extratargetfilter virtual attributePetr Viktorin2014-03-146-140/+52
| | | | | | | | | | | | | | | | | | The --filter, --type, and --memberof options interact in a way that's difficult to recreate in the UI: type and memberof are "views" on the filter, they affect it and are affected by it Add a "extratagretfilter" view that only contains the filters not linked to type or memberof. Show extra target filter, and not the full target filter, by default; show both with --all, and full filter only with --raw. Write support will be added in a subsequent patch. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix idrange unit test failureMartin Kosek2014-03-141-1/+1
| | | | | | | This is a follow up to patch for ticket 4247 - the raised errors.DependentEntry changed, test needs to be change as well. https://fedorahosted.org/freeipa/ticket/4247
* ipaserver.install.service: Fix estimated time displayPetr Viktorin2014-03-132-13/+53
| | | | | | | | | | Use basic math rather than timezone conversion to get minutes and seconds. Break out the message generation into a small tested function. https://fedorahosted.org/freeipa/ticket/4242 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Prohibit deletion of active subdomain rangeTomas Babej2014-03-131-5/+17
| | | | | | | | | | Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: Datetime parsing and formattingPetr Vobornik2014-03-1314-71/+448
| | | | | | | | | | | | | | | this patch implements: - output_formatter in field. It should be used in par with formatter. Formatter serves for datasource->widget conversion, output_formatter for widget->datasource format conversion. - datetime module which parses/format strings in subset of ISO 8601 and LDAP generalized time format to Date. - utc formatter replaced with new datetime formatter - datetime_validator introduced - new datetime field, extension of text field, which by default uses datetime formatter and validator Dojo was regenerated to include dojo/string module https://fedorahosted.org/freeipa/ticket/4194 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Do not hardcode path to ipa-getkeytab in testsPetr Viktorin2014-03-133-4/+14
| | | | | | | | | | | Using the in-tree binary makes testing outside the source tree impossible. Use ipa-getkeytab from $PATH, and add the directory to $PATH when running the in-tree tests. Part of the work for https://fedorahosted.org/freeipa/ticket/3654 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui: use unique ids for checkboxesPetr Vobornik2014-03-131-4/+1
| | | | | | | | Checkboxes have not used unique ids across the whole UI. It broke checking by clicking on label for later displayed instances. It became serious problem when rcue introduced new checkbox styles with 'label clicking' as default check method. https://fedorahosted.org/freeipa/ticket/3904 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* trust: do not fetch subdomains in case shared secret was used to set up the ↵Alexander Bokovoy2014-03-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | trust Until incoming trust is validated from AD side, we cannot run any operations against AD using the trust. Also, Samba currently does not suport verifying trust against the other party (returns WERR_NOT_SUPPORTED). This needs to be added to the documentation: When using 'ipa trust-add ad.domain --trust-secret', one has to manually validate incoming trust using forest trust properties in AD Domains and Trusts tool. Once incoming trust is validated at AD side, use IPA command 'ipa trust-fetch-domains ad.domain' to retrieve topology of the AD forest. From this point on the trust should be usable. https://fedorahosted.org/freeipa/ticket/4246 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipaserver/dcerpc: make sure to always return unicode SID of the trust domainAlexander Bokovoy2014-03-121-1/+1
| | | | | | | | | | Trusted domain SID could be obtained through different means. When it is fetched from the AD DC via LDAP, it needs to be extracted from a default context and explicitly converted to unicode. https://fedorahosted.org/freeipa/ticket/4246 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Support OTP in form based authPetr Vobornik2014-03-121-6/+32
| | | | | | | | OTP requires to use kerberos FAST channel. Ccache with ticket obtained using ipa.keytab is used as an armor. https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Added QRcode generation to Web UIPetr Vobornik2014-03-129-7/+246
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for managing user-auth typesPetr Vobornik2014-03-122-0/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for radius proxyPetr Vobornik2014-03-126-1/+147
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* UI for OTP tokensPetr Vobornik2014-03-127-11/+361
| | | | | | https://fedorahosted.org/freeipa/ticket/3369 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fix handling of action visibility change in action panelPetr Vobornik2014-03-121-0/+18
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Use general password dialog for host OTPPetr Vobornik2014-03-121-136/+16
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Password DialogPetr Vobornik2014-03-124-1/+351
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fixed doc examples in Spec_modPetr Vobornik2014-03-121-1/+3
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Declarative replacement of array item in specification objectPetr Vobornik2014-03-121-1/+49
| | | | | | | | This patch adds option to define which item of which array attribute of specification object will be replaced by a new value. The difference between combination of $add and $del is that it keeps position of that item in the array. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Added empty value meaning to boolean formatterPetr Vobornik2014-03-122-4/+20
| | | | | | | | | Boolean object properties can have different default meaning for not defined value. This patch allows to defined this meaning to `boolean_formatter` by introduction of `emty_value` property. `boolean_state_evaluator` was modified to leverage it as well. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipa-sam: cache gid to sid and uid to sid requests in idmap cacheJason Woods2014-03-121-14/+114
| | | | | | | | | | | | | | | | | | | | | | Add idmap_cache calls to ipa-sam to prevent huge numbers of LDAP calls to the directory service for gid/uid<->sid resolution. Additionally, this patch further reduces number of queries by: - fast fail on uidNumber=0 which doesn't exist in FreeIPA, - return fallback group correctly when looking up user primary group as is done during init, - checking for group objectclass in case insensitive way Patch by Jason Woods <devel@jasonwoods.me.uk> Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com> https://fedorahosted.org/freeipa/ticket/4234 and https://bugzilla.redhat.com/show_bug.cgi?id=1073829 https://bugzilla.redhat.com/show_bug.cgi?id=1074314 Reviewed-By: Sumit Bose <sbose@redhat.com>
* permission_add: Remove permission entry if adding the ACI failsPetr Viktorin2014-03-122-1/+45
| | | | | | https://fedorahosted.org/freeipa/ticket/4187 Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
* ipa-replica-install never checks for 7389 portMartin Kosek2014-03-114-31/+32
| | | | | | | | | | | | | | | When creating replica from a Dogtag 9 based IPA server, the port 7389 which is required for the installation is never checked by ipa-replica-conncheck even though it knows that it is being installed from the Dogtag 9 based FreeIPA. If the 7389 port would be blocked by firewall, installation would stuck with no hint to user. Make sure that the port configuration parsed from replica info file is used consistently in the installers. https://fedorahosted.org/freeipa/ticket/4240 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Avoid passing non-terminated string to is_master_hostMartin Kosek2014-03-111-1/+2
| | | | | | | | | | | When string is not terminated, queries with corrupted base may be sent to LDAP: ... cn=ipa1.example.com<garbage>,cn=masters... https://fedorahosted.org/freeipa/ticket/4214 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* permission-find: Cache the root entry for legacy permissionsPetr Viktorin2014-03-111-8/+23
| | | | | | | | | This makes searching faster if there are many legacy permissions present. The root entry (which contains all legacy permission ACIs) is only looked up once. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Log unhandled exceptions in certificate renewal scripts.Jan Cholasta2014-03-107-211/+262
| | | | | | https://fedorahosted.org/freeipa/ticket/4093 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permissions plugin: Don't crash with empty targetfilterPetr Viktorin2014-03-072-1/+48
| | | | | | https://fedorahosted.org/freeipa/ticket/4206 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Allow multiple values for memberofPetr Viktorin2014-03-074-11/+55
| | | | | | | Design: http://www.freeipa.org/page/V3/Multivalued_target_filters_in_permissions Additional fix for: https://fedorahosted.org/freeipa/ticket/4074 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission-mod: Remove attributelevelrights before reverting entryPetr Viktorin2014-03-072-1/+29
| | | | | | | | | LDAPUpdate adds the display-only 'attributelevelrights' attribute, which doesn't exist in LDAP. Remove it before reverting entry. https://fedorahosted.org/freeipa/ticket/4212 Reviewed-By: Martin Kosek <mkosek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 14:00:04 +0000