summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Configure KDC to use certs after they are deployedreplica_kdcSimo Sorce2017-03-092-5/+18
| | | | | | | | Certmonger needs to access the KDC when it tries to obtain certs, so make sure the KDC can run, then reconfigure it to use pkinit anchors once certs are deployed. Signed-off-by: Simo Sorce <simo@redhat.com>
* backup: backup anonymous keytabMartin Basti2017-03-091-0/+1
| | | | | | | | Freeipa stops working without anon keytab https://pagure.io/freeipa/issue/5959 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server install: require IPv6 stack to be enabledTomas Krizek2017-03-095-0/+22
| | | | | | | | | | Add checks to install and replica install to verify IPv6 stack is enabled. IPv6 is required by some IPA parts (AD, conncheck, ...). https://pagure.io/freeipa/issue/6608 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* add whoami commandAlexander Bokovoy2017-03-094-2/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whoami command allows to query details about currently authenticated identity. The command returns following information: * object class name * function to call to get actual details about the object * arguments to pass to the function There are five types of objects that could bind to IPA using their credentials. `ipa whoami` call expects one of the following: * users * staged users * hosts * Kerberos services * ID user override from the default trust view The latter category of objects is automatically mapped by SASL GSSAPI mapping rule in 389-ds for users from trusted Active Directory forests. The command is expected to be used by Web UI to define proper view for the authenticated identity. It is not visible in the command line interface is `ipa` command. Below is an example of how communication looks like for a host principal: # kinit -k # ipa console (Custom IPA interactive Python console) >>> api.Command.whoami() {u'command': u'host_show/1', u'object': u'host', u'arguments': (u'ipa.example.com',)} >>> Fixes https://pagure.io/freeipa/issue/6643 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-managed-entries: only permit running the command on IPA masterMartin Babinsky2017-03-091-0/+3
| | | | | | https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa-managed-entries: use server-mode APIMartin Babinsky2017-03-091-1/+5
| | | | | | | | | | During LDAP connection management refactoring the ad-hoc ldap connection in `ipa-managed-entries` was replaced by calls to ldap2 backend without updating API initialization. https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Don't use weak ciphers for client HTTPS connectionsStanislav Laznicka2017-03-092-1/+8
| | | | | | https://pagure.io/freeipa/issue/6730 Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: Add cermapmatch modulePavel Vomacka2017-03-085-1/+406
| | | | | | | | | | Add module which can show users which are mapped to the provided certificate. Additionaly, the certificate is parsed and parsed information are also displayed. https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Adapter for certmap_match result tablePavel Vomacka2017-03-081-0/+79
| | | | | | | | | | | | | | | Result of certmap_match command is in the following format: [{domain: 'domain1', uid:[uid11,uid12,uid13]}, {domain: 'domain2', uid:[uid21, uid22, uid23},...] For correct displaying in table we need to reformat it to the following: [{domain: 'domain1', uid: 'uid11'}, {domain: 'domain1', uid: 'uid12'},... This can be done using this Adapter. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Possibility to choose object when API call returns list of objectsPavel Vomacka2017-03-081-0/+13
| | | | | | | | | | | | In case that API call returns array of objects which contains data, using 'object_index' attribute in adapter specification we can set which object should be used. It is possible to choose only one object specified by its index in array. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to turn of autoload when details.load is calledPavel Vomacka2017-03-082-1/+10
| | | | | | | | | | When field on details facet has set 'autoload_value' to false, then it won't be loaded using that.load method of details facet. That means that field might stay unchanged even that loading of data was performed. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* config: re-add `init_config` and `config`Jan Cholasta2017-03-081-0/+149
| | | | | | | | | | | Re-add `init_config` and `config` to `ipapython.config`, because they are used by Ipsilon (see https://pagure.io/ipsilon/issue/265). This partially reverts commit 7b966e8577fdb56f069cf26a6ab4d6c77b8743b9. https://pagure.io/freeipa/issue/6707 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Chain CSR generator file loadersChristian Heimes2017-03-081-17/+44
| | | | | | | | | First try custom location, then csrgen subdir in confdir and finally fall back to package data. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move csrgen templates into ipaclient packageChristian Heimes2017-03-0819-52/+30
| | | | | | | | | | | | csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow login to WebUI using Kerberos aliases/enterprise principalsMartin Babinsky2017-03-082-49/+16
| | | | | | | | | | | | | The logic of the extraction/validation of principal from the request and subsequent authentication was simplified and most of the guesswork will be done by KDC during kinit. This also allows principals from trusted domains to login via rpcserver. https://fedorahosted.org/freeipa/ticket/6343 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: fix `dnsrecord_add` interactive modeJan Cholasta2017-03-082-1/+7
| | | | | | | | | | | | | | | `dnsrecord_add` interactive mode might prompt for value of non-existent arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This happens because `dnsrecord_add` extra flags are incorrectly defined as parts of the respective DNS records. Remove extra flags from DNS record parts to fix the interactive mode on old clients talking to new servers. Skip non-existent arguments in the interactive mode to fix new clients talking to old servers. https://fedorahosted.org/freeipa/ticket/6457 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: use --setup-kra in testsMartin Basti2017-03-081-7/+2
| | | | | | | | | | | | This will allow to test --setup-kra option together with ipa-server-install in install tests Separate installation using ipa-kra-install is already covered. https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* KRA: add --setup-kra to ipa-server-installMartin Basti2017-03-085-7/+21
| | | | | | | | | | | | | | | | | This patch allows to install KRA on first IPA server in one step using ipa-server-install This option improves containers installation where ipa-server can be installed with KRA using one call without need to call docker exec. Please note the the original `kra.install()` calls in ipaserver/install/server/install.py were empty operations as it did nothing, so it is safe to move them out from CA block https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: don't change casing of Auth Indicators valuesPavel Vomacka2017-03-082-4/+4
| | | | | | | | | | | All values were previously converted to lowercase which was not coresponding with CLI behaviour. Now they stay as they are inserted. I also have to change the strings to lowercase because the otp and radius should be inserted as lowercase words. https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Allow disabling lowering text in custom_checkbox_widgetPavel Vomacka2017-03-082-1/+6
| | | | | | | | | Add new attribute which keeps information whether each text added using custom_checkbox_widget shoud be transformed to lowercase. Part of: https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fixes normalization of value in attributes widgetPetr Vobornik2017-03-081-1/+1
| | | | | | | | | | | | | | | | Fix is in checkboxes widget but the only affected one is attributes widget. Reproduction: 1. Add permission with attribute with uppercase character $ ipa permission-add aa_test --type=stageuser --attrs=businessCategory --right=read 2. Check if it is correctly displayed in Web UI Actual result: - businesscategory is not checked Expected result: - businesscategory is checked Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* IdM Server: list all Employees with matching Smart CardFlorence Blanc-Renaud2017-03-083-1/+179
| | | | | | | | | | | | | Implement a new IPA command allowing to retrieve the list of users matching the provided certificate. The command is using SSSD Dbus interface, thus including users from IPA domain and from trusted domains. This requires sssd-dbus package to be installed on IPA server. https://fedorahosted.org/freeipa/ticket/6646 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add support for custom table pagination sizePavel Vomacka2017-03-086-6/+77
| | | | | | | | | | | New customization button opens dialog with field for setting the number of lines in tables. After saving the new value there is new topic which starts refreshing current table facet (if shown) and set all other facets expired. Therefore all tables are immediately regenerated. https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make singleton from config modulePavel Vomacka2017-03-081-6/+45
| | | | | | | | Also added general setter and getter for attributes of config. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add javascript integer validatorPavel Vomacka2017-03-081-0/+34
| | | | | | | | | Javascript integer validator checks whether value entered into field is number and is not higher than Number.MAX_SAFE_INTEGER constant. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* man: add missing --setup-adtrust option to manpageMartin Basti2017-03-082-0/+6
| | | | | | | | | ipa-server-install and ipa-replica-install manpages miss --setup-adtrust options https://pagure.io/freeipa/issue/6630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* WebUI: Add certmap modulePavel Vomacka2017-03-086-1/+433
| | | | | | | | | Add facets for certmaprule and certmapconfigure entities. https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Custom command multivalued adder dialogPavel Vomacka2017-03-081-0/+34
| | | | | | | | | | Adder dialog which is used along with custom_command_multivalued_widget. It behaivor of confirm dialog and adds fields which are necessary. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Create non editable row widget for mutlivalued widgetPavel Vomacka2017-03-084-13/+25
| | | | | | | | | | | | Old krb-principal widget is changed to general one. And used also for ipacertmapdata in user. This widget make every line non-editable. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to set field always writablePavel Vomacka2017-03-082-26/+52
| | | | | | | | | | | | If field will have set attribute 'always_writable' to true, then 'no_update' flag will be ingored. Used in command user-{add,remove}-certmap which needs to be writable in WebUI and also needs to be omitted from user-mod command. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Use GSS-SPNEGO if connecting locallySimo Sorce2017-03-071-1/+5
| | | | | | | | | | | | | | | | | | | | | GSS-SPNEGO allows us to negotiate a SASL bind with less roundtrips therefore use it when possible. We only enable it for local connections for now because we only recently fixed Cyrus SASL to do proper GSS-SPNEGO negotiation. This change means a newer and an older version are not compatible. Restricting ourselves to the local host prevents issues with incompatible services, and it is ok for us as we are only really looking for speedups for the local short-lived connections performed by the framework. Most other clients have longer lived connections, so peformance improvements there are not as important. Ticket: https://pagure.io/freeipa/issue/6656 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa systemd unit should define Wants=network instead of Requires=networkFlorence Blanc-Renaud2017-03-071-1/+1
| | | | | | | | | | | The file ipa.service defines Requires=network.target which means that ipa stack will be restarted each time the network stack is restarted. This is not needed, and Wants=network.target will be sufficient. https://fedorahosted.org/freeipa/ticket/6723 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: Change structure of Identity submenuPavel Vomacka2017-03-075-7/+48
| | | | | | | | | | | | | Previously there were 'User Groups', 'Host Groups' and 'Netgroups' separately, now these three items are grouped into one named 'Groups' which has sidebar with three items mentioned above. This change allows us to move ID views into Identity submenu. https://pagure.io/freeipa/issue/6717 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add sizelimit:0 to cert-findPavel Vomacka2017-03-074-0/+4
| | | | | | | | | | | It was not possible to get all arbitrary certificates which were added using {user|host|service|idview}-add-cert method. Adding sizelimit:0 to this cert-find command fix the issue. It set sizelimit to unlimited. https://pagure.io/freeipa/issue/6712 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-078-3/+33
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* rabase.get_certificate: make serial number arg mandatoryFraser Tweedale2017-03-072-2/+2
| | | | | | | | | | | In rabase.get_certificate it does not make sense for the serial_number argument to be optional. Make it a mandatory positional argument. Part of: https://pagure.io/freeipa/issue/3473 Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* test_csrgen: adjusted comparison test scripts for CSRGeneratorMichal Reznik2017-03-072-8/+10
| | | | | | | | | | | | | | | | | | Commit ada91c2 introduced changes in "csrgen/templates/openssl_base.tmpl" which broke the following 2 tests: test_CSRGenerator.test_userCert_OpenSSL test_CSRGenerator.test_caIPAserviceCert_OpenSSL The tests use files caIPAserviceCert_openssl.sh and userCert_openssl.sh as expected scripts in order to compare scripts generated by CSRGenerator. E.g. as other parameter was introduced we are now not checking with "if [[ $# -ne 2 ]]" but rather with if "[[ $# -lt 2 ]]". https://pagure.io/freeipa/issue/6724 Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* We don't offer no quickiesStanislav Laznicka2017-03-061-1/+1
| | | | | | | It's not our main priority as developers to offer any forms of quickies nor guides on how to perform them. Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix cookie with Max-Age processingStanislav Laznicka2017-03-062-5/+12
| | | | | | | | | | When cookie has Max-Age set it tries to get expiration by adding to a timestamp. Without this patch the timestamp would be set to None and thus the addition of timestamp + max_age fails https://pagure.io/freeipa/issue/6718 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Use https to get security domain from DogtagChristian Heimes2017-03-031-1/+5
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Extract method to map principal to princpal typeFraser Tweedale2017-03-031-15/+14
| | | | | | Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove redundant principal_type argumentFraser Tweedale2017-03-032-9/+12
| | | | | | | | | Minor refactor to remove the redundant 'principal_type' argument from 'caacl_check' and associated functions. Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* man: update ipa-cacert-manageTomas Krizek2017-03-021-1/+4
| | | | | | | | | Make it clear this command is used to only renew certificate for the CA and provide guidance on how to renew other certificates. https://pagure.io/freeipa/issue/6648 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Change README to use MarkdownPetr Vobornik2017-03-024-108/+90
| | | | | | | | | So that it will be nicely formatted on FreeIPA Pagure landing page. https://pagure.io/freeipa Some links were updated as other projects also moved to Pagure.io. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-0215-13/+862
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Cleanup certdbChristian Heimes2017-03-021-62/+55
| | | | | | | | | * use with statement to open/close files * prefer fchmod/fchown when a file descriptor is available * set permission before data is written to file Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Default to pkginstall=true without duplicated definitionsChristian Heimes2017-03-021-2/+1
| | | | | | | | | | | | automake was complaining about duplicated definitions of pkginstall. It was defined to true in Makefile.python.am only to be overriden in some Makefile.am. Now we assume that pkginstall is implicit true and only skip installation when pkginstall is explicitly set to false. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* pylint: ignore pypi placeholdersChristian Heimes2017-03-021-0/+1
| | | | | | | | pylint gets confused by duplicated package names, e.g. ipaplatform and pypi/ipaplatform. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Python build: use --build-base everywhereChristian Heimes2017-03-021-7/+16
| | | | | | | | | Some calls to setup.py specified a build base, some did not. This can lead to issues, e.g. build, clean and install are using different build directories. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add with_wheels global to install wheel and PyPI packaging dependenciesChristian Heimes2017-03-021-3/+8
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-01 02:00:07 +0000