| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
| |
We have helpers to manage these values so they shouldn't be available
via add/mod. There is no logic behind them to do the right thing.
https://fedorahosted.org/freeipa/ticket/1307
https://fedorahosted.org/freeipa/ticket/1320
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
HBAC rules control who can access what services on what hosts and from where.
You can use HBAC to control which users or groups on a source host can
access a service, or group of services, on a target host.
Since applying HBAC rules implies use of a production environment,
this plugin aims to provide simulation of HBAC rules evaluation without
having access to the production environment.
Test user coming from source host to a service on a named host against
existing enabled rules.
ipa hbactest --user= --srchost= --host= --service=
[--rules=rules-list] [--nodetail] [--enabled] [--disabled]
--user, --srchost, --host, and --service are mandatory, others are optional.
If --rules is specified simulate enabling of the specified rules and test
the login of the user using only these rules.
If --enabled is specified, all enabled HBAC rules will be added to simulation
If --disabled is specified, all disabled HBAC rules will be added to simulation
If --nodetail is specified, do not return information about rules matched/not matched.
If both --rules and --enabled are specified, apply simulation to --rules _and_
all IPA enabled rules.
If no --rules specified, simulation is run against all IPA enabled rules.
EXAMPLES:
1. Use all enabled HBAC rules in IPA database to simulate:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
matched: allow_all
2. Disable detailed summary of how rules were applied:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail
--------------------
Access granted: True
--------------------
3. Test explicitly specified HBAC rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule
---------------------
Access granted: False
---------------------
notmatched: my-second-rule
notmatched: myrule
4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
matched: allow_all
5. Test all disabled HBAC rules in IPA database:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled
---------------------
Access granted: False
---------------------
notmatched: new-rule
6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled
---------------------
Access granted: False
---------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
7. Test all (enabled and disabled) HBAC rules in IPA database:
$ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled
--------------------
Access granted: True
--------------------
notmatched: my-second-rule
notmatched: my-third-rule
notmatched: myrule
notmatched: new-rule
matched: allow_all
Only rules existing in IPA database are tested. They may be in enabled or
disabled disabled state.
Specifying them through --rules option explicitly enables them only in
simulation run.
Specifying non-existing rules will not grant access and report non-existing
rules in output.
|
| |
|
|
|
|
|
|
|
| |
The caIPAserviceCert.cfg was updated to set the client cert flag on
server certs we issue.
https://fedorahosted.org/freeipa/ticket/1434
|
|
|
|
|
|
|
| |
This can cause problems if a host is enrolled, unenrolled and a password
set. The password will be marked as expired like all new passwords are.
https://fedorahosted.org/freeipa/ticket/1526
|
|
|
|
|
|
|
| |
The HBAC service, HBAC service group, sudo command and sudo command
group have been modified to show the associations as facets.
Ticket #1536
|
|
|
|
|
|
|
| |
The HBAC service class has been modified to define the memberof
relationship with HBAC service group.
Ticket #1546
|
|
|
|
|
|
|
| |
The IPA.service_provisioning_status_widget has been modified to
execute the disable command with the right entity name.
Ticket #1543
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1493
|
|
|
|
|
|
|
| |
The sudo command group details page has been fixed to use the
correct label name.
Ticket #1537.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
change widget and widget unit tests to hold on to entity, not entity name.
Replacing entity_name with entity.name in most places.
The one exception is columns for table_widget.
Widgets that refer to other entities have to have late resolution of the entity object, due to circular dependencies.
cleanup entity assignment.
removed template and layout,
merged setup into create
adder dialogs adjust height for external
removed init from widget, isection, association, facet, host and service
Make unit tests use factory.
fix functional tests to click find link correctly.
tweak to activation test, but still broken.
moved initialization code to the end
use --all for hbacrule find, so the type shows up now
fixed dns exception code and exception handling for get_entity
replace metadata look up with value from entity.
fixed author lines
removed duplicate columns in managed by facets.
tweak to nav fix in order to initialize tab.
more defensive code
update metadata for true false
one line init for entity_name in widget
move init code to end of constructor functions
moved constants to start of function for adder_dialog
external fields for dialogs initialized at dialog creation
sudo sections: move add fields and columns to widget definition.
The parameter validation in IPA.column ...This is precondition checking. Note that it merely throws an exception if the entity_name is not set. I want this stuff at the top of the function so that it is obvious to people looking to use them what is required. I added a comment to make this clear, but I'd like to keep precondition checking at the top of the function.
decreased the scope of the pkey_name and moved the initiailzation fof columns into the setup_column function for association_tables
return false at the end of click handler
removed blank labels in sudo command section
fix radio buttons for sudo category
fixed table side for adder dialogs with external fields
comments for future direction with add_columns
https://fedorahosted.org/freeipa/ticket/1451
https://fedorahosted.org/freeipa/ticket/1462
https://fedorahosted.org/freeipa/ticket/1493
https://fedorahosted.org/freeipa/ticket/1497
https://fedorahosted.org/freeipa/ticket/1532
https://fedorahosted.org/freeipa/ticket/1534
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
normalization.
Replace deepcopy with constructor (i.e. type call)
Can now "clone" with configuration changes by passing object
of the same type to it's constructor, e.g.
dn1 = DN(('cn', 'foo'))
dn2 = DN(dn1)
dn2 = DN(dn1, first_key_match=False)
Remove pairwise grouping for RDN's. Had previously removed it
for DN's, left it in for RDN's because it seemed to make sense
because of the way RDN's work but consistency is a higher goal.
Add keyword constructor parameters to pass configuration options.
Make first_key_match a configuration keyword.
Updated documentation.
Updated unit test.
FWIW, I noticed the unittest is now running 2x faster, not sure why,
removal of deepcopy? Anyway, hard to argue with performance doubling.
|
|
|
|
|
|
|
| |
Fix several test failures when issuer does not match the one
generated by make-testcert (CN=Certificate Authority,O=<realm>).
https://fedorahosted.org/freeipa/ticket/1527
|
|
|
|
|
| |
The IPA.adder_dialog has been modified to use translated label for
the Find button.
|
|
|
|
|
|
|
| |
The sudo rule interface has been modified to remove unused labels
and use translated dialog box title.
Ticket #1518
|
|
|
|
|
|
|
|
| |
The handler for host 'Set OTP' button has been modified to obtain
the primary key from the entity and return false to stop the normal
event processing.
Ticket #1511
|
|
|
|
|
|
|
|
| |
When using the add_indirect helper we create a new map and then add a key
for it all in one step. If adding the key fails for any reason be sure to
remove the map we added.
https://fedorahosted.org/freeipa/ticket/1520
|
|
|
|
| |
ticket 1523
|
|
|
|
|
|
|
|
|
|
|
| |
The summary value was set to primary key. However, the primary key
may contain also an info option as a workaround for multiple direct
maps problem.
This patch sets the result 'value' and thus summary text to
expected and consistent value.
https://fedorahosted.org/freeipa/ticket/1524
|
|
|
|
|
|
|
|
|
| |
When opening a bookmark, each tab level will be updated separately
from top to bottom according to the URL state. The navigation code
has been modified to recognize when an ancestor tab is being updated
and not change the URL state.
Ticket #1521
|
|
|
|
| |
BZ https://bugzilla.redhat.com/show_bug.cgi?id=723969
|
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1477
Redirection after updating empty DNS Record (which is deleted).
Added hook to details facet for post update operation.
|
|
|
|
| |
ticket 1375
|
|
|
|
|
|
|
| |
The entitlement facets have been modified to use the new icons
provided by Kyle Baker.
Ticket #1425
|
|
|
|
|
|
|
|
| |
If you had a 64-bit system and installed a 32-bit version of IPA then
ipa-getkeytab probably wouldn't work because yum wouldn't know to pull
in the 32-bit version of cyrus-sasl-gssapi.
https://fedorahosted.org/freeipa/ticket/1499
|
|
|
|
|
|
| |
Fix references to ipa-replica-manage in ipa-csreplica-manage.
https://fedorahosted.org/freeipa/ticket/1519
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1505
|
|
|
|
| |
fix JSL warning
|
|
|
|
|
| |
The click event handlers for certificate buttons have been fixed
to stop standard event processing which causes the page to change.
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1493
|
|
|
|
|
| |
The mock-up get_state() has been modified to return an empty object
if it's called without parameter. It's the same as $bbq.getState().
|
|
|
|
|
|
|
|
|
|
|
|
| |
The navigation code has been modified store the facet's state
separately in the facet object itself. The path state is stored
in the navigation object. When the path is changed to view a new
facet, only the path and the state of the new facet will be shown
in the URL, thus keeping the URL short.
This fixes pagination, bookmark and search filter problems as well.
Ticket #1507, 1516, 1517
|
|
|
|
|
|
|
|
| |
The select event handler in the navigation tab has been modified to
distinguish the source of the event. If the event is triggered by
URL hash change, it will use the state specified in the URL. If the
event is triggered by a mouse click, it will use the state stored
internally.
|
|
|
|
|
|
|
|
| |
The IPA.current_facet() has been merged into IPA.entity.setup()
and replaced by IPA.entity.get_facet(). The setup() will read the
current facet's name from the <entity>-facet URL parameter and store
the facet object in the entity object. The get_facet() without any
parameter will return the current facet object.
|
|
|
|
| |
ticket 1147
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1514
|
|
|
|
|
|
|
| |
It won't appear in the UI/CLI but is still available via XML-RPC.
allow is the default and deny will be rejected.
https://fedorahosted.org/freeipa/ticket/1495
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The pairwise grouping used to form RDN's and AVA's proved to be
confusing in practice, this patch removes that functionality thus
requiring programmers to explicitly pair attr,value using a tuple or
list.
In addition it was discovered additional functionality was needed to
support some DN operations in freeipa. DN objects now support
startswith(), endswith() and the "in" membership test. These functions
and operators will accept either a DN or RDN.
The unittest was modified to remove the pairwise tests and add new
explicit tests. The unittest was augmented to test the new
functionality. In addition the unittest was cleaned up a bit to use
common utilty functions for improved readabilty and robustness.
The documentation was updated.
fix test_role_plugin use of DN to avoid pairwise grouping
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1509
https://fedorahosted.org/freeipa/ticket/1510
|
|
|
|
|
|
|
| |
The code for supporting custom layouts using HTML templates has been
removed. If it's needed again in the future the code can be restored.
Ticket #1501
|
|
|
|
|
|
|
|
| |
The HBAC access time is currently not supported, so the related UI
code has been removed to reduce maintenance issue. When the feature
becomes supported in the future the code may be restored/rewritten.
Ticket #546
|
|
|
|
|
|
|
|
| |
In a recent change the details page was changed to create and locate
field containers with 'details-field' CSS class. The HBAC and sudo
custom details pages have been modified to use the same CSS class.
Ticket #1508
|
|
|
|
|
|
|
|
|
| |
The UUID field has been removed from the entitlement registration
dialog box because it's currently not supported. The code has been
modified not to send empty UUID value should this become supported
in the future.
Ticket #1506
|
|
|
|
|
|
|
|
|
|
| |
A custom adder dialog has been added for DNS zones to simplify creating
reverse zones from IP address. The dialog provides a checkbox which
indicates whether the content of the zone name field is an IP address.
The IP address will be used to generate the reverse zone name and email
address.
Ticket #1045
|
|
|
|
|
|
|
| |
A custom deleter dialog for hosts has been added to provide an option
whether to remove the hosts from DNS.
Ticket #1470
|
|
|
|
|
|
|
|
|
| |
Remove all DNS entities if the DNS server is not installed.
Removes it from the navigation as well.
https://fedorahosted.org/freeipa/ticket/1498
move created count to last thing in the funciton.
|
|
|
|
| |
This fixes an indentation problem.
|
| |
|