summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* server install: remove duplicate knob definitionsJan Cholasta2017-03-131-24/+0
| | | | | | | | Remove duplicate definitions of knobs already defined in client install. https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: add missing space in realm_name descriptionJan Cholasta2017-03-131-1/+1
| | | | | | https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: remove duplicate -w optionJan Cholasta2017-03-131-0/+4
| | | | | | | | | Remove duplicate -w alias of --admin-password in ipa-server-install and ipa-replica-install. https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certmap: load certificate from file in certmap-match CLIJan Cholasta2017-03-131-0/+49
| | | | | | | | | Load the certificate from a file specified in the first argument. Raw certificate value can be specified using --certificate. https://pagure.io/freeipa/issue/6646 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* installer: update time estimatesTomas Krizek2017-03-107-11/+17
| | | | | | | | | | Time estimates have been updated to be more accurate. Only tasks that are estimated to take longer than 10 seconds have the estimate displayed. https://pagure.io/freeipa/issue/6596 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Bump required version of gssproxy to 0.7.0David Kupka2017-03-101-2/+1
| | | | | | | https://pagure.io/freeipa/issue/6671 https://pagure.io/freeipa/issue/6698 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* pylint_plugins: add forbidden import checkerJan Cholasta2017-03-1016-11/+135
| | | | | | | | | | Add new pylint AST checker plugin which implements a check for imports forbidden in IPA. Which imports are forbidden is configurable in pylintrc. Provide default forbidden import configuration and disable the check for existing forbidden imports in our code base. Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: do not warn about CAs if there is only one masterPetr Vobornik2017-03-101-0/+4
| | | | | | | | | | | | | | | | | | Web UI showed pop-up dialog which recommends to install additional CA in topology section when only 1 CA existed even if there was only one master. Though behind the pop-up is to prevent situation, where multiple replicas are installed but neither with --setup-ca option and thus risking to loose CA when original master is lost. The warning was displayed also if only one IPA server exists. It is unnecessary to annoy admin only about CA because the entire IPA is not duplicated. Therefore the pop-up is now shown only one IPA server exists. https://pagure.io/freeipa/issue/6598 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Store session cookie in a ccache optionSimo Sorce2017-03-103-22/+239
| | | | | | | | | | | Instead of using the kernel keyring, store the session cookie within the ccache. This way kdestroy will really wipe away all credentials. Ticket: https://pagure.io/freeipa/issue/6661 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add support for searching policies in cn=accountsSimo Sorce2017-03-103-6/+17
| | | | | | | | | | | Use the new multibase search to collect policies from multiple subtrees. The 'any' parameter is set to 'true' so the search stop when the first result is found in any of the bases. https://fedorahosted.org/freeipa/ticket/6568 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add code to retrieve results from multiple basesSimo Sorce2017-03-102-0/+113
| | | | | | | | | Internally performs multiple seraches as needed based on the basedn strings passed in and whether the caller indicated that any result is ok or all results are needed. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipapython: fix DEFAULT_PLUGINS in version.pyJan Cholasta2017-03-092-2/+9
| | | | | | | | | | | Replace the placeholder with the actual value during build. This fixes the client incorrectly assuming that the default version of all plugins is 1. https://pagure.io/freeipa/issue/6597 Reviewed-By: Martin Basti <mbasti@redhat.com>
* backup: backup anonymous keytabMartin Basti2017-03-091-0/+1
| | | | | | | | Freeipa stops working without anon keytab https://pagure.io/freeipa/issue/5959 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server install: require IPv6 stack to be enabledTomas Krizek2017-03-095-0/+22
| | | | | | | | | | Add checks to install and replica install to verify IPv6 stack is enabled. IPv6 is required by some IPA parts (AD, conncheck, ...). https://pagure.io/freeipa/issue/6608 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* add whoami commandAlexander Bokovoy2017-03-094-2/+150
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whoami command allows to query details about currently authenticated identity. The command returns following information: * object class name * function to call to get actual details about the object * arguments to pass to the function There are five types of objects that could bind to IPA using their credentials. `ipa whoami` call expects one of the following: * users * staged users * hosts * Kerberos services * ID user override from the default trust view The latter category of objects is automatically mapped by SASL GSSAPI mapping rule in 389-ds for users from trusted Active Directory forests. The command is expected to be used by Web UI to define proper view for the authenticated identity. It is not visible in the command line interface is `ipa` command. Below is an example of how communication looks like for a host principal: # kinit -k # ipa console (Custom IPA interactive Python console) >>> api.Command.whoami() {u'command': u'host_show/1', u'object': u'host', u'arguments': (u'ipa.example.com',)} >>> Fixes https://pagure.io/freeipa/issue/6643 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-managed-entries: only permit running the command on IPA masterMartin Babinsky2017-03-091-0/+3
| | | | | | https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa-managed-entries: use server-mode APIMartin Babinsky2017-03-091-1/+5
| | | | | | | | | | During LDAP connection management refactoring the ad-hoc ldap connection in `ipa-managed-entries` was replaced by calls to ldap2 backend without updating API initialization. https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Don't use weak ciphers for client HTTPS connectionsStanislav Laznicka2017-03-092-1/+8
| | | | | | https://pagure.io/freeipa/issue/6730 Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: Add cermapmatch modulePavel Vomacka2017-03-085-1/+406
| | | | | | | | | | Add module which can show users which are mapped to the provided certificate. Additionaly, the certificate is parsed and parsed information are also displayed. https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Adapter for certmap_match result tablePavel Vomacka2017-03-081-0/+79
| | | | | | | | | | | | | | | Result of certmap_match command is in the following format: [{domain: 'domain1', uid:[uid11,uid12,uid13]}, {domain: 'domain2', uid:[uid21, uid22, uid23},...] For correct displaying in table we need to reformat it to the following: [{domain: 'domain1', uid: 'uid11'}, {domain: 'domain1', uid: 'uid12'},... This can be done using this Adapter. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Possibility to choose object when API call returns list of objectsPavel Vomacka2017-03-081-0/+13
| | | | | | | | | | | | In case that API call returns array of objects which contains data, using 'object_index' attribute in adapter specification we can set which object should be used. It is possible to choose only one object specified by its index in array. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to turn of autoload when details.load is calledPavel Vomacka2017-03-082-1/+10
| | | | | | | | | | When field on details facet has set 'autoload_value' to false, then it won't be loaded using that.load method of details facet. That means that field might stay unchanged even that loading of data was performed. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* config: re-add `init_config` and `config`Jan Cholasta2017-03-081-0/+149
| | | | | | | | | | | Re-add `init_config` and `config` to `ipapython.config`, because they are used by Ipsilon (see https://pagure.io/ipsilon/issue/265). This partially reverts commit 7b966e8577fdb56f069cf26a6ab4d6c77b8743b9. https://pagure.io/freeipa/issue/6707 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Chain CSR generator file loadersChristian Heimes2017-03-081-17/+44
| | | | | | | | | First try custom location, then csrgen subdir in confdir and finally fall back to package data. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move csrgen templates into ipaclient packageChristian Heimes2017-03-0819-52/+30
| | | | | | | | | | | | csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow login to WebUI using Kerberos aliases/enterprise principalsMartin Babinsky2017-03-082-49/+16
| | | | | | | | | | | | | The logic of the extraction/validation of principal from the request and subsequent authentication was simplified and most of the guesswork will be done by KDC during kinit. This also allows principals from trusted domains to login via rpcserver. https://fedorahosted.org/freeipa/ticket/6343 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: fix `dnsrecord_add` interactive modeJan Cholasta2017-03-082-1/+7
| | | | | | | | | | | | | | | `dnsrecord_add` interactive mode might prompt for value of non-existent arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This happens because `dnsrecord_add` extra flags are incorrectly defined as parts of the respective DNS records. Remove extra flags from DNS record parts to fix the interactive mode on old clients talking to new servers. Skip non-existent arguments in the interactive mode to fix new clients talking to old servers. https://fedorahosted.org/freeipa/ticket/6457 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: use --setup-kra in testsMartin Basti2017-03-081-7/+2
| | | | | | | | | | | | This will allow to test --setup-kra option together with ipa-server-install in install tests Separate installation using ipa-kra-install is already covered. https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* KRA: add --setup-kra to ipa-server-installMartin Basti2017-03-085-7/+21
| | | | | | | | | | | | | | | | | This patch allows to install KRA on first IPA server in one step using ipa-server-install This option improves containers installation where ipa-server can be installed with KRA using one call without need to call docker exec. Please note the the original `kra.install()` calls in ipaserver/install/server/install.py were empty operations as it did nothing, so it is safe to move them out from CA block https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: don't change casing of Auth Indicators valuesPavel Vomacka2017-03-082-4/+4
| | | | | | | | | | | All values were previously converted to lowercase which was not coresponding with CLI behaviour. Now they stay as they are inserted. I also have to change the strings to lowercase because the otp and radius should be inserted as lowercase words. https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Allow disabling lowering text in custom_checkbox_widgetPavel Vomacka2017-03-082-1/+6
| | | | | | | | | Add new attribute which keeps information whether each text added using custom_checkbox_widget shoud be transformed to lowercase. Part of: https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fixes normalization of value in attributes widgetPetr Vobornik2017-03-081-1/+1
| | | | | | | | | | | | | | | | Fix is in checkboxes widget but the only affected one is attributes widget. Reproduction: 1. Add permission with attribute with uppercase character $ ipa permission-add aa_test --type=stageuser --attrs=businessCategory --right=read 2. Check if it is correctly displayed in Web UI Actual result: - businesscategory is not checked Expected result: - businesscategory is checked Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* IdM Server: list all Employees with matching Smart CardFlorence Blanc-Renaud2017-03-083-1/+179
| | | | | | | | | | | | | Implement a new IPA command allowing to retrieve the list of users matching the provided certificate. The command is using SSSD Dbus interface, thus including users from IPA domain and from trusted domains. This requires sssd-dbus package to be installed on IPA server. https://fedorahosted.org/freeipa/ticket/6646 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add support for custom table pagination sizePavel Vomacka2017-03-086-6/+77
| | | | | | | | | | | New customization button opens dialog with field for setting the number of lines in tables. After saving the new value there is new topic which starts refreshing current table facet (if shown) and set all other facets expired. Therefore all tables are immediately regenerated. https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make singleton from config modulePavel Vomacka2017-03-081-6/+45
| | | | | | | | Also added general setter and getter for attributes of config. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add javascript integer validatorPavel Vomacka2017-03-081-0/+34
| | | | | | | | | Javascript integer validator checks whether value entered into field is number and is not higher than Number.MAX_SAFE_INTEGER constant. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* man: add missing --setup-adtrust option to manpageMartin Basti2017-03-082-0/+6
| | | | | | | | | ipa-server-install and ipa-replica-install manpages miss --setup-adtrust options https://pagure.io/freeipa/issue/6630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* WebUI: Add certmap modulePavel Vomacka2017-03-086-1/+433
| | | | | | | | | Add facets for certmaprule and certmapconfigure entities. https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Custom command multivalued adder dialogPavel Vomacka2017-03-081-0/+34
| | | | | | | | | | Adder dialog which is used along with custom_command_multivalued_widget. It behaivor of confirm dialog and adds fields which are necessary. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Create non editable row widget for mutlivalued widgetPavel Vomacka2017-03-084-13/+25
| | | | | | | | | | | | Old krb-principal widget is changed to general one. And used also for ipacertmapdata in user. This widget make every line non-editable. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to set field always writablePavel Vomacka2017-03-082-26/+52
| | | | | | | | | | | | If field will have set attribute 'always_writable' to true, then 'no_update' flag will be ingored. Used in command user-{add,remove}-certmap which needs to be writable in WebUI and also needs to be omitted from user-mod command. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Use GSS-SPNEGO if connecting locallySimo Sorce2017-03-071-1/+5
| | | | | | | | | | | | | | | | | | | | | GSS-SPNEGO allows us to negotiate a SASL bind with less roundtrips therefore use it when possible. We only enable it for local connections for now because we only recently fixed Cyrus SASL to do proper GSS-SPNEGO negotiation. This change means a newer and an older version are not compatible. Restricting ourselves to the local host prevents issues with incompatible services, and it is ok for us as we are only really looking for speedups for the local short-lived connections performed by the framework. Most other clients have longer lived connections, so peformance improvements there are not as important. Ticket: https://pagure.io/freeipa/issue/6656 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa systemd unit should define Wants=network instead of Requires=networkFlorence Blanc-Renaud2017-03-071-1/+1
| | | | | | | | | | | The file ipa.service defines Requires=network.target which means that ipa stack will be restarted each time the network stack is restarted. This is not needed, and Wants=network.target will be sufficient. https://fedorahosted.org/freeipa/ticket/6723 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: Change structure of Identity submenuPavel Vomacka2017-03-075-7/+48
| | | | | | | | | | | | | Previously there were 'User Groups', 'Host Groups' and 'Netgroups' separately, now these three items are grouped into one named 'Groups' which has sidebar with three items mentioned above. This change allows us to move ID views into Identity submenu. https://pagure.io/freeipa/issue/6717 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add sizelimit:0 to cert-findPavel Vomacka2017-03-074-0/+4
| | | | | | | | | | | It was not possible to get all arbitrary certificates which were added using {user|host|service|idview}-add-cert method. Adding sizelimit:0 to this cert-find command fix the issue. It set sizelimit to unlimited. https://pagure.io/freeipa/issue/6712 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-078-3/+33
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* rabase.get_certificate: make serial number arg mandatoryFraser Tweedale2017-03-072-2/+2
| | | | | | | | | | | In rabase.get_certificate it does not make sense for the serial_number argument to be optional. Make it a mandatory positional argument. Part of: https://pagure.io/freeipa/issue/3473 Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* test_csrgen: adjusted comparison test scripts for CSRGeneratorMichal Reznik2017-03-072-8/+10
| | | | | | | | | | | | | | | | | | Commit ada91c2 introduced changes in "csrgen/templates/openssl_base.tmpl" which broke the following 2 tests: test_CSRGenerator.test_userCert_OpenSSL test_CSRGenerator.test_caIPAserviceCert_OpenSSL The tests use files caIPAserviceCert_openssl.sh and userCert_openssl.sh as expected scripts in order to compare scripts generated by CSRGenerator. E.g. as other parameter was introduced we are now not checking with "if [[ $# -ne 2 ]]" but rather with if "[[ $# -lt 2 ]]". https://pagure.io/freeipa/issue/6724 Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* We don't offer no quickiesStanislav Laznicka2017-03-061-1/+1
| | | | | | | It's not our main priority as developers to offer any forms of quickies nor guides on how to perform them. Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix cookie with Max-Age processingStanislav Laznicka2017-03-062-5/+12
| | | | | | | | | | When cookie has Max-Age set it tries to get expiration by adding to a timestamp. Without this patch the timestamp would be set to None and thus the addition of timestamp + max_age fails https://pagure.io/freeipa/issue/6718 Reviewed-By: Simo Sorce <ssorce@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-30 14:58:05 +0000