summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* certprofile: add profile format explanationFraser Tweedale2015-08-121-0/+20
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/5089 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use absolute importsPetr Viktorin2015-08-1263-138/+159
| | | | | | | In Python 3, implicit relative imports will not be supported. Use fully-qualified imports everywhere. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Import 'reduce' from functoolsPetr Viktorin2015-08-121-0/+1
| | | | | | | The reduce function is no longer a built-in in Python 3. Importing it from functools works on both py2 and py3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Replace dict.has_key with the 'in' operatorPetr Viktorin2015-08-1214-55/+56
| | | | | | | | | The deprecated has_key method will be removed from dicts in Python 3. For custom dict-like classes, has_key() is kept on Python 2, but disabled for Python 3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize function and method attribute namesPetr Viktorin2015-08-126-9/+9
| | | | | | | | Python 3 uses double-underscored names for internal function attributes. In Python 2.7, these names exist as aliases to the old 'func_*' and 'im_*' names. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-12118-661/+661
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* install: Fix server and replica install optionsJan Cholasta2015-08-122-74/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/5184 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* idranges: raise an error when local IPA ID range is being modifiedMartin Babinsky2015-08-121-23/+29
| | | | | | | | | also show the message about the way UID/GID ranges are managed in FreeIPA in the idrange-mod's help message https://fedorahosted.org/freeipa/ticket/4826 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* validate mutually exclusive options in vault-addPetr Vobornik2015-08-121-0/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/5195 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* adjust search so that it works for non-admin usersPetr Vobornik2015-08-125-3/+8
| | | | | | | | | | | | | | | | Non-admin user can now search for: - hosts - hostgroups - netgroups - servers - services (Fixes ACI issue where search returns nothing when user does't have read rights for an attribute in search_attributes. https://fedorahosted.org/freeipa/ticket/5167 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix KRB5PrincipalName / UPN SAN comparisonFraser Tweedale2015-08-111-1/+1
| | | | | | | | | | | | | Depending on how the target principal name is conveyed to the command (i.e. with / without realm), the KRB5PrincipalName / UPN subjectAltName validation could be comparing unequal strings and erroneously rejecting a valid request. Normalise both side of the comparison to ensure that the principal names contain realm information. Fixes: https://fedorahosted.org/freeipa/ticket/5191 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix default CA ACL added during upgradeFraser Tweedale2015-08-111-1/+1
| | | | | | | | | The upgrade script is adding the default CA ACL with incorrect attributes - usercategory=all instead of servicecategory=all. Fix it to create the correct object. Fixes: https://fedorahosted.org/freeipa/ticket/5185 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust-install: Correctly determine 4.2 FreeIPA serversTomas Babej2015-08-111-1/+1
| | | | | | | | | | | | | We need to detect a list of FreeIPA 4.2 (and above) servers, since only there is the required version of SSSD present. Since the maximum domain level for 4.2 is 0 (and not 1), we can filter for any value of ipaMaxDomainLevel / ipaMinDomainLevel attributes to generate the list. https://fedorahosted.org/freeipa/ticket/5199 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Work around python-nss bug on unrecognised OIDsFraser Tweedale2015-08-111-1/+14
| | | | | | | | | | | | | | | A bug in python-nss causes an error to be thrown when converting an unrecognised OID to a string. If cert-request receives a PKCS #10 CSR with an unknown extension, the error is thrown. Work around this error by first checking if the OID is recognised and, if it is not, using a different method to obtain its string representation. Once the python-nss bug is fixed, this workaround should be reverted. https://bugzilla.redhat.com/show_bug.cgi?id=1246729 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add profile for DNP3 / IEC 62351-8 certificatesFraser Tweedale2015-08-114-0/+117
| | | | | | | | | | | The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow SAN extension for cert-request self-serviceFraser Tweedale2015-08-111-1/+1
| | | | | | | | | | | Users cannot self-issue a certificate with a subjectAltName extension (e.g. with rfc822Name altNames). Suppress the cert-request "request certificate with subjectaltname" permission check when the bind principal is the target principal (i.e. cert-request self-service). Fixes: https://fedorahosted.org/freeipa/ticket/5190 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Give more info on virtual command access denialFraser Tweedale2015-08-111-1/+1
| | | | | | | | The current error message upon a virutal command access denial does not give any information about the virtual operation that was prohibited. Add more information to the ACIError message. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix upgrade of sidgen and extdom pluginsMartin Basti2015-08-102-6/+31
| | | | | | | | | If configuration entries already exist, upgrade will not add them again. https://fedorahosted.org/freeipa/ticket/5151 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add LDAP vs Kerberos behavior description to user auth typesPetr Vobornik2015-08-104-6/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/4935 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fixed missing KRA agent cert on replica.Endi S. Dewata2015-08-101-8/+9
| | | | | | | | | The code that exports the KRA agent certificate has been moved such that it will be executed both on master and replica. https://fedorahosted.org/freeipa/ticket/5174 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dcerpc: Simplify generation of LSA-RPC binding stringsTomas Babej2015-08-071-2/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5183 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix selector of protocol for LSA RPC binding stringAlexander Bokovoy2015-08-071-2/+2
| | | | | | | | | | | | | For Windows Server 2012R2 and others which force SMB2 protocol use we have to specify right DCE RPC binding options. For using SMB1 protocol we have to omit specifying SMB2 protocol and anything else or otherwise SMB1 would be considered a pipe to connect to. This is by design of a binding string format. https://fedorahosted.org/freeipa/ticket/5183 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix incorrect type comparison in trust-fetch-domainsTomas Babej2015-08-061-1/+1
| | | | | | | | Value needs to be unpacked from the list and converted before comparison. https://fedorahosted.org/freeipa/ticket/5182 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix otptoken-remove-managedby command summaryFraser Tweedale2015-08-051-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Port from python-kerberos to python-gssapiMichael Simacek2015-08-055-53/+95
| | | | | | | | | | | | kerberos library doesn't support Python 3 and probably never will. python-gssapi library is Python 3 compatible. https://fedorahosted.org/freeipa/ticket/5147 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* store certificates issued for user entries as userCertificate;binaryMartin Babinsky2015-08-042-13/+31
| | | | | | | | | | | This patch forces the user management CLI command to store certificates as userCertificate;binary attribute. The code to retrieve of user information was modified to enable outputting of userCertificate;binary attribute to the command line. The modification also fixes https://fedorahosted.org/freeipa/ticket/5173 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test suite for user/host/service certificate management API commandsMartin Babinsky2015-08-031-0/+349
| | | | | | | | | These tests excercise various scenarios when using new class of API commands to add or remove certificates to user/service/host entries. Part of http://www.freeipa.org/page/V4/User_Certificates Reviewed-By: Milan Kubík <mkubik@redhat.com>
* user-show: add --out option to save certificates to fileFraser Tweedale2015-07-313-4/+30
| | | | | | | | | | Add the --out option to user-show, bringing it into line with host-show and service-show with the ability to save the user's certificate(s) to a file. https://fedorahosted.org/freeipa/ticket/5171 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile-import: do not require profileId in profile dataChristian Heimes2015-07-311-3/+5
| | | | | | | | | | | | | certprofile-import no longer requires profileId in profile data. Instead the profile ID from the command line is taken and added to the profile data internally. If profileId is set in the profile, then it still has to match the CLI option. https://fedorahosted.org/freeipa/ticket/5090 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: Allow Tracker.dn be an instance of FuzzyMilan Kubík2015-07-311-2/+3
| | | | | | | | | | | | | Some of the IPA LDAP entries are using ipaUniqueID as the "primary key". To match this UUID based attribute in assert_deepequal, an instance of Fuzzy class must be used. This change adds the possibility to assign the Fuzzy object as the DN for the tracked entry. The user may need to override the rdn and name properties for the class using the Fuzzy DN. Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Validate vault's file parametersChristian Heimes2015-07-311-12/+47
| | | | | | | | | | | A user can pass file names for password, public and private key files to the vault plugin. The plugin attempts to read from these files. If any file can't be, an internal error was raised. The patch wraps all reads and turns any IOError and UnicodeError into a ValidationError. https://fedorahosted.org/freeipa/ticket/5155 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-3130-92/+92
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Replace M2Crypto RC4 with python-cryptography ARC4Christian Heimes2015-07-312-7/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the dependency on M2Crypto in favor for cryptography. Cryptography is more strict about the key size and doesn't support non-standard key sizes: >>> from M2Crypto import RC4 >>> from ipaserver.dcerpc import arcfour_encrypt >>> RC4.RC4(b'key').update(b'data') 'o\r@\x8c' >>> arcfour_encrypt(b'key', b'data') Traceback (most recent call last): ... ValueError: Invalid key size (24) for RC4. Standard key sizes 40, 56, 64, 80, 128, 192 and 256 are supported: >>> arcfour_encrypt(b'key12', b'data') '\xcd\xf80d' >>> RC4.RC4(b'key12').update(b'data') '\xcd\xf80d' http://cryptography.readthedocs.org/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.ARC4 https://fedorahosted.org/freeipa/ticket/5148 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Require Dogtag PKI >= 10.2.6Christian Heimes2015-07-291-3/+3
| | | | | | | | | | | | | Dogtag 10.2.6 comes with two fixes for cloning from 9.x to 10.x instances: https://fedorahosted.org/pki/ticket/1495 https://fedorahosted.org/pki/ticket/1488 https://fedorahosted.org/freeipa/ticket/5140 https://fedorahosted.org/freeipa/ticket/5129 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: fix regressions failed auth messagesPetr Vobornik2015-07-292-5/+5
| | | | | | | | | | | | 1. after logout, krb auth no longer shows "session expired" but correct "Authentication with Kerberos failed". 2. "The password or username you entered is incorrect." is showed on failed forms-based auth. https://fedorahosted.org/freeipa/ticket/5163 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ULC: Fix stageused-add --from-delete commandMartin Basti2015-07-291-4/+5
| | | | | | | | | | | Nonexistent method was used to move deleted user to staged area. Minor fixes added: * handle not found error * return new DN https://fedorahosted.org/freeipa/ticket/5145 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use 'mv -Z' in specfile to restore SELinux contextMartin Basti2015-07-291-6/+3
| | | | | | | | | There might be AVC denial between moving file and restoring context. Using 'mv -Z' will solve this issue. https://fedorahosted.org/freeipa/ticket/4923 Reviewed-By: David Kupka <dkupka@redhat.com>
* ACI plugin: correctly parse bind rules enclosed in parenthesesMartin Babinsky2015-07-291-2/+6
| | | | | | | | | Since bind rule such as `(userdn = "ldap:///anyone")` is also a valid statement, the ipalib ACI parser was updated to handle this case. https://fedorahosted.org/freeipa/ticket/5037 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix client ca.crt to match the server's certGabe2015-07-271-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3809 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use Exception class instead of StandardErrorNiranjan Mallapadi2015-07-271-2/+2
| | | | | | | | In except clause, use of "," is not recommended (PEP 3110) Signed-off-by: Niranjan Mallapadi <mrniranjan@fedoraproject.org> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* otptoken: use ipapython.nsslib instead of Python's ssl moduleChristian Heimes2015-07-272-30/+8
| | | | | | | | | | | | The otptoken plugin is the only module in FreeIPA that uses Python's ssl module instead of NSS. The patch replaces ssl with NSSConnection. It uses the default NSS database to lookup trust anchors. NSSConnection uses NSS for hostname matching. The package python-backports-ssl_match_hostname is no longer required. https://fedorahosted.org/freeipa/ticket/5068 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile-import: improve profile format documentationChristian Heimes2015-07-271-1/+1
| | | | | | | | | The certprofile-import plugin expects a raw Dogtag config file. The XML format is not supported. --help gives a hint about the correct file format. https://fedorahosted.org/freeipa/ticket/5089 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Added test - topology plugin is listed among DS pluginsOleg Fayans2015-07-271-0/+70
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove ico files from MakefileMartin Basti2015-07-271-2/+0
| | | | | | | | | Icons were removed in a4be844809179ff0a05286606df1487d81a70022 but still persist in Makefile. This patch fixes Makefile. https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add Kerberos configuration instructions for ChromePetr Vobornik2015-07-273-31/+80
| | | | | | | | | | * IE section moved at the end * Chrome section added * FF and IE icons removed https://fedorahosted.org/freeipa/ticket/823 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replication: Fix incorrect exception invocationTomas Babej2015-07-241-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* idviews: Enforce objectclass check in idoverride*-delTomas Babej2015-07-231-0/+19
| | | | | | | | | | | | | Even with anchor to sid type checking, it would be still possible to delete a user ID override by specifying a group raw anchor and vice versa. This patch introduces a objectclass check in idoverride*-del commands to prevent that. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* idviews: Restrict anchor to name and name to anchor conversionsTomas Babej2015-07-231-4/+46
| | | | | | | | | | | | | When converting the ID override anchor from AD SID representation to the object name, we need to properly restrict the type of the object that is being resolved. The same restriction applies for the opposite direction, when converting the object name to it's SID. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dcerpc: Add get_trusted_domain_object_type methodTomas Babej2015-07-231-0/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix broken search for users by their managerMartin Babinsky2015-07-233-11/+8
| | | | | | | | | The patch fixes incorrect construction of search filter when using `ipa user-find` with '--manager' option. https://fedorahosted.org/freeipa/ticket/5146 Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-09 11:43:58 +0000