summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix indentationMartin Basti2014-06-031-21/+21
| | | | | | There was 5 spaces instead of 4, my bad. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Test DNS: wildcard in RR ownerMartin Basti2014-06-031-0/+46
| | | | | | | | Only test, issue was fixed in https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/3148 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* PTR record target can be relativeMartin Basti2014-06-032-4/+3
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS new testsMartin Basti2014-06-031-41/+741
| | | | | | | | | | Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS modified testsMartin Basti2014-06-032-241/+283
| | | | | | | | | | | * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* move hostname validation from DNS to hostsMartin Basti2014-06-031-3/+11
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* _domain_name_validatord moved from DNS to realmdomainsMartin Basti2014-06-032-13/+7
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified record and zone class to support IDNMartin Basti2014-06-031-97/+307
| | | | | | | | | | | | | | * Records data are always returned as string * Attributes idnsname, idnssoamname, idnssoarname are returned as * DNSName, with option --raw as string * option --raw returns all IDN domains punycoded Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified records and zone parameters to use DNSNameParamMartin Basti2014-06-032-74/+65
| | | | | | | | | | | | | * Zone is stored as an absolute name (ipa never support relative * zonenames) * compatible with relative zone names as was before * PTR target can be relative domain name Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified dns related global functionsMartin Basti2014-06-034-117/+74
| | | | | | | | | | | * Modified functions to use DNSName type * Removed unused functions Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified has_output attributesMartin Basti2014-06-032-4/+10
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSName conversion in ipaldapMartin Basti2014-06-031-0/+7
| | | | | | | | | | Domain name has to be stored in LDAP in punycoded value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CLI conversion of DNSName typeMartin Basti2014-06-031-0/+3
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* get_ancestors_primary_keys cloneMartin Basti2014-06-032-29/+29
| | | | | | | | | | Fix: classes didnt inherite params from parent correctly Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dns_name_values capability addedMartin Basti2014-06-034-6/+27
| | | | | | | | | | Added capability to transfer DNSName type between server and client Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169i Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSNameParam parameterMartin Basti2014-06-033-1/+72
| | | | | | | | | | New param type for domain names Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSName typeMartin Basti2014-06-031-0/+100
| | | | | | | | | | Type used to store domain names based on dnspython Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allows to sort non text entriesMartin Basti2014-06-032-1/+7
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add read permissions for automember tasksPetr Viktorin2014-06-022-5/+19
| | | | | | | | | | | Permission to read all tasks is given to high-level admins. Managed permission for automember tasks is given to automember task admins. "targetattr=*" is used because tasks are extensibleObject with attributes that aren't in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* krbtpolicy plugin: Fix internal error when global policy is not readablePetr Viktorin2014-05-301-9/+27
| | | | | | | | | | | | | | | An ACIError is now raised if: - the user doesn't have permission to read any one of the ticket policy attributes on the requested entry (checked using attribute-level rights) - any ticket policy attribute from the default policy is not available (either not readable, or not there at all) (only checked if these are accessed, i.e. when the user entry doesn't override all of the defaults, or when requesting the global policy) https://fedorahosted.org/freeipa/ticket/4354 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* krbtpolicy plugin: Code cleanupPetr Viktorin2014-05-301-15/+15
| | | | | | | | | | - Use the new plugin registration API See: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration - Remove the star import from baseldap Part of the work for: https://fedorahosted.org/freeipa/ticket/2653 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Restore krbCanonicalName handlingNalin Dahyabhai2014-05-301-5/+1
| | | | | | | | | | | When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set, rewrite the principal name to the canonical value, else error out, instead of always returning an error if the requested name doesn't look like the canonical one. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Accept any alias, not just the last valueNalin Dahyabhai2014-05-301-0/+3
| | | | | | | | | If the entry's krbPrincipalName attribute is multi-valued, accept any of the values, not just the last one we happen to examine. https://fedorahosted.org/freeipa/ticket/3966 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipa recursively adds old backupsGabe2014-05-301-0/+1
| | | | | | | | - Added exclude for the ipa backup folder to the files tar https://fedorahosted.org/freeipa/ticket/4331 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ldap2.has_upg: Raise an error if the UPG definition is not foundPetr Viktorin2014-05-291-13/+17
| | | | | | | | | | | | | | | | | The UPG Definition is always present in IPA; if it can not be read it's usually caused by insufficient privileges. Previously the code assumed the absence of the entry meant that UPG is disabled. With granular read permissions, this would mean that users that can add users but can't read UPG Definition would add users without UPG, and the reason for that would not be very clear. It is better to fail early if the definition can't be read. Raise an error if the UPG Definition is not available. This makes read access to it a prerequisite for adding users. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission for the UPG DefinitionPetr Viktorin2014-05-291-0/+17
| | | | | | | | | | | | Since user_add checks the UPG definition to see if UPG is enabled, user admins need read access to add users correctly. All attributes are allowed since UPG Definition is an extensibleObject; the needed attributes are not in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci plugin: Fix internal error when ACIs are not readablePetr Viktorin2014-05-291-1/+1
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* pwpolicy-mod: Fix crash when priority is changedPetr Viktorin2014-05-283-3/+77
| | | | | | | | | | | | | The exc_callback was expecting the old update_entry signature, (dn, attrs). This was changed to just (entry) for ticket #2660, see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API. Update the exc_callback to expect the entry as first argument, and add some tests. https://fedorahosted.org/freeipa/ticket/4309 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dns: Add idnsSecInlineSigning attribute, add --dnssec option to zonePetr Viktorin2014-05-284-7/+17
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Call generate-rndc-key.sh during ipa-server-installAdam Misnyovszki2014-05-273-1/+29
| | | | | | | | | | | | | | | | | | | | | | Since systemd has by default a 2 minute timeout to start a service, the end of ipa-server-install might fail because starting named times out. This patch ensures that generate-rndc-key.sh runs before named service restart. Also, warning message is displayed before KDC install and generate-rndc-key.sh, if there is a lack of entropy, to notify the user that the process could take more time than expected. Modifications done by Martin Kosek: - removed whitespace at the end of installutils.py - the warning in krbinstance.py moved right before the step requiring entropy - slightly reworded the warning message https://fedorahosted.org/freeipa/ticket/4210 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* admin tools: Log IPA versionPetr Viktorin2014-05-279-0/+9
| | | | | | | | | | | Add the IPA version, and vendor version if applicable, to the beginning of admintool logs -- both framework and indivitual tools that don't yet use the framework. This will make debugging easier. https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipalib.version: Add VENDOR_VERSIONPetr Viktorin2014-05-273-2/+12
| | | | | | | | | This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase Java stack size for Web UI build on aarch64Petr Vobornik2014-05-261-1/+1
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* rpcserver: login_password datetime fix in expiration checkPetr Vobornik2014-05-261-8/+2
| | | | | | | | | krbpasswordexpiration conversion to time failed because now we get datetime object instead of string. https://fedorahosted.org/freeipa/ticket/4339 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ldap2.find_entries: Do not modify attrs_list in-placePetr Viktorin2014-05-261-6/+9
| | | | | | | | | | | | | | | dap2.find_entries modified the passed in attrs_list to remove the virtual attributes memberindirect and memberofindirect before passing the list to LDAP. This means that a call like ldap2.get_entry(dn, attrs_list=some_framework_object.default_attributes) would permanently remove the virtual attributes from some_framework_object's definition. Create a copy of the list instead. https://fedorahosted.org/freeipa/ticket/4349 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove the global anonymous read ACIPetr Viktorin2014-05-266-115/+30
| | | | | | | | | | | | | | Also remove - the deny ACIs that implemented exceptions to it: - no anonymous access to roles - no anonymous access to member information - no anonymous access to hbac - no anonymous access to sudo (2×) - its updater plugin Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-262-0/+31
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* update_managed_permissions: Pass around anonymous ACI rather than its blacklistPetr Viktorin2014-05-261-17/+18
| | | | | | | | It turns out the ACI object of the anonymous read ACI, rather than just the list of its attributes, will be useful in the future. Change the plugin so that the ACI object is passed around. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default the token owner to the person adding the tokenNathaniel McCallum2014-05-231-1/+8
| | | | | | | | Creating tokens for yourself is the most common operation. Making this the default optimizes for the common case. Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Only specify the ipatokenuniqueid default in the add operationNathaniel McCallum2014-05-233-9/+12
| | | | | | | | | | | Specifying the default in the LDAP Object causes the parameter to be specified for non-add operations. This is especially problematic when performing the modify operation as it causes the primary key to change for every modification. https://fedorahosted.org/freeipa/ticket/4227 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipalib.cli: Add filename argument to ipa consolePetr Viktorin2014-05-221-6/+25
| | | | | | | | | This allows writing simple IPA scripts using the shebang #! /usr/bin/ipa console https://fedorahosted.org/freeipa/ticket/4351 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* kdb: Don't provide password expiration when using only RADIUSNathaniel McCallum2014-05-221-0/+4
| | | | | | | | | | If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse the user. It also causes password change dialogues when the password is irrelevant. https://fedorahosted.org/freeipa/ticket/4299 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Replace "replica admins read access" ACI with a permissionPetr Viktorin2014-05-213-5/+66
| | | | | | | | | Add a 'Read Replication Agreements' permission to replace the read ACI for cn=config. https://fedorahosted.org/freeipa/ticket/3829 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa-client-automount should not configure nsswitch.conf manuallyGabe2014-05-161-6/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/3733 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa-client-automount: Use rpcclient, not xmlclient, for automountlocation_showPetr Viktorin2014-05-141-1/+1
| | | | | Fix for a regression in 66fb4d5e849a049e95d3ef4fcf2b86217488634d https://fedorahosted.org/freeipa/ticket/4290
* Clean up Smartproxy support, drop unused codeRob Crittenden2014-05-136-51/+4
| | | | | | | | | Drop the logrotate file because Apache manages the logs Drop the systemd configuration because we run in Apache Import json_encode_binary from ipalib Fix Requires Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* webui-ci: decorate all webui tests with screenshot decoratorPetr Vobornik2014-05-1223-0/+79
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-ci: save screenshot on test failurePetr Vobornik2014-05-121-0/+34
| | | | | | | | | | | | | New decorator: ui_driver.screenshot created. It should be applied on test methods. Screenshot is saved on each exception except SkipTest. Configuration: - add: `save_screenshots: True` to ~/.ipa/ui_test.conf to enable saving screenshots - optionally add `screenshot_dir: /path/to/dir` to specify target directory otherwise screenshots are saved to current directory Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fixed typo in ipa-replica-manage man pageThorsten Scherf2014-05-121-1/+1
| | | | Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-14 18:18:32 +0000