summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Show progress when enabling SSL in DS in ipa-server-install output.Jan Cholasta2014-03-252-7/+12
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Remove unused method export_ca_cert of dsinstance.Jan Cholasta2014-03-251-5/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Upload CA certificate from DS NSS database in CA-less server install.Jan Cholasta2014-03-252-18/+7
| | | | | | | | | | Before, the file provided in the --root-ca-file option was used directly for the upload. However, it is the same file which is imported to the NSS database, so the second code path is not necessary. Also removed now unused upload_ca_dercert method of dsinstance. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use LDAP API to upload CA certificate instead of ldapmodify command.Jan Cholasta2014-03-253-13/+18
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Do not create CA certificate files in CA-less server install.Jan Cholasta2014-03-251-15/+4
| | | | | | | | | | The files are created later by ipa-client-install, there's no need to do it twice. This also fixes a bug in CA-less, where the CA certificate is not removed from /etc/pki/nssdb after client uninstall, because it has a different nickname. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Move CACERT definition to a single place.Jan Cholasta2014-03-2517-23/+24
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix certificate renewal scripts to work with separate CA DS instance.Jan Cholasta2014-03-253-22/+44
| | | | | | https://fedorahosted.org/freeipa/ticket/3805 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permission plugin: Add 'top' to the list of object classesPetr Viktorin2014-03-251-1/+3
| | | | | | | | | | | The 'top' objectclass is added by DS if not present. On every update the managed permission updater compared the object_class list with the state from LDAP, saw that there's an extra 'top' value, and tried deleting it. Add 'top' to the list to match the entry in LDAP. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add Object metadata and update plugin for managed permissionsPetr Viktorin2014-03-253-0/+180
| | | | | | | | The default read permission is added for Netgroup as an example. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Design: http://www.freeipa.org/page/V3/Managed_Read_permissions Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow modifying permissions with ":" in the namePetr Viktorin2014-03-254-11/+63
| | | | | | | | | | | | | | The ":" character will be reserved for default permissions, so that users cannot create a permission with a name that will later be added as a default. Allow the ":" character modifying/deleting permissions*, but not when creating them. Also do not allow the new name to contain ":" when renaming. (* modify/delete have unrelated restrictions on managed permissions) Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_permission_plugin: Fix tests that make too broad assumptionsPetr Viktorin2014-03-252-44/+28
| | | | | | | | | | | | | | The test that searches with a limit of 1 assumes a specific order LDAP returns entries in. Future patches will change this order. Do not check the specific entry returned. The test that searched for --bindtype assumed that no anonymous permissions exist in a clean install. Again, this will be changed in future patches. Add a name to the bindtype test, and add a negatitive test to verify the filtering works. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission-find: Fix handling of the search term for legacy permissionsPetr Viktorin2014-03-251-17/+24
| | | | | | | Previously the search term was only applied to the name. Fix it so that it filters results based on any attribute. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow indexing API object types by classPetr Viktorin2014-03-252-4/+23
| | | | | | | | | | | | | | This allows code like: from ipalib.plugins.dns import dnszone_mod api.Command[dnszone_mod] This form should be preferred when getting specific objects because it ensures that the appropriate plugin is imported. https://fedorahosted.org/freeipa/ticket/4185 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Proxy PKI clone /ca/ee/ca/profileSubmit URIMartin Kosek2014-03-251-2/+2
| | | | | | | | | | | | PKI change done in ticket https://fedorahosted.org/pki/ticket/816 requires the PKI Clone's SSL Server certificate to be issued by it's associated PKI master. Allow this call on IPA master. https://fedorahosted.org/freeipa/ticket/4265 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* extdom: do not return results from the wrong domainSumit Bose2014-03-251-0/+12
| | | | | Resolves: https://fedorahosted.org/freeipa/ticket/4264 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* permission plugin: Do not add the ipapermissionv2 for outputPetr Viktorin2014-03-243-7/+6
| | | | | | | | | As with the flags, the objectclass should be returned as it is on the entry. https://fedorahosted.org/freeipa/ticket/4257 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui-ci: fix test_rebuild_membership_hosts on server without DNSPetr Vobornik2014-03-241-19/+5
| | | | | | | Host adder dialog differs on installations with and without DNS. Previous test used values for adding hosts which were suitable only for IPA servers installed with DNS. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipatests: test_trust: Change expected home directories for posix usersTomas Babej2014-03-242-4/+5
| | | | | | | | | | | | | | Information from the AD about the home directories is not leveraged at all, but is generated from the username and domain. Fix the assumptions in the tests. Also changes 'Subdomain Test User' to 'Subdomaintest User' to be more consistent. https://fedorahosted.org/freeipa/ticket/4184 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix typo in ipa -v migrate-dsGabe2014-03-212-2/+2
| | | | | | | | Remove 'u' from .po files as it is a typo and has been removed from other files. https://fedorahosted.org/freeipa/ticket/2546 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* permission CLI: rename --permissions to --rightPetr Viktorin2014-03-213-7/+8
| | | | | | | | The old name is kept as a deprecated alias. https://fedorahosted.org/freeipa/ticket/4231 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* cli: Add mechanism for deprecated option name aliasesPetr Viktorin2014-03-212-14/+30
| | | | | | | | | Add a new Param kwarg, deprecated_cli_aliases, that lists deprecated aliases. The aliases will appear in a "Deprecated options" in the help, and otherwise act as the normal variant. Preparation for: https://fedorahosted.org/freeipa/ticket/4231
* cli: Show list of values in --help for all EnumsPetr Viktorin2014-03-211-4/+4
| | | | | | Previously only the StrEnum param type had the list of values listed in the help. Extend the functionality to any kind of Enum.
* cli: Clean up importsPetr Viktorin2014-03-211-6/+3
|
* test_integration.tasks: Do not fail cleanup if backup directory does not existPetr Viktorin2014-03-201-1/+2
| | | | | | | | | If the test backup directory was never created (for example if there was an early failure, or install was never run), we don't want the test to fail. Do not restore if the backup dir is not there. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix order of synchronizing time when running ipa-client-installGabe2014-03-201-17/+19
| | | | | | | | | | When running ipa-client-install, it asks for user name, synchronizes time, then asks for user password which the order could be confusing to some users. This changes ipa-client-install to synchronize time before prompting for user kerberos authentication. https://fedorahosted.org/freeipa/ticket/3957 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: update license information of used third party codePetr Vobornik2014-03-201-49/+211
| | | | | | | | | Reflects: - adding of RCUE styles along with Bootstrap 2.0. - removal of jQuery BBQ plugin - removal of rhino enviroment for selenium which was used in old UI tests Reviewed-By: Simo Sorce <ssorce@redhat.com>
* webui: change permissions UI to v2Petr Vobornik2014-03-2011-296/+396
| | | | | | | | | | | | | | reflect ipalib permission changes in Web UI. - http://www.freeipa.org/page/V4/Permissions_V2 - http://www.freeipa.org/page/V4/Anonymous_and_All_permissions - http://www.freeipa.org/page/V4/Managed_Read_permissions - http://www.freeipa.org/page/V4/Multivalued_target_filters_in_permissions https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: reflect enabled state in child widgets of a multivalued widgetPetr Vobornik2014-03-201-6/+33
| | | | | | | | | | | Child widgets are disabled when main widget is disabled. Also main widget won't show "add" button. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not create <hr> delimiter between sectionsPetr Vobornik2014-03-201-4/+0
| | | | | | | | | | | | | - section delimiter don't look good and limits UI Their removal will allow: - section hiding (needed in aci v2 UI) - fluid section layout prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: better check for existing options in attributes_widgetsPetr Vobornik2014-03-201-3/+9
| | | | | | | https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: fix unit testsPetr Vobornik2014-03-2012-56/+29
| | | | | | | | UI unit tests were broken since main RCUE work. This patch fixes them all except aci, which will be fixed along with update of aci UI. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui-static: update metadata filesPetr Vobornik2014-03-203-11508/+6192
| | | | | | | | | | | | Update JSON metadata files for static presentation of FreeIPA UI and some tests. This regeneration did not happen for very long time and an update is needed for upcoming ACI patch. prerequisite for: https://fedorahosted.org/freeipa/ticket/4079 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: do not use dom for getting selected automount keysPetr Vobornik2014-03-202-10/+15
| | | | | | | | | | | Old implementation crawled DOM for gathering data from DOM. Such code is very error prone. Little visual change somewhere else can break it - as happened in main patch for #4217. prerequisite for: https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-css: improve radio,checkbox keyboard support and colorPetr Vobornik2014-03-206-23/+56
| | | | | | | | | | | | | checkboxes and radio buttons: - do not change color on hover when disabled - are focusable and checkable be keyboard again. This uses a little trick where the real checkbox is hidden under the artificial checkbox. That way it has the same position and therefore it works even in containers with overflow set. https://fedorahosted.org/freeipa/ticket/4217 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: remove hover effect from disabled action buttonPetr Vobornik2014-03-171-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4256 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add Nathaniel McCallum to .mailmapPetr Viktorin2014-03-171-0/+1
|
* Add missing dependencyNalin Dahyabhai2014-03-141-0/+1
| | | | | | | We use Java classes which are bundled with rhino when uglifying Javascript sources at build-time, so we need rhino at build-time. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Update Dogtag 9 database during replica installationMartin Kosek2014-03-144-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create other clones. Add an update file to do the database update. Content is based on recommendation from PKI team: * https://bugzilla.redhat.com/show_bug.cgi?id=1075118#c9 This update file can be removed when Dogtag database upgrades are done in PKI component. Upstream tickets: * https://fedorahosted.org/pki/ticket/710 (database upgrade framework) * https://fedorahosted.org/pki/ticket/906 (checking database version) Also make sure that PKI service is restarted in the end of the installation as the other services to make sure it picks changes done during LDAP updates. https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* permission plugin: Do not change extra target filters by "views"Petr Viktorin2014-03-142-4/+172
| | | | | | | | | | | | | Previously, setting/deleting the "--type" virtual attribute removed all (objectclass=...) target filters. Change so that only the filter associated with --type is removed. The same change applies to --memberof: only filters associated with the option are removed when --memberof is (un-)set. Follow-up to https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Do not fail on non-DN memberof filtersPetr Viktorin2014-03-141-1/+5
| | | | | | | | | | The --memberof logic tried to convert the value of a (memberof=...) filter to a DN, which failed with filters like (memberof=*). Do not try to set memberof if the value is not a DN. A test will be added in a subsequent patch. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Support searching by extratargetfilterPetr Viktorin2014-03-142-1/+43
| | | | | | | | | | The extratargetfilter behaves exactly like targetfilter, so that e.g. ipa permission-find --filter=(objectclass=ipausergroup) finds all permissions with that filter in the ACI. Part of the work for https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Add tests for extratargetfilterPetr Viktorin2014-03-141-0/+317
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission CLI: Rename filter to rawfilter, extratargetfilter to filterPetr Viktorin2014-03-143-11/+13
| | | | | | | Since extratargetfilter is shown by default, change it to also have the "default" (i.e. shorter) option name. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Write support for extratargetfilterPetr Viktorin2014-03-141-47/+88
| | | | | | | | | Extend the permission-add and permission-mod commands to process extratargetfilter. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Output the extratargetfilter virtual attributePetr Viktorin2014-03-146-140/+52
| | | | | | | | | | | | | | | | | | The --filter, --type, and --memberof options interact in a way that's difficult to recreate in the UI: type and memberof are "views" on the filter, they affect it and are affected by it Add a "extratagretfilter" view that only contains the filters not linked to type or memberof. Show extra target filter, and not the full target filter, by default; show both with --all, and full filter only with --raw. Write support will be added in a subsequent patch. Part of the work for: https://fedorahosted.org/freeipa/ticket/4216 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix idrange unit test failureMartin Kosek2014-03-141-1/+1
| | | | | | | This is a follow up to patch for ticket 4247 - the raised errors.DependentEntry changed, test needs to be change as well. https://fedorahosted.org/freeipa/ticket/4247
* ipaserver.install.service: Fix estimated time displayPetr Viktorin2014-03-132-13/+53
| | | | | | | | | | Use basic math rather than timezone conversion to get minutes and seconds. Break out the message generation into a small tested function. https://fedorahosted.org/freeipa/ticket/4242 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Prohibit deletion of active subdomain rangeTomas Babej2014-03-131-5/+17
| | | | | | | | | | Changes the code in the idrange_del method to not only check for the root domains that match the SID in the IDRange, but for the SIDs of subdomains of trusts as well. https://fedorahosted.org/freeipa/ticket/4247 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: Datetime parsing and formattingPetr Vobornik2014-03-1314-71/+448
| | | | | | | | | | | | | | | this patch implements: - output_formatter in field. It should be used in par with formatter. Formatter serves for datasource->widget conversion, output_formatter for widget->datasource format conversion. - datetime module which parses/format strings in subset of ISO 8601 and LDAP generalized time format to Date. - utc formatter replaced with new datetime formatter - datetime_validator introduced - new datetime field, extension of text field, which by default uses datetime formatter and validator Dojo was regenerated to include dojo/string module https://fedorahosted.org/freeipa/ticket/4194 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Do not hardcode path to ipa-getkeytab in testsPetr Viktorin2014-03-133-4/+14
| | | | | | | | | | | Using the in-tree binary makes testing outside the source tree impossible. Use ipa-getkeytab from $PATH, and add the directory to $PATH when running the in-tree tests. Part of the work for https://fedorahosted.org/freeipa/ticket/3654 Reviewed-By: Martin Kosek <mkosek@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-15 19:20:05 +0000