summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove allow_constrained_delegation from gssproxy.confPavel Vomacka2017-03-141-1/+0
| | | | | | | | | | | The Apache process must not allowed to use constrained delegation to contact services because it is already allowed to impersonate users to itself. Allowing it to perform constrained delegation would let it impersonate any user against the LDAP service without authentication. https://pagure.io/freeipa/issue/6225 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* WebUI: Add support for management of user short name resolutionPavel Vomacka2017-03-142-0/+8
| | | | | | | | | | | Added field into idview details page and into server config where the order of domains used while searching for user. Domains can be separated by ':' character. https://pagure.io/freeipa/issue/6372 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Re-use trust domain retrieval code in certmap validatorsMartin Babinsky2017-03-141-8/+3
| | | | | | | | https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idview: add domain_resolution_order attributeMartin Babinsky2017-03-144-7/+38
| | | | | | | | | | | `idview-add` and `idview-mod` can now set and validate the attribute. The required objectclass is added on-demand after modification https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaconfig: add the ability to manipulate domain resolution orderMartin Babinsky2017-03-144-6/+118
| | | | | | | | | | | | | | | optional attribute was added to config object along with validator that check for valid domain names and also checks whether the specified domains exist in FreeIPA or in trusted forests and, in case of trusted domains, are not disabled. Part of http://www.freeipa.org/page/V4/AD_User_Short_Names https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Short name resolution: introduce the required schemaMartin Babinsky2017-03-142-0/+3
| | | | | | | | | | | | Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema. Extend ipaConfig object with ipaNameResolutionData objectclass during update. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Run test_ipaclient test suiteChristian Heimes2017-03-141-0/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* httpinstance: disable system trust module in /etc/httpd/aliasJan Cholasta2017-03-143-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the NSS database in /etc/httpd/alias is installed with the system trust module enabled. This is problematic for a number of reasons: * IPA has its own trust store, which is effectively bypassed when the system trust module is enabled in the database. This may cause IPA unrelated CAs to be trusted by httpd, or even IPA related CAs not to be trusted by httpd. * On client install, the IPA trust configuration is copied to the system trust store for third parties. When this configuration is removed, it may cause loss of trust information in /etc/httpd/alias (https://bugzilla.redhat.com/show_bug.cgi?id=1427897). * When a CA certificate provided by the user in CA-less install conflicts with a CA certificate in the system trust store, the latter may be used by httpd, leading to broken https (https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html). Disable the system trust module on install and upgrade to prevent the system trust store to be used in /etc/httpd/alias and fix all of the above issues. https://pagure.io/freeipa/issue/6132 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Backup KDC certificate pairStanislav Laznicka2017-03-141-0/+2
| | | | | | | | | KDC certificate pair was added but is not included in backup which might cause issues when restoring the IPA service. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/paths: Rename IPA_KEYTAB to OLD_IPA_KEYTAB.Timo Aaltonen2017-03-141-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/paths: Add IPA_HTTPD_KDCPROXY.Timo Aaltonen2017-03-141-0/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaplatform/debian/services: Fix is_running arguments.Timo Aaltonen2017-03-141-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add copy-schema-to-ca for RHEL6 to contrib/Martin Basti2017-03-141-0/+118
| | | | | | | | Fixed version that works on RHEL6. Adding it to contrib to avoid loosing it. https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-144-132/+2
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: add link to login page which for login using certificatePavel Vomacka2017-03-143-4/+78
| | | | | | | | | | Also add error message when login failed. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Support certificate login after installation and upgradePavel Vomacka2017-03-146-2/+59
| | | | | | | | | | | | Add necessary steps which set SSSD and set SELinux boolean during installation or upgrade. Also create new endpoint in apache for login using certificates. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Don't fail more if cert req/cert creation failedStanislav Laznicka2017-03-141-2/+5
| | | | | | | | | This should help debugging issues that could happen during server certificate creation. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-prepare server-cert creationStanislav Laznicka2017-03-141-1/+2
| | | | | | | | | | Fixes an issue introduced in 0a54fac0, we need to specify the current master's hostname so that we know to which CA we need to connect to create the other's server Server-Cert. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* csrgen: hide cert-get-requestdata in CLIJan Cholasta2017-03-141-0/+2
| | | | | | | | | The CSR generation feature is supposed to be used from cert-request, hide the internal cert-get-requestdata command in the CLI. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-144-12/+56
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: add output file option to cert-requestJan Cholasta2017-03-141-14/+52
| | | | | | | | | | | The certificate returned by cert-request can now be saved to a file in the CLI using a new --certificate-out option. Deprecate --out in cert-show in favor of --certificate-out. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* TESTS WebUI: Vaults managementPavel Vomacka2017-03-143-1/+273
| | | | | | | | | | | | | | Bunch of tests for WebUI Vault Management. Covers: Adding vaults Modifying vaults Adding members and owners to all types of vaults https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* TESTS: Add support for sidebar with facetsPavel Vomacka2017-03-141-2/+12
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* TESTS: Add support for KRA in ui_driverPavel Vomacka2017-03-141-0/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add vault managementPavel Vomacka2017-03-146-2/+948
| | | | | | | | | | | | | | | | | | | | Add vault management into WebUI, there are some constraints: - There is no crypto library so Symmetric and Assymetric vaults are not supported in WebUI. Also retrieving or archiving data is not supported. - There aren't any container support right now Supported is: - Browsing vaults - Adding Standard vaults (users, service, shared) - Removing vaults - Adding and removing owners - Adding and removing members https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: allow to show rows with same pkey in tablesPavel Vomacka2017-03-147-30/+90
| | | | | | | | | Allows to show rows which have the same primary key. Used in Vault. https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: search facet's default actions might be overridenPavel Vomacka2017-03-141-5/+26
| | | | | | | | | | | While defining search facet and adding custom actions with the same name as default actions in search facet. Custom actions will be used and their definition will override default actions. Part of:https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add possibility to hide only one tab in sidebarPavel Vomacka2017-03-141-0/+14
| | | | | | | | | Removes item selected by name attribute from sidebar Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Possibility to set list of table attributes which will be added to _del commandPavel Vomacka2017-03-141-1/+35
| | | | | | | | | | | 'additional_table_attrs' can contain array of names of columns. Value from each column with its name will be added to the batch _del command. in case that the column with set name does not exists - the name is skipped. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend _show command after _find command in table facetsPavel Vomacka2017-03-141-2/+40
| | | | | | | | | | | | Allow pagination to table facets which needs to call _show on all rows with additional parameter. 'show_command_additional_attr' can be set to any attribute from result of _find command. This attribute is taken with its value and added to options of _each command for each row. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add possibility to pass url parameter to update command of details pagePavel Vomacka2017-03-141-0/+11
| | | | | | | | | | 'update_attribute' can contain a name of field in details page. In that case the value of the field with field name will be appended to the update command options. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add property which allows refresh command to use url valuePavel Vomacka2017-03-141-0/+28
| | | | | | | | | | 'refresh_attribute' can be set to the name of url parameter name. This parameter with its value is then passed to refresh command of the details facet. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Added optional option in refreshing after modifying association tablePavel Vomacka2017-03-141-2/+16
| | | | | | | | | | | | | The 'refresh_option' of association field takes string. This string has to correspond with field name on details page. In case that the field is present the value of the field is passed to command as option in following format: {fieldname: field_value} Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Possibility to skip checking writable according to metadataPavel Vomacka2017-03-142-18/+65
| | | | | | | | | | | | | Useful in association tables which need to ignore object's metadata flags. Association tables don't check right at all. They check them only when 'acl_param' is set in association table field spec. In case that checking metadata needs to be turned on even for Association table, then set 'check_writable_from_metadata' true value in spec. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow to set another other_entity namePavel Vomacka2017-03-141-3/+26
| | | | | | | | | | | | | Association table's add, del commands needs as option list of cn of other_entity, which is added or deleted. There is a case (currently in vaults) that the name of option is different than the name of other_entity. In this situation we can set 'other_option_name' and put there the option name. This option name will be used instead of 'other_entity' name. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Additional option to add and del operations can be setPavel Vomacka2017-03-141-0/+22
| | | | | | | | | | | | | | By setting the property 'additional_add_del_field' to the name of one of the fields which are on current details page, we choose field which value will be added to *_add_* and *_del_* commands in this format: {field_name: field_value} --field_name: field_value Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* permissions: add permissions for read and mod of external group membersPetr Vobornik2017-03-132-0/+21
| | | | | | | | Issue: "User Administrator" role cannot add users to an External Group. https://fedorahosted.org/freeipa/ticket/5504 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Installation must publish CA cert in /usr/share/ipa/html/ca.crtFlorence Blanc-Renaud2017-03-131-0/+6
| | | | | | | | | | | | Regression introduced with commit d124e30. ipa-server-install and ipa-replica-install must publish the CA cert in /usr/share/ipa/html/ca.crt, otherwise the web page http://ipaserver.ipadomain.com/ipa/config/ssbrowser.html has a link to http://ipaserver.ipadomain.com/ipa/config/ca.crt but this file is missing. https://pagure.io/freeipa/issue/6750 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc.py: use arcfour_encrypt from sambaAlexander Bokovoy2017-03-131-9/+1
| | | | | | | | | | | Samba Python bindings provide samba.arcfour_encrypt(key, data). Instead of implementing own wrapper, use Samba's. In future Samba versions this wrapper will be FIPS 140-2 compatible. Fixes https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Don't allow standalone KRA uninstallsStanislav Laznicka2017-03-137-105/+12
| | | | | | | | | | KRA uninstallation is very likely to break the user's setup. Don't allow it at least till we can be safely sure we are able to remove it in a standalone manner without breaking anything. https://pagure.io/freeipa/issue/6538 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add message about last KRA to WebUI Topology viewStanislav Laznicka2017-03-133-11/+22
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add check to prevent removal of last KRAStanislav Laznicka2017-03-131-0/+13
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Travis CI: run tests in development modeJan Cholasta2017-03-131-0/+2
| | | | | | | | Set `mode` to `development` in default.conf after ipa-server-install. https://pagure.io/freeipa/issue/6625 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* backend plugins: fix crashes in development modeJan Cholasta2017-03-133-18/+20
| | | | | | | | | | | | | Do not set or delete attributes directly on KerberosWSGIExecutioner, ldap2 and ra_lightweight_ca instances, as that raises an AttributeError in development mode because of ReadOnly locking. Use the usual workaround of `object.__setattr__` and `object.__delattr__` to fix the issue. https://pagure.io/freeipa/issue/6625 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* pylint: bump dependency to version >= 1.6Martin Basti2017-03-131-2/+2
| | | | | | Older pylint versions produces false positive errors Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* vault: cache the transport certificate on clientJan Cholasta2017-03-134-64/+170
| | | | | | | | | | Cache the KRA transport certificate on disk (in ~/.cache/ipa) as well as in memory. https://fedorahosted.org/freeipa/ticket/6652 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* rpc: fix crash in verbose modeJan Cholasta2017-03-131-5/+6
| | | | | | | | | | Fix a crash caused by feeding incorrect data to `json.dumps()` in `JSONServerProxy.__request()` introduced by commit 8159c2883bf66980582d1227c364df4e592bdd7e. https://pagure.io/freeipa/issue/6734 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: re-introduce option groupsJan Cholasta2017-03-1312-193/+254
| | | | | | | | | Re-introduce option groups in ipa-client-install, ipa-server-install and ipa-replica-install. https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install CLI: remove magic option groupsJan Cholasta2017-03-131-11/+6
| | | | | | | | | Do not automatically create the "basic options" and "uninstall options" option groups in the CLI code. https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client install: split off SSSD options into a separate classJan Cholasta2017-03-132-41/+55
| | | | | | | | | Split off SSSD knob definitions from the ClientInstallInterface class into a new SSSDInstallInterface class. https://pagure.io/freeipa/issue/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-30 19:15:44 +0000