summaryrefslogtreecommitdiffstats
path: root/API.txt
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "adtrust: remove nttrustpartner parameter"Martin Basti2016-06-101-3/+6
| | | | | | | | | | This reverts commit 185806432d6dfccc5cdd73815471ce60a575b073. The wrong version of patch has been pushed. https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-101-6/+3
| | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-091-1/+2
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNS Location: location-show: return list of servers in locationMartin Basti2016-06-031-1/+2
| | | | | | | | | location-show returns list of servers curently assigned to the location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: extend server-* command with locationsMartin Basti2016-06-031-1/+19
| | | | | | | | | Server find, server show, server mod should work with IPA locations. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: location-* commandsMartin Basti2016-06-031-0/+59
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-031-0/+7
| | | | | | | | | | Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: introduce API schema pluginsJan Cholasta2016-06-031-0/+95
| | | | | | | | | | | | | | | | | Add a set of plugins for API schema introspection. This includes: * a set of commands for command introspection (`command_find`, `command_show`, `command_defaults`), * a set of commands for command param introspection (`param_find`, `param_show`), * a set of commands for command output introspection (`output_find`, `output_show`), * a set of commands for help topic introspection (`topic_find`, `topic_show`), * a command to get the full API schema in one call (`schema`). https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: replace DeprecatedParam with `deprecated` Param argumentJan Cholasta2016-06-031-17/+11
| | | | | | | | | | | | | | | Introduce new `deprecated` Param keywork argument. Setting it to True on a param has the same effect as using DeprecatedParam. This allows deprecating params while retaining their type information. Revert all DeprecatedParam params back to their original definition and set `deprecated` to True. Remove the now unused DeprecatedParam class. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Enable service authentication indicator managementNathaniel McCallum2016-06-021-3/+6
| | | | | | | https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Performance: Find commands: do not process members by defaultMartin Basti2016-05-311-22/+22
| | | | | | | | | | | | | | | | In all *-find commands, member attributes shouldn't be processed due high amount fo ldpaserches cause serious performance issues. For this reason --no-members option is set by default in CLI and API. To get members in *-find command option --all in CLI is rquired or 'no_members=False' or 'all=True' must be set in API call. For other commands processing of members stays unchanged. WebUI is not affected by this change. https://fedorahosted.org/freeipa/ticket/4995 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* vault: copy arguments of client commands from server counterpartsJan Cholasta2016-05-251-7/+14
| | | | | | | | | | | | | Copy arguments of vault_{add,mod,archive,retrieve} from vault_{add,mod,archive,retrieve}_internal. Also add missing LDAPCreate arguments to vault_add_internal. This will make it possible to move the commands to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* otptoken_yubikey: fix otptoken_add_yubikey argumentsJan Cholasta2016-05-251-2/+9
| | | | | | | | Copy args, options and output of otptoken_add_yubikey from otptoken_add. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: do not rely on server data structures in code called on clientJan Cholasta2016-05-251-0/+6
| | | | | | | | | | | | | | | | Replace code which references the DNSRecord and dnsrecord classes with equivalent code which uses only generic data structures. This will make it possible to move client code to ipaclient without dnsrecord bits, DNSRecord and all its subclasses. The conversion from record value to structured record can't be done on the client without DNSRecord and subclasses. Introduce a new internal command dnsrecord_split_parts to do the job on the server when necessary. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* makeapi: optimize API.txtJan Cholasta2016-05-251-4559/+4559
| | | | | | | | | | | | | | | | | | | | Change Param formatting to: * always use quantified names rather than the `required` and `multivalue` kwargs, * ignore kwargs with default value, * ignore kwargs related to validation, as validation is now strictly server-side, * ignore the `attribute` and `primary_key` kwargs, as they are relevant only on object params, * ignore the `include` and `exclude` kwargs, as makeapi takes into account only params available in the 'cli' context, * ignore the unused `csv` kwarg. Format optional Output arguments as kwargs. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* idviews: Add user certificate attribute to user ID overridesTomas Babej2016-05-061-2/+28
| | | | | | https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Increase API version for 'ipamaxusernamelength' attribute changeMartin Basti2016-04-201-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5774 Reviewed-By: David Kupka <dkupka@redhat.com>
* Allow admins to disable preauth for SPNs.Simo Sorce2016-03-081-1/+1
| | | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dns: do not add (forward)zone if it is already resolvable.David Kupka2015-12-141-2/+5
| | | | | | | | | Check if the zone user wants to add is already resolvable and refuse to create it if yes. --skip-overlap-check and --force options suppress this check. https://fedorahosted.org/freeipa/ticket/5087 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-111-0/+8
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* topologysuffix: change iparepltopoconfroot API propertiesPetr Vobornik2015-12-031-3/+3
| | | | | | | Change CLI option, label and type to reflect that it is a only a DN of the suffix. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* server: use topologysuffix name in iparepltopomanagedsuffixJan Cholasta2015-12-011-3/+6
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* topology: treat server suffix as multivalued attribute in APIPetr Vobornik2015-11-271-1/+1
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow multiple managers per user - CLI partMartin Basti2015-11-201-0/+44
| | | | | | | | | | | | | | | | | | | | Added commands: * user-add-manager * user-remove-manager * stageuser-add-manager * stageuser-remove-manager Commit contains override of convert_attribute_members method in baseuser class that ensures the managers will be returned in 'manager' attribute due to backward compatibility instead of 'manager_user' as would be expected. https://fedorahosted.org/freeipa/ticket/5344 This patch also fixes: https://fedorahosted.org/freeipa/ticket/5387 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* do not ask for segment direction when running topology commandsMartin Babinsky2015-10-201-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5222 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* vault: add vault container commandsPetr Vobornik2015-09-171-0/+53
| | | | | | | | | | | | | | | | adds commands: * vaultcontainer-show [--service <service>|--user <user>|--shared ] * vaultcontainer-del [--service <service>|--user <user>|--shared ] * vaultcontainer-add-owner [--service <service>|--user <user>|--shared ] [--users <users>] [--groups <groups>] [--services <services>] * vaultcontainer-remove-owner [--service <service>|--user <user>|--shared ] [--users <users>] [--groups <groups>] [--services <services>] https://fedorahosted.org/freeipa/ticket/5250 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* certprofile: remove 'rename' optionFraser Tweedale2015-09-021-2/+1
| | | | | | | | | The initial fix of ticket 5247 rejected renames, but left the option behind for API compatibility. Remove the option now, according to the consensus that because it never worked, it is fine to remove it. Fixes: https://fedorahosted.org/freeipa/ticket/5247 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* vault: change default vault type to symmetricPetr Vobornik2015-08-261-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5251 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added support for changing vault encryption.Endi S. Dewata2015-08-251-1/+26
| | | | | | | | | | | | The vault-mod command has been modified to support changing vault encryption attributes (i.e. type, password, public/private keys) in addition to normal attributes (i.e. description). Changing the encryption requires retrieving the stored secret with the old attributes and rearchiving it with the new attributes. https://fedorahosted.org/freeipa/ticket/5176 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add user-stage commandMartin Basti2015-08-211-1/+9
| | | | | | | | | | | | | | This patch replaces 'stageuser-add --from-delete' with new command user-stage. Original way always required to specify first and last name, and overall combination of options was hard to manage. The new command requires only login of deleted user (user-del --preserve). https://fedorahosted.org/freeipa/ticket/5041 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add flag to list all service and user vaultsChristian Heimes2015-08-191-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The vault-find plugin has two additional arguments to list all service vaults or user vaults. Since the name of a vault is only unique for a particular user or service, the commands also print the vault user or vault service. The virtual attributes were added in rev 01dd951ddc0181b559eb3dd5ff0336c81e245628. Example: $ ipa vault-find --users ---------------- 2 vaults matched ---------------- Vault name: myvault Type: standard Vault user: admin Vault name: UserVault Type: standard Vault user: admin ---------------------------- Number of entries returned 2 ---------------------------- $ ipa vault-find --services ---------------- 2 vaults matched ---------------- Vault name: myvault Type: standard Vault service: HTTP/ipatest.freeipa.local@FREEIPA.LOCAL Vault name: myvault Type: standard Vault service: ldap/ipatest.freeipa.local@FREEIPA.LOCAL ---------------------------- Number of entries returned 2 ---------------------------- https://fedorahosted.org/freeipa/ticket/5150 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* vault: validate vault typePetr Vobornik2015-08-181-3/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5211 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added CLI param and ACL for vault service operations.Endi S. Dewata2015-08-171-4/+8
| | | | | | | | | | | | | The CLIs to manage vault owners and members have been modified to accept services with a new parameter. A new ACL has been added to allow a service to create its own service container. https://fedorahosted.org/freeipa/ticket/5172 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* user-show: add --out option to save certificates to fileFraser Tweedale2015-07-311-1/+2
| | | | | | | | | | Add the --out option to user-show, bringing it into line with host-show and service-show with the ability to save the user's certificate(s) to a file. https://fedorahosted.org/freeipa/ticket/5171 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-311-3/+3
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS: Consolidate DNS RR types in API and schemaMartin Basti2015-07-211-24/+4
| | | | | | | | | | | | | | | | | | | | | | | | * Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API: These records never worked, they dont have attributes in schema. TSIG and TKEY are meta-RR should not be in LDAP TA is not supported by BIND NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be in LDAP. *! SIG, NSEC are already defined in schema, must stay in API. * Add HINFO, MINFO, MD, NXT records to API as unsupported records These records are already defined in LDAP schema * Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records These records were defined in IPA API as unsupported, but schema definition was missing. This causes that ACI cannot be created for these records and dnszone-find failed. (#5055) https://fedorahosted.org/freeipa/ticket/4934 https://fedorahosted.org/freeipa/ticket/5055 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* move session_logout command to ipalib/plugins directoryPetr Vobornik2015-07-081-0/+4
| | | | | | | | API refactoring caused that session_logout command was not registered. Commands in ipalib/plugins directory are automatically registered. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added vault access control.Endi S. Dewata2015-07-081-14/+78
| | | | | | | | | | | New LDAP ACIs have been added to allow vault owners to manage the vaults and to allow members to access the vaults. New CLIs have been added to manage the owner and member list. The LDAP schema has been updated as well. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* trusts: add support for one-way trust and switch to it by defaultAlexander Bokovoy2015-07-081-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trusts: pass AD DC hostname if specified explicitlyAlexander Bokovoy2015-07-081-1/+2
| | | | | | Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* certprofile: add ability to update profile config in DogtagFraser Tweedale2015-07-081-1/+2
| | | | | | | | | Add the `--file=FILENAME' option to `certprofile-mod' which, when given, will update the profile configuration in Dogtag to the contents of the file. Fixes: https://fedorahosted.org/freeipa/ticket/5093 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile: add option to export profile configFraser Tweedale2015-07-081-1/+2
| | | | | | | | | Add the `--out=FILENAME' option to `certprofile-show'. When given, it exports the profile configuration from Dogtag and writes it to the named file. Fixes: https://fedorahosted.org/freeipa/ticket/5091 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added ipaVaultPublicKey attribute.Endi S. Dewata2015-07-071-3/+3
| | | | | | | | | A new attribute ipaVaultPublicKey has been added to replace the existing ipaPublicKey used to store the vault public key. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added symmetric and asymmetric vaults.Endi S. Dewata2015-07-071-11/+41
| | | | | | | | | | | The vault plugin has been modified to support symmetric and asymmetric vaults to provide additional security over the standard vault by encrypting the data before it's sent to the server. The encryption functionality is implemented using the python-cryptography library. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* new commands to manage user/host/service certificatesMartin Babinsky2015-07-021-0/+66
| | | | | | | | | | | | A new group of commands is introduced that simplifies adding and removing binary certificates to entries. A general form of the command is ipa [user/host/service]-[add/remove]-cert [pkey] --certificate=[BASE64 BLOB] Part of http://www.freeipa.org/page/V4/User_Certificates and https://fedorahosted.org/freeipa/ticket/4238 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idviews: Fallback to AD DC LDAP only if specifically allowedTomas Babej2015-07-021-10/+20
| | | | | | https://fedorahosted.org/freeipa/ticket/4524 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Verify replication topology for a suffixPetr Vobornik2015-06-291-0/+5
| | | | | | | | | | | | Checks done: 1. check if the topology is not disconnected. In other words if there are replication paths between all servers. 2. check if servers don't have more than a recommended number of replication agreements(4) https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: change user-del flags to be CLI-specificJan Cholasta2015-06-181-2/+2
| | | | | | | | Rename --permanently to --no-preserve. https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* User life cycle: provide preserved user virtual attributeJan Cholasta2015-06-151-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* server: add "del" commandPetr Vobornik2015-06-151-0/+8
| | | | | | | this command is internal and is supposed to be used by ipa-replica-managed to delete replica. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-22 15:07:36 +0000