summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Add possibility to pass url parameter to update command of details pagePavel Vomacka2017-03-141-0/+11
| | | | | | | | | | 'update_attribute' can contain a name of field in details page. In that case the value of the field with field name will be appended to the update command options. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add property which allows refresh command to use url valuePavel Vomacka2017-03-141-0/+28
| | | | | | | | | | 'refresh_attribute' can be set to the name of url parameter name. This parameter with its value is then passed to refresh command of the details facet. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Added optional option in refreshing after modifying association tablePavel Vomacka2017-03-141-2/+16
| | | | | | | | | | | | | The 'refresh_option' of association field takes string. This string has to correspond with field name on details page. In case that the field is present the value of the field is passed to command as option in following format: {fieldname: field_value} Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Possibility to skip checking writable according to metadataPavel Vomacka2017-03-142-18/+65
| | | | | | | | | | | | | Useful in association tables which need to ignore object's metadata flags. Association tables don't check right at all. They check them only when 'acl_param' is set in association table field spec. In case that checking metadata needs to be turned on even for Association table, then set 'check_writable_from_metadata' true value in spec. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow to set another other_entity namePavel Vomacka2017-03-141-3/+26
| | | | | | | | | | | | | Association table's add, del commands needs as option list of cn of other_entity, which is added or deleted. There is a case (currently in vaults) that the name of option is different than the name of other_entity. In this situation we can set 'other_option_name' and put there the option name. This option name will be used instead of 'other_entity' name. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Additional option to add and del operations can be setPavel Vomacka2017-03-141-0/+22
| | | | | | | | | | | | | | By setting the property 'additional_add_del_field' to the name of one of the fields which are on current details page, we choose field which value will be added to *_add_* and *_del_* commands in this format: {field_name: field_value} --field_name: field_value Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Don't allow standalone KRA uninstallsStanislav Laznicka2017-03-131-4/+1
| | | | | | | | | | KRA uninstallation is very likely to break the user's setup. Don't allow it at least till we can be safely sure we are able to remove it in a standalone manner without breaking anything. https://pagure.io/freeipa/issue/6538 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add message about last KRA to WebUI Topology viewStanislav Laznicka2017-03-132-9/+20
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: do not warn about CAs if there is only one masterPetr Vobornik2017-03-101-0/+4
| | | | | | | | | | | | | | | | | | Web UI showed pop-up dialog which recommends to install additional CA in topology section when only 1 CA existed even if there was only one master. Though behind the pop-up is to prevent situation, where multiple replicas are installed but neither with --setup-ca option and thus risking to loose CA when original master is lost. The warning was displayed also if only one IPA server exists. It is unnecessary to annoy admin only about CA because the entire IPA is not duplicated. Therefore the pop-up is now shown only one IPA server exists. https://pagure.io/freeipa/issue/6598 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-managed-entries: only permit running the command on IPA masterMartin Babinsky2017-03-091-0/+3
| | | | | | https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa-managed-entries: use server-mode APIMartin Babinsky2017-03-091-1/+5
| | | | | | | | | | During LDAP connection management refactoring the ad-hoc ldap connection in `ipa-managed-entries` was replaced by calls to ldap2 backend without updating API initialization. https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: Add cermapmatch modulePavel Vomacka2017-03-084-1/+394
| | | | | | | | | | Add module which can show users which are mapped to the provided certificate. Additionaly, the certificate is parsed and parsed information are also displayed. https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Adapter for certmap_match result tablePavel Vomacka2017-03-081-0/+79
| | | | | | | | | | | | | | | Result of certmap_match command is in the following format: [{domain: 'domain1', uid:[uid11,uid12,uid13]}, {domain: 'domain2', uid:[uid21, uid22, uid23},...] For correct displaying in table we need to reformat it to the following: [{domain: 'domain1', uid: 'uid11'}, {domain: 'domain1', uid: 'uid12'},... This can be done using this Adapter. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Possibility to choose object when API call returns list of objectsPavel Vomacka2017-03-081-0/+13
| | | | | | | | | | | | In case that API call returns array of objects which contains data, using 'object_index' attribute in adapter specification we can set which object should be used. It is possible to choose only one object specified by its index in array. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to turn of autoload when details.load is calledPavel Vomacka2017-03-082-1/+10
| | | | | | | | | | When field on details facet has set 'autoload_value' to false, then it won't be loaded using that.load method of details facet. That means that field might stay unchanged even that loading of data was performed. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Move csrgen templates into ipaclient packageChristian Heimes2017-03-0814-247/+0
| | | | | | | | | | | | csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* KRA: add --setup-kra to ipa-server-installMartin Basti2017-03-082-0/+11
| | | | | | | | | | | | | | | | | This patch allows to install KRA on first IPA server in one step using ipa-server-install This option improves containers installation where ipa-server can be installed with KRA using one call without need to call docker exec. Please note the the original `kra.install()` calls in ipaserver/install/server/install.py were empty operations as it did nothing, so it is safe to move them out from CA block https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: don't change casing of Auth Indicators valuesPavel Vomacka2017-03-082-4/+4
| | | | | | | | | | | All values were previously converted to lowercase which was not coresponding with CLI behaviour. Now they stay as they are inserted. I also have to change the strings to lowercase because the otp and radius should be inserted as lowercase words. https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Allow disabling lowering text in custom_checkbox_widgetPavel Vomacka2017-03-082-1/+6
| | | | | | | | | Add new attribute which keeps information whether each text added using custom_checkbox_widget shoud be transformed to lowercase. Part of: https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fixes normalization of value in attributes widgetPetr Vobornik2017-03-081-1/+1
| | | | | | | | | | | | | | | | Fix is in checkboxes widget but the only affected one is attributes widget. Reproduction: 1. Add permission with attribute with uppercase character $ ipa permission-add aa_test --type=stageuser --attrs=businessCategory --right=read 2. Check if it is correctly displayed in Web UI Actual result: - businesscategory is not checked Expected result: - businesscategory is checked Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add support for custom table pagination sizePavel Vomacka2017-03-085-6/+73
| | | | | | | | | | | New customization button opens dialog with field for setting the number of lines in tables. After saving the new value there is new topic which starts refreshing current table facet (if shown) and set all other facets expired. Therefore all tables are immediately regenerated. https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make singleton from config modulePavel Vomacka2017-03-081-6/+45
| | | | | | | | Also added general setter and getter for attributes of config. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add javascript integer validatorPavel Vomacka2017-03-081-0/+34
| | | | | | | | | Javascript integer validator checks whether value entered into field is number and is not higher than Number.MAX_SAFE_INTEGER constant. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* man: add missing --setup-adtrust option to manpageMartin Basti2017-03-082-0/+6
| | | | | | | | | ipa-server-install and ipa-replica-install manpages miss --setup-adtrust options https://pagure.io/freeipa/issue/6630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* WebUI: Add certmap modulePavel Vomacka2017-03-085-1/+421
| | | | | | | | | Add facets for certmaprule and certmapconfigure entities. https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Custom command multivalued adder dialogPavel Vomacka2017-03-081-0/+34
| | | | | | | | | | Adder dialog which is used along with custom_command_multivalued_widget. It behaivor of confirm dialog and adds fields which are necessary. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Create non editable row widget for mutlivalued widgetPavel Vomacka2017-03-084-13/+25
| | | | | | | | | | | | Old krb-principal widget is changed to general one. And used also for ipacertmapdata in user. This widget make every line non-editable. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to set field always writablePavel Vomacka2017-03-082-26/+52
| | | | | | | | | | | | If field will have set attribute 'always_writable' to true, then 'no_update' flag will be ingored. Used in command user-{add,remove}-certmap which needs to be writable in WebUI and also needs to be omitted from user-mod command. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Change structure of Identity submenuPavel Vomacka2017-03-074-7/+43
| | | | | | | | | | | | | Previously there were 'User Groups', 'Host Groups' and 'Netgroups' separately, now these three items are grouped into one named 'Groups' which has sidebar with three items mentioned above. This change allows us to move ID views into Identity submenu. https://pagure.io/freeipa/issue/6717 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add sizelimit:0 to cert-findPavel Vomacka2017-03-074-0/+4
| | | | | | | | | | | It was not possible to get all arbitrary certificates which were added using {user|host|service|idview}-add-cert method. Adding sizelimit:0 to this cert-find command fix the issue. It set sizelimit to unlimited. https://pagure.io/freeipa/issue/6712 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-071-1/+5
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* man: update ipa-cacert-manageTomas Krizek2017-03-021-1/+4
| | | | | | | | | Make it clear this command is used to only renew certificate for the CA and provide guidance on how to renew other certificates. https://pagure.io/freeipa/issue/6648 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-024-0/+39
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Update server/replica installer man pagesMartin Babinsky2017-03-012-0/+108
| | | | | | | | | | | Since AD trust installer is now a part of composite installers, their man pages were updated with separate section documenting relevant AD trust-related option descriptions. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix erroneous short name options in ipa-adtrust-install man pageMartin Babinsky2017-03-011-2/+2
| | | | | | | | | | | `--rid-base` and `--secondary-rid-base` had `-U` option assigned by error in the man page. Remove it as these options have not short alias. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* print the installation info only in standalone modeMartin Babinsky2017-03-011-1/+1
| | | | | | | | | | There is no point in emitting this message during server/replica install. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Limit sessions to 30 minutes by defaultSimo Sorce2017-03-011-0/+1
| | | | | | | | | | When we changed the session handling code we unintentinally extended sessions expiraion time to the whole ticket lifetime of 24h. Related to https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Define template version in certmap.confFlorence Blanc-Renaud2017-03-011-0/+4
| | | | | | | | | | | | | | | | | | | | A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the definition of VERSION 2 in certmap.conf.template. ipa-server-upgrade tool compares the template version with the version in certmap.conf. As VERSION is not defined in either file, it concludes that version = 0 for both and does not make a backup of certmap.conf even though it prints that it will. The fix re-defines VERSION in the template and adapts the code because the template has changed (it is using $ISSUER_DN instead of CN=Certificate Authority,$SUBJECT_BASE). The fix also logs an error when a template file is not versioned. https://fedorahosted.org/freeipa/ticket/6354 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-012-15/+25
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Workaround for certmonger's "Subject" representationsStanislav Laznicka2017-03-011-1/+11
| | | | | | | | | | | | | | | | If an OpenSSL certificate is requested in Certmonger (CERT_STORAGE == "FILE") the "Subject" field of such Certificate is ordered as received. However, when an NSS certificate is requested, the "Subject" field takes the LDAP order (components get reversed). This is a workaround so that the behavior stays the same. The workaround should be removed when https://pagure.io/certmonger/issue/62 gets fixed. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-011-2/+2
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-281-4/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-235-12/+0
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* added help about default value for --external-ca-type optionThorsten Scherf2017-02-231-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove non-sensical kdestroy on https stopSimo Sorce2017-02-221-1/+1
| | | | | | | | | | | | | | This kdestroy runs as root and wipes root's own ccachs ... this is totally inappropriate. Use a file ccache that ends up in the private tmp, so that if the service is restarted the file is automatically removed. https://fedorahosted.org/freeipa/ticket/6673 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-223-3/+11
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server upgrade: fix upgrade from pre-4.0Jan Cholasta2017-02-202-1/+2
| | | | | | | | | | | | | | update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: fix incorrect behavior of ESC button on comboboxPavel Vomacka2017-02-171-3/+8
| | | | | | | | | | | | | | When combobox is opened then ESC key should close it. There was a bug that ESC key closed also the dialog. It was caused by bad keyboard event handling. The CB was closed by keydown event and the dialog by keyup. Therefore the propagating of keyup and keydown event is stopped when CB is opened (when the event is fired on CB element). https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* WebUI: add default on_cancel function in adder_dialogPavel Vomacka2017-02-171-0/+2
| | | | | | | | | | | | | | | Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method when closing dialog using ESC key. Previously the on_cancel method was not defined, therefore dialog was not correctly closed. This was the root cause of the bug, that adder dialog cannot be opened after closing it using ESC. Now the default function for on_cancel is dialog.close. So dialog is correctly closed. https://fedorahosted.org/freeipa/ticket/6388 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move AD trust installation code to a separate moduleMartin Babinsky2017-02-171-342/+7
| | | | | | | | | | | | This facilitates calling the necessary checks and configuration code as a module from e.g. a composite installer. The code that checks for the admin credentials stays in the standalone installer as the code inside the adtrust module is expected to operate also without admin credentials. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 04:44:06 +0000