summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Add safe updates for objectClassesMartin Kosek2012-09-041-0/+2
| | | | | | | | | | | | | | | | | | | Current objectclass updates in a form of "replace" update instruction dependent on exact match of the old object class specification in the update instruction and the real value in LDAP. However, this approach is very error prone as object class definition can easily differ as for example because of unexpected X-ORIGIN value. Such objectclass update failures may lead to serious malfunctions later. When comparing the objectclasses, make sure we normalize them both before we compare them to mitigate these kinds of errors. python-ldap's objectclass model can be utilized to do the normalization part. One objectclass update instruction was changed to do a replace of an objectclass separately from add update instruction so that we really only replace what's stored in LDAP. https://fedorahosted.org/freeipa/ticket/2440
* Password policy paging with proper sortingPetr Vobornik2012-08-292-3/+6
| | | | | | | | This patch adds option to disable sorting when paging. It allowed to enable paging in password policy with order of items untouched (they are sorted on server side by priority). Also fixing issue when paging is disabled and command summary = null. It displayed 'null' in facet footer. https://fedorahosted.org/freeipa/ticket/2677
* Successful action notificationPetr Vobornik2012-08-2914-81/+127
| | | | | | | | | | | | | | | | | | | User was not notified about success of actions executed from action list, action panel or facet cotrol bar. This patch adds IPA.notify_success(message) call. It creates a yellow notification area with supplied message in Web UI header in the middle of the green area (empty space of first level navigation). This area is displayed for 3s and then it fades out (800ms). It also fades out when it is clicked. This call is used(directly or indirectly) in: * search facets: delete, disable, enable actions * details facets: delete action * user details facet: reset password action * host details facet: unprovision, set OTP actions * service details facet: unprovision action * host and service details facet: request, revoke, restore certificates actions * group details facet: change to POSIX/external actions * dns zone details facet: add/remove permission actions https://fedorahosted.org/freeipa/ticket/2977
* Fix issue which broke setup of Web UI unit testsPetr Vobornik2012-08-291-1/+3
| | | | | | Web UI itself wasn't negatively affected. https://fedorahosted.org/freeipa/ticket/2897
* Revert change causing failure in test automationPetr Vobornik2012-08-291-3/+3
| | | | | | | | Move of click handler in patch for #2834 causes failure of automation tests. This patch reverts the problematic part. It should not affect function of fix for #2824. https://fedorahosted.org/freeipa/ticket/3014
* Ticket #2850 - Ipactl exception not handled wellJohn Dennis2012-08-271-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2850 - Ipactl exception not handled well There were various places in ipactl which intialized IpactlError with None as the msg. If you called str() on that exception all was well because ScriptError.__str__() converted a msg with None to the empty string (IpactlError is subclassed from ScriptError). But a few places directly access e.msg which will be None if initialized that way. It's hard to tell from the stack traces but I'm pretty sure it's those places which use e.msg directly which will cause the problems seen in the bug report. I do not believe it is ever correct to initialize an exception message to None, I don't even understand what that means. On the other hand initializing to the empty string is sensible and for that matter is the default for the class. This patch makes two fixes: 1) The ScriptError initializer will now convert a msg parameter of None to the empty string. 2) All places that initialized IpactlError's msg parameter to None removed the None initializer allowing the msg parameter to default to the empty string. I don't know how to test the fix for Ticket #2850 because it's not clear how it got into that state in the first place, but I do believe initialing the msg value to None is clearly wrong and should fix the problem.
* Ask for admin password in ipa-adtrust-installAlexander Bokovoy2012-08-242-0/+46
| | | | | | | | | The credentials of the admin user will be used to obtain Kerberos ticket before configuring cross-realm trusts support and afterwards, to ensure that the ticket contains MS-PAC information required to actually add a trust with Active Directory domain via 'ipa trust-add --type=ad' command. https://fedorahosted.org/freeipa/ticket/2852
* Add ACI to allow regenerating ipaNTHash from ipasamAlexander Bokovoy2012-08-221-1/+2
| | | | | | ACI was lacking to allow actually writing MagicRegen into ipaNTHash attribute, Part 2 of https://fedorahosted.org/freeipa/ticket/3016
* Range Web UIPetr Vobornik2012-08-2113-3/+390
| | | | | | | | | | | Range web UI was implemented. It consist of: * new menu item - 'ranges' in 'IPA Server' tab * new search page * new details page https://fedorahosted.org/freeipa/ticket/2894
* Read DM password from option in external CA installMartin Kosek2012-08-171-1/+4
| | | | | | | | ipa-server-install with external CA could not be run in an unattended mode as DM password was required to decipher answer cache. https://fedorahosted.org/freeipa/ticket/2793
* Ticket #2584 - Installation fails when CN is set in certificate subject baseJohn Dennis2012-08-161-14/+13
| | | | | | | | | | | | | | | | | | It is illegal to have more than one CN attribute in a certificate subject. The subject command line arg is actually inserting a dn between a leading RDN with a CN attribute and a suffix. The final subject must have only CN attribute therefore the subject command line arg must not contain CN. The patch modifies the subject validation to prohibit CN. It also improves the error messages to clearly indicate which command line parameter caused the failure and why. While fixing the above it discovered the logic used for subject validation with an external CA was flawed. DN objects were not being used when they should be (certificate subject and issuer fields are dn syntax). That code was also fixed so that the comparisions between subjects and issuers were performed with DN objects. While fixing this it was noted the object type relationship between IPA DN objects and x509 DN objects was awkward, ticket 3003 was opened to address this.
* Use DN object for Directory Manager in ipa-replica-manage connect commandRob Crittenden2012-08-161-1/+1
|
* Improves exception handling in ipa-replica-prepare.Tomas Babej2012-08-142-1/+10
| | | | | | | | A backtrace is no longer displayed when trying to prepare a replica file with the local LDAP server down. Also adds --debug option and no longer displays info messages without it. https://fedorahosted.org/freeipa/ticket/2939
* Update other facets on delete from search pagePetr Vobornik2012-08-142-3/+27
| | | | | | | | When an object in search facet was deleted, other facets were not notified that they need to refresh. If one crated object with same pkey as deleted object and then navigated to it's details he could see old object's data. This notification was added. https://fedorahosted.org/freeipa/ticket/2618
* Disable caching of Web UI login_kerberos requestPetr Vobornik2012-08-141-0/+1
| | | | | | IE caches login_kerberos request so SSO doesn't work after logout. This patch disables the caching. https://fedorahosted.org/freeipa/ticket/2991
* Handle case when trusted domain user access the Web UIPetr Vobornik2012-08-141-1/+21
| | | | | | WebUI catches the fact that the user can't access LDAP server with a current ticket. It shows form-based auth login dialog. Previoustly an ugly error was returned on an almost empty page, and user had no recourse. https://fedorahosted.org/freeipa/ticket/2897
* Read-only external facet for non-external groupsPetr Vobornik2012-08-142-1/+57
| | | | | | | Added evaluators to decide if attribute facet should be read-only based on attribute level rights. Default values serves well for group's external member. https://fedorahosted.org/freeipa/ticket/2895
* Group external member facetPetr Vobornik2012-08-141-0/+15
| | | | | | Added 'external' attribute facet to group entity. It serves for displaying group's externalmember attribute. https://fedorahosted.org/freeipa/ticket/2895
* Attribute facetPetr Vobornik2012-08-144-9/+276
| | | | | | Created new type of facet: attribute facet. This facet is similar to association facet but it serves for displaying object's multivalued attributes which behaves like association attributes. It will serve as a basis for displaying group's externalmember attribute. https://fedorahosted.org/freeipa/ticket/2895
* Display group typePetr Vobornik2012-08-143-9/+71
| | | | | | | | Created new value_map_widget which serves for displaying values based on a map. It is added to group for displaying its type. The decision is based on group's objectclass. https://fedorahosted.org/freeipa/ticket/2895
* Make group posixPetr Vobornik2012-08-142-1/+19
| | | | | | New option for creating plain user group posix group. External group can't be made posix. https://fedorahosted.org/freeipa/ticket/2338
* Make group externalPetr Vobornik2012-08-144-1/+66
| | | | | | New action for creating plain group external. Posix group can't be made external. https://fedorahosted.org/freeipa/ticket/2895
* Add external groupPetr Vobornik2012-08-142-27/+48
| | | | | | Group can be normal, posix and external. Posix checkbox was removed and was replaced by radio for selecting group type. This adds possibility of adding of external group. https://fedorahosted.org/freeipa/ticket/2895
* Fix winsync agreements creationMartin Kosek2012-08-121-4/+3
| | | | | | | | | | | | | | Due to recent addition of ID range support to DsInstance, the class could no longer be instantiated when realm_name was passed but ID range parameters were not. This condition broke winsync agreements creation in ipa-replica-manage. Make sure that ID range computation in DsInstance does not crash in this cases so that winsync replica can be created. Also convert --binddn option of ipa-replica-manage script to IPA native DN type so that setup_agreement does not crash. https://fedorahosted.org/freeipa/ticket/2987
* Use DN objects instead of stringsJohn Dennis2012-08-1218-119/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Convert every string specifying a DN into a DN object * Every place a dn was manipulated in some fashion it was replaced by the use of DN operators * Add new DNParam parameter type for parameters which are DN's * DN objects are used 100% of the time throughout the entire data pipeline whenever something is logically a dn. * Many classes now enforce DN usage for their attributes which are dn's. This is implmented via ipautil.dn_attribute_property(). The only permitted types for a class attribute specified to be a DN are either None or a DN object. * Require that every place a dn is used it must be a DN object. This translates into lot of:: assert isinstance(dn, DN) sprinkled through out the code. Maintaining these asserts is valuable to preserve DN type enforcement. The asserts can be disabled in production. The goal of 100% DN usage 100% of the time has been realized, these asserts are meant to preserve that. The asserts also proved valuable in detecting functions which did not obey their function signatures, such as the baseldap pre and post callbacks. * Moved ipalib.dn to ipapython.dn because DN class is shared with all components, not just the server which uses ipalib. * All API's now accept DN's natively, no need to convert to str (or unicode). * Removed ipalib.encoder and encode/decode decorators. Type conversion is now explicitly performed in each IPASimpleLDAPObject method which emulates a ldap.SimpleLDAPObject method. * Entity & Entry classes now utilize DN's * Removed __getattr__ in Entity & Entity clases. There were two problems with it. It presented synthetic Python object attributes based on the current LDAP data it contained. There is no way to validate synthetic attributes using code checkers, you can't search the code to find LDAP attribute accesses (because synthetic attriutes look like Python attributes instead of LDAP data) and error handling is circumscribed. Secondly __getattr__ was hiding Python internal methods which broke class semantics. * Replace use of methods inherited from ldap.SimpleLDAPObject via IPAdmin class with IPAdmin methods. Directly using inherited methods was causing us to bypass IPA logic. Mostly this meant replacing the use of search_s() with getEntry() or getList(). Similarly direct access of the LDAP data in classes using IPAdmin were replaced with calls to getValue() or getValues(). * Objects returned by ldap2.find_entries() are now compatible with either the python-ldap access methodology or the Entity/Entry access methodology. * All ldap operations now funnel through the common IPASimpleLDAPObject giving us a single location where we interface to python-ldap and perform conversions. * The above 4 modifications means we've greatly reduced the proliferation of multiple inconsistent ways to perform LDAP operations. We are well on the way to having a single API in IPA for doing LDAP (a long range goal). * All certificate subject bases are now DN's * DN objects were enhanced thusly: - find, rfind, index, rindex, replace and insert methods were added - AVA, RDN and DN classes were refactored in immutable and mutable variants, the mutable variants are EditableAVA, EditableRDN and EditableDN. By default we use the immutable variants preserving important semantics. To edit a DN cast it to an EditableDN and cast it back to DN when done editing. These issues are fully described in other documentation. - first_key_match was removed - DN equalty comparison permits comparison to a basestring * Fixed ldapupdate to work with DN's. This work included: - Enhance test_updates.py to do more checking after applying update. Add test for update_from_dict(). Convert code to use unittest classes. - Consolidated duplicate code. - Moved code which should have been in the class into the class. - Fix the handling of the 'deleteentry' update action. It's no longer necessary to supply fake attributes to make it work. Detect case where subsequent update applies a change to entry previously marked for deletetion. General clean-up and simplification of the 'deleteentry' logic. - Rewrote a couple of functions to be clearer and more Pythonic. - Added documentation on the data structure being used. - Simplfy the use of update_from_dict() * Removed all usage of get_schema() which was being called prior to accessing the .schema attribute of an object. If a class is using internal lazy loading as an optimization it's not right to require users of the interface to be aware of internal optimization's. schema is now a property and when the schema property is accessed it calls a private internal method to perform the lazy loading. * Added SchemaCache class to cache the schema's from individual servers. This was done because of the observation we talk to different LDAP servers, each of which may have it's own schema. Previously we globally cached the schema from the first server we connected to and returned that schema in all contexts. The cache includes controls to invalidate it thus forcing a schema refresh. * Schema caching is now senstive to the run time context. During install and upgrade the schema can change leading to errors due to out-of-date cached schema. The schema cache is refreshed in these contexts. * We are aware of the LDAP syntax of all LDAP attributes. Every attribute returned from an LDAP operation is passed through a central table look-up based on it's LDAP syntax. The table key is the LDAP syntax it's value is a Python callable that returns a Python object matching the LDAP syntax. There are a handful of LDAP attributes whose syntax is historically incorrect (e.g. DistguishedNames that are defined as DirectoryStrings). The table driven conversion mechanism is augmented with a table of hard coded exceptions. Currently only the following conversions occur via the table: - dn's are converted to DN objects - binary objects are converted to Python str objects (IPA convention). - everything else is converted to unicode using UTF-8 decoding (IPA convention). However, now that the table driven conversion mechanism is in place it would be trivial to do things such as converting attributes which have LDAP integer syntax into a Python integer, etc. * Expected values in the unit tests which are a DN no longer need to use lambda expressions to promote the returned value to a DN for equality comparison. The return value is automatically promoted to a DN. The lambda expressions have been removed making the code much simpler and easier to read. * Add class level logging to a number of classes which did not support logging, less need for use of root_logger. * Remove ipaserver/conn.py, it was unused. * Consolidated duplicate code wherever it was found. * Fixed many places that used string concatenation to form a new string rather than string formatting operators. This is necessary because string formatting converts it's arguments to a string prior to building the result string. You can't concatenate a string and a non-string. * Simplify logic in rename_managed plugin. Use DN operators to edit dn's. * The live version of ipa-ldap-updater did not generate a log file. The offline version did, now both do. https://fedorahosted.org/freeipa/ticket/1670 https://fedorahosted.org/freeipa/ticket/1671 https://fedorahosted.org/freeipa/ticket/1672 https://fedorahosted.org/freeipa/ticket/1673 https://fedorahosted.org/freeipa/ticket/1674 https://fedorahosted.org/freeipa/ticket/1392 https://fedorahosted.org/freeipa/ticket/2872
* Permissions of replica files changed to 0600.Tomas Babej2012-08-071-1/+3
| | | | | | | File system permissions on replica files in /var/lib/ipa were changed to 0600. https://fedorahosted.org/freeipa/ticket/2847
* Replace use of attr with prop for booleansPetr Vobornik2012-08-025-41/+33
| | | | | | | | Recommened way of setting boolean HTML attributes is by $.prop(boolean) method not $.attr(boolean) because it sets DOM object property not an attribute. Latter works because of jquery's backward compatibility. This patch makes things clearer. Some info about prop and attr: http://stackoverflow.com/a/5876747 https://fedorahosted.org/freeipa/ticket/2817
* Fixed incorrect use of jQuery.attr for setting disabled attributePetr Vobornik2012-08-021-4/+2
| | | | | | | | Occurance: select_widget Update to latest version of jQuery uncovered this issue. https://fedorahosted.org/freeipa/ticket/2817
* Web UI tests fixPetr Vobornik2012-08-022-3/+4
| | | | | | | ACI tests were crashing because of misconfigured facet. Entity link test were crashing because of incorrect jquery selector. https://fedorahosted.org/freeipa/ticket/2817
* Unified buttonsPetr Vobornik2012-08-022-12/+28
| | | | | | Buttons in association dialog and action list have different style and behavior than buttons in dialogs. This patch unifies it by using jquery.button widget. https://fedorahosted.org/freeipa/ticket/2817
* Removal of unnecessary overrides of jquery-ui stylesPetr Vobornik2012-08-021-69/+14
| | | | | | | | | | | | | | | | ipa.css had to be updated to work with updated jquery-ui. This patch removes several duplicate styles. Following issues were fixed: * dialogs titles in IE and Opera were black instead of green * no black line in first navigation level in IE and Opera * all browsers (FF, IE, Chrome, Opera) have the same style for buttons and headers * dialogs has borders again (should we remove its shadow?) Known issues: * selected tab-1 in Chrome and Opera doesn't overlaps background line as in IE and FF. Not sure how to fix without breaking (there are border overlaps) the latter ones. I think it looks good enough. * some buttons are missing padding. Will be fixed in next patch. https://fedorahosted.org/freeipa/ticket/2817
* Fix for incorrect event handler definitionPetr Vobornik2012-08-021-2/+2
| | | | | | Clicks events should be better defined by jquery calls (usually addEventListener) not as elements attributes. Definition as element attribute causes problems after upgrade to jquery 1.7.2. Two occurances were removed. https://fedorahosted.org/freeipa/ticket/2817
* Update to jquery-ui-1.8.21.customPetr Vobornik2012-08-029-829/+184
| | | | | | | | jquery-ui was regenerated to up to date version. Border radius and IPA custom colors were added to theme so we don't have to override them in ipa.css. https://fedorahosted.org/freeipa/ticket/2817
* Update to jquery.1.7.2.minPetr Vobornik2012-08-021-8374/+4
| | | | | | jquery library wasn't updated for a long time. https://fedorahosted.org/freeipa/ticket/2817
* PAC Type options for services in Web UIPetr Vobornik2012-08-025-5/+839
| | | | | | | | | | Following options were added to Web UI * PAC Type in service * PAC Type in configuration Testing metadata for objects and commands were regenerated. https://fedorahosted.org/freeipa/ticket/2958
* Add per-service option to store the types of PAC it supportsRob Crittenden2012-08-015-1/+16
| | | | | | Create a per-service default as well. https://fedorahosted.org/freeipa/ticket/2184
* Fixed: combobox stacking in service adder dialogPetr Vobornik2012-08-011-2/+4
| | | | | | | First select's content is displayed under second comboxes content when select is opened when second combobox is opened Bonus for: https://fedorahosted.org/freeipa/ticket/2834
* Fixed: Unable to select option in combobox in IE and ChromePetr Vobornik2012-08-012-7/+8
| | | | | | | | | There's probably a bug regarding z-index stacking in Chrome and IE. It appears when combobox is used in dialog. Combobox's select area had z-index=1010. When first jquery dialogs is open it has z-index=1000. Further dialogs have higher z-index. When dialog's z-index exceeds 1010 option in select control can't be selected. IMO it is a browser bug because select control lies in dialog content's stacking context so it should be functional even with z-index=1. This patch raises select area's z-index to 9000000 which should prevent the issue for some time. Also it make's combobox's z-index configurable so we can solve combobox stacking (ie in service-add dialog). Second part of: https://fedorahosted.org/freeipa/ticket/2834
* Ensure ipa-adtrust-install is run with Kerberos ticket for admin userAlexander Bokovoy2012-07-312-23/+28
| | | | | | | | | | | | When setting up AD trusts support, ipa-adtrust-install utility needs to be run as: - root, for performing Samba configuration and using LDAPI/autobind - kinit-ed IPA admin user, to ensure proper ACIs are granted to fetch keytab As result, we can get rid of Directory Manager credentials in ipa-adtrust-install https://fedorahosted.org/freeipa/ticket/2815
* Update translationsPetr Viktorin2012-07-3127-173658/+11180
| | | | | | | | | | | | Update the pot file to match current source, and pull translations from Transifex The commands used to create this commit were: tx pull -fa # needs an account and transifex client setup cd install/po make update-pot (update LINGUAS to contain all languages with translations, and no empty ones) make update-po
* Use certmonger to renew CA subsystem certificatesRob Crittenden2012-07-3019-13/+466
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
* Arrange stripping .po filesPetr Viktorin2012-07-243-4/+39
| | | | | | | | | | | | | | | | | | | | The .po files we use for translations have two shortcomings when used in Git: - They include file locations, which change each time the source is updated. This results in large, unreadable diffs that don't merge well. - They include source strings for untranslated messages, wasting space unnecessarily. Update the Makefile so that the extraneous information is stripped when the files are updated or pulled form Transifex, and empty translation files are removed entirely. Also, translations are normalized to a common style. This should help diffs and merges. The validator requires file location comments to identify the programming language, and to produce good error reports. To make this work, merge the comments in before validation. First patch for: https://fedorahosted.org/freeipa/ticket/2435
* Fix autoscroll to top in tables in IEPetr Vobornik2012-07-252-0/+13
| | | | | | | | | | In IE when a window is small (horizontal scrollbar is displayed) click or keyboard input on various parts of UI makes search tables scroll to top. It prevents from selecting items in a table. This issue happens when using absolute positioned element with overflow style. It's a bug in IE. Two workarounds were added to make UI usable in IE. Adding position:relative; style to body element fixes the problem in search pages. It doesn't help in association dialogs though. The bug doesn't occur when some child element has focus. It's possible to set focus to first visible checkbox while scrolling down but user experience is very bad. Better solution seems to scroll back when IE scrolls to top on mousedown. That way mouse click event happens on the target element and it can gain focus and therefore be selected. Some glitches still remains but is usable. https://fedorahosted.org/freeipa/ticket/2835
* IDs and names for dialogsPetr Vobornik2012-07-256-11/+33
| | | | | | | | | | It's hard to detect if or which type dialog is displayed becouse not all dialogs have IDs. On dialog open, it's id or name (if id is not set) is used for containing element id. Many of dialog types were missing id or name so name was added to each dialog type. In HTML, element's id should be unique. Our framework allows opening two dialogs with the same id. It may lead to state where getElementById method may have unpredicted behaviour. Therefore attribute 'data-name' with dialog's name was added to dialog's containing element. Automation framework can search more reliable by using this attribute instead of id. https://fedorahosted.org/freeipa/ticket/2853
* Framework for admin/install tools, with ipa-ldap-updaterPetr Viktorin2012-07-221-158/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently, FreeIPA's install/admin scripts are long pieces of code that aren't very reusable, importable, or testable. They have been extended over time with features such as logging and error handling, but since each tool was extended individually, there is much inconsistency and code duplication. This patch starts a framework which the admin tools can use, and converts ipa-ldap-updater to use the framework. Common tasks the tools do -- option parsing, validation, logging setup, error handling -- are represented as methods. Individual tools can extend, override or reuse the defaults as they see fit. The ipa-ldap-updater has two modes (normal and --upgrade) that don't share much functionality. They are represented by separate classes. Option parsing, and selecting which class to run, happens before they're instantiated. All code is moved to importable modules to aid future testing. The only thing that remains in the ipa-ldap-updater script is a two-line call to the library. First part of the work for: https://fedorahosted.org/freeipa/ticket/2652
* Default to no when trying trying to install a replica on wrong server.Rob Crittenden2012-07-191-1/+1
| | | | | | | | When installing a replica file on the wrong server we warn that this will likely fail and prompt to Continue. This prompt should default to False, not True. https://fedorahosted.org/freeipa/ticket/2325
* Fix updating minimum_connections in ipa-upgradeconfigPetr Viktorin2012-07-181-18/+19
| | | | | | | | | | | The upgrade script set the "psearch" directive in some circumstances, but did not remember that it was set, so later, when setting minimum_connections, it assumed psearch is not set. Also, the script did not set minimum_connections if the directive wasn't already there. It should be set in that case. Related to https://fedorahosted.org/freeipa/ticket/2554
* Fix detection of deleted mastersSimo Sorce2012-07-171-9/+15
| | | | | | | | | | | | | | | When setting up agreements we need to be careful in not allowing to 'reconnect' a master that was previously completely deleted as it would misses entries that are vital for proper functioning. This change in code fixes 2 problems with the current approach. 1) it removes false positives when we are tryig to reconnect a replica that was previosuly merely disconnected but was still part of the domain and just replicating via a different topology and not a direct link 2) adds checks for entries that are deleted when an actual removal is performed. so that we cannot 'reconnect' previously unrelated replicas when one of the 2 has been permanently deleted from the masters tree. Second part of ticket https://fedorahosted.org/freeipa/ticket/2925
* Fix safety checks to prevent orphaning replicasSimo Sorce2012-07-171-1/+1
| | | | | | | | This is just a typo, we were checking one side twice and never the other side. So depending on which side you run the command you'd be able or not to remove the replication agreement even if it was the last one. First part of ticket: https://fedorahosted.org/freeipa/ticket/2925
* Bigger textarea for permission type=subtreePetr Vobornik2012-07-182-2/+8
| | | | | | Adder dialog and details facet for permission type=subtree have small textarea for defining subtree filter. It was unconfortable to define the filter. This difference was removed. https://fedorahosted.org/freeipa/ticket/2832
generated by cgit (git 2.34.1) at 2024-06-12 00:22:12 +0000