summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Pylint: import max one module per lineMartin Basti2016-03-221-1/+2
| | | | | Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Pylint: fix definition of global variablesMartin Basti2016-03-221-1/+0
| | | | | | | | | | Global variables should be defined in the outer space, not just marked as global inside functions. Removes unused global variables Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-222-6/+6
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* DS deadlock when memberof scopes topology plugin updatesThierry Bordaz2016-03-181-0/+2
| | | | | | | | | | | | | | | | | Topology plugin may merge (aka DEL) segments that would trigger internal search for groups owning that segment. The problem is that it is searching those groups into the full suffix and so need the schema compat map lock. If any other operation holding schema compat map lock need to access the page involved in the DEL, there is a deadlock. This fix is to prevent useless group searching if the target entry is a segment or is in compat tree. https://fedorahosted.org/freeipa/ticket/5637 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add field for group id in user add dialogPavel Vomacka2016-03-102-2/+14
| | | | | | | | | | Add new field in user add dialog. This combo box lists all posix groups so user can choose one. It is also possible to fill a GID number which is not in the list. https://fedorahosted.org/freeipa/ticket/5505 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Nodes stay fixed after initial animation.Pavel Vomacka2016-03-101-0/+16
| | | | | | | | | | There is an animation of nodes layout after first load of graph or adding new node. Then all nodes of the graph are set to the fixed state. The node is set to fixed even after manual turn off of fixed state. https://fedorahosted.org/freeipa/ticket/5649 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add pan and zoom functionality to the topology graphPavel Vomacka2016-03-101-8/+109
| | | | | | | | | | Add zooming and panning functionality to the topology graph. Also the page rememberes the old setting of the graph position and size. So, after refreshing the graph has the same position and size as it had before. https://fedorahosted.org/freeipa/ticket/5502 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* krb5conf: use 'true' instead of 'yes' for forwardable optionMartin Basti2016-03-092-2/+2
| | | | | | | | | 'yes' is also valid value in krb5.conf but we should be consistent and use only 'true' as we do for other options. https://fedorahosted.org/freeipa/ticket/5518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow to specify Kerberos authz data type per userSimo Sorce2016-03-091-1/+1
| | | | | | | | | | | | Like for services setting the ipaKrbAuthzData attribute on a user object will allow us to control exactly what authz data is allowed for that user. Setting NONE would allow no authz data, while setting MS-PAC would allow only Active Directory compatible data. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/2579 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Configure 389ds with "default" cipher suiteMartin Basti2016-03-091-3/+3
| | | | | | | | | nsSSLCiphers: "default" provides only secure ciphers that should be used when connecting to DS https://fedorahosted.org/freeipa/ticket/5684 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* CONFIGURE: Replace obsolete macrosLukas Slebodnik2016-03-081-1/+0
| | | | | | | | | The AC_PROG_LIBTOOL macro is obsoleted by since libtool-2.0 which is already in rhel6+ https://fedorahosted.org/FedoraReview/wiki/AutoTools Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: fail nicely if cookies are disabledPetr Vobornik2016-03-031-6/+20
| | | | | | | | | | | Reworks also sessionStorage test because disablement of cookies might be connected with sessionStorage and localStorage. E.g. Chrome raises exception when *Storage is accessed with "Block sites from setting any data" settings set in "Content Settings/Cookies" section. https://fedorahosted.org/freeipa/ticket/4338 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* pylint: supress false positive no-member errorsMartin Basti2016-03-021-2/+2
| | | | | | | | | pylint 1.5 prints many false positive no-member errors which are supressed by this commit. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix URL for reporting bugs in stringsPetr Spacek2016-03-011-1/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* slapi-nis: update configuration to allow external members of IPA groupsAlexander Bokovoy2016-03-012-0/+4
| | | | | | | | | | | | | | Currently in an environment with trust to AD the compat tree does not show AD users as members of IPA groups. The reason is that IPA groups are read directly from the IPA DS tree and external groups are not handled. slapi-nis project has added support for it in 0.55, make sure we update configuration for the group map if it exists and depend on 0.55 version. https://fedorahosted.org/freeipa/ticket/4403 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-adtrust-install: Allow dash in the NETBIOS nameTomas Babej2016-02-291-2/+4
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-261-1/+1
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* fix permission: Read Replication AgreementsMartin Basti2016-02-254-1/+18
| | | | | | | | | | | | | | This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-231-0/+2
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: fixed showing of success message after password change on loginPetr Vobornik2016-02-231-1/+1
| | | | | | | | | | similar issue and cause as in https://fedorahosted.org/freeipa/ticket/5567 root cause is that binding triggers validation which clears messages in validation summary. Maybe it could be refactored in a future to not use the same validation summary field for API calls and fields. Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: use API call ca_is_enabled instead of enable_ra env variable.Petr Vobornik2016-02-233-1/+15
| | | | | | | | To be consistent with backend code. https://fedorahosted.org/freeipa/ticket/5622 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* replica promotion: fix AVC denials in remote connection checkJan Cholasta2016-02-111-1/+1
| | | | | | | | Also move com.redhat.idm.trust-fetch-domains to /usr/libexec/ipa/oddjob. https://fedorahosted.org/freeipa/ticket/5550 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add validation to Issue new certificate dialogPavel Vomacka2016-02-022-20/+45
| | | | | | | | | 'Issue new certificate' dialog now validates whether user fills 'principal' and 'csr' field. In case that one of these fields is empty then it does not allow to submit the dialog. https://fedorahosted.org/freeipa/ticket/5432 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Automatically detect and remove dangling RUVsStanislav Laznicka2016-02-022-0/+163
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Listing and cleaning RUV extended for CA suffixStanislav Laznicka2016-02-021-15/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/5411 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Convert ipa-sam to use the new getkeytab controlSimo Sorce2016-02-011-0/+1
| | | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5495 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix standalone installation of externally signed CA on IPA masterMartin Babinsky2016-01-281-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5636 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: remove moot error from webui buildPetr Vobornik2016-01-271-1/+2
| | | | | | | | | | add module 'libs/d3' to a list of modules provided by third party libraries it is provided by d3 library in libs directory https://fedorahosted.org/freeipa/ticket/5641 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* cert renewal: import all external CA certs on IPA CA cert renewalJan Cholasta2016-01-271-19/+9
| | | | | | | | | | Import all external CA certs to the Dogtag NSS database on IPA CA cert renewal. This fixes Dogtag not being able to connect to DS which uses 3rd party server cert after ipa-certupdate. https://fedorahosted.org/freeipa/ticket/5595 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: crash nicely if sessionStorage is not availablePetr Vobornik2016-01-272-6/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5643 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add support for the 'user' url parameter for the reset_password.htmlPavel Vomacka2016-01-271-0/+4
| | | | | | | | The /ipa/ui/reset_password.html page is now able to use url paramater 'user'. The value of this parameter is used for pre-filling the username field. https://fedorahosted.org/freeipa/ticket/5001 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add tool tips for Revert, Refresh, Undo, and Undo AllPavel Vomacka2016-01-273-0/+8
| | | | | | | | | | | | Add tool tips for buttons in detail view. New tooltips: Reload - Reload current settings from the server. Revert - Undo all unsaved changes. Undo - Undo this change. Undo all - Undo all changes in this field. https://fedorahosted.org/freeipa/ticket/5428 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts)Petr Viktorin2016-01-271-3/+5
| | | | | | | | | | | | | | | | Make ipaclient a Python library like ipapython, ipalib, etc. Use setup.py instead of autotools for installing it. Move C client tools, Python scripts, and man pages, to client/. Remove old, empty or outdated, boilerplate files (NEWS, README, AUTHORS). Remove /setup-client.py (ipalib/setup.py should be used instead). Update Makefiles and the spec file accordingly. https://fedorahosted.org/freeipa/ticket/5638 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Exclude o=ipaca subtree from Retro Changelog (syncrepl)Martin Basti2016-01-211-0/+1
| | | | | | | | | | CA and DS have issues with Retro Changelog plugin. CA subtree should be excluded from syncrepl. This should improve speed of CA related operations too. https://fedorahosted.org/freeipa/ticket/5538 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Set close button type attribute to 'button'.James Groffen2016-01-201-0/+1
| | | | | | Stops IE10 from closing the dialog on an enter keypress. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fixed login error message box in LoginScreen pageAbhijeet Kasurde2016-01-201-4/+4
| | | | | | | | | | | Fix added for showing error message returned from server to client browser. User is now notified with proper error messages returned by server. https://bugzilla.redhat.com/show_bug.cgi?id=1293870 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: dislay server suffixes in server search pagePetr Vobornik2016-01-202-1/+12
| | | | | | | | | | | | | | There was a change where suffixes in server are not longer returned as DNs but rather a cn of related topology suffix. I.e. they share "memberof" logic. This caused that search page doesn't get the data because it uses "no_member: true" option by default. This patch overrides the behavior because it is OK for server search page to fetch also member data - it is not so costly as e.g. in users. https://fedorahosted.org/freeipa/ticket/5609 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-181-5/+5
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* IPA upgrade: move replication ACIs to the mapping tree entryMartin Babinsky2016-01-181-1/+9
| | | | | | | | | | | | | | | During IPA server upgrade from pre-4.3 versions, the ACIs permitting manipulation of replication agreements are removed from the 'cn="$SUFFIX",cn=mapping tree,cn=config' and 'cn=o\3Dipaca,cn=mapping tree,cn=config'. However they are never re-added breaking management and installation of replicas. This patch modifies the update process so that the ACIs are first added to the 'cn=mapping tree,cn=config' and then removed from the child entries. https://fedorahosted.org/freeipa/ticket/5575 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix: uninstall does not stop named-pkcs11 and ipa-ods-exporterMartin Basti2016-01-182-0/+7
| | | | | | | | | | | ipactl is not aware of new services installed later, if ipactl restart or start has not been executed. This commit is workaround, proper fix may need to improve ipactl. https://fedorahosted.org/freeipa/ticket/5262 Reviewed-By: David Kupka <dkupka@redhat.com>
* Enable pylint unbalanced-tuple-unpacking checkMartin Basti2016-01-141-2/+1
| | | | | | | | Enables check and fixes one issue. get_entries can be replaced by get_entry, filter is not needed because check of 'originfilter' attribute is done later. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use only AES enctypes by defaultSimo Sorce2016-01-131-2/+0
| | | | | | | | | | | | Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-csreplica-manage: remove extraneous ldap2 connectionMartin Babinsky2016-01-131-2/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5583 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-113-55/+42
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: pwpolicy cospriority field was marked as requiredPetr Vobornik2016-01-081-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5553 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: add examples to network address validator error messagePetr Vobornik2016-01-081-1/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/5532 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Enable pylint expression-not-assigned checkMartin Basti2015-12-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables check and fixes: ************* Module ipa-replica-conncheck install/tools/ipa-replica-conncheck:150: [W0106(expression-not-assigned), parse_options] Expression "(replica_group.add_option('-w', '--password', dest='password', sensitive=True, help='Password for the principal'), )" is assigned to nothing) ************* Module ipatests.test_xmlrpc.test_automount_plugin ipatests/test_xmlrpc/test_automount_plugin.py:437: [W0106(expression-not-assigned), test_automount_indirect.test_1a_automountmap_add_indirect] Expression "api.Command['automountmap_add_indirect'](self.locname, self.mapname, **self.map_kw)['result']" is assigned to nothing) ************* Module ipatests.test_ipaserver.test_otptoken_import ipatests/test_ipaserver/test_otptoken_import.py:128: [W0106(expression-not-assigned), test_otptoken_import.test_mini] Expression "[(t.id, t.options) for t in doc.getKeyPackages()]" is assigned to nothing) ************* Module ipatests.test_ipaserver.test_ldap ipatests/test_ipaserver/test_ldap.py:221: [W0106(expression-not-assigned), test_LDAPEntry.test_popitem] Expression "list(e) == []" is assigned to nothing) ************* Module ipa-client-install ipa-client/ipa-install/ipa-client-install:114: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-p', '--principal', dest='principal', help='principal to use to join the IPA realm'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:116: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-w', '--password', dest='password', sensitive=True, help='password to join the IPA realm (assumes bulk password unless principal is also set)'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:118: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-k', '--keytab', dest='keytab', help='path to backed up keytab from previous enrollment'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:120: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-W', dest='prompt_password', action='store_true', default=False, help='Prompt for a password to join the IPA realm'), )" is assigned to nothing) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove wildcard importsMartin Basti2015-12-239-10/+22
| | | | | | | | | | | Wildcard imports should not be used. Check for wildcard imports has been enabled in pylint. Pylint note: options 'wildcard-import' causes too much false positive results, so instead it I used 'unused-wildcard-import' option which has almost the same effect. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove unused importsMartin Basti2015-12-2313-17/+9
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-dns-install: Do not check for zone overlap when DNS installed.David Kupka2015-12-221-1/+1
| | | | | | | | | | | When DNS is already installed somewhere in topology we should not check for zone overlap because it would always say that we are overlapping our own domain. ipa-replica-install already does that but ipa-dns-install did not. https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 08:32:10 +0000