summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
* Support 8192-bit RSA keys in default cert profileFraser Tweedale2017-03-221-1/+1
| | | | | | | | | Update the caIPAserviceCert profile to accept 8192-bit RSA keys. Affects new installs only, because there is not yet a facility to update included profiles. Fixes: https://pagure.io/freeipa/issue/6319 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* man ipa-cacert-manage install needs clarificationFlorence Blanc-Renaud2017-03-221-0/+2
| | | | | | | | | The customers are often confused by ipa-cacert-manage install. The man page should make it clear that IPA CA is not modified in any way by this command. https://pagure.io/freeipa/issue/6795 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Increase Apache HTTPD's default keep alive timeoutChristian Heimes2017-03-201-1/+6
| | | | | | | | | Apache has a default keep alive timeout of 5 seconds. That's too low for interactive commands, e.g. password prompts. 30 seconds sounds like a good compromise. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add options to allow ticket cachingSimo Sorce2017-03-161-0/+2
| | | | | | | | | | | | This new option (planned to land in gssproxy 0.7) we cache the ldap ticket properly and avoid a ticket lookup to the KDC on each and every ldap connection. (Also requires krb5 libs 1.15.1 to benefit from caching). Ticket: https://pagure.io/freeipa/issue/6771 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix Python 3 pylint errorsChristian Heimes2017-03-151-2/+2
| | | | | | | | | | | | | | | | ************* Module ipaserver.install.ipa_kra_install ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse') ************* Module ipapython.install.core ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member) ************* Module ipatests.test_ipapython.test_dn ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals()) ************* Module ipa-ca-install install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove allow_constrained_delegation from gssproxy.confPavel Vomacka2017-03-141-1/+0
| | | | | | | | | | | The Apache process must not allowed to use constrained delegation to contact services because it is already allowed to impersonate users to itself. Allowing it to perform constrained delegation would let it impersonate any user against the LDAP service without authentication. https://pagure.io/freeipa/issue/6225 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* WebUI: Add support for management of user short name resolutionPavel Vomacka2017-03-142-0/+8
| | | | | | | | | | | Added field into idview details page and into server config where the order of domains used while searching for user. Domains can be separated by ':' character. https://pagure.io/freeipa/issue/6372 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Short name resolution: introduce the required schemaMartin Babinsky2017-03-142-0/+3
| | | | | | | | | | | | Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema. Extend ipaConfig object with ipaNameResolutionData objectclass during update. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-142-127/+0
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: add link to login page which for login using certificatePavel Vomacka2017-03-143-4/+78
| | | | | | | | | | Also add error message when login failed. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Support certificate login after installation and upgradePavel Vomacka2017-03-142-2/+32
| | | | | | | | | | | | Add necessary steps which set SSSD and set SELinux boolean during installation or upgrade. Also create new endpoint in apache for login using certificates. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* TESTS WebUI: Vaults managementPavel Vomacka2017-03-141-1/+26
| | | | | | | | | | | | | | Bunch of tests for WebUI Vault Management. Covers: Adding vaults Modifying vaults Adding members and owners to all types of vaults https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add vault managementPavel Vomacka2017-03-145-2/+910
| | | | | | | | | | | | | | | | | | | | Add vault management into WebUI, there are some constraints: - There is no crypto library so Symmetric and Assymetric vaults are not supported in WebUI. Also retrieving or archiving data is not supported. - There aren't any container support right now Supported is: - Browsing vaults - Adding Standard vaults (users, service, shared) - Removing vaults - Adding and removing owners - Adding and removing members https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: allow to show rows with same pkey in tablesPavel Vomacka2017-03-147-30/+90
| | | | | | | | | Allows to show rows which have the same primary key. Used in Vault. https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: search facet's default actions might be overridenPavel Vomacka2017-03-141-5/+26
| | | | | | | | | | | While defining search facet and adding custom actions with the same name as default actions in search facet. Custom actions will be used and their definition will override default actions. Part of:https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add possibility to hide only one tab in sidebarPavel Vomacka2017-03-141-0/+14
| | | | | | | | | Removes item selected by name attribute from sidebar Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Possibility to set list of table attributes which will be added to _del commandPavel Vomacka2017-03-141-1/+35
| | | | | | | | | | | 'additional_table_attrs' can contain array of names of columns. Value from each column with its name will be added to the batch _del command. in case that the column with set name does not exists - the name is skipped. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend _show command after _find command in table facetsPavel Vomacka2017-03-141-2/+40
| | | | | | | | | | | | Allow pagination to table facets which needs to call _show on all rows with additional parameter. 'show_command_additional_attr' can be set to any attribute from result of _find command. This attribute is taken with its value and added to options of _each command for each row. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add possibility to pass url parameter to update command of details pagePavel Vomacka2017-03-141-0/+11
| | | | | | | | | | 'update_attribute' can contain a name of field in details page. In that case the value of the field with field name will be appended to the update command options. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add property which allows refresh command to use url valuePavel Vomacka2017-03-141-0/+28
| | | | | | | | | | 'refresh_attribute' can be set to the name of url parameter name. This parameter with its value is then passed to refresh command of the details facet. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Added optional option in refreshing after modifying association tablePavel Vomacka2017-03-141-2/+16
| | | | | | | | | | | | | The 'refresh_option' of association field takes string. This string has to correspond with field name on details page. In case that the field is present the value of the field is passed to command as option in following format: {fieldname: field_value} Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Possibility to skip checking writable according to metadataPavel Vomacka2017-03-142-18/+65
| | | | | | | | | | | | | Useful in association tables which need to ignore object's metadata flags. Association tables don't check right at all. They check them only when 'acl_param' is set in association table field spec. In case that checking metadata needs to be turned on even for Association table, then set 'check_writable_from_metadata' true value in spec. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Allow to set another other_entity namePavel Vomacka2017-03-141-3/+26
| | | | | | | | | | | | | Association table's add, del commands needs as option list of cn of other_entity, which is added or deleted. There is a case (currently in vaults) that the name of option is different than the name of other_entity. In this situation we can set 'other_option_name' and put there the option name. This option name will be used instead of 'other_entity' name. Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Additional option to add and del operations can be setPavel Vomacka2017-03-141-0/+22
| | | | | | | | | | | | | | By setting the property 'additional_add_del_field' to the name of one of the fields which are on current details page, we choose field which value will be added to *_add_* and *_del_* commands in this format: {field_name: field_value} --field_name: field_value Part of: https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Don't allow standalone KRA uninstallsStanislav Laznicka2017-03-131-4/+1
| | | | | | | | | | KRA uninstallation is very likely to break the user's setup. Don't allow it at least till we can be safely sure we are able to remove it in a standalone manner without breaking anything. https://pagure.io/freeipa/issue/6538 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add message about last KRA to WebUI Topology viewStanislav Laznicka2017-03-132-9/+20
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: do not warn about CAs if there is only one masterPetr Vobornik2017-03-101-0/+4
| | | | | | | | | | | | | | | | | | Web UI showed pop-up dialog which recommends to install additional CA in topology section when only 1 CA existed even if there was only one master. Though behind the pop-up is to prevent situation, where multiple replicas are installed but neither with --setup-ca option and thus risking to loose CA when original master is lost. The warning was displayed also if only one IPA server exists. It is unnecessary to annoy admin only about CA because the entire IPA is not duplicated. Therefore the pop-up is now shown only one IPA server exists. https://pagure.io/freeipa/issue/6598 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-managed-entries: only permit running the command on IPA masterMartin Babinsky2017-03-091-0/+3
| | | | | | https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipa-managed-entries: use server-mode APIMartin Babinsky2017-03-091-1/+5
| | | | | | | | | | During LDAP connection management refactoring the ad-hoc ldap connection in `ipa-managed-entries` was replaced by calls to ldap2 backend without updating API initialization. https://pagure.io/freeipa/issue/6735 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: Add cermapmatch modulePavel Vomacka2017-03-084-1/+394
| | | | | | | | | | Add module which can show users which are mapped to the provided certificate. Additionaly, the certificate is parsed and parsed information are also displayed. https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Adapter for certmap_match result tablePavel Vomacka2017-03-081-0/+79
| | | | | | | | | | | | | | | Result of certmap_match command is in the following format: [{domain: 'domain1', uid:[uid11,uid12,uid13]}, {domain: 'domain2', uid:[uid21, uid22, uid23},...] For correct displaying in table we need to reformat it to the following: [{domain: 'domain1', uid: 'uid11'}, {domain: 'domain1', uid: 'uid12'},... This can be done using this Adapter. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Possibility to choose object when API call returns list of objectsPavel Vomacka2017-03-081-0/+13
| | | | | | | | | | | | In case that API call returns array of objects which contains data, using 'object_index' attribute in adapter specification we can set which object should be used. It is possible to choose only one object specified by its index in array. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to turn of autoload when details.load is calledPavel Vomacka2017-03-082-1/+10
| | | | | | | | | | When field on details facet has set 'autoload_value' to false, then it won't be loaded using that.load method of details facet. That means that field might stay unchanged even that loading of data was performed. Part of: https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Move csrgen templates into ipaclient packageChristian Heimes2017-03-0814-247/+0
| | | | | | | | | | | | csrgen broke packaging of ipaclient for PyPI. All csrgen related resources are now package data of ipaclient package. Package data is accessed with Jinja's PackageLoader() or through pkg_resources. https://pagure.io/freeipa/issue/6714 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Ben Lipton <blipton@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* KRA: add --setup-kra to ipa-server-installMartin Basti2017-03-082-0/+11
| | | | | | | | | | | | | | | | | This patch allows to install KRA on first IPA server in one step using ipa-server-install This option improves containers installation where ipa-server can be installed with KRA using one call without need to call docker exec. Please note the the original `kra.install()` calls in ipaserver/install/server/install.py were empty operations as it did nothing, so it is safe to move them out from CA block https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* WebUI: don't change casing of Auth Indicators valuesPavel Vomacka2017-03-082-4/+4
| | | | | | | | | | | All values were previously converted to lowercase which was not coresponding with CLI behaviour. Now they stay as they are inserted. I also have to change the strings to lowercase because the otp and radius should be inserted as lowercase words. https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Allow disabling lowering text in custom_checkbox_widgetPavel Vomacka2017-03-082-1/+6
| | | | | | | | | Add new attribute which keeps information whether each text added using custom_checkbox_widget shoud be transformed to lowercase. Part of: https://fedorahosted.org/freeipa/ticket/6308 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui: fixes normalization of value in attributes widgetPetr Vobornik2017-03-081-1/+1
| | | | | | | | | | | | | | | | Fix is in checkboxes widget but the only affected one is attributes widget. Reproduction: 1. Add permission with attribute with uppercase character $ ipa permission-add aa_test --type=stageuser --attrs=businessCategory --right=read 2. Check if it is correctly displayed in Web UI Actual result: - businesscategory is not checked Expected result: - businesscategory is checked Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add support for custom table pagination sizePavel Vomacka2017-03-085-6/+73
| | | | | | | | | | | New customization button opens dialog with field for setting the number of lines in tables. After saving the new value there is new topic which starts refreshing current table facet (if shown) and set all other facets expired. Therefore all tables are immediately regenerated. https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make singleton from config modulePavel Vomacka2017-03-081-6/+45
| | | | | | | | Also added general setter and getter for attributes of config. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add javascript integer validatorPavel Vomacka2017-03-081-0/+34
| | | | | | | | | Javascript integer validator checks whether value entered into field is number and is not higher than Number.MAX_SAFE_INTEGER constant. Part of: https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* man: add missing --setup-adtrust option to manpageMartin Basti2017-03-082-0/+6
| | | | | | | | | ipa-server-install and ipa-replica-install manpages miss --setup-adtrust options https://pagure.io/freeipa/issue/6630 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* WebUI: Add certmap modulePavel Vomacka2017-03-085-1/+421
| | | | | | | | | Add facets for certmaprule and certmapconfigure entities. https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add Custom command multivalued adder dialogPavel Vomacka2017-03-081-0/+34
| | | | | | | | | | Adder dialog which is used along with custom_command_multivalued_widget. It behaivor of confirm dialog and adds fields which are necessary. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Create non editable row widget for mutlivalued widgetPavel Vomacka2017-03-084-13/+25
| | | | | | | | | | | | Old krb-principal widget is changed to general one. And used also for ipacertmapdata in user. This widget make every line non-editable. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add possibility to set field always writablePavel Vomacka2017-03-082-26/+52
| | | | | | | | | | | | If field will have set attribute 'always_writable' to true, then 'no_update' flag will be ingored. Used in command user-{add,remove}-certmap which needs to be writable in WebUI and also needs to be omitted from user-mod command. Part of: https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Change structure of Identity submenuPavel Vomacka2017-03-074-7/+43
| | | | | | | | | | | | | Previously there were 'User Groups', 'Host Groups' and 'Netgroups' separately, now these three items are grouped into one named 'Groups' which has sidebar with three items mentioned above. This change allows us to move ID views into Identity submenu. https://pagure.io/freeipa/issue/6717 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: add sizelimit:0 to cert-findPavel Vomacka2017-03-074-0/+4
| | | | | | | | | | | It was not possible to get all arbitrary certificates which were added using {user|host|service|idview}-add-cert method. Adding sizelimit:0 to this cert-find command fix the issue. It set sizelimit to unlimited. https://pagure.io/freeipa/issue/6712 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-071-1/+5
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* man: update ipa-cacert-manageTomas Krizek2017-03-021-1/+4
| | | | | | | | | Make it clear this command is used to only renew certificate for the CA and provide guidance on how to renew other certificates. https://pagure.io/freeipa/issue/6648 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-05 01:50:20 +0000