summaryrefslogtreecommitdiffstats
path: root/ipaclient/plugins
Commit message (Collapse)AuthorAgeFilesLines
* csrgen: hide cert-get-requestdata in CLIJan Cholasta2017-03-141-0/+2
| | | | | | | | | The CSR generation feature is supposed to be used from cert-request, hide the internal cert-get-requestdata command in the CLI. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-141-1/+4
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: add output file option to cert-requestJan Cholasta2017-03-141-14/+52
| | | | | | | | | | | The certificate returned by cert-request can now be saved to a file in the CLI using a new --certificate-out option. Deprecate --out in cert-show in favor of --certificate-out. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: cache the transport certificate on clientJan Cholasta2017-03-131-52/+153
| | | | | | | | | | Cache the KRA transport certificate on disk (in ~/.cache/ipa) as well as in memory. https://fedorahosted.org/freeipa/ticket/6652 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certmap: load certificate from file in certmap-match CLIJan Cholasta2017-03-131-0/+49
| | | | | | | | | Load the certificate from a file specified in the first argument. Raw certificate value can be specified using --certificate. https://pagure.io/freeipa/issue/6646 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* dns: fix `dnsrecord_add` interactive modeJan Cholasta2017-03-081-0/+6
| | | | | | | | | | | | | | | `dnsrecord_add` interactive mode might prompt for value of non-existent arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This happens because `dnsrecord_add` extra flags are incorrectly defined as parts of the respective DNS records. Remove extra flags from DNS record parts to fix the interactive mode on old clients talking to new servers. Skip non-existent arguments in the interactive mode to fix new clients talking to old servers. https://fedorahosted.org/freeipa/ticket/6457 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Vault: port key wrapping to python-cryptographyChristian Heimes2017-03-021-89/+92
| | | | | | | https://fedorahosted.org/freeipa/ticket/6650 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove NSSConnection from otptoken pluginStanislav Laznicka2017-03-011-7/+6
| | | | | | | | | Replace NSSConnection with httplib.HTTPSConenction to be able to remove NSSConnection for good. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Support encrypted private keysBen Lipton2017-02-281-0/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Allow overriding the CSR generation profileBen Lipton2017-02-281-1/+12
| | | | | | | | | | In case users want multiple CSR generation profiles that work with the same dogtag profile, or in case the profiles are not named the same, this flag allows specifying an alternative CSR generation profile. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Automate full cert request flowBen Lipton2017-02-282-2/+79
| | | | | | | | | | | | | | | | | Allows the `ipa cert-request` command to generate its own CSR. It no longer requires a CSR passed on the command line, instead it creates a config (bash script) with `cert-get-requestdata`, then runs it to build a CSR, and submits that CSR. Example usage (NSS database): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs Example usage (PEM private key file): $ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS: dns-update-system-record can create nsupdate fileMartin Basti2017-02-151-6/+66
| | | | | | | | | | Added option --out <path> creates a file with IPA DNS data in nsupdate format. https://fedorahosted.org/freeipa/ticket/6585 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* tests: Add tests for CSR autogenerationBen Lipton2017-01-311-1/+2
| | | | | | | | | This patch also contains some code changes to make the code easier to test and to make the tests pass. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* csrgen: Add code to generate scripts that generate CSRsBen Lipton2017-01-311-0/+114
| | | | | | | | | | | | Adds a library that uses jinja2 to format a script that, when run, will build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses this library and builds the script for a given principal. The rules are read from json files in /usr/share/ipa/csr, but the rule provider is a separate class so that it can be replaced easily. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-241-1/+1
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaclient.plugins: Use api_version from internally called commandsDavid Kupka2016-12-143-0/+24
| | | | | | | | | | | | In client plugins make sure the api_version is 'inherited' from server command that is internally called. Otherwise the api_version is obtained from client API instance. When calling server command from client command 'version' is passed in options and it overrides the right one. Server then refuses to handle such call. https://fedorahosted.org/freeipa/ticket/6539 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add options to write lightweight CA cert or chain to fileFraser Tweedale2016-12-121-0/+53
| | | | | | | | | | | | | | Administrators need a way to retrieve the certificate or certificate chain of an IPA-managed lightweight CA. Add params to the `ca' object for carrying the CA certificate and chain (as multiple DER values). Add the `--chain' flag for including the chain in the result (chain is also included with `--all'). Add the `--certificate-out' option for writing the certificate to a file (or the chain, if `--chain' was given). Fixes: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Make `env` and `plugins` commands local againMartin Babinsky2016-12-021-3/+4
| | | | | | | | | | | | | | During thin client refactoring, LocalOrRemote class implementation of `run` method was overriden by default Command implementation during instantiation of client plugins from schema. This caused these commands to always forward this request to IPA master. This patch restores the original behavior: unless `--server` option was specified, the commands will always print out local config. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Use api.env.nss_dir instead of paths.IPA_NSSDB_DIRChristian Heimes2016-11-142-7/+3
| | | | | | | | | | ipaclient plugins are now using nss_dir from api.env instead of hard-coded paths.IPA_NSSDB_DIR. Closes: https://fedorahosted.org/freeipa/ticket/6386 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-111-2/+0
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-271-0/+2
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-273-10/+4
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Prompt for forwarder in dnsforwardzone-addTomas Krizek2016-09-261-0/+5
| | | | | | | | | | When the command ipa dnsforwardzone-add is invoked without specifying the forwarder as an argument and the forward policy is not set to none, prompt for DNS forwarder. https://fedorahosted.org/freeipa/ticket/6169 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* dns: fix crash in interactive mode against old serversJan Cholasta2016-09-061-1/+61
| | | | | | | | | | Add a client-side fallback of the dnsrecord_split_parts command for old servers to avoid CommandError in dnsrecord_add and dnsrecord_mod CLI interactive mode. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: prompt for missing record parts in CLIJan Cholasta2016-09-061-14/+16
| | | | | | | | | Fix the code which determines if a record part is required and thus should be prompted not to wrongfully consider all record parts to be optional. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* dns: normalize record type read interactively in dnsrecord_addJan Cholasta2016-09-061-0/+2
| | | | | | | | | | | | | When dnsrecord_add is called without options in interactive mode, it prompts the user to enter a record type. The record type is expected to be upper case further in the code, which causes non-upper case values not to work correctly. Fix this issue by upper casing the value after it is read. https://fedorahosted.org/freeipa/ticket/6203 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Handled empty hostname in server-del commandAbhijeet Kasurde2016-08-241-2/+6
| | | | | | | | Fixes: https://fedorahosted.org/freeipa/ticket/6248 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* migrate-ds: Mention --enable-migration in error message about migration modePetr Spacek2016-08-221-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6234 Reviewed-By: Martin Basti <mbasti@redhat.com>
* client: Do not create instance just to check isinstanceDavid Kupka2016-08-173-12/+11
| | | | | | | | | Checking that classes are idenical gives the same result and avoids unnecessary instantiation. https://fedorahosted.org/freeipa/ticket/6048 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* client: add missing output params to client-side commandsJan Cholasta2016-08-102-0/+30
| | | | | | | | | | | | Add output params for the otptoken-add-yubikey, vault-add, vault-mod, vault-archive and vault-retrieve commands. This fixes the commands not having any output in CLI. https://fedorahosted.org/freeipa/ticket/6182 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix ipa hbactest outputFlorence Blanc-Renaud2016-08-041-1/+3
| | | | | | | | | | | | | | | | ipa hbactest command produces a Traceback (TypeError: cannot concatenate 'str' and 'bool' objects) This happens because hbactest overrides output_for_cli but does not properly handle the output for 'value' field. 'value' contains a boolean but it should not be displayed (refer to ipalib/frontend.py, Command.output_for_cli()). Note that the issue did not appear before because the 'value' field had a flag no_display. https://fedorahosted.org/freeipa/ticket/6157 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: add missing salt option to vault_modJan Cholasta2016-08-041-1/+1
| | | | | | | | | The option was accidentally removed in commit 4b119e21a2f93ca16c5edf3d1058552b44feeaf8. https://fedorahosted.org/freeipa/ticket/6154 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: Change doc, summary, topic and NO_CLI to class propertiesDavid Kupka2016-08-033-20/+35
| | | | | | | | | Avoid need to instantiate all commands just to get information for displaying help. https://fedorahosted.org/freeipa/ticket/6048 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* vault: Catch correct exception in decryptDavid Kupka2016-08-031-1/+1
| | | | | | | | ValueError is raised when decryption fails. https://fedorahosted.org/freeipa/ticket/6160 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: fix hiding of commands which lack server supportJan Cholasta2016-07-283-6/+12
| | | | | | | | | | Rather than checking the server counterpart's NO_CLI, which may be False even for commands supported on the server, check wheter the server counterpart is a command defined on the server or a local placeholder. https://fedorahosted.org/freeipa/ticket/6089 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Revert "Enable vault-* commands on client"Jan Cholasta2016-07-281-0/+16
| | | | | | | | This reverts commit 9feeaca9fb552229638ce98086aa75905a45b48d. https://fedorahosted.org/freeipa/ticket/6089 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* vault-add: set the default vault type on the client side if none was givenMartin Babinsky2016-07-131-0/+5
| | | | | | | | | | | | `vault-add` commands does much processing depending on the vault type even before the request is forwarded to remote server. Since default values for parameters are now filled only on server side, the client-side logic would fail if the vault type was not explicitly given. In this case we have to retrieve and use the default vault type from schema. https://fedorahosted.org/freeipa/ticket/6047 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Removed unused method parameter from migrate-dsStanislav Laznicka2016-07-131-1/+1
| | | | | | | | | An extra parameter on client side command override of migrate-ds output was causing errors. https://fedorahosted.org/freeipa/ticket/6034 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enable vault-* commands on clientMartin Basti2016-07-121-16/+0
| | | | | | | | | | | | | Client plugins fot vault commands were disabled by NO_CLI=True, inherited from vault_add_interal, that is always NO_CLI=True. Introduced by this commit 8278da6967dbe425b4e0c6cf37dc1c53052525b2 Removed NO_CLI=True from client side plugins for vault. https://fedorahosted.org/freeipa/ticket/6035 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* client: add placeholders for required remote pluginsJan Cholasta2016-06-303-3/+78
| | | | | | | | | | | | Add placeholders for remote plugins which are required by client-side commands. They are used when the remote plugins are not available. This fixes API initialization error when the remote server does not have the plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: ignore override errors in command overridesJan Cholasta2016-06-3022-43/+43
| | | | | | | | | This fixes API initialization errors when the remote server does not have the overriden command. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: fix CLI output of cert_remove_holdJan Cholasta2016-06-301-1/+13
| | | | | | | | | | cert_remove_hold uses output params instead of exceptions to convey unsuccessful result. Move the output params to the client side before the command is fixed to use exceptions. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: fix dns_update_system_records to work with thin clientJan Cholasta2016-06-211-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/2008 https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: allow search by certificateJan Cholasta2016-06-211-0/+23
| | | | | | | | | Allow search by certificate data or file in cert-find. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* cert: add object pluginJan Cholasta2016-06-211-3/+3
| | | | | | | | | | Implement cert as an object with methods rather than a bunch of loosely related commands. https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* schema: remove output_paramsJan Cholasta2016-06-201-0/+35
| | | | | | | | | | | | | Since output params are copied from object plugins, remove them from command schema and include object name instead. One exception to this are the output params used for failed members in member add/remove commands. Move these to the client side, as they will be replaced by warnings. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* permission: handle ipapermright deprecated CLI alias on the clientJan Cholasta2016-06-201-0/+31
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* passwd: handle sort order of passwd argument on the clientJan Cholasta2016-06-201-0/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: skip `count` and `total` output in env.output_for_cliJan Cholasta2016-06-201-0/+3
| | | | | | | | | Do not include the `count` and `total` output values in CLI output in env.output_for_cli by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: do not rely on custom param fields in record attributesJan Cholasta2016-06-201-3/+4
| | | | | | | | | Obtain the information provided by the `hint` kwarg and `dnsrecord_part` and `dnsrecord_extra` flags by other means. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-21 19:21:44 +0000