summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Add ipaDNSVersion option to dnsconfig* commands and use new attributePetr Spacek2016-05-301-2/+12
| | | | | | | | | | | | | | | | | | | | Ad-hoc LDAP calls in DNS upgrade code were hard to maintain and ipaConfigString was bad idea from the very beginning as it was hard to manipulate the number in it. To avoid problems in future we are introducing new ipaDNSVersion attribute which is used on cn=dns instead of ipaConfigString. Original value of ipaConfigString is kept in the tree for now so older upgraders see it and do not execute the upgrade procedure again. The attribute can be changed only by installer/upgrade so it is not exposed in dnsconfig_mod API. Command dnsconfig_show displays it only if --all option was used. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Turn verify_host_resolvable() into a wrapper around ipapython.dnsutilPetr Spacek2016-05-302-59/+71
| | | | | | | | | | | | | The code was duplicate and less generic anyway. As a side-effect I had to re-wrap dns.exception.DNSException into a PublicError so it can be displayed to the user. DNSError is now a super class for other DNS-related errors. Errors from DNS resolver are re-raised as DNSResolverError. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use root_logger for verify_host_resolvable()Petr Spacek2016-05-304-10/+12
| | | | | | | | | | After discussion with Martin Basti we decided to standardize on root_logger with hope that one day we will use root_logger.getLogger('module') to make logging prettier and tunable per module. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move check_zone_overlap() from ipapython.ipautil to ipapython.dnsutilPetr Spacek2016-05-301-1/+2
| | | | | | | | | This is preparatory work to avoid (future) cyclic import between ipapython.dnsutil and ipapython.ipautil. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS: Warn if forwarding policy conflicts with automatic empty zonesPetr Spacek2016-05-302-0/+43
| | | | | | | | | | | | | | | | | | Forwarding policy "first" or "none" may conflicts with some automatic empty zones. Queries for zones specified by RFC 6303 will ignore forwarding and recursion and always result in NXDOMAIN answers. This is not detected and warned about. Global forwarding is equivalent to forward zone ".". Example: Forward zone 1.10.in-addr.arpa with policy "first" will not forward anything because BIND will automatically prefer automatic empty zone "10.in-addr.arpa." which is authoritative. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added some attributes to Modify Users permissionStanislav Laznicka2016-05-291-3/+4
| | | | | | | | | Added 'employeenumber', 'departmentnumber' and 'mail' to Modify Users permission https://fedorahosted.org/freeipa/ticket/5911#comment:2 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused variables in automount pluginMartin Basti2016-05-261-8/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* frontend: allow commands to have an argument named `name`Jan Cholasta2016-05-251-4/+4
| | | | | | | | | Rename the `name` argument of Command.get_default_of to `_name` to avoid conflicts with keyword arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: use relative imports for cross-plugin importsJan Cholasta2016-05-2543-76/+76
| | | | | | | | | This will make it possible to move the plugin modules between ipalib, ipaclient and ipaserver without having to change the imports. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: copy arguments of client commands from server counterpartsJan Cholasta2016-05-251-52/+73
| | | | | | | | | | | | | Copy arguments of vault_{add,mod,archive,retrieve} from vault_{add,mod,archive,retrieve}_internal. Also add missing LDAPCreate arguments to vault_add_internal. This will make it possible to move the commands to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: move client-side code to the module levelJan Cholasta2016-05-251-94/+96
| | | | | | | | | | | Move client-side code from the vault class to module-level functions. This will make it possible to move the code to ipaclient without the vault class bits. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* otptoken_yubikey: fix otptoken_add_yubikey argumentsJan Cholasta2016-05-251-33/+35
| | | | | | | | Copy args, options and output of otptoken_add_yubikey from otptoken_add. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* otptoken: fix import of DNJan Cholasta2016-05-251-1/+2
| | | | | | | | | | Import DN from ipapython.dn rather than ipalib.plugins.baseldap. This will make it possible to move otptoken_sync to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: do not rely on server data structures in code called on clientJan Cholasta2016-05-251-48/+78
| | | | | | | | | | | | | | | | Replace code which references the DNSRecord and dnsrecord classes with equivalent code which uses only generic data structures. This will make it possible to move client code to ipaclient without dnsrecord bits, DNSRecord and all its subclasses. The conversion from record value to structured record can't be done on the client without DNSRecord and subclasses. Introduce a new internal command dnsrecord_split_parts to do the job on the server when necessary. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: move code called on client to the module levelJan Cholasta2016-05-251-120/+130
| | | | | | | | | | | | Move DNSRecord and dnsrecord code called on client to module-level functions. This will make it possible to move the code to ipaclient without the DNSRecord and dnsrecord class bits. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* automount: do not inherit automountlocation_import from LDAPQueryJan Cholasta2016-05-251-1/+8
| | | | | | | | | | | | automountlocation_import is a client-side command which does not use LDAP directly. Inherit it from Command rather than LDAPQuery and copy its arguments from automountlocation_show. This will make it possible to move automountlocation_import to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: move the interactive_prompt callback type to CommandJan Cholasta2016-05-252-37/+10
| | | | | | | | | | | | Move interactive_prompt callback type from baseldap.BaseLDAPCommand to Command. This will make it possible to move all interactive_prompt callbacks to ipaclient. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: merge baseldap.CallbackRegistry into CommandJan Cholasta2016-05-252-55/+59
| | | | | | | | Also make it possible for subclasses to introduce new callback types. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: switch API to Registry-based plugin discoveryJan Cholasta2016-05-252-59/+49
| | | | | | | | | | | | | Merge Registrar into Registry. Use the Registry instance of each plugin module to discover plugins in the module instead of the global Registrar instance. This removes the side-effect of all plugins in a module being re-registered every time the module is imported. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: remove the unused deprecated API.register methodJan Cholasta2016-05-251-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: fix incorrect API.register calls in docstringsJan Cholasta2016-05-253-25/+27
| | | | | | | | | | | | Use API.add_plugin to load specific plugins into API objects. Use Registry to register plugins. This fixes doctests. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5115 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib, ipaserver: migrate all plugins to Registry-based registrationJan Cholasta2016-05-253-10/+12
| | | | | | | | Do not use the deprecated API.register method. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: replace API.import_plugins with new API.add_packageJan Cholasta2016-05-252-34/+29
| | | | | | | | | | | | | | | Replace API.import_plugins with a new method API.add_package which allows loading plugin packages into an API object from a package object. This makes loading of plugin packages loading consistent with loading of plugin modules and classes. Rename API.modules to API.packages and use package objects where implemented to reflect the change. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: remove the unused `csv` argument of ParamJan Cholasta2016-05-2516-54/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* makeapi: optimize API.txtJan Cholasta2016-05-252-38/+77
| | | | | | | | | | | | | | | | | | | | Change Param formatting to: * always use quantified names rather than the `required` and `multivalue` kwargs, * ignore kwargs with default value, * ignore kwargs related to validation, as validation is now strictly server-side, * ignore the `attribute` and `primary_key` kwargs, as they are relevant only on object params, * ignore the `include` and `exclude` kwargs, as makeapi takes into account only params available in the 'cli' context, * ignore the unused `csv` kwarg. Format optional Output arguments as kwargs. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not forward argument defaults to serverJan Cholasta2016-05-252-2/+5
| | | | | | | | | | | When forwarding a command call to a server, use only arguments which were explicitly specified by the caller. This increases compatibility between new clients and old servers. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* user: do not assume the preserve flags have value in user_delJan Cholasta2016-05-251-5/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not forward unspecified positional arguments to serverJan Cholasta2016-05-251-1/+14
| | | | | | | | | When forwarding a command call to a server, do not use a value of None in place of unspecified positional arguments. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: make optional positional command arguments actually optionalJan Cholasta2016-05-2513-23/+44
| | | | | | | | | Fix several plugins not to assume optional positional arguments have a value of None when not specified. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch: do not crash when no argument is specifiedJan Cholasta2016-05-251-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: perform argument value validation only on serverJan Cholasta2016-05-253-5/+16
| | | | | | | | | | | | | | | | Do not validate values of command arguments on the client and let the server handle validation. This will make the client more lightweight by not having it to carry validation code and metadata with itself for the price of increasing network traffic in case the validation fails. Types of the arguments are still validated on both the client and the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: remove the unused Command.soft_validate methodJan Cholasta2016-05-251-14/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: re-raise remote RequirementError using CLI name in CLIJan Cholasta2016-05-254-23/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: include structured error information in responsesJan Cholasta2016-05-253-1/+11
| | | | | | | | | | | | | | Include keyword arguments of exceptions in RPC responses. This is limited to JSON-RPC, as XML-RPC does not support additional data in error responses. Include keyword arguments of messages in RPC responses. Include keyword arguments of exceptions in batch command result. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* parameters: remove unused ConversionError and ValidationError argumentsJan Cholasta2016-05-254-63/+34
| | | | | | | | | | Do not set the `value`, `index` and `rule` arguments when raising ConversionError and ValidationError. The arguments are unused and are not specified consistently accross the framework and plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: do not crash when unable to parse JSONJan Cholasta2016-05-251-1/+1
| | | | | | | | | When unable to parse JSON response from the server, properly raise JSONError not to cause a crash. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix referenced before assigment variables in except statementsMartin Basti2016-05-201-2/+2
| | | | | | | Variable msg may not exists in the last except context, and even it contains improper value because it is not related to catched exception Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* makeapi: use the same formatting for `int` and `long` valuesJan Cholasta2016-05-191-0/+2
| | | | | | | | | This prevents validation failures on architectures where integer is less than 32 bits. https://fedorahosted.org/freeipa/ticket/5894 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Batch command: avoid accessing potentially undefined context.principalPetr Spacek2016-05-121-1/+4
| | | | | | | | | | | This might happen when the command is called directly in Python, e.g. in installers and so on. Pylint pylint-1.5.5-1.fc24.noarch caught this. https://fedorahosted.org/freeipa/ticket/5838 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib.cli: Improve reporting of binary values in the CLIPetr Viktorin2016-05-101-2/+3
| | | | | | | | | Make sure the base64-encoded value is a string, so it is printed without the b'' markers. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* idviews: Add user certificate attribute to user ID overridesTomas Babej2016-05-061-2/+77
| | | | | | https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certprofile plugin: Use binary mode for file with binary dataPetr Viktorin2016-05-051-1/+1
| | | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipalib.rpc: Send base64-encoded data as string under Python 3Petr Viktorin2016-05-051-1/+4
| | | | | | | | | | Python 3's JSON library cannot deal with bytes, so decode base64-encoded data to string. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* radiusproxy plugin: Use str(error) rather than error.messagePetr Viktorin2016-05-051-1/+1
| | | | | | | | | | In Python 3, the "message" attribute has been removed in favor of calling str() on the error. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Added fix for notifying user about locked user account in WebUIAbhijeet Kasurde2016-04-281-0/+6
| | | | | | | | | | | | User in now notified about "Locked User account" message instead of "The password or username you entered is incorrect" or any generic error message Fixes : https://fedorahosted.org/freeipa/ticket/5076 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* dns plugin: Fix zone normalization under Python 3Petr Viktorin2016-04-281-1/+3
| | | | | | | | | | | | | | In Python 3, str.encode('ascii') converts to bytes, and str() (nicknamed unicode() in IPA) returns the string representation of an object, which is b'...' for bytes. So, unicode('...'.encode('ascii')) results in "b'...'". Change the code to only call encode() for the error. Part of the work for https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Do not do extra search for ipasshpubkey to generate fingerprintsMartin Basti2016-04-266-35/+115
| | | | | | | | | | | | | | | | | | | | Host, user and idview commands do unnnecessary extra search for ipasshpubkey attribute to generate fingerprints. Note: Host and user plugins shows ipasshpubkey only when the attribute is changed, idviews show ipasshpubkey always. This behavior has been kept by this commit. common_pre/post_callbacks were fixed in [base|stage]user modules. common_callbacks requires the same arguments as pre/post_callbacks now (except baseuser_find.post_common_callback) Note2: in *-add commands there is no need for managing ipasshpubkey as this attribute should be shown always there. https://fedorahosted.org/freeipa/ticket/3376 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Performace: don't download password attributes in host/user-findMartin Basti2016-04-222-6/+0
| | | | | | | | | | | | For each entry in user/host-find was executed an extra search for password attributes what has significant impact on performance (for 2000 users there were 2000 additional searches) http://www.freeipa.org/page/V4/Performance_Improvements https://fedorahosted.org/freeipa/ticket/5281 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add 'skip overlap check' checkbox into add zone dialogPavel Vomacka2016-04-221-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5773 Reviewed-By: Martin Basti <mbasti@redhat.com>
* caacl: correctly handle full user principal nameFraser Tweedale2016-04-201-2/+2
| | | | | | | | The caacl HBAC request is correct when just the username is given, but the full 'user@REALM' form was not handled correctly. Fixes: https://fedorahosted.org/freeipa/ticket/5733 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 10:06:10 +0000