summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Add user-stage commandMartin Basti2015-08-212-36/+59
| | | | | | | | | | | | | | This patch replaces 'stageuser-add --from-delete' with new command user-stage. Original way always required to specify first and last name, and overall combination of options was hard to manage. The new command requires only login of deleted user (user-del --preserve). https://fedorahosted.org/freeipa/ticket/5041 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add flag to list all service and user vaultsChristian Heimes2015-08-191-15/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The vault-find plugin has two additional arguments to list all service vaults or user vaults. Since the name of a vault is only unique for a particular user or service, the commands also print the vault user or vault service. The virtual attributes were added in rev 01dd951ddc0181b559eb3dd5ff0336c81e245628. Example: $ ipa vault-find --users ---------------- 2 vaults matched ---------------- Vault name: myvault Type: standard Vault user: admin Vault name: UserVault Type: standard Vault user: admin ---------------------------- Number of entries returned 2 ---------------------------- $ ipa vault-find --services ---------------- 2 vaults matched ---------------- Vault name: myvault Type: standard Vault service: HTTP/ipatest.freeipa.local@FREEIPA.LOCAL Vault name: myvault Type: standard Vault service: ldap/ipatest.freeipa.local@FREEIPA.LOCAL ---------------------------- Number of entries returned 2 ---------------------------- https://fedorahosted.org/freeipa/ticket/5150 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert-request: remove allowed extensions checkFraser Tweedale2015-08-191-19/+3
| | | | | | | | | | | | | | | cert-request currently permits a limited number of request extensions; uncommon and esoteric extensions are prohibited and this limits the usefulness of custom profiles. The Dogtag profile has total control over what goes into the final certificate and has the option to reject request based on the request extensions present or their values, so there is little reason to restrict what extensions can be used in FreeIPA. Remove the check. Fixes: https://fedorahosted.org/freeipa/ticket/5205 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* vault: Add container information to vault command resultsJan Cholasta2015-08-191-0/+44
| | | | | | https://fedorahosted.org/freeipa/ticket/5150 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* vault: Fix vault-find with criteriaJan Cholasta2015-08-191-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5212 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Prohibit deletion of predefined profilesFraser Tweedale2015-08-181-2/+11
| | | | | | | | | | | Deletion of predefined profiles, including the default profile, should not be allowed. Detect this case and raise an error. Also update the predefined profiles collection to use namedtuple, making it easier to access the various components. Fixes: https://fedorahosted.org/freeipa/ticket/5198 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* user-undel: Fix error messages.David Kupka2015-08-181-7/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5207 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: validate vault typePetr Vobornik2015-08-181-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5211 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* vault: normalize service principal in service vault operationsPetr Vobornik2015-08-181-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5233 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fixed vault container ownership.Endi S. Dewata2015-08-181-2/+23
| | | | | | | | | | The vault-add command has been fixed such that if the user/service private vault container does not exist yet it will be created and owned by the user/service instead of the vault creator. https://fedorahosted.org/freeipa/ticket/5194 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* vault: Fix param labels in output of vault owner commandsJan Cholasta2015-08-181-0/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/5214 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* baseldap: Allow overriding member param label in LDAPModMemberJan Cholasta2015-08-181-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5214 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* trusts: Detect missing Samba instanceTomas Babej2015-08-171-20/+79
| | | | | | | | | | | | | | | | | | | | | In the event of invocation of trust related commands, IPA server needs to contact local Samba instance. This is not possible on servers that merely act as AD trust agents, since they do not have Samba instance running. Properly detect the absence of the Samba instance and output user-friendly message which includes list of servers that are capable of running the command, if such exist. List of commands affected: * ipa trust-add * ipa trust-fetch-domains * all of the trustdomain commands available via CLI https://fedorahosted.org/freeipa/ticket/5165 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Detect domain clash with IPA domain when adding a AD trustTomas Babej2015-08-171-0/+8
| | | | | | | | | | | | | | | | | | When IPA is deployed in the same domain as AD, trust-add fails since the names of the local domain and trusted domain ranges is the same - it's always DOMAIN.NAME_id_range. When adding a trusted domain, we look for previous ranges for this domain (which may have been left behind by previous trust attempts). Since AD and IPA are in the same domain, we find a local domain range, which does not have a SID. Detect such domain collisions early and bail out with an appropriate error message. https://fedorahosted.org/freeipa/ticket/4549 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added CLI param and ACL for vault service operations.Endi S. Dewata2015-08-171-94/+83
| | | | | | | | | | | | | The CLIs to manage vault owners and members have been modified to accept services with a new parameter. A new ACL has been added to allow a service to create its own service container. https://fedorahosted.org/freeipa/ticket/5172 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add permission for bypassing CA ACL enforcementFraser Tweedale2015-08-141-3/+10
| | | | | | | | | | | | Add the "Request Certificate ignoring CA ACLs" permission and associated ACI, initially assigned to "Certificate Administrators" privilege. Update cert-request command to skip CA ACL enforcement when the bind principal has this permission. Fixes: https://fedorahosted.org/freeipa/ticket/5099 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* add permission: System: Manage User CertificatesPetr Vobornik2015-08-141-1/+9
| | | | | | | | | usercertificate attr was moved from "System Modify Users" to this new permission. https://fedorahosted.org/freeipa/ticket/5177 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Asymmetric vault: validate public key in clientChristian Heimes2015-08-131-0/+13
| | | | | | | | | | | | The ipa vault commands now load and validate the public key for asymmetric encryption, before sending it to the server. This prevents invalid vaults and prohibits accidental exposure of private key material. https://fedorahosted.org/freeipa/ticket/5142 https://fedorahosted.org/freeipa/ticket/5143 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ULC: Prevent preserved users from being assigned membershipJan Cholasta2015-08-131-13/+18
| | | | | | https://fedorahosted.org/freeipa/ticket/5170 Reviewed-By: David Kupka <dkupka@redhat.com>
* certprofile: add profile format explanationFraser Tweedale2015-08-121-0/+20
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/5089 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use absolute importsPetr Viktorin2015-08-1214-64/+70
| | | | | | | In Python 3, implicit relative imports will not be supported. Use fully-qualified imports everywhere. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Import 'reduce' from functoolsPetr Viktorin2015-08-121-0/+1
| | | | | | | The reduce function is no longer a built-in in Python 3. Importing it from functools works on both py2 and py3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Replace dict.has_key with the 'in' operatorPetr Viktorin2015-08-122-3/+3
| | | | | | | | | The deprecated has_key method will be removed from dicts in Python 3. For custom dict-like classes, has_key() is kept on Python 2, but disabled for Python 3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize function and method attribute namesPetr Viktorin2015-08-125-5/+5
| | | | | | | | Python 3 uses double-underscored names for internal function attributes. In Python 2.7, these names exist as aliases to the old 'func_*' and 'im_*' names. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-1229-134/+134
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* idranges: raise an error when local IPA ID range is being modifiedMartin Babinsky2015-08-121-23/+29
| | | | | | | | | also show the message about the way UID/GID ranges are managed in FreeIPA in the idrange-mod's help message https://fedorahosted.org/freeipa/ticket/4826 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* validate mutually exclusive options in vault-addPetr Vobornik2015-08-121-0/+12
| | | | | | https://fedorahosted.org/freeipa/ticket/5195 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* adjust search so that it works for non-admin usersPetr Vobornik2015-08-125-3/+8
| | | | | | | | | | | | | | | | Non-admin user can now search for: - hosts - hostgroups - netgroups - servers - services (Fixes ACI issue where search returns nothing when user does't have read rights for an attribute in search_attributes. https://fedorahosted.org/freeipa/ticket/5167 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix KRB5PrincipalName / UPN SAN comparisonFraser Tweedale2015-08-111-1/+1
| | | | | | | | | | | | | Depending on how the target principal name is conveyed to the command (i.e. with / without realm), the KRB5PrincipalName / UPN subjectAltName validation could be comparing unequal strings and erroneously rejecting a valid request. Normalise both side of the comparison to ensure that the principal names contain realm information. Fixes: https://fedorahosted.org/freeipa/ticket/5191 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Work around python-nss bug on unrecognised OIDsFraser Tweedale2015-08-111-1/+14
| | | | | | | | | | | | | | | A bug in python-nss causes an error to be thrown when converting an unrecognised OID to a string. If cert-request receives a PKCS #10 CSR with an unknown extension, the error is thrown. Work around this error by first checking if the OID is recognised and, if it is not, using a different method to obtain its string representation. Once the python-nss bug is fixed, this workaround should be reverted. https://bugzilla.redhat.com/show_bug.cgi?id=1246729 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add profile for DNP3 / IEC 62351-8 certificatesFraser Tweedale2015-08-111-0/+1
| | | | | | | | | | | The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Allow SAN extension for cert-request self-serviceFraser Tweedale2015-08-111-1/+1
| | | | | | | | | | | Users cannot self-issue a certificate with a subjectAltName extension (e.g. with rfc822Name altNames). Suppress the cert-request "request certificate with subjectaltname" permission check when the bind principal is the target principal (i.e. cert-request self-service). Fixes: https://fedorahosted.org/freeipa/ticket/5190 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Give more info on virtual command access denialFraser Tweedale2015-08-111-1/+1
| | | | | | | | The current error message upon a virutal command access denial does not give any information about the virtual operation that was prohibited. Add more information to the ACIError message. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: add LDAP vs Kerberos behavior description to user auth typesPetr Vobornik2015-08-101-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4935 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix incorrect type comparison in trust-fetch-domainsTomas Babej2015-08-061-1/+1
| | | | | | | | Value needs to be unpacked from the list and converted before comparison. https://fedorahosted.org/freeipa/ticket/5182 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix otptoken-remove-managedby command summaryFraser Tweedale2015-08-051-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Port from python-kerberos to python-gssapiMichael Simacek2015-08-052-33/+92
| | | | | | | | | | | | kerberos library doesn't support Python 3 and probably never will. python-gssapi library is Python 3 compatible. https://fedorahosted.org/freeipa/ticket/5147 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* store certificates issued for user entries as userCertificate;binaryMartin Babinsky2015-08-042-13/+31
| | | | | | | | | | | This patch forces the user management CLI command to store certificates as userCertificate;binary attribute. The code to retrieve of user information was modified to enable outputting of userCertificate;binary attribute to the command line. The modification also fixes https://fedorahosted.org/freeipa/ticket/5173 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* user-show: add --out option to save certificates to fileFraser Tweedale2015-07-311-1/+26
| | | | | | | | | | Add the --out option to user-show, bringing it into line with host-show and service-show with the ability to save the user's certificate(s) to a file. https://fedorahosted.org/freeipa/ticket/5171 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile-import: do not require profileId in profile dataChristian Heimes2015-07-311-3/+5
| | | | | | | | | | | | | certprofile-import no longer requires profileId in profile data. Instead the profile ID from the command line is taken and added to the profile data internally. If profileId is set in the profile, then it still has to match the CLI option. https://fedorahosted.org/freeipa/ticket/5090 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Validate vault's file parametersChristian Heimes2015-07-311-12/+47
| | | | | | | | | | | A user can pass file names for password, public and private key files to the vault plugin. The plugin attempts to read from these files. If any file can't be, an internal error was raised. The patch wraps all reads and turns any IOError and UnicodeError into a ValidationError. https://fedorahosted.org/freeipa/ticket/5155 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-312-2/+2
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ULC: Fix stageused-add --from-delete commandMartin Basti2015-07-291-4/+5
| | | | | | | | | | | Nonexistent method was used to move deleted user to staged area. Minor fixes added: * handle not found error * return new DN https://fedorahosted.org/freeipa/ticket/5145 Reviewed-By: David Kupka <dkupka@redhat.com>
* ACI plugin: correctly parse bind rules enclosed in parenthesesMartin Babinsky2015-07-291-2/+6
| | | | | | | | | Since bind rule such as `(userdn = "ldap:///anyone")` is also a valid statement, the ipalib ACI parser was updated to handle this case. https://fedorahosted.org/freeipa/ticket/5037 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix client ca.crt to match the server's certGabe2015-07-271-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3809 Reviewed-By: Martin Basti <mbasti@redhat.com>
* otptoken: use ipapython.nsslib instead of Python's ssl moduleChristian Heimes2015-07-271-28/+8
| | | | | | | | | | | | The otptoken plugin is the only module in FreeIPA that uses Python's ssl module instead of NSS. The patch replaces ssl with NSSConnection. It uses the default NSS database to lookup trust anchors. NSSConnection uses NSS for hostname matching. The package python-backports-ssl_match_hostname is no longer required. https://fedorahosted.org/freeipa/ticket/5068 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certprofile-import: improve profile format documentationChristian Heimes2015-07-271-1/+1
| | | | | | | | | The certprofile-import plugin expects a raw Dogtag config file. The XML format is not supported. --help gives a hint about the correct file format. https://fedorahosted.org/freeipa/ticket/5089 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* idviews: Enforce objectclass check in idoverride*-delTomas Babej2015-07-231-0/+19
| | | | | | | | | | | | | Even with anchor to sid type checking, it would be still possible to delete a user ID override by specifying a group raw anchor and vice versa. This patch introduces a objectclass check in idoverride*-del commands to prevent that. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* idviews: Restrict anchor to name and name to anchor conversionsTomas Babej2015-07-231-4/+46
| | | | | | | | | | | | | When converting the ID override anchor from AD SID representation to the object name, we need to properly restrict the type of the object that is being resolved. The same restriction applies for the opposite direction, when converting the object name to it's SID. https://fedorahosted.org/freeipa/ticket/5029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* fix broken search for users by their managerMartin Babinsky2015-07-233-11/+8
| | | | | | | | | The patch fixes incorrect construction of search filter when using `ipa user-find` with '--manager' option. https://fedorahosted.org/freeipa/ticket/5146 Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 13:05:07 +0000