summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Allow admins to disable preauth for SPNs.Simo Sorce2015-12-111-1/+2
| | | | | | | | | | | | | | | Some legacy softare is not able to properly cope with preauthentication, allow the admins to disable the requirement to use preauthentication for all Service Principal Names if they so desire. IPA Users are excluded, for users, which use password of lessere entrpy, preauthentication is always required by default. This setting does NOT override explicit policies set on service principals or in the global policy, it only affects the default. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/3860
* Disable User's ability to use the setkeytab exop.Simo Sorce2015-12-111-1/+1
| | | | | | | | | | | | Users can still obtain a keytab for themselves using the getkeytab exop which does not circumvent password policy checks. Users are disallowed from using setkeytab by default in new installations but not in existing installations (no forced upgrade). Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5485
* Introduce option to disable the SetKeytab exopSimo Sorce2015-12-111-0/+1
| | | | | | | | | | | If DisableSetKeytab is set in ipaConfig options then setkeytab will not be available. The default is still to allow this operation for backwards compatibility towards older clients that do not know how to use the new GetKeytab extended operation. Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/5485
* Fix minor typosYuri Chornoivan2015-12-072-2/+2
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* aci: add IPA servers host group 'ipaservers'Jan Cholasta2015-12-072-0/+32
| | | | | | | https://fedorahosted.org/freeipa/ticket/3416 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Extend topology helpPetr Vobornik2015-12-041-3/+52
| | | | | | | `ipa help topology` is improved. Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* rename topology suffixes to "domain" and "ca"Petr Vobornik2015-12-041-0/+3
| | | | | | | https://www.redhat.com/archives/freeipa-devel/2015-November/msg00485.html Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topologysuffix: change iparepltopoconfroot API propertiesPetr Vobornik2015-12-031-6/+4
| | | | | | | Change CLI option, label and type to reflect that it is a only a DN of the suffix. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Removed duplicate domain name validating functionStanislav Laznicka2015-12-024-28/+33
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* topology: replace "suffices" with "suffixes"Jan Cholasta2015-12-011-4/+4
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* server: use topologysuffix name in iparepltopomanagedsuffixJan Cholasta2015-12-011-2/+95
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: increase time limit for upgradesMartin Basti2015-12-011-2/+1
| | | | | | | | | | | | | | | | Default ldap search limit is now 30 sec by default during upgrade. Limits must be changed for the whole ldap2 connection, because this connection is used inside update plugins and commands called from upgrade. Together with increasing the time limit, also size limit should be unlimited during upgrade. With sizelimit=None we may get the TimeExceeded exception from getting default value of the sizelimit from LDAP. https://fedorahosted.org/freeipa/ticket/5267 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* topology: treat server suffix as multivalued attribute in APIPetr Vobornik2015-11-271-1/+1
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: topology graph facetPetr Vobornik2015-11-271-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4286 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Compare objectclasses as case insensitive in baseuser.pyMartin Basti2015-11-251-4/+7
| | | | | | | | Objectclasses must be handled as case insensitive. https://fedorahosted.org/freeipa/ticket/5456 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use absolute domain in detection of A/AAAA recordsMartin Basti2015-11-251-5/+1
| | | | | | | | | | | | Python dns resolver append configured domain to queries which may lead to false positive answer. Exmaple: resolving "ipa.example.com" may return records for "ipa.example.com.example.com" if domain is configured as "example.com" https://fedorahosted.org/freeipa/ticket/5421 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Call directly function is_host_resolvable instead do call via frameworkMartin Basti2015-11-251-3/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Make command dns-resolve deprecated.Martin Basti2015-11-252-3/+24
| | | | | | | | | | | | | | | | | To debug DNS issues other commands should be used like 'dig', 'host', 'nslookup' instead of command 'ipa dns-resolve'. This command is executed on server side, what may not be helpful with debugging clients. 'ipa dns-resolve' command is worse copy of host command, users should use 'host' command instead. dns-resolve is removed from CLI https://fedorahosted.org/freeipa/ticket/5466 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix upgrade of forwardzones when zone is in realmdomainsMartin Basti2015-11-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-241-0/+8
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* remove forgotten print in DNS pluginMartin Basti2015-11-231-1/+0
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgrade: fix migration of old dns forward zonesMartin Basti2015-11-201-24/+27
| | | | | | | | Plugins should call self.api not the global one during upgrade https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow multiple managers per user - CLI partMartin Basti2015-11-203-29/+67
| | | | | | | | | | | | | | | | | | | | Added commands: * user-add-manager * user-remove-manager * stageuser-add-manager * stageuser-remove-manager Commit contains override of convert_attribute_members method in baseuser class that ensures the managers will be returned in 'manager' attribute due to backward compatibility instead of 'manager_user' as would be expected. https://fedorahosted.org/freeipa/ticket/5344 This patch also fixes: https://fedorahosted.org/freeipa/ticket/5387 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move common code of user and stageuser to baseuser postcallbackMartin Basti2015-11-203-6/+4
| | | | | | | usser-add and stageuser-add contains common code that can be exported to baseuser common postcallback Reviewed-By: David Kupka <dkupka@redhat.com>
* Use domain level constants in topology pluginMartin Basti2015-11-101-4/+3
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* DNS record-add warns when a suspicious DNS name is detectedPetr Spacek2015-11-102-0/+40
| | | | | | | | Relative name "record.zone" is being added into zone "zone.", which is probably a mistake. User probably wanted to either specify relative name "record" or use FQDN "record.zone.". Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-csreplica-manage: disable connect/disconnect/del with domain level > 0Martin Basti2015-11-021-0/+5
| | | | | | | | | | * ipa-csreplica-manage {connect|disconnect} - a user should use 'ipa topologysegment-*' commands * ipa-csreplica-manage del - a user should use ipa-replica-manage del https://fedorahosted.org/freeipa/ticket/5405 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added user friendly error message for dnszone enable and disableAbhijeet Kasurde2015-10-291-2/+10
| | | | | | | | | | Added try-except block in dns plugin in order to provide user friendly message to end user. https://fedorahosted.org/freeipa/ticket/4811 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* silence pylint in Python 3-specific portion of ipalib/rpc.pyMartin Babinsky2015-10-271-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.rpc: Update for Python 3Petr Viktorin2015-10-271-6/+29
| | | | | | | | The client XML-RPC implementation is tied to rpclib internals, so with a change in Python it needs to be updated. And rpclib changed in Python 3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib: Remove NSSHTTPSPetr Viktorin2015-10-271-1/+1
| | | | | | This workaround is unused in Python 2.7+. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and belowPetr Viktorin2015-10-271-21/+12
| | | | | | IPA hasn't supported these pythons for a while now. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Domain levels: use constants rather than hardcoded valuesMartin Basti2015-10-271-2/+6
| | | | | | | | | | | Added constants for domain levels DOMAIN_LEVEL_0 = 0 DOMAIN_LEVEL_1 = 1 This allows to search for domain level easier in code. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trustdomain: Perform validation of the trust domain firstTomas Babej2015-10-261-1/+6
| | | | | | | | | | Makes sure that the first check that is performed when trustdomain-del command is run is that the actual trusted domain exists. This is done to prevent a subseqent error which might be misleading. https://fedorahosted.org/freeipa/ticket/5389 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Make trust_show.get_dn raise properly formatted NotFoundTomas Babej2015-10-261-8/+24
| | | | | | | | | | | | | The trust_show command does not raise a properly formatted NotFound error if the trust is not found, only a generic EmptyResult error is raised. This patch makes the trust_show tell us what actually could not be found. https://fedorahosted.org/freeipa/ticket/5389 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* always ask the resolver for the reverse zone when manipulating PTR recordsMartin Babinsky2015-10-221-33/+18
| | | | | | | | | | | | | Instead of searching for all zones to identify the correct reverse zone, we will first ask the resolver to return the name of zone that should contain the desired record and then see if IPA manages this zone. This patch also removes a duplicate function in bindinstance.py that is not used anywhere. https://fedorahosted.org/freeipa/ticket/5200 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Work around ipalib.text (i18n) str/unicode handlingPetr Viktorin2015-10-221-9/+18
| | | | | | | Python 3 doesn't provide ugettext/ungettext, since gettext/ngettext work with (unicode) strings. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix more bytes/unicode issuesPetr Viktorin2015-10-222-3/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.messages: Add "message" property to PublicMessagePetr Viktorin2015-10-221-0/+5
| | | | | | | In Python 3, the "message" property was removed in favor of calling str(). Add it to PublicMessage, since IPA code depends on it. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Handle binascii.Error from base64.b64decode()Petr Viktorin2015-10-222-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Python 3, the base64.b64decode function raises binascii.Error (a ValueError subclass) when it finds incorrect padding. In Python 2 it raises TypeError. Callers should usually handle ValueError; unless they are specifically concerned with handling base64 padding issues). In some cases, callers should handle ValueError: - ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should handle ValueError - ipalib.x509 (load_certificate*, get_*): callers should handle ValueError In other cases ValueError is handled: - ipalib.parameters - ipapython.ssh - ipalib.rpc (json_decode_binary - callers already expect ValueError) - ipaserver.install.ldapupdate Elsewhere no error handling is done, because values come from trusted sources, or are pre-validated: - vault plugin - ipaserver.install.cainstance - ipaserver.install.certs - ipaserver.install.ipa_otptoken_import Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: warn user if DNSSEC key master is not installedMartin Basti2015-10-222-0/+51
| | | | | | | | | Warning user that DNSSEC key master is not installed when commands dnszone-add, dnszone-mod, dnszone-show when option dnssec=true https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* execute user-del pre-callback also during user preservationMartin Babinsky2015-10-211-21/+28
| | | | | | | | | | | user preservation code was not using the pre-callback function which did check whether a protected member is being deleted and facilitated the orphaning/deletion of OTP tokens owner/managed by the user. https://fedorahosted.org/freeipa/ticket/5362 https://fedorahosted.org/freeipa/ticket/5372 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not ask for segment direction when running topology commandsMartin Babinsky2015-10-201-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5222 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* enable topology plugin on upgradePetr Vobornik2015-10-151-0/+18
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idoverride: Ignore ValidationErrors when converting the anchorTomas Babej2015-10-141-24/+33
| | | | | | | | | | | When converting the anchor to a human readable form, SID validation may fail, i.e. if the domain is no longer trusted. Ignore such cases and pass along the anchor in the raw format. https://fedorahosted.org/freeipa/ticket/5322 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* remove ID overrides when deleting a userMartin Babinsky2015-10-141-0/+6
| | | | | | | | patch fixes a regression introduced during user-del refactoring https://fedorahosted.org/freeipa/ticket/5365 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* vault: fix private service vault creationJan Cholasta2015-10-131-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5361 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* rpc: Name argument to KerberosErrorPetr Viktorin2015-10-131-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.parameters: Require bytes for Bytes.patternPetr Viktorin2015-10-131-1/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.parameters: Handle 0-prefixed octal format of intsPetr Viktorin2015-10-131-0/+3
| | | | | | | | | | In Python 2, numbers prfixed with '0' are parsed as octal, e.g. '020' -> 16. In Python 3, the prefix is '0o'. Handle the old syntax for IPA's parameter conversion to keep backwards compatibility. Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 05:15:34 +0000