summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* Use absolute domain in detection of A/AAAA recordsMartin Basti2015-11-251-5/+1
| | | | | | | | | | | | Python dns resolver append configured domain to queries which may lead to false positive answer. Exmaple: resolving "ipa.example.com" may return records for "ipa.example.com.example.com" if domain is configured as "example.com" https://fedorahosted.org/freeipa/ticket/5421 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Call directly function is_host_resolvable instead do call via frameworkMartin Basti2015-11-251-3/+1
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Make command dns-resolve deprecated.Martin Basti2015-11-252-3/+24
| | | | | | | | | | | | | | | | | To debug DNS issues other commands should be used like 'dig', 'host', 'nslookup' instead of command 'ipa dns-resolve'. This command is executed on server side, what may not be helpful with debugging clients. 'ipa dns-resolve' command is worse copy of host command, users should use 'host' command instead. dns-resolve is removed from CLI https://fedorahosted.org/freeipa/ticket/5466 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix upgrade of forwardzones when zone is in realmdomainsMartin Basti2015-11-251-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add profiles and default CA ACL on migrationFraser Tweedale2015-11-241-0/+8
| | | | | | | | | | | | | | | | | | | | Profiles and the default CA ACL were not being added during replica install from pre-4.2 servers. Update ipa-replica-install to add these if they are missing. Also update the caacl plugin to prevent deletion of the default CA ACL and instruct the administrator to disable it instead. To ensure that the cainstance installation can add profiles, supply the RA certificate as part of the instance configuration. Certmonger renewal setup is avoided at this point because the NSSDB gets reinitialised later in installation procedure. Also move the addition of the default CA ACL from dsinstance installation to cainstance installation. Fixes: https://fedorahosted.org/freeipa/ticket/5459 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* remove forgotten print in DNS pluginMartin Basti2015-11-231-1/+0
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgrade: fix migration of old dns forward zonesMartin Basti2015-11-201-24/+27
| | | | | | | | Plugins should call self.api not the global one during upgrade https://fedorahosted.org/freeipa/ticket/5472 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow multiple managers per user - CLI partMartin Basti2015-11-203-29/+67
| | | | | | | | | | | | | | | | | | | | Added commands: * user-add-manager * user-remove-manager * stageuser-add-manager * stageuser-remove-manager Commit contains override of convert_attribute_members method in baseuser class that ensures the managers will be returned in 'manager' attribute due to backward compatibility instead of 'manager_user' as would be expected. https://fedorahosted.org/freeipa/ticket/5344 This patch also fixes: https://fedorahosted.org/freeipa/ticket/5387 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move common code of user and stageuser to baseuser postcallbackMartin Basti2015-11-203-6/+4
| | | | | | | usser-add and stageuser-add contains common code that can be exported to baseuser common postcallback Reviewed-By: David Kupka <dkupka@redhat.com>
* Use domain level constants in topology pluginMartin Basti2015-11-101-4/+3
| | | | Reviewed-By: David Kupka <dkupka@redhat.com>
* DNS record-add warns when a suspicious DNS name is detectedPetr Spacek2015-11-102-0/+40
| | | | | | | | Relative name "record.zone" is being added into zone "zone.", which is probably a mistake. User probably wanted to either specify relative name "record" or use FQDN "record.zone.". Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-csreplica-manage: disable connect/disconnect/del with domain level > 0Martin Basti2015-11-021-0/+5
| | | | | | | | | | * ipa-csreplica-manage {connect|disconnect} - a user should use 'ipa topologysegment-*' commands * ipa-csreplica-manage del - a user should use ipa-replica-manage del https://fedorahosted.org/freeipa/ticket/5405 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Added user friendly error message for dnszone enable and disableAbhijeet Kasurde2015-10-291-2/+10
| | | | | | | | | | Added try-except block in dns plugin in order to provide user friendly message to end user. https://fedorahosted.org/freeipa/ticket/4811 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* silence pylint in Python 3-specific portion of ipalib/rpc.pyMartin Babinsky2015-10-271-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.rpc: Update for Python 3Petr Viktorin2015-10-271-6/+29
| | | | | | | | The client XML-RPC implementation is tied to rpclib internals, so with a change in Python it needs to be updated. And rpclib changed in Python 3. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib: Remove NSSHTTPSPetr Viktorin2015-10-271-1/+1
| | | | | | This workaround is unused in Python 2.7+. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and belowPetr Viktorin2015-10-271-21/+12
| | | | | | IPA hasn't supported these pythons for a while now. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Domain levels: use constants rather than hardcoded valuesMartin Basti2015-10-271-2/+6
| | | | | | | | | | | Added constants for domain levels DOMAIN_LEVEL_0 = 0 DOMAIN_LEVEL_1 = 1 This allows to search for domain level easier in code. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* trustdomain: Perform validation of the trust domain firstTomas Babej2015-10-261-1/+6
| | | | | | | | | | Makes sure that the first check that is performed when trustdomain-del command is run is that the actual trusted domain exists. This is done to prevent a subseqent error which might be misleading. https://fedorahosted.org/freeipa/ticket/5389 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Make trust_show.get_dn raise properly formatted NotFoundTomas Babej2015-10-261-8/+24
| | | | | | | | | | | | | The trust_show command does not raise a properly formatted NotFound error if the trust is not found, only a generic EmptyResult error is raised. This patch makes the trust_show tell us what actually could not be found. https://fedorahosted.org/freeipa/ticket/5389 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* always ask the resolver for the reverse zone when manipulating PTR recordsMartin Babinsky2015-10-221-33/+18
| | | | | | | | | | | | | Instead of searching for all zones to identify the correct reverse zone, we will first ask the resolver to return the name of zone that should contain the desired record and then see if IPA manages this zone. This patch also removes a duplicate function in bindinstance.py that is not used anywhere. https://fedorahosted.org/freeipa/ticket/5200 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Work around ipalib.text (i18n) str/unicode handlingPetr Viktorin2015-10-221-9/+18
| | | | | | | Python 3 doesn't provide ugettext/ungettext, since gettext/ngettext work with (unicode) strings. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix more bytes/unicode issuesPetr Viktorin2015-10-222-3/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.messages: Add "message" property to PublicMessagePetr Viktorin2015-10-221-0/+5
| | | | | | | In Python 3, the "message" property was removed in favor of calling str(). Add it to PublicMessage, since IPA code depends on it. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Handle binascii.Error from base64.b64decode()Petr Viktorin2015-10-222-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In Python 3, the base64.b64decode function raises binascii.Error (a ValueError subclass) when it finds incorrect padding. In Python 2 it raises TypeError. Callers should usually handle ValueError; unless they are specifically concerned with handling base64 padding issues). In some cases, callers should handle ValueError: - ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should handle ValueError - ipalib.x509 (load_certificate*, get_*): callers should handle ValueError In other cases ValueError is handled: - ipalib.parameters - ipapython.ssh - ipalib.rpc (json_decode_binary - callers already expect ValueError) - ipaserver.install.ldapupdate Elsewhere no error handling is done, because values come from trusted sources, or are pre-validated: - vault plugin - ipaserver.install.cainstance - ipaserver.install.certs - ipaserver.install.ipa_otptoken_import Reviewed-By: Tomas Babej <tbabej@redhat.com>
* DNSSEC: warn user if DNSSEC key master is not installedMartin Basti2015-10-222-0/+51
| | | | | | | | | Warning user that DNSSEC key master is not installed when commands dnszone-add, dnszone-mod, dnszone-show when option dnssec=true https://fedorahosted.org/freeipa/ticket/5290 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* execute user-del pre-callback also during user preservationMartin Babinsky2015-10-211-21/+28
| | | | | | | | | | | user preservation code was not using the pre-callback function which did check whether a protected member is being deleted and facilitated the orphaning/deletion of OTP tokens owner/managed by the user. https://fedorahosted.org/freeipa/ticket/5362 https://fedorahosted.org/freeipa/ticket/5372 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* do not ask for segment direction when running topology commandsMartin Babinsky2015-10-201-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5222 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* enable topology plugin on upgradePetr Vobornik2015-10-151-0/+18
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idoverride: Ignore ValidationErrors when converting the anchorTomas Babej2015-10-141-24/+33
| | | | | | | | | | | When converting the anchor to a human readable form, SID validation may fail, i.e. if the domain is no longer trusted. Ignore such cases and pass along the anchor in the raw format. https://fedorahosted.org/freeipa/ticket/5322 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* remove ID overrides when deleting a userMartin Babinsky2015-10-141-0/+6
| | | | | | | | patch fixes a regression introduced during user-del refactoring https://fedorahosted.org/freeipa/ticket/5365 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* vault: fix private service vault creationJan Cholasta2015-10-131-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5361 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* rpc: Name argument to KerberosErrorPetr Viktorin2015-10-131-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.parameters: Require bytes for Bytes.patternPetr Viktorin2015-10-131-1/+4
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.parameters: Handle 0-prefixed octal format of intsPetr Viktorin2015-10-131-0/+3
| | | | | | | | | | In Python 2, numbers prfixed with '0' are parsed as octal, e.g. '020' -> 16. In Python 3, the prefix is '0o'. Handle the old syntax for IPA's parameter conversion to keep backwards compatibility. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add `message` property to IPA's errors and warnings under Python 3Petr Viktorin2015-10-131-0/+12
| | | | | | | | Python 3 removes the "message" attribute from exceptions, in favor of just calling str(). Add it back for IPA's own exception types. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipalib.aci: Port to Python 3Petr Viktorin2015-10-131-6/+8
| | | | | | | | | - Don't encode under Python 3, where shlex would choke on bytes - Sort the attrs dictionary in export_to_string, so the tests are deterministic. (The iteration order of dicts was always unspecified, but was always the same in practice under CPython 2.) Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Rename caught exception for use outside the except: block.Petr Viktorin2015-10-131-1/+2
| | | | | | | | | | | | | | In Python 3, the variable with the currently handled exception is unset at the end of the except block. (This is done to break reference cycles, since exception instances now carry tracebacks, which contain all locals.) Fix this in baseldap's error handler. Use a simpler structure for the ipatests.raises utility that only uses the exception inside the except block. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* x509: Port to Python 3Petr Viktorin2015-10-131-1/+8
| | | | | | | | | | | | In python 3 , `bytes` has the buffer interface, and `buffer` was removed. Also, invalid padding in base64-encoded data raises a ValueError rather than TypeError. In tests, use pytest.assert_raises for more correct exception assertions. Also, get rid of unused imports in the tests Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Do not compare types that are not comparable in Python 3Petr Viktorin2015-10-131-3/+3
| | | | | | | | | | In Python 3, different types are generally not comparable (except for equality), and None can't be compared to None. Fix cases of these comparisons. In ipatest.util, give up on sorting lists if the sorting raises a TypeError. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* realmdomains: Do not fail due the ValidationError when adding _kerberos TXT ↵Tomas Babej2015-10-121-2/+5
| | | | | | | | record https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* realmdomains: Issue a warning when automated management of realmdomains failedTomas Babej2015-10-122-5/+54
| | | | | | https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* realmdomains: Add validation that realmdomain being added is indeed from our ↵Tomas Babej2015-10-121-24/+76
| | | | | | | | realm https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* realmdomains: Minor style and wording improvementsTomas Babej2015-10-121-15/+60
| | | | | | https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* util: Add detect_dns_zone_realm_type helperTomas Babej2015-10-121-0/+55
| | | | | | https://fedorahosted.org/freeipa/ticket/5278 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: select a server with KRA for vault operationsJan Cholasta2015-10-081-3/+0
| | | | | | | | This uses the same mechanism which is used for the CA. https://fedorahosted.org/freeipa/ticket/5302 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove uses of the `types` modulePetr Viktorin2015-10-076-17/+12
| | | | | | | | | | | In Python 3, the types module no longer provide alternate names for built-in types, e.g. `types.StringType` can just be spelled `str`. NoneType is also removed; it needs to be replaced with type(None) Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.configparser instead of ConfigParserPetr Viktorin2015-10-071-1/+1
| | | | | | | | The module name was lowercased in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.xmlrpc.client instead of xmlrpclibPetr Viktorin2015-10-072-23/+31
| | | | | | | | The module is renamed to xmlrpc.client in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use six.moves.urllib instead of urllib/urllib2/urlparsePetr Viktorin2015-10-074-23/+25
| | | | | | | | In Python 3, these modules are reorganized. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 13:29:31 +0000