summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* dns: do not rely on custom param fields in record attributesJan Cholasta2016-06-201-7/+25
| | | | | | | | | Obtain the information provided by the `hint` kwarg and `dnsrecord_part` and `dnsrecord_extra` flags by other means. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: do not crash on missing output in output_for_cliJan Cholasta2016-06-201-1/+1
| | | | | | | | Do not crash in Command.output_for_cli when an output value is missing. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: skip `value` output in output_for_cliJan Cholasta2016-06-201-1/+3
| | | | | | | | | Do not include the `value` output value in CLI output in Command.output_for_cli by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: don't copy command arguments to output paramsJan Cholasta2016-06-201-12/+1
| | | | | | | | | | | | | | Use only object params and params defined in has_output_params as output params. This removes unnecessary duplication of params defined both in object plugins and as command arguments. This requires all command output params to be properly defined in either the object plugins or the command's has_output_params. Fix the plugins where this wasn't true. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-201-2/+2
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-del: perform full master removal in managed topologyMartin Babinsky2016-06-172-1/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements most of the del_master_managed() functionality as a part of `server-del` command. `server-del` nows performs these actions: * check topology connectivity * check that at least one CA/DNS server and DNSSec masters are left after removal * cleanup all LDAP entries/attributes exposing information about the master * cleanup master DNS records * remove master and service principals * remove master entry from LDAP * check that all segments pointing to the master were removed `server-del` now accepts the following options: * `--force`: force master removal even if it doesn't exist * `--ignore-topology-disconnect`: ignore errors arising from disconnected topology before and after master removal * `--ignore-last-of-role`: remove master even if it is last DNS server, and DNSSec key master. The last CA will *not* be removed regardless of this option. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver module for working with managed topologyMartin Babinsky2016-06-171-50/+0
| | | | | | | | | This module should aggregate common functionality utilized in the commands managing domain-level 1 topology. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-171-0/+9
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-171-0/+9
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: dnsserver-* commandsMartin Basti2016-06-172-0/+54
| | | | | | | | | | | | | New commands for manipulation with DNS server configuration were added: * dnsserver-show * dnsserver-mod * dnsserver-find https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: server-mod: add automatic records updateMartin Basti2016-06-171-0/+10
| | | | | | | | | For any location or server weight change is required to update records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: command dns-update-system-recordsMartin Basti2016-06-171-0/+23
| | | | | | | | | | | | | | command dns-update-system-records updates/fixes DNS records for IPA services: * updating A, AAAA records for CA * updating SRV records for LDAP, kerberos and AD trust * updating TXT record in _kerberos with proper realm * updating dns locations if used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: DNS data managementMartin Basti2016-06-171-0/+2
| | | | | | | | | | | | Adding module that allows to work with IPA DNS system records: * getting system records * updating system records * work with DNS locations https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: call `execute` rather than `forward` in LocalJan Cholasta2016-06-151-0/+3
| | | | | | | | This allows properly subclassing from both Local and other Command classes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns, passwd: fix outputs of `dns_resolve` and `passwd` commandsJan Cholasta2016-06-151-0/+6
| | | | | | | | Use proper output type for the `value` output of the commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch, schema: use Dict instead of AnyJan Cholasta2016-06-151-0/+9
| | | | | | | | | Add new Dict parameter class and use it in the batch and command_defaults plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: initialize plugins on demandJan Cholasta2016-06-153-23/+63
| | | | | | | | | Use a new API namespace class which does not initialize plugins until they are accessed. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: allow plugins to be non-classesJan Cholasta2016-06-152-18/+53
| | | | | | | | | Allow registering any object that is callable and has `name` and `bases` attributes as a plugin. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-151-0/+2
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix: Local variable s_indent might be referenced before definedMartin Basti2016-06-131-0/+1
| | | | | | | | | Sanity fix to make sure we do not hit UnboundLocalError and fail terribly https://fedorahosted.org/freeipa/ticket/5921 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* schema: do not validate unrequested params in command_defaultsJan Cholasta2016-06-091-3/+5
| | | | | | | | | | | | Request specific params when getting the defaults instead of getting defaults for all params and filtering the result. This fixes command_defaults failing with validation errors on unrequested params. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-091-0/+1
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-061-26/+0
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: location-* commandsMartin Basti2016-06-031-0/+1
| | | | | | | | | http://www.freeipa.org/page/V4/DNS_Location_Mechanism https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* frontend: do not check API minor version of the clientJan Cholasta2016-06-031-2/+0
| | | | | | | | | | Thin client always respects API schema of the server, even when it is newer that the server. Remove the API minor version check done on the server, as it is no longer necessary. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: move server-side plugins to ipaserverJan Cholasta2016-06-0360-34801/+1
| | | | | | | | | | Move the remaining plugin code from ipalib.plugins to ipaserver.plugins. Remove the now unused ipalib.plugins package. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaclient: implement thin clientJan Cholasta2016-06-032-6/+11
| | | | | | | | | | Dynamically create plugin package for the remote server with modules and commands based on the API schema when client API is finalizes. For in-tree API instances, use ipalib.plugins directly. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* misc: hide the unused --all option of `env` and `plugins` in CLIJan Cholasta2016-06-031-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: move File command arguments to ipaclientJan Cholasta2016-06-033-8/+15
| | | | | | | | | | File arguments are relevant only on the client, on the server they are the same as Str. Specify the arguments as Str in ipalib.plugins and override them with File in ipaclient.plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: do not validate command name in RPCClient.forwardJan Cholasta2016-06-031-4/+0
| | | | | | | | | | | The validation is already done on the server. This allows manually forwarding commands unknown to the client but known to the server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: optimize JSON-RPC response handlingJan Cholasta2016-06-031-3/+3
| | | | | | | | | | Speed up JSON-RPC response handling by putting received response data fragments in a list and joining them at once instead of concatenating each fragment one by one. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: specify connection options in API configJan Cholasta2016-06-032-3/+2
| | | | | | | | | Specify RPC connection options once in API.bootstrap rather than in each invocation of rpcclient.connect. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: allow overriding NSS DB directory in API configJan Cholasta2016-06-032-5/+6
| | | | | | | | | Add new `nss_dir` API config option to allow rpcclient to use a non-default NSS DB for the connection. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* rpc: respect API config in RPCClient.create_connectionJan Cholasta2016-06-031-2/+8
| | | | | | | | | | When connecting rpcclient, get the default values of the `verbose`, `fallback` and `delegate` options from API config rather than hard-code them. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: introduce API schema pluginsJan Cholasta2016-06-031-0/+660
| | | | | | | | | | | | | | | | | Add a set of plugins for API schema introspection. This includes: * a set of commands for command introspection (`command_find`, `command_show`, `command_defaults`), * a set of commands for command param introspection (`param_find`, `param_show`), * a set of commands for command output introspection (`output_find`, `output_show`), * a set of commands for help topic introspection (`topic_find`, `topic_show`), * a command to get the full API schema in one call (`schema`). https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: replace DeprecatedParam with `deprecated` Param argumentJan Cholasta2016-06-037-31/+60
| | | | | | | | | | | | | | | Introduce new `deprecated` Param keywork argument. Setting it to True on a param has the same effect as using DeprecatedParam. This allows deprecating params while retaining their type information. Revert all DeprecatedParam params back to their original definition and set `deprecated` to True. Remove the now unused DeprecatedParam class. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* parameters: introduce no_convert keyword argumentJan Cholasta2016-06-031-2/+11
| | | | | | | | | | | | | When set to true, the argument causes params to not convert unicode values to the param type. This will allow thin client to properly handle params which can be converted from unicode to the param type only on the server, e.g. because of a normalizer. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* parameters: introduce cli_metavar keyword argumentJan Cholasta2016-06-032-3/+6
| | | | | | | | | | Add new Param keyword argument cli_metavar to specify the stand-in for CLI option arguments in command help text. Uppercase class name is used by default. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: split off client-side plugin code into ipaclientJan Cholasta2016-06-0317-751/+1
| | | | | | | | | | | Provide client-side overrides for command plugins which implement any of the client-side `interactive_prompt_callback`, `forward` or `output_for_cli` methods and move the methods from the original plugins to the overrides. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: move code shared by client and server to separate moduleJan Cholasta2016-06-034-77/+109
| | | | | | | | Move the shared code to a new ipalib.dns module. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* frontend: turn Method attributes into propertiesJan Cholasta2016-06-031-32/+11
| | | | | | | | | Implement the `obj_name`, `attr_name` and `obj` Method attributes as properties to allow them to be overriden in sub-classes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: remember overriden plugins in APIJan Cholasta2016-06-031-0/+9
| | | | | | | | | | Remember what plugin class was overriden by what plugin class in API objects. Add new method API.get_plugin_next which returns the plugin class which was overriden by the plugin class specified as argument. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: simplify API plugin initialization codeJan Cholasta2016-06-031-32/+29
| | | | | | | | | Use a flat dictionary to track plugins in API rather than nested dictionaries. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* plugable: turn Plugin attributes into propertiesJan Cholasta2016-06-031-26/+17
| | | | | | | | | | | | | | Implement the `name`, `doc` and `summary` Plugin attributes as properties to allow them to be overriden in sub-classes. Always use .doc rather than .__doc__ to access plugin documentation. Remove the mostly unused `module`, `fullname`, `bases` and `label` attributes. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* help, makeapi: do not use hardcoded plugin package nameJan Cholasta2016-06-031-13/+21
| | | | | | | | | | | Iterate over all plugin packages defined in the API to find the given topic module. The last module found has priority. This will allow topics to be defined in client-side plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* help, makeapi: specify module topic by nameJan Cholasta2016-06-0312-12/+34
| | | | | | | | | | | | | Specify module topic by name rather than by name and summary. A topic module of the topic name must exist. Summary is extracted from the docstring of the topic module. This changes makes topic handling more generic and consistent between modules and commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* help, makeapi: allow setting command topic explicitlyJan Cholasta2016-06-032-36/+30
| | | | | | | | | | | | Help topic can now be specified in the 'topic' class attribute of command plugins. Default value is the name of the module where the command is defined. This allows defining a command outside of the topic module. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipalib: move client-side plugins to ipaclientJan Cholasta2016-06-035-1390/+3
| | | | | | | | | Move the rpcclient backend and commands which are executed on the client to ipaclient.plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaclient: introduce ipaclient.pluginsJan Cholasta2016-06-031-0/+3
| | | | | | | | Load plugins from ipaclient.plugins in client API instances. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns: fix dnsrecord interactive modeJan Cholasta2016-06-031-2/+2
| | | | | | | | Do not crash in interactive mode of dnsrecord_{add,mod}. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 19:55:26 +0000