summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
...
* ipaplatform: Move all filesystem paths to ipaplatform.paths moduleTomas Babej2014-06-167-10/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipalib.config: Don't autoconvert values to floatPetr Viktorin2014-06-161-5/+0
| | | | | | | | | | | | | | | | | | When api.env is loaded, strings that "look like" floats got auto-converted to floats. This is wrong, as the conversion to float can lose precision. Case in point: the api_version (e.g. '2.88') should never be interpreted as float. Do not automatically convert to float. We have two numeric options: startup_timeout and wait_for_dns. wait_for_dns is already converted to int when used in the code. Convert startup_timeout to float explicitly when used, so configuration that specified it with a decimal point continues to work. Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipalib.config: Only convert basedn to DNPetr Viktorin2014-06-161-1/+1
| | | | | | | | | The current code would convert values to DN if the key was a substring of 'basedn', e.g. 'base' or 'sed'. Only convert if we're actually dealing with 'basedn'. Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add support for managedBy to tokensNathaniel McCallum2014-06-162-9/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This also constitutes a rethinking of the token ACIs after the introduction of SELFDN support. Admins, as before, have full access to all token permissions. Normal users have read/search/compare access to all of the non-secret data for tokens assigned to them, whether managed by them or not. Users can add tokens if, and only if, they will also manage this token. Managers can also read/search/compare tokens they manage. Additionally, they can write non-secret data to their managed tokens and delete them. When a normal user self-creates a token (the default behavior), then managedBy is automatically set. When an admin creates a token for another user (or no owner is assigned at all), then managed by is not set. In this second case, the token is effectively read-only for the assigned owner. This behavior enables two important other behaviors. First, an admin can create a hardware token and assign it to the user as a read-only token. Second, when the user is deleted, only his self-managed tokens are deleted. All other (read-only) tokens are instead orphaned. This permits the same token object to be reasigned to another user without loss of any counter data. https://fedorahosted.org/freeipa/ticket/4228 https://fedorahosted.org/freeipa/ticket/4259 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib.frontend: Do API version check before converting argumentsPetr Viktorin2014-06-132-19/+19
| | | | | | | | | | | | | This results in the proper message being shown if the client sends an option the server doesn't have yet. It also adds the check to commands that override run() but not __call__, such as `ipa ping`, and to commands run on the server. Adjust tests for these changes. https://fedorahosted.org/freeipa/ticket/3963 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix --ttl description for DNS zonesPetr Spacek2014-06-121-2/+2
| | | | | | | TTL specified in idnsZone object class affects all records at zone apex, not only SOA record. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Make sure member* attrs are always granted together in read permissionsPetr Viktorin2014-06-1111-9/+14
| | | | | | | | | | | | | | Memberofindirect processing of an entry doesn't work if the user doesn't have rights to any one of these attributes: - member - memberuser - memberhost Add all of these to any read permission that specifies any of them. Add a check to makeaci that will enforce this for any future permissions. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make 'permission' the default bind type for managed permissionsPetr Viktorin2014-06-118-22/+0
| | | | | | | | | | | This reduces typing (or copy/pasting), and draws a bit of attention to any non-default privileges (currently 'any' or 'anonymous'). Leaving the bindtype out by mistake isn't dangerous: by default a permission is not granted to anyone, since it is not included in any priviliges. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* permission plugin: Sort rights when writing the ACIPetr Viktorin2014-06-111-1/+1
| | | | | | This makes the ACI independent on set/dict iteration order. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Update all remaining plugins to the new Registry APINathaniel McCallum2014-06-1131-274/+333
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make zonenames absolute in host pluginMartin Basti2014-06-111-2/+3
| | | | | | | This is fix for regression caused by IDNA patch, zone names must be absolute. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Add missing attributes to User managed permissionsPetr Viktorin2014-06-101-2/+3
| | | | | | | | | | - Add nsAccountLock to the Unlock user accounts permission - Add member to Read User Membership - Add userClass and preferredLanguage to Modify Users https://fedorahosted.org/freeipa/ticket/3697 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert User default permissions to managedPetr Viktorin2014-06-101-0/+91
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Split long docstrings that were recently modifiedPetr Viktorin2014-06-104-52/+52
| | | | | | | | When the strings are changed again, translators will only need to re-translate the modified parts. See: https://fedorahosted.org/freeipa/ticket/3587 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui: move host action panel actions to action dropdownPetr Vobornik2014-06-101-0/+2
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: association adder dialog - change find label to filterPetr Vobornik2014-06-101-0/+2
| | | | | | also add filter placeholder Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add search box placeholder textPetr Vobornik2014-06-101-0/+1
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: improve paginationPetr Vobornik2014-06-101-0/+2
| | | | | | | | pagination now support: - styles updated to PatternFly + DataTables - added 'First' and 'Last' button Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: activity indicatorsPetr Vobornik2014-06-101-0/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/4177 https://fedorahosted.org/freeipa/ticket/4255 Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* webui: add confirmation to action dropdown actionsPetr Vobornik2014-06-101-0/+1
| | | | Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
* Add version and API versionGabe2014-06-092-1/+6
| | | | | | | | | | - Add API version to constants.py - Add version option to plugable.py - Add version to ipa manpage and fix a couple of typos https://fedorahosted.org/freeipa/ticket/4316 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add missing attributes to 'Modify Sudo rule' permissionPetr Viktorin2014-06-041-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4344 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Convert Sudo rule default permissions to managedPetr Viktorin2014-06-041-1/+32
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/4346 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipalib.aci: Fix bugs in comparisonPetr Viktorin2014-06-041-3/+3
| | | | | | | | | | | | - regression in be6edef6e48224e74344f48d25876b09cd263674: The __ne__ special method was named incorrectly - regression in 1ea6def129aa459ecc3d176a3b6aebdf75de2eb7: The targetattr operator was never compared Include some new comparison tests. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix indentationMartin Basti2014-06-031-21/+21
| | | | | | There was 5 spaces instead of 4, my bad. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* PTR record target can be relativeMartin Basti2014-06-031-2/+1
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* move hostname validation from DNS to hostsMartin Basti2014-06-031-3/+11
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* _domain_name_validatord moved from DNS to realmdomainsMartin Basti2014-06-032-13/+7
| | | | | | | | | | Validator is no more used in dns plugin Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified record and zone class to support IDNMartin Basti2014-06-031-97/+307
| | | | | | | | | | | | | | * Records data are always returned as string * Attributes idnsname, idnssoamname, idnssoarname are returned as * DNSName, with option --raw as string * option --raw returns all IDN domains punycoded Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified records and zone parameters to use DNSNameParamMartin Basti2014-06-031-28/+19
| | | | | | | | | | | | | * Zone is stored as an absolute name (ipa never support relative * zonenames) * compatible with relative zone names as was before * PTR target can be relative domain name Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified dns related global functionsMartin Basti2014-06-033-115/+72
| | | | | | | | | | | * Modified functions to use DNSName type * Removed unused functions Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Modified has_output attributesMartin Basti2014-06-031-2/+8
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* CLI conversion of DNSName typeMartin Basti2014-06-031-0/+3
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* get_ancestors_primary_keys cloneMartin Basti2014-06-031-1/+1
| | | | | | | | | | Fix: classes didnt inherite params from parent correctly Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dns_name_values capability addedMartin Basti2014-06-032-4/+24
| | | | | | | | | | Added capability to transfer DNSName type between server and client Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169i Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSNameParam parameterMartin Basti2014-06-032-1/+71
| | | | | | | | | | New param type for domain names Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allows to sort non text entriesMartin Basti2014-06-032-1/+7
| | | | | | | | Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add read permissions for automember tasksPetr Viktorin2014-06-021-5/+16
| | | | | | | | | | | Permission to read all tasks is given to high-level admins. Managed permission for automember tasks is given to automember task admins. "targetattr=*" is used because tasks are extensibleObject with attributes that aren't in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* krbtpolicy plugin: Fix internal error when global policy is not readablePetr Viktorin2014-05-301-9/+27
| | | | | | | | | | | | | | | An ACIError is now raised if: - the user doesn't have permission to read any one of the ticket policy attributes on the requested entry (checked using attribute-level rights) - any ticket policy attribute from the default policy is not available (either not readable, or not there at all) (only checked if these are accessed, i.e. when the user entry doesn't override all of the defaults, or when requesting the global policy) https://fedorahosted.org/freeipa/ticket/4354 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* krbtpolicy plugin: Code cleanupPetr Viktorin2014-05-301-15/+15
| | | | | | | | | | - Use the new plugin registration API See: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration - Remove the star import from baseldap Part of the work for: https://fedorahosted.org/freeipa/ticket/2653 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add managed read permission for the UPG DefinitionPetr Viktorin2014-05-291-0/+17
| | | | | | | | | | | | Since user_add checks the UPG definition to see if UPG is enabled, user admins need read access to add users correctly. All attributes are allowed since UPG Definition is an extensibleObject; the needed attributes are not in the schema. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci plugin: Fix internal error when ACIs are not readablePetr Viktorin2014-05-291-1/+1
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* pwpolicy-mod: Fix crash when priority is changedPetr Viktorin2014-05-281-1/+1
| | | | | | | | | | | | | The exc_callback was expecting the old update_entry signature, (dn, attrs). This was changed to just (entry) for ticket #2660, see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API. Update the exc_callback to expect the entry as first argument, and add some tests. https://fedorahosted.org/freeipa/ticket/4309 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* dns: Add idnsSecInlineSigning attribute, add --dnssec option to zonePetr Viktorin2014-05-281-1/+7
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-261-0/+17
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default the token owner to the person adding the tokenNathaniel McCallum2014-05-231-1/+8
| | | | | | | | Creating tokens for yourself is the most common operation. Making this the default optimizes for the common case. Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Only specify the ipatokenuniqueid default in the add operationNathaniel McCallum2014-05-231-2/+5
| | | | | | | | | | | Specifying the default in the LDAP Object causes the parameter to be specified for non-add operations. This is especially problematic when performing the modify operation as it causes the primary key to change for every modification. https://fedorahosted.org/freeipa/ticket/4227 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipalib.cli: Add filename argument to ipa consolePetr Viktorin2014-05-221-6/+25
| | | | | | | | | This allows writing simple IPA scripts using the shebang #! /usr/bin/ipa console https://fedorahosted.org/freeipa/ticket/4351 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* plugin registration refactoring for pwpolicyAdam Misnyovszki2014-05-061-24/+15
| | | | | | | | decorators used for plugin registration in pwpolicy according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 20:19:05 +0000