summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Add missing global options in dnsconfigMartin Kosek2012-03-201-1/+20
| | | | | | | | | | | Add a support for new global options in bind-dyndb-ldap, that is: * idnsforwardpolicy: Default policy for conditional forwarding * idnsallowsyncptr: Allow globaly PTR synchronization for dynamic updates * idnszonerefresh: Default interval between regular polls of the name server for new DNS zones https://fedorahosted.org/freeipa/ticket/2439
* Allow port numbers for idnsForwardersMartin Kosek2012-03-201-4/+24
| | | | | | | | Let user enter custom ports for zone conditional forwarders or global forwarders in dnsconfig. Ports can be specified in a standard BIND format: IP_ADDRESS [port PORT] https://fedorahosted.org/freeipa/ticket/2462
* Use a consistent parameter name in errors, defaulting to cli_name.Rob Crittenden2012-03-202-16/+24
| | | | | | | | For general command-line errors we want to use the cli_name on output. The exception is when using *attr, we want to return that attribute name in the exception. https://fedorahosted.org/freeipa/ticket/1418
* Content is no more overwritten by error messagePetr Vobornik2012-03-191-0/+8
| | | | | | | | | | | | | | | | | When an error which caused calling of report_error occurt, the content of a facet got replaced by error message. There was no way how to force the facet to recreate its content and the facet became unusable. This patch creates a containter for an error message. On error, report_error writes its content to error container, content container is hidden and error container is shown. Older comment in a code suggested to move the error message to facet's footer. A message in a footer could be missed by the user and on top of that a footer is sometimes used by various facet and we would have to solve the same problem again. From experience the cause of an error is usually a missing pkey in a path. Therefore error information suggests user to navigate to top level. It causes to load default facets with default values so errors in navigation state shouldn't happen. Facet content is displayed back on facet_show. If user tries to display same object as before facet's need_update() would return false, therefore need_update was modified to always return true if error is displayed. Reproduction: 1) display any nested entity - ie DNS record 2) delete its parent pkey from path - &dnszone-pkey=example.com 3) reload the page with this path https://fedorahosted.org/freeipa/ticket/2449
* Don't allow hosts and services of IPA masters to be disabled.Rob Crittenden2012-03-193-7/+19
| | | | https://fedorahosted.org/freeipa/ticket/2487
* Import the ipaserver plugins based on context, not env.in_server.Rob Crittenden2012-03-191-1/+1
| | | | | | | | | in_server controls how a method is dispatched, it should not also control what plugins are imported. This suppresses the error message "session memcached servers not running." https://fedorahosted.org/freeipa/ticket/2499
* Better hbactest validation messagePetr Vobornik2012-03-151-0/+1
| | | | | | | | HBAC Test validation message contains all missing values in form of list of links instead of general 'missing values' message and redirection to first missing value's facet. When a link is clicked user is redirected to value's facet. https://fedorahosted.org/freeipa/ticket/2182
* Display serial number as HEX (DECIMAL) when showing certificates.Rob Crittenden2012-03-144-19/+25
| | | | https://fedorahosted.org/freeipa/ticket/1991
* Don't crash when searching with empty relationship optionsPetr Viktorin2012-03-131-22/+14
| | | | | | | | | | | | | | | | Empty sequences (and sequences of empty strings) are normalized to None, but the member filter code expected a list. This patch extends a test for missing options to also catch false values. The functional change is from `if param_name in options:` to `if options.get(param_name):`; the rest of the patch is code de-duplication and tests. These are CSV params with csv_skipspace set, so on the CLI, empty set is given as a string with just spaces and commas (including the empty string). https://fedorahosted.org/freeipa/ticket/2479
* Don't set dbdir in the connection until after the connection is created.Rob Crittenden2012-03-131-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | We were comparing the current connection with itself so were never going to call nss_shutdown(). dbdir needs to be set after the connection has been made. This worked on single server installs because we don't do a ping so NSS would never be pre-initialized. If multiple servers are available we call ping() to find one that is up before submitting the request, this is what would have pre-initialized NSS. This was tripping up request-cert because it will intialize NSS with no DB if it hasn't been initialized. We need to initialize it to validate the CSR. A non-working client was doing this when calling cert-request: - call load_certificate_request() - nss.nss_nodb_init() - load the CSR - create a connection, dbdir=/etc/pki/nssdb - the dbdir matches within the same connection, don't call nss_shutdown() - connect to remote server - fail, untrusted CA because we are still using db from nss_nodb_init. Instead if we set dbdir afterward then this will properly be shutdown and NSS re-initialized with correct dbdir. https://fedorahosted.org/freeipa/ticket/2498
* Fix migration plugin compat checkMartin Kosek2012-03-111-3/+7
| | | | | | | | | | | | Ticket #2274 implements a check for compat plugin and warns user if it is enabled. However, there are 2 issues connected with the plugin: 1) The check is performed against the remote (migrated) LDAP server and not the local LDAP server, which does not make much sense 2) When the compat plugin is missing in cn=plugins,cn=config, it raises an error and thus breaks the migration This patch fixes both issues. https://fedorahosted.org/freeipa/ticket/2508
* Mark most config options as requiredPetr Viktorin2012-03-121-15/+15
| | | | | | | IPA assumes most config options are present, but allowed the user to delete them. This patch marks them as required. https://fedorahosted.org/freeipa/ticket/2159
* Enforce that required attributes can't be set to None in CRUD UpdatePetr Viktorin2012-03-123-7/+17
| | | | | | | | | | | | The `required` parameter attribute didn't distinguish between cases where the parameter is not given and all, and where the parameter is given but empty. The case of updating a required attribute couldn't be validated properly, because when it is given but empty, validators don't run. This patch introduces a new flag, 'nonempty', that specifies the parameter can be missing (if not required), but it can't be None. This flag gets added automatically to required parameters in CRUD Update.
* Allow removing sudo commands with special characters from command groupsPetr Viktorin2012-03-121-2/+2
| | | | | | | | | Previously the commands were compared as serialized strings. Differences in serializations meant commands with special characters weren't found in the checked list. Use the DN class to compare DNs correctly. https://fedorahosted.org/freeipa/ticket/2483
* Ignore case in yes/no promptsMartin Kosek2012-03-071-1/+1
| | | | | | | | | We did not accept answers like "Yes", "YES", "No", etc. as valid answers to yes/no prompts (used for example in dnsrecord-del interactive mode). This could confuse users. This patch changes the behavior to ignore the answer case. https://fedorahosted.org/freeipa/ticket/2484
* Do kinit in client before connecting to backendRob Crittenden2012-03-041-4/+27
| | | | | | | | | | | | | | The client installer was failing because a backend connection could be created before a kinit was done. Allow multiple simultaneous connections. This could fail with an NSS shutdown error when the second connection was created (objects still in use). If all connections currently use the same database then there is no need to initialize, let it be skipped. Add additional logging to client installer. https://fedorahosted.org/freeipa/ticket/2478
* Improve dnsrecord interactive helpMartin Kosek2012-03-012-20/+109
| | | | | | | | | | | | | | | | | | | | | Add 2 new features to DNS record interactive help to increase its usability and also make its behavior more consistent with standard parameter interactive help: 1) Ask for missing DNS parts When a required part of a newly added DNS record was missing, we just returned a ValidationError. Now, the interactive help rather asks for all missing required parts of all DNS records that were being added by its parts. 2) Let user amend invalid part When an interactive help asked for a DNS record part value and user enters an invalid value, the entire interactive help exits with an error. This may upset a user if he already entered several correct DNS record part values. Now, the help rather tells user what's wrong and give him an opportunity to amend the value. https://fedorahosted.org/freeipa/ticket/2386
* Add help for new structured DNS frameworkMartin Kosek2012-03-011-4/+31
| | | | | | | | | | DNS Test Day shown that the new RR specific DNS options and the concepts behind them may not be easily understood. This patch adds an explanation of the new DNS framework for structured options to make it easier for the user to understand and use the new options. https://fedorahosted.org/freeipa/ticket/2382
* Fix encoding for setattr/addattr/delattrMartin Kosek2012-03-011-0/+2
| | | | | | | | | | Attribute values passed by --{set,add,del}attr parameters were normalized and validated using appropriate parameter, but were never encoded for the backend. This make prevents manipulation with dirsvr BOOL attributes where framework tries to pass boolean value instead of encoded "TRUE"/"FALSE" values. https://fedorahosted.org/freeipa/ticket/2418
* Add support for sudoOrderRob Crittenden2012-03-011-0/+41
| | | | | | | | | | Update ipaSudoRule objectClass on upgrades to add new attributes. Ensure uniqueness of sudoOrder in rules. The attributes sudoNotBefore and sudoNotAfter are being added to schema but not as Params. https://fedorahosted.org/freeipa/ticket/1314
* Remove memberPrincipal for deleted replicasMartin Kosek2012-03-021-0/+1
| | | | | | | | | | | | When a replica is deleted, its memberPrincipal entries in cn=s4u2proxy,cn=etc,SUFFIX were not removed. Then, if the replica is reinstalled and connected again, the installer would report an error with duplicate value in LDAP. This patch extends replica cleanup procedure to remove replica principal from s4u2proxy configuration. https://fedorahosted.org/freeipa/ticket/2451
* Add status command to retrieve user lockout statusRob Crittenden2012-03-021-1/+112
| | | | | | | This information is not replicated so pull from all IPA masters and display the status across all servers. https://fedorahosted.org/freeipa/ticket/2162
* Forms based authentication UIPetr Voborník2012-03-021-0/+6
| | | | | | | | | | | | | | | | | | | | Support for forms based authentication was added to UI. It consist of: 1) new login page Page url is [ipa server]/ipa/ui/login.html Page contains a login form. For authentication it sends ajax request at [ipa server]/session/json/login_password. If authentication is successfull page is redirected to [ipa server]/ipa/ui if it fails from whatever reason a message is shown. 2) new enhanced error dialog - authorization_dialog. This dialog is displayed when user is not authorized to perform action - usually when ticket and session expires. It is a standard error dialog which shows kerberos ticket related error message and newly offers (as a link) to use form based authentication. If user click on the link, the dialog content and buttons switch to login dialog which has same functionality as 'new login page'. User is able to return back to the error message by clicking on a back button. login.html uses same css styles as migration page -> ipa-migration.css was merged into ipa.css. https://fedorahosted.org/freeipa/ticket/2450
* Fix ticket checks when using either s4u2proxy or a delegated krbtgtSimo Sorce2012-03-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | When using s4u2proxy the only ticket we can access via direct krb5 calls is the HTTP/ ticket which was saved in the ccache as evidence ticket. This ticket is later used by GSSAPI as evidence to obtain an ldap ticket. This works by chance, we shouldn't use calls to get_credentials just to verify ticket expiration dates, but I realize this is a limitation of the current krbV bindings and we have no other way around at the moment. Checking the HTTP/ ticket will fail in case a krbtgt is fully delegated to us. In that case the ccache will contain only a krbtgt, so as a fallback we check that. Checking the ldap/ ticket is never really useful. When s4u2proxy is used, trying to check the ldap/ ticket will fail because we do not have it yet on the first authentication before a session is estalished, and doing it later is not useful. When we have a krbtgt we could go and grap a ldap/ ticket directy, but again that makes little sense. In general all tickets will have the same expiration date (which deopends on the original krbtgt) so checking one is sufficient. Fixes: http://fedorahosted.org/freeipa/ticket/2472
* Migration warning when compat enabledOndrej Hamada2012-02-291-2/+28
| | | | | | | | | | | Added check into migration plugin to warn user when compat is enabled. If compat is enabled, the migration fails and user is warned that he must turn the compat off or run the script with (the newly introduced) option '--with-compat'. '--with-compat' is new flag. If it is set, the compat status is ignored. https://fedorahosted.org/freeipa/ticket/2274
* Only apply validation rules when adding and updating.Rob Crittenden2012-02-299-19/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There may be cases, for whatever reason, that an otherwise illegal entry gets created that doesn't match the criteria for a valid user/host/group name. If this happens (i.e. migration) there is no way to remove this using the IPA tools because we always applied the name pattern. So you can't, for example, delete a user with an illegal name. Primary keys are cloned with query=True in PKQuery which causes no rules to be applied on mod/show/find. This reverts a change from commit 3a5e26a0 which applies class rules when query=True (for enforcing no white space). Replace rdnattr with rdn_is_primary_key. This was meant to tell us when an RDN change was necessary to do a rename. There could be a disconnect where the rdnattr wasn't the primary key and in that case we don't need to do an RDN change, so use a boolean instead so that it is clear that RDN == primary key. Add a test to ensure that nowhitespace is actually enforced. https://fedorahosted.org/freeipa/ticket/2115 Related: https://fedorahosted.org/freeipa/ticket/2089 Whitespace tickets: https://fedorahosted.org/freeipa/ticket/1285 https://fedorahosted.org/freeipa/ticket/1286 https://fedorahosted.org/freeipa/ticket/1287
* Added logout buttonPetr Voborník2012-02-281-1/+3
| | | | | | | | | | Logout button was added to Web UI. Click on logout button executes session_logout command. If command succeeds or xhr stutus is 401 (unauthorized - already logged out) page is redirected to logout.html. logout.html is a simple page with "You have been logged out" text and a link to return back to main page. https://fedorahosted.org/freeipa/ticket/2363
* Improve FQDN handling in DNS and host pluginsMartin Kosek2012-02-292-31/+40
| | | | | | | | | | | | | | | | | | | | | DNS and host plugin does not work well with domain names ending with dot. host plugin creates a record with two fqdn attributes when such hostname is created which then has to be manually fixed. DNS plugin handled zones with and without trailing dot as two distinct zones, which may lead to issues when both zones are created. This patch sanitizes approach to FQDNs in both DNS and host plugin. Hostnames are now always normalized to the form without trailing dot as this form did not work before and it would keep hostname form consistent without changes in our server/client enrollment process. As DNS zones always worked in both forms this patch rather makes sure that the plugin works with both forms of one zone and prevents creating 2 identical zones with just different format. https://fedorahosted.org/freeipa/ticket/2420
* Improve hostname and domain name validationMartin Kosek2012-02-293-35/+72
| | | | | | | | | | | | | | | DNS plugin did not check DNS zone and DNS record validity and user was thus able to create domains like "foo bar" or other invalid DNS labels which would really confuse both user and bind-dyndb-ldap plugin. This patch at first consolidates hostname/domain name validators so that they use common functions and we don't have regular expressions and other checks defined in several places. These new cleaned validators are then used for zone/record name validation. https://fedorahosted.org/freeipa/ticket/2384
* Improve dnsrecord-add interactive modeMartin Kosek2012-02-291-4/+9
| | | | | | | | | | | When an invalid record type is entered during dnsrecord-add interactive mode, user is provided with a list of allowed values (record types). However, the provided list contains also unsupported record types (APL, DHCID, etc.) and any attempt to add such records would end with error. This patch limits the list to supported record types only. https://fedorahosted.org/freeipa/ticket/2378
* Don't set migrated user's GID to that of default users group.Rob Crittenden2012-02-291-3/+8
| | | | | | The GID should be the UID unless UPG is disabled. https://fedorahosted.org/freeipa/ticket/2430
* Validate attributes in permission-addOndrej Hamada2012-02-281-0/+55
| | | | | | | | | | | When adding or modifying permission with both type and attributes specified, check whether the attributes are allowed for specified type. In case of disallowed attributes raises the ObjectclassViolation exception. New tests were also added to the unit-tests. https://fedorahosted.org/freeipa/ticket/2293
* Add support defaultNamingContext and add --basedn to migrate-dsRob Crittenden2012-02-291-13/+28
| | | | | | | | | | | | | | | | | | | | There are two sides to this, the server and client side. On the server side we attempt to add a defaultNamingContext on already installed servers. This will fail on older 389-ds instances but the failure is not fatal. New installations on versions of 389-ds that support this attribute will have it already defined. On the client side we need to look for both defaultNamingContext and namingContexts. We still need to check that the defaultNamingContext is an IPA server (info=IPAV2). The migration change also takes advantage of this and adds a new option which allows one to provide a basedn to use instead of trying to detect it. https://fedorahosted.org/freeipa/ticket/1919 https://fedorahosted.org/freeipa/ticket/2314
* Added unsupported_validatorPetr Voborník2012-02-291-0/+1
| | | | | | | | dnszone attributes idnsallowquery and idnsallowtransfer have valid but currently unsupported values: 'localhost' and 'localnets'. New validator was introduced for unsuported values. By using this validator user can see that the value is currently unsupported instead of showing 'invalid value' or passing the value to server and creating error there. https://fedorahosted.org/freeipa/ticket/2351
* New UI for DNS global configurationPetr Voborník2012-02-291-0/+3
| | | | | | UI for DNS global configuration was implemented. https://fedorahosted.org/freeipa/ticket/2350
* DNS Zone UI: added new attributesPetr Voborník2012-02-291-0/+1
| | | | | | | | | | | | | | | | | New attributes were added to DNS zone details facet. Attributes: idnsallowquery idnsallowtransfer idnsforwarders idnsforwardpolicy idnsallowsyncptr New network address validator created for idnsallowquery and idnsallowtransfer attributes. Network address validator also added to dnszone adder dialog - from_ip field. https://fedorahosted.org/freeipa/ticket/2351
* Use stricter semantics when checking IP address for DNS recordsPetr Viktorin2012-02-291-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2379
* Improve dns error messageMartin Kosek2012-02-281-2/+8
| | | | | | | | | | Improve AttrValueNotFound exception error message raised in the DNS module when a deleted (modified) attribute value is not found in a record. In order to be consistent with previous DNS module implementation this error message should include an attribute label instead of an attribute name. https://fedorahosted.org/freeipa/ticket/2377
* Implement password based session loginJohn Dennis2012-02-273-31/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Adjust URL's - rename /ipa/login -> /ipa/session/login_kerberos - add /ipa/session/login_password * Adjust Kerberos protection on URL's in ipa.conf * Bump VERSION in httpd ipa.conf to pick up session changes. * Adjust login URL in ipa.js * Add InvalidSessionPassword to errors.py * Rename krblogin class to login_kerberos for consistency with new login_password class * Implement login_password.kinit() method which invokes /usr/bin/kinit as a subprocess * Add login_password class for WSGI dispatch, accepts POST application/x-www-form-urlencoded user & password parameters. We form the Kerberos principal from the server's realm. * Add function krb5_unparse_ccache() * Refactor code to share common code * Clean up use of ccache names, be consistent * Replace read_krbccache_file(), store_krbccache_file(), delete_krbccache_file() with load_ccache_data(), bind_ipa_ccache(), release_ipa_ccache(). bind_ipa_ccache() now sets environment KRB5CCNAME variable. release_ipa_ccache() now clears environment KRB5CCNAME variable. * ccache names should now support any ccache storage scheme, not just FILE based ccaches * Add utilies to return HTTP status from wsgi handlers, use constants for HTTP status code for consistency. Use utilies for returning from wsgi handlers rather than duplicated code. * Add KerberosSession.finalize_kerberos_acquisition() method so different login handlers can share common code. * add Requires: krb5-workstation to server (server now calls kinit) * Fix test_rpcserver.py to use new dispatch inside route() method https://fedorahosted.org/freeipa/ticket/2095
* Implement session activity timeoutJohn Dennis2012-02-273-25/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously sessions expired after session_auth_duration had elapsed commencing from the start of the session. We new support a "rolling" expiration where the expiration is advanced by session_auth_duration everytime the session is accessed, this is equivalent to a inactivity timeout. The expiration is still constrained by the credential expiration in all cases. The session expiration behavior is configurable based on the session_auth_duration_type. * Reduced the default session_auth_duration from 1 hour to 20 minutes. * Replaced the sesssion write_timestamp with the access_timestamp and update the access_timestamp whenever the session data is created, retrieved, or written. * Modify set_session_expiration_time to handle both an inactivity timeout and a fixed duration. * Introduce KerberosSession as a mixin class to share session duration functionality with all classes manipulating session data with Kerberos auth. This is both the non-RPC login class and the RPC classes. * Update make-lint to handle new classes. * Added session_auth_duration_type config item. * Updated default.conf.5 man page for new session_auth_duration_type item. * Removed these unused config items: mount_xmlserver, mount_jsonserver, webui_assets_dir https://fedorahosted.org/freeipa/ticket/2392
* Tweak the session auth to reflect developer consensus.John Dennis2012-02-273-9/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
* Limit allowed characters in a netgroup name to alpha, digit, -, _ and .Rob Crittenden2012-02-272-0/+9
| | | | | | Apply this to hostgroup names as well since they can be linked. https://fedorahosted.org/freeipa/ticket/2221
* Add SSHFP update policy for existing zonesMartin Kosek2012-02-271-0/+18
| | | | | | | | | | | | | SSH public key support includes a feature to automatically add/update client SSH fingerprints in SSHFP records. However, the update won't work for zones created before this support was added as they don't allow clients to update SSHFP records in their update policies. This patch lets dns upgrade module extend the original policy to allow the SSHFP dynamic updates. It updates only original policy, we don't want it to overwrite custom user policies. https://fedorahosted.org/freeipa/ticket/2394
* Add reverse DNS record when forward is createdMartin Kosek2012-02-272-139/+308
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
* Don't consider virtual attributes when validating custom objectclassesRob Crittenden2012-02-271-0/+5
| | | | | | | | | We verify user and group default objectclasses when changing them to be sure that required objectclasses aren't being dropped. We need to ignore virtual attributes or it will raise an error because they aren't defined in schema. https://fedorahosted.org/freeipa/ticket/2406
* Add gidnumber minvalueMartin Kosek2012-02-232-0/+2
| | | | | | Do not accept invalid GID values in IPA user/group plugins. https://fedorahosted.org/freeipa/ticket/2335
* Add API for PTR sync controlMartin Kosek2012-02-241-0/+5
| | | | | | | | | | | | | | | | New version of bind-dyndb-ldap plugin have an ability to automatically update machine reverse address when its forward address is updated via GSS-TSIG update. The reverse zone must be managed by FreeIPA as well in order of this feature to work. As it would not be secure to enable this behaviour for all zones there is a global attribute that can enable PTR sync for all zones and also a per-zone attribute that can enable for chosen zones only. This patch adds an API for this control. https://fedorahosted.org/freeipa/ticket/2176
* Add DNS conditional forwardingMartin Kosek2012-02-241-1/+21
| | | | | | | | Add ability configure per-zone forwarder for DNS zones. Any data in such zone will then be considered as non-authoritative and all queries will be sent to specified forwarder. https://fedorahosted.org/freeipa/ticket/2108
* Query and transfer ACLs for DNS zonesMartin Kosek2012-02-241-2/+85
| | | | | | | | | | | | | | Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
* Global DNS optionsMartin Kosek2012-02-241-0/+50
| | | | | | | | | | | | Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
generated by cgit (git 2.34.1) at 2025-02-26 16:15:26 +0000