summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* disallow mod of topology segment nodesPetr Vobornik2015-06-111-0/+2
| | | | | | | | | | | | | | | | | Mod of segment end will be disallowed in topology plugin. Reasoning (by Ludwig): if we want to properly allow mods to change connectivity and endpoints, then we would need to check if the mod disconnects the topology, delete existing agreements, check if the new would be a duplicate and create new agmts. There could be some difficult scenarios, like having A <--> B <--> C <--> D, if you modify the segment B-C to A-D topology breaks and is then reconnected. part of: https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNSSEC: validate forward zone forwardersMartin Basti2015-06-113-3/+182
| | | | | | | | | | Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNSSEC: Improve global forwarders validationMartin Basti2015-06-113-52/+164
| | | | | | | | | | Validation now provides more detailed information and less false positives failures. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* rename topologysegment_refresh to topologysegment_reinitializePetr Vobornik2015-06-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5056 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Enforce CA ACLs in cert-request commandFraser Tweedale2015-06-112-0/+93
| | | | | | | | | | | | | | | This commit adds CA ACL enforcement to the cert-request command and uses the pyhbac machinery. It is planned to implement ACL enforcement in Dogtag in a future release, and remove certificate issuance privileges and CA ACL enforcement responsibility from the framework. See https://fedorahosted.org/freeipa/ticket/5011 for more information. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add CA ACL pluginFraser Tweedale2015-06-112-0/+478
| | | | | | | | | | | | | | | | | | | Implement the caacl commands, which are used to indicate which principals may be issued certificates from which (sub-)CAs, using which profiles. At this commit, and until sub-CAs are implemented, all rules refer to the top-level CA (represented as ".") and no ca-ref argument is exposed. Also, during install and upgrade add a default CA ACL that permits certificate issuance for all hosts and services using the profile 'caIPAserviceCert' on the top-level CA. Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Martin Basti <mbasti@redhat.com>
* vault: Fix ipa-kra-installJan Cholasta2015-06-101-9/+29
| | | | | | | | | Use state in LDAP rather than local state to check if KRA is installed. Use correct log file names. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: David Kupka <dkupka@redhat.com>
* vault: Move vaults to cn=vaults,cn=kraJan Cholasta2015-06-101-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: David Kupka <dkupka@redhat.com>
* topology: hide topologysuffix-add del mod commandsPetr Vobornik2015-06-101-0/+6
| | | | | | | | | Suffices are created on installation/upgrade. Users should not modify them. https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* topology: allow only one node to be specified in topologysegment-refreshPetr Vobornik2015-06-101-6/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Added vault-archive and vault-retrieve commands.Endi S. Dewata2015-06-081-1/+495
| | | | | | | | | | New commands have been added to archive and retrieve data into and from a vault, also to retrieve the transport certificate. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migration now accepts scope as argumentDrew Erny2015-06-051-1/+18
| | | | | | | | | | | Adds a new option to command ipa migrate-ds, --scope=[base,onelevel,subtree] which allows the user to specify LDAP search depth for users and groups. 'onelevel' was the hard-coded level before this patch and is still default. Specify 'subtree' to search nested OUs for users and groups. https://fedorahosted.org/freeipa/ticket/2547 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: topology pluginPetr Vobornik2015-06-041-0/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/4997 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* webui: IPA.command_dialog - a new dialog base classPetr Vobornik2015-06-041-0/+1
| | | | | | | | refactoring for: https://fedorahosted.org/freeipa/ticket/4997 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* topology: ipa management commandsPetr Vobornik2015-06-042-0/+386
| | | | | | | | | | | ipalib part of topology management Design: - http://www.freeipa.org/page/V4/Manage_replication_topology https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update cert-request to support user certs and profilesFraser Tweedale2015-06-042-88/+133
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/57 Part of: https://fedorahosted.org/freeipa/ticket/4938 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add usercertificate attribute to user pluginFraser Tweedale2015-06-042-3/+9
| | | | | | Part of: https://fedorahosted.org/freeipa/tickets/4938 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add profile_id parameter to 'request_certificate'Fraser Tweedale2015-06-041-1/+1
| | | | | | | | | | | | Add the profile_id parameter to the 'request_certificate' function and update call sites. Also remove multiple occurrences of the default profile ID 'caIPAserviceCert'. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add generic split_any_principal methodFraser Tweedale2015-06-041-8/+19
| | | | | | | | | | | | | | | There exist methods to split user or service/host principals, but there is no method to split any kind of principal and allow the caller to decide what to do. Generalize ``ipalib.plugins.service.split_principal`` to return a service of ``None`` if the principal is a user principal, rename it ``split_any_principal`` and reimplement ``split_principal`` to preserve existing behaviour. Part of: https://fedorahosted.org/freeipa/ticket/4938 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add certprofile pluginFraser Tweedale2015-06-042-0/+254
| | | | | | | | | | | | | Add the 'certprofile' plugin which defines the commands for managing certificate profiles and associated permissions. Also update Dogtag network code in 'ipapython.dogtag' to support headers and arbitrary request bodies, to facilitate use of the Dogtag profiles REST API. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix certificate management with service-modFraser Tweedale2015-06-031-1/+1
| | | | | | | | | | Adding or removing certificates from a service via --addattr or --delattr is broken. Get certificates from entry_attrs instead of options. https://fedorahosted.org/freeipa/ticket/4238 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix: regression in host and service pluginMartin Basti2015-06-032-7/+14
| | | | | | | | | | | Test failures: * wrong error message * mod operation always delete usercertificates https://fedorahosted.org/freeipa/ticket/4238 Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add plugin to manage service constraint delegationsRob Crittenden2015-06-031-0/+537
| | | | | | | | | | Service Constraints are the delegation model used by ipa-kdb to grant service A to obtain a TGT for a user against service B. https://fedorahosted.org/freeipa/ticket/3644 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Support multiple host and service certificatesFraser Tweedale2015-06-022-84/+117
| | | | | | | | | | | | | | | | | | | | | | Update the framework to support multiple host and service certificates. host-mod and service-mod revoke existing certificates that are not included in the modified entry. Using addattr=certificate=... will result in no certificates being revoked. The existing behaviour of host-disable, host-del, service-disable and service-del (revoke existing certificate) is preserved but now applies to all certificates in the host or service entry. Also update host-show and service-show to write all the principal's certificates to the file given by the ``--out=FILE`` option. Part of: http://www.freeipa.org/page/V4/User_Certificates https://fedorahosted.org/freeipa/ticket/4238 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Do not print traceback when pipe is brokenGabe2015-06-021-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/2284 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow ipa help command to run when ipa-client-install is not configuredGabe2015-06-021-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/3584 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server-find and server-show commandsPetr Vobornik2015-05-262-0/+90
| | | | | | | | | | | ipa server-find ipa server-show FQDN These commands display a list of IPA servers stored in cn=masters,cn=ipa,cn=etc,$SUFFIX https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add Domain Level featureTomas Babej2015-05-263-0/+157
| | | | | | | https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Added vault plugin.Endi S. Dewata2015-05-252-0/+322
| | | | | | | | | A new plugin has been added to manage vaults. Test scripts have also been added to verify the functionality. https://fedorahosted.org/freeipa/ticket/3872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: option to not create user private groupPetr Vobornik2015-05-201-0/+1
| | | | | | | | | | | Web UI wa not able to create a user without a private group. New field added to user adder dialog to allow that. https://fedorahosted.org/freeipa/ticket/4986 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
* webui: stageuser pluginPetr Vobornik2015-05-201-0/+11
| | | | | Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* User life cycle: Add 'Stage User Provisioning' permission/priviledgeThierry Bordaz2015-05-181-3/+14
| | | | | | | Add the ability for 'Stage user provisioning' priviledge to add stage users. Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: Stage user Administrators permission/priviledgeThierry Bordaz2015-05-182-1/+150
| | | | | | | | Creation of stage user administrator https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: support of user-undelThierry Bordaz2015-05-181-1/+46
| | | | | | | | | add user plugin commands : user-undel user-undel: moves a user from delete container to the active container https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: user-find support finding delete usersThierry Bordaz2015-05-181-3/+20
| | | | | | | | | change user plugin commands : user-find user-find support of --preserved option to show preserved (aka deleted) users https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: user-del supports --permanently, --preserve options and ↵Thierry Bordaz2015-05-181-12/+123
| | | | | | | | | | | | | ability to delete deleted user change user plugin commands : user-del - --permanently: deletes permanently an Active user (DEL) - --preserve: move an Active user to Delete user (MODRDN) - allows to delete Active user and Delete user https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: new stageuser commands activate (provisioning)Thierry Bordaz2015-05-181-7/+65
| | | | | | | | | Add plugin commands to stageuser plugin: stageuser_activate: activate entries created by provisioning https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: new stageuser commands activateThierry Bordaz2015-05-182-1/+222
| | | | | | | | | Add plugin commands to stageuser plugin: stageuser_activate: activate entries created by IPA CLIs https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* User life cycle: new stageuser commands del/mod/find/showThierry Bordaz2015-05-183-77/+180
| | | | | | | | | | | | Add plugin commands to stageuser plugin: stageuser_del stageuser_mod stageuser_find stageuser_show https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: David Kupka <dkupka@redhat.com>
* baseldap: Fix possible crash in LDAPObject.handle_duplicate_entryJan Cholasta2015-05-151-1/+1
|
* cli: differentiate Flag a Bool when autofill is setPetr Vobornik2015-05-121-2/+2
| | | | | | | | | | | With previous behavior there was no difference between Flag and Bool if - autofill == True - default = some value It prevented to have a boolean which is set by default to true, but could be set to False if users wants to without prompting in interactive shell. Reviewed-By: Martin Basti <mbasti@redhat.com>
* migrate-ds: log migrated group members only on debug levelPetr Vobornik2015-05-121-2/+2
| | | | | | It pollutes error_log. Reviewed-By: Martin Basti <mbasti@redhat.com>
* migrate-ds: optimize gid checks by utilizing dictionary nature of setPetr Vobornik2015-05-121-4/+4
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* migrate-ds: remove unused def_group_gid context propertyPetr Vobornik2015-05-121-3/+1
| | | | | | it's no longer used anywhere Reviewed-By: Martin Basti <mbasti@redhat.com>
* migrate-ds: skip default group optionPetr Vobornik2015-05-121-4/+14
| | | | | | | | | | | | | New option --use-default-group=False could be used to disable adding of migrated users into default group. By default, the default group is no longer POSIX therefore it doesn't fulfill the original idea of providing GID and therefore it could be skipped during migration. https://fedorahosted.org/freeipa/ticket/4950 Reviewed-By: Martin Basti <mbasti@redhat.com>
* migrate-ds: optimize adding users to default groupPetr Vobornik2015-05-121-17/+12
| | | | | | | | | | | | | Migrate-ds searches for user without a group and adds them to default group. There is no point in checking if the user's selected by previous queary are not member of default group because they are not member of any group. The operation is also speeded up by not fetching the default group. Users are added right away. https://fedorahosted.org/freeipa/ticket/4950 Reviewed-By: Martin Basti <mbasti@redhat.com>
* use Connectible.disconnect() instead of .destroy_connection()Petr Vobornik2015-05-071-1/+1
| | | | | | | | | Destroy connection is an internal function of Connectible and therefore it should not be used directly. https://fedorahosted.org/freeipa/ticket/4991 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Unsaved changes dialog internally inconsistentGabe2015-05-071-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4926 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make lint work on Fedora 22.David Kupka2015-04-271-0/+1
| | | | | | | | | | | pylint added 'confidence' parameter to 'add_message' method of PyLinter. To be compatible with both, pre- and post- 1.4 IPALinter must accept the parameter but not pass it over. Also python3 checker was added and enabled by default. FreeIPA is still not ready for python3. Additionally few false-positives was marked. Reviewed-By: Martin Basti <mbasti@redhat.com>
* speed up indirect member processingPetr Vobornik2015-04-273-4/+78
| | | | | | | | | | | | | | | the old implementation tried to get all entries which are member of group. That means also user. User can't have any members therefore this costly processing was unnecessary. New implementation reduces the search only to entries which have members. Also page size was removed to avoid paging by small pages(default size: 100) which is very slow for many members. https://fedorahosted.org/freeipa/ticket/4947 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-29 04:32:13 +0000