summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Refresh Dogtag RestClient.ca_host propertyStanislav Laznicka2017-05-021-12/+18
| | | | | | | | | | | | | | | | Refresh the ca_host property of the Dogtag's RestClient class when it's requested as a context manager. This solves the problem which would occur on DL0 when installing CA which needs to perform a set of steps against itself accessing 8443 port. This port should however only be available locally so trying to connect to remote master would fail. We need to make sure the right CA host is accessed. https://pagure.io/freeipa/issue/6878 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Vault: Explicitly default to 3DES CBCChristian Heimes2017-04-281-2/+10
| | | | | | | | | | | The server-side plugin for IPA Vault relied on the fact that the default oid for encryption algorithm is 3DES in CBC mode (DES-EDE3-CBC). Dogtag 10.4 has changed the default from 3DES to AES. Pass the correct algorithm OID to KeyClient.archive_encrypted_data(). Closes: https://pagure.io/freeipa/issue/6899 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Update get_attr_filter in LDAPSearch to handle nsaccountlock user searchesGabe2017-04-262-1/+11
| | | | | | | | | | - Update get_attr_filter in LDAPSearch to handle nsaccountlock by setting the default value for nsaccountlock to false as well as update the filter to check for the default value - Remove pytest xfail for test_find_enabled_user https://pagure.io/freeipa/issue/6896 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert: defer cert-find result post-processingJan Cholasta2017-04-192-37/+66
| | | | | | | | | | | | | Rather than post-processing the results of each internal search, post-process the combined result. This avoids expensive per-certificate searches when cert-find is executed with the --all option on certificates which won't even be included in the combined result. https://pagure.io/freeipa/issue/6808 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* trust: always use oddjobd helper for fetching trust informationAlexander Bokovoy2017-04-111-33/+10
| | | | | | | | | | | | | | Since introduction of privilege separation in IPA framework none of the operations that require direct access to the framework's credentials can be done. All authentication has to be performed with GSSAPI. As result, we cannot obtain TGT for HTTP/.. principal with kinit anymore, so it is better to re-route all types of trust to oddjobd helper and get rid of casing out two-way trust. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1438366 Reviewed-By: Martin Basti <mbasti@redhat.com>
* idrange-add: properly handle empty --dom-name optionFlorence Blanc-Renaud2017-04-051-1/+1
| | | | | | | | | | | | | When idrange-add is called with --dom-name=, the CLI exits with ipa: ERROR: an internal error has occurred This happens because the code checks if the option is provided but does not check if the value is None. We need to handle empty dom-name as if the option was not specified. https://pagure.io/freeipa/issue/6404 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add an option to build ipaserver wheelsChristian Heimes2017-04-031-9/+1
| | | | | | | | | | | | | | To create a wheel bundle with ipaserver and its dependencies: make wheel_bundle IPA_SERVER_WHEELS=1 To include additional dependencies: make wheel_bundle IPA_EXTRA_WHEELS=ipatests[webui] Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Conditionally import pyhbacChristian Heimes2017-04-033-90/+105
| | | | | | | | | | | | | | | | | | | | | | | | The pyhbac module is part of SSSD. It's not available as stand-alone PyPI package. It would take a lot of effort to package it because the code is deeply tight into SSSD. Let's follow the example of other SSSD Python packages and make the import of pyhbac conditionally. It's only necessary for caacl and hbactest plugins. I renamed convert_to_ipa_rule() to _convert_to_ipa_rule() because it does not check for presence of pyhbac package itself. The check is performed earlier in execute(). The prefix indicates that it is an internal function and developers have to think twice before using it in another place. This makes it much easier to install ipaserver with instrumented build of Python with a different ABI or in isolated virtual envs to profile and debug the server. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Hide request_type doc string in cert-request helpAbhijeet Kasurde2017-03-311-1/+1
| | | | | | | | | | | | Fix hides description of request_type argument in cert-request command help Fixes https://pagure.io/freeipa/issue/6494 Fixes https://pagure.io/freeipa/issue/5734 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add --password-expiration to allow admin to force user password expirationGabe2017-03-312-1/+5
| | | | | | | - Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow erasing ipaDomainResolutionOrder attributeFabiano Fidêncio2017-03-301-0/+5
| | | | | | | | | | | | | | Currently when trying to erase the ipaDomainResolutionOrder attribute we hit an internal error as the split() method is called on a None object. By returning early in case of empty string we now allow removing the ipaDomainResolutionOrder attribute by both calling delattr or setting its value to an empty string. https://pagure.io/freeipa/issue/6825 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the sudorule objectsStanislav Laznicka2017-03-271-0/+1
| | | | | | | | | | The recent changes allow the sudorule objects to be renamed. https://pagure.io/freeipa/issue/2466 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the HBAC rule objectsStanislav Laznicka2017-03-271-0/+1
| | | | | | | | | | The recent changes allow HBAC rule objects to be renamed. https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Reworked the renaming mechanismStanislav Laznicka2017-03-2713-26/+34
| | | | | | | | | | | | | | | | | | | The rename operation on *_mod commands was only allowed when the primary key of an entry was also its RDN. With these changes, it should be possible to rename the rest of the entries as well. An attribute to the base LDAPObject was added to whitelist the objects we want to allow to be renamed. It replaced an old attribute rdn_is_primary_key which was used for the very same purpose but the name was confusing because it was not set correctly for certain objects. https://pagure.io/freeipa/issue/2466 https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: do not limit internal searches in cert-findJan Cholasta2017-03-271-18/+10
| | | | | | | | | | | | Instead, apply the limits on the combined result. This fixes (absence of) `--sizelimit` leading to strange behavior, such as `cert-find --users user` returning a non-empty result only with `--sizelimit 0`. https://pagure.io/freeipa/issue/6716 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Add support for login for AD usersPavel Vomacka2017-03-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | After login, method user-find --whoami was called which cannot be called for AD users. That method was replaced by ipa whoami command and sequential command according to result of ipa whoami. AD user can now be logged in. AD users have new menu definition which contains only list of IPA users and profile page of AD user - "User ID Override". This commit also fixes several places where IPA.whoami object was used, because its structure was also changed. It now contains two objects. First one is stored in 'metadata' property and stores result from ipa whoami (type of object, command which should be called for showing detailed data about currently logged entity, etc). The second one is stored in 'data' property which stores result of _show command for currently logged entity. https://pagure.io/freeipa/issue/3242 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ldap2: use LDAP whoami operation to retrieve bind DN for current connectionAlexander Bokovoy2017-03-221-4/+3
| | | | | | | | | | | | | For external users which are mapped to some DN in LDAP server, we wouldn't neccesary be able to find a kerberos data in their LDAP entry. Instead of searching for Kerberos principal use actual DN we are bound to because for get_effective_rights LDAP control we only need the DN itself. Fixes https://pagure.io/freeipa/issue/6797 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* check for replica's KDC entry on master before requesting PKINIT certMartin Babinsky2017-03-151-3/+3
| | | | | | | | | | This prevents replication-based race conditions to break PKINIT certificate requests on replica installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* check that the master requesting PKINIT cert has KDC enabledMartin Babinsky2017-03-151-5/+17
| | | | | | | https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* idviews: correctly handle modification of non-existent viewMartin Babinsky2017-03-151-3/+6
| | | | | | | | | | the pre-callback in `idview-mod` did not correctly handle non-existent object during objectclass check. It will now correctly report that the object was not found instead on generic 'no such entry'. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Re-use trust domain retrieval code in certmap validatorsMartin Babinsky2017-03-141-8/+3
| | | | | | | | https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idview: add domain_resolution_order attributeMartin Babinsky2017-03-141-2/+31
| | | | | | | | | | | `idview-add` and `idview-mod` can now set and validate the attribute. The required objectclass is added on-demand after modification https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaconfig: add the ability to manipulate domain resolution orderMartin Babinsky2017-03-141-2/+113
| | | | | | | | | | | | | | | optional attribute was added to config object along with validator that check for valid domain names and also checks whether the specified domains exist in FreeIPA or in trusted forests and, in case of trusted domains, are not disabled. Part of http://www.freeipa.org/page/V4/AD_User_Short_Names https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-141-7/+46
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* WebUI: add vault managementPavel Vomacka2017-03-141-0/+38
| | | | | | | | | | | | | | | | | | | | Add vault management into WebUI, there are some constraints: - There is no crypto library so Symmetric and Assymetric vaults are not supported in WebUI. Also retrieving or archiving data is not supported. - There aren't any container support right now Supported is: - Browsing vaults - Adding Standard vaults (users, service, shared) - Removing vaults - Adding and removing owners - Adding and removing members https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* permissions: add permissions for read and mod of external group membersPetr Vobornik2017-03-131-0/+17
| | | | | | | | Issue: "User Administrator" role cannot add users to an External Group. https://fedorahosted.org/freeipa/ticket/5504 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add message about last KRA to WebUI Topology viewStanislav Laznicka2017-03-131-2/+2
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add check to prevent removal of last KRAStanislav Laznicka2017-03-131-0/+13
| | | | | | | https://pagure.io/freeipa/issue/6538 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* backend plugins: fix crashes in development modeJan Cholasta2017-03-132-16/+16
| | | | | | | | | | | | | Do not set or delete attributes directly on KerberosWSGIExecutioner, ldap2 and ra_lightweight_ca instances, as that raises an AttributeError in development mode because of ReadOnly locking. Use the usual workaround of `object.__setattr__` and `object.__delattr__` to fix the issue. https://pagure.io/freeipa/issue/6625 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* add whoami commandAlexander Bokovoy2017-03-092-0/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whoami command allows to query details about currently authenticated identity. The command returns following information: * object class name * function to call to get actual details about the object * arguments to pass to the function There are five types of objects that could bind to IPA using their credentials. `ipa whoami` call expects one of the following: * users * staged users * hosts * Kerberos services * ID user override from the default trust view The latter category of objects is automatically mapped by SASL GSSAPI mapping rule in 389-ds for users from trusted Active Directory forests. The command is expected to be used by Web UI to define proper view for the authenticated identity. It is not visible in the command line interface is `ipa` command. Below is an example of how communication looks like for a host principal: # kinit -k # ipa console (Custom IPA interactive Python console) >>> api.Command.whoami() {u'command': u'host_show/1', u'object': u'host', u'arguments': (u'ipa.example.com',)} >>> Fixes https://pagure.io/freeipa/issue/6643 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Add cermapmatch modulePavel Vomacka2017-03-081-0/+12
| | | | | | | | | | Add module which can show users which are mapped to the provided certificate. Additionaly, the certificate is parsed and parsed information are also displayed. https://pagure.io/freeipa/issue/6601 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* dns: fix `dnsrecord_add` interactive modeJan Cholasta2017-03-081-1/+1
| | | | | | | | | | | | | | | `dnsrecord_add` interactive mode might prompt for value of non-existent arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This happens because `dnsrecord_add` extra flags are incorrectly defined as parts of the respective DNS records. Remove extra flags from DNS record parts to fix the interactive mode on old clients talking to new servers. Skip non-existent arguments in the interactive mode to fix new clients talking to old servers. https://fedorahosted.org/freeipa/ticket/6457 Reviewed-By: Martin Basti <mbasti@redhat.com>
* IdM Server: list all Employees with matching Smart CardFlorence Blanc-Renaud2017-03-081-1/+165
| | | | | | | | | | | | | Implement a new IPA command allowing to retrieve the list of users matching the provided certificate. The command is using SSSD Dbus interface, thus including users from IPA domain and from trusted domains. This requires sssd-dbus package to be installed on IPA server. https://fedorahosted.org/freeipa/ticket/6646 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add support for custom table pagination sizePavel Vomacka2017-03-081-0/+4
| | | | | | | | | | | New customization button opens dialog with field for setting the number of lines in tables. After saving the new value there is new topic which starts refreshing current table facet (if shown) and set all other facets expired. Therefore all tables are immediately regenerated. https://fedorahosted.org/freeipa/ticket/5742 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Add certmap modulePavel Vomacka2017-03-081-0/+12
| | | | | | | | | Add facets for certmaprule and certmapconfigure entities. https://fedorahosted.org/freeipa/ticket/6601 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* WebUI: Change structure of Identity submenuPavel Vomacka2017-03-071-0/+5
| | | | | | | | | | | | | Previously there were 'User Groups', 'Host Groups' and 'Netgroups' separately, now these three items are grouped into one named 'Groups' which has sidebar with three items mentioned above. This change allows us to move ID views into Identity submenu. https://pagure.io/freeipa/issue/6717 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-073-0/+17
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* rabase.get_certificate: make serial number arg mandatoryFraser Tweedale2017-03-072-2/+2
| | | | | | | | | | | In rabase.get_certificate it does not make sense for the serial_number argument to be optional. Make it a mandatory positional argument. Part of: https://pagure.io/freeipa/issue/3473 Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Extract method to map principal to princpal typeFraser Tweedale2017-03-031-15/+14
| | | | | | Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove redundant principal_type argumentFraser Tweedale2017-03-032-9/+12
| | | | | | | | | Minor refactor to remove the redundant 'principal_type' argument from 'caacl_check' and associated functions. Part of: https://pagure.io/freeipa/issue/5011 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-024-9/+595
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* dogtag: remove redundant property definitionFraser Tweedale2017-03-011-20/+0
| | | | | | | | | | | The dogtag `ra' backend defines a `ca_host' property, which is also defined (identically) by the `RestClient' class, which recently became a superclass of `ra'. Remove the redundant property definition. Part of: https://pagure.io/freeipa/issue/3473 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-013-75/+92
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove NSSConnection from DogtagStanislav Laznicka2017-03-011-23/+18
| | | | | | | | | | | | | Replaced NSSConnection with Python's httplib.HTTPSConnection. This class is OpenSSL-based. A client certificate with a private key is required to authenticate against the certificate server. We facilitate the RA_AGENT_PEM which already exists. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move RA agent certificate file export to a different locationStanislav Laznicka2017-03-011-1/+1
| | | | | | | | | | | | HTTPS connection to certificate server requires client authentication so we need a file with client certificate and private key prior to its first occurence which happens during migration of certificate profiles to LDAP. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ca: correctly authorise ca-del, ca-enable and ca-disableFraser Tweedale2017-02-281-2/+14
| | | | | | | | | | | | | | | | | | | | CAs consist of a FreeIPA and a corresponding Dogtag object. When executing ca-del, ca-enable and ca-disable, changes are made to the Dogtag object. In the case of ca-del, the corresponding FreeIPA object is deleted after the Dogtag CA is deleted. These operations were not correctly authorised; the FreeIPA permissions are not checked before the Dogtag operations are executed. This allows any user to delete, enable or disable a lightweight CA (except the main IPA CA, for which there are additional check to prevent deletion or disablement). Add the proper authorisation checks to the ca-del, ca-enable and ca-disable commands. https://pagure.io/freeipa/issue/6713 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-234-18/+0
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix session logoutSimo Sorce2017-02-221-1/+1
| | | | | | | | | | | There were 2 issues with session logouts, one is that the logout_cookie was checked and acted on in the wrong place, the other is that the wrong value was set in the IPASESSION header. Fixes https://fedorahosted.org/freeipa/ticket/6685 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Change session logout to kill only the cookieSimo Sorce2017-02-171-2/+3
| | | | | | | | | | | Removing the ccache goes too far as it will cause unrelated sessions to fail as well, this is a problem for accounts used to do unattended operations and that may operate in parallel. Fixes https://fedorahosted.org/freeipa/ticket/6682 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-152-6/+6
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 04:17:44 +0000