summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Modify webUI to adhere to new IPA server APIChangmin Teng2019-09-101-0/+2
| | | | | | | | | | | | Given the changes in IPA server API changes, whebUI is modified to utilize new authentication indicators, and disabled custom indicators for services' white list. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* Extend the list of supported pre-auth mechanisms in IPA server APIChangmin Teng2019-09-104-9/+24
| | | | | | | | | | | | | As new authentication indicators implemented, we also modified server API to support those new values. Also, "krbprincipalauthind" attribute is modified to use a pre-defined set of values instead of arbitrary strings. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* config plugin: replace 'is 0' with '== 0'Florence Blanc-Renaud2019-09-041-2/+2
| | | | | | | | | Since python3.8, identity checks with literal produce syntax warnings. Replace the check 'if .. is 0' with 'if .. == 0' Related: https://pagure.io/freeipa/issue/8057 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow insecure binds for migrationChristian Heimes2019-08-131-5/+4
| | | | | | | | | | | | | | Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind over an insecure connection. Password logins were only allowed over LDAPS or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases. This commit lifts the restriction and permits insecure binds over plain LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA certificate is configured with a plain LDAP connection. Fixes: https://pagure.io/freeipa/issue/8040 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Don't return SSH keys with ipa host-find --pkey-onlyRob Crittenden2019-08-071-1/+2
| | | | | | | | This was introduced in 14ee02dcbd6cbb6c221ac7526e471a9fc58fcc82 https://pagure.io/freeipa/issue/8029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* user-stage: transfer all attributes from preserved to stage userFlorence Blanc-Renaud2019-07-311-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The user-stage command is internally implemented as: - user_show(all=True) in order to read the user attributes - loop on the attributes defined as possible to add using stageuser-add and transform them into new options for stageuser_add (for instance stageuser-add provides the option --shell for the attribute loginshell, but there is no option for the attribute businesscategory). - call stageuser_add in order to create a new entry in the active users subtree - user-del to remove the previous entry in the staged users subtree The issue is in the 2nd step. Only the attributes with a stageuser-add option are processed. The logic of the code should be slightly modified, so that all the attributes read in the first step are processed: - if they correspond to an option of stageuser-add, process them like it's currently done. For instance if the entry contains displayname, then it should be processed as --displayName=value in the stageuser-add cmd - if they do not correspond to an option of stageuser-add, add them with --setattr=<attrname>=<attrvalue> Note that some attributes may need to be filtered, for instance user-show returns has_password or has_keytab, which do not correspond to attributes in the LDAP entry. Fixes: https://pagure.io/freeipa/issue/7597 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* WebUI: Add PKINIT status field to 'Configuration' pageSerhii Tsymbaliuk2019-07-261-0/+1
| | | | | | | | | | - Add 'Server Options' section to the page - Add 'IPA master capable of PKINIT' field to the 'Server Options' Ticket: https://pagure.io/freeipa/issue/7305 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Remove posixAccount from service_find search filterRob Crittenden2019-07-191-1/+0
| | | | | | | | | | | | | | This will allow cifs principals to be found. They were suppressed because they include objectclass=posixAccount. This is a bit of a historical anomaly. This was included in the filter from the initial commit (though it was person, not posixAccount). I believe it was a mistake from the beginning but it wasn't noticed because it didn't cause any obvious issues. https://pagure.io/freeipa/issue/8013 Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
* certmap rules: altSecurityIdentities should only be used for trusted domainsAlexander Bokovoy2019-07-171-0/+73
| | | | | | | | | | | IPA LDAP has no altSecurityIdentities in use, it only should apply to identities in trusted Active Directory domains. Add checks to enforce proper certmap rule attribution for specific Active Directory domains. Related: https://pagure.io/freeipa/issue/7932 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Make use of single configuration point for SELinuxStanislav Levin2019-07-011-17/+43
| | | | | | | | | | | | | | | | | | | | | For now, FreeIPA supports SELinux things as they are in RedHat/Fedora. But different distributions may have their own SELinux customizations. This moves SELinux configuration out to platform constants: - SELINUX_MCS_MAX - SELINUX_MCS_REGEX - SELINUX_MLS_MAX - SELINUX_MLS_REGEX - SELINUX_USER_REGEX - SELINUX_USERMAP_DEFAULT - SELINUX_USERMAP_ORDER and applies corresponding changes to the test code. Fixes: https://pagure.io/freeipa/issue/7996 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add SMB attributes for usersTibor Dudlák2019-07-012-2/+71
| | | | | | | | | | | | | | | SMB attributes are used by Samba domain controller when reporting details about IPA users via LSA DCE RPC calls. Based on the initial work from the external plugin: https://github.com/abbra/freeipa-user-trust-attributes Related: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Signed-off-by: Tibor Dudlák <tdudlak@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* ipaserver.plugins.service: add service-add-smb to set up an SMB serviceAlexander Bokovoy2019-06-291-2/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | SMB service has a number of predefined properties that must be set at a creation time. Thus, we provide a special command that handles all the needed changes. In addition, since SMB principal name is predefined, it is generated automatically based on the machine hostname. Since we generate the service's object primary key, its argument/option should be removed from the list of the command's arguments and options. We also remove those options that make no sense in the context of SMB service. Most controversial would probably be a lack of the authentication indicator that could be associated with the service. However, this is intended: SMB service on the domain member is used by both humans and other SMB services in the domain. Thus, it is not possible to require a specific authentication indicator to be present: automated acquisition of the credentials by a domain controller or other domain member machine accounts is based on a single factor creds and cannot be changed. Access to SMB service should be regulated on the SMB protocol level, with access controls in share ACLs. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* trust-fetch-domains: make sure we use right KDC when --server is specifiedAlexander Bokovoy2019-06-281-9/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since we are authenticating against AD DC before talking to it (by using trusted domain object's credentials), we need to override krb5.conf configuration in case --server option is specified. The context is a helper which is launched out of process with the help of oddjobd. The helper takes existing trusted domain object, uses its credentials to authenticate and then runs LSA RPC calls against that trusted domain's domain controller. Previous code directed Samba bindings to use the correct domain controller. However, if a DC visible to MIT Kerberos is not reachable, we would not be able to obtain TGT and the whole process will fail. trust_add.execute() was calling out to the D-Bus helper without passing the options (e.g. --server) so there was no chance to get that option visible by the oddjob helper. Also we need to make errors in the oddjob helper more visible to error_log. Thus, move error reporting for a normal communication up from the exception catching. Resolves: https://pagure.io/freeipa/issue/7895 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* stageuser-find: fix search with non-posix userFlorence Blanc-Renaud2019-06-251-1/+2
| | | | | | | | | | | | | | | | | ipa stageuser-find fails to return a staged user if it does not contain the posixaccount objectclass. The code is replacing the search filter (objectclass=posixaccount) with (|(objectclass=posixaccount)(objectclass=inetorgperson)) so it should work in theory. The issue is that on python2 the filter has been hexlified before reaching the stageuser plugin, hence filter.replace does not recognize the pattern (objectclass=posixaccount). The fix consists in creating the filter with a call to ldap.make_filter_from_attr() that will hexlify too, if needed. Fixes: https://pagure.io/freeipa/issue/7983 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Make use of the single configuration point for the default shellsStanislav Levin2019-06-193-4/+11
| | | | | | | | | | | | | | For now all the default shells of users and admin are hardcoded in different parts of the project. This makes it impossible to run the test suite against the setup, which has the default shell differed from '/bin/sh'. The single configuration point for the shell of users and admin is added to overcome this limitation. Fixes: https://pagure.io/freeipa/issue/7978 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Handle missing LWCA certificate or chainFraser Tweedale2019-06-181-13/+44
| | | | | | | | | | | | | | | | | | | | | If lightweight CA key replication has not completed, requests for the certificate or chain will return 404**. This can occur in normal operation, and should be a temporary condition. Detect this case and handle it by simply omitting the 'certificate' and/or 'certificate_out' fields in the response, and add a warning message to the response. Also update the client-side plugin that handles the --certificate-out option. Because the CLI will automatically print the warning message, if the expected field is missing from the response, just ignore it and continue processing. ** after the Dogtag NullPointerException gets fixed! Part of: https://pagure.io/freeipa/issue/7964 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ldap2.can_read: fix py3 compatibilityAlexander Bokovoy2019-05-281-1/+1
| | | | | | | | | As with commit b37d18288d, can_read() method does not need to decode a string in Python 3. can_read() wasn't used anywhere in the code, apparently. Related: https://pagure.io/freeipa/issue/7953 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* LDAPCreate: allow callers to override objectclassesAlexander Bokovoy2019-05-281-2/+2
| | | | | | | | | | | | | | | | | | LDAPCreate class explicitly allows use of --setattr/--addattr options to pass-in additional configuration or override some of the framework decisions. However, changes to objectclasses are ignored. We have a number of plugins where additional attributes and their values are generated at creation time. For example, ipa-sidgen plugin generates ipaNTSecurityIdentifier value on LDAP ADD operation when objectclasses include a specific object class and some other attributes (uidNumber, gidNumber) do present in the LDAP mods. Allow to override object-specific LDAP objectclasses by the --setattr/--addattr option values. Related: https://pagure.io/freeipa/issue/7953 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add knob to limit hostname lengthRob Crittenden2019-05-162-2/+29
| | | | | | | | | | | | | | | | | | | | | | On Linux systems the length limit for hostnames is hardcoded at 64 in MAXHOSTNAMELEN Solaris, for example, allows 255 characters, and DNS allows the total length to be up to 255 (with each label < 64). Add a knob to allow configuring the maximum hostname length (FQDN) The same validators are used between hosts and DNS to apply the knob only when dealing with a FQDN as a hostname. The maxlen option is included so installers can limit the length of allowed hostnames when the --hostname option is used. https://pagure.io/freeipa/issue/2018 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Adapt cert-find performance workaround for usersChristian Heimes2019-04-091-10/+15
| | | | | | | | | | | ipa cert-find --users=NAME was slow on system with lots of certificates. User certificates have CN=$username, therefore the performance tweak from ticket 7835 also works for user certificates. Related: https://pagure.io/freeipa/issue/7835 Fixes: https://pagure.io/freeipa/issue/7901 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Bypass D-BUS interface definition deficiences for trust-fetch-domainsAlexander Bokovoy2019-04-081-2/+9
| | | | | | | | | | | | | | | | | | | | | In oddjobd it is possible to pass arguments as command line or on the stdin. We use command line to pass them but the way oddjobd registers the D-BUS method signatures is by specifying all arguments as mandatory. Internally, oddjobd simply ignores if you passed less arguments than specified in the D-BUS defition. Unfortunately, it is not possible to specify less than maximum due to D-BUS seeing all arguments in the list (30 is defined for the trust-fetch-domains). To pass options, have to pad a list of arguments to maximum with empty strings and then filter out unneeded ones in the script. Option parser already removes all options from the list of arguments so all we need to do is to take our actual arguments. In case of trust-fetch-domains, it is the name of the domain so we can only care about args[0]. Fixes: https://pagure.io/freeipa/issue/7903 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* oddjob: allow to pass options to trust-fetch-domainsAlexander Bokovoy2019-04-011-5/+26
| | | | | | | | | | | | | | | Refactor com.redhat.idm.trust-fetch.domains oddjob helper to allow passing administrative credentials and a domain controller to talk to. This approach allows to avoid rediscovering a domain controller in case a user actually specified the domain controller when establishing trust. It also allows to pass through admin credentials if user decides to do so. The latter will be used later to allow updating trust topology in a similar oddjob helper. Resolves: https://pagure.io/freeipa/issue/7895 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Show a notification that sssd needs restarting after idrange-modOleg Kozlov2019-03-291-1/+8
| | | | | | | | | | | | | | If the `ipa idrange-mod` command has been used show a notification that sssd.service needs restarting. It's needed for applying changes. E.g. after setup AD trust with a domain with more than 200000 objects (the highest RID > idm's default value, 200000) users with RIDs > 200000 are not able to login, the size needs to be increased via idrange-mod, but it makes an effect only after sssd restarting. Implementation: Notification was implemented via passing `ipalib.messages.ServiceRestartRequired` to `add_message` method in `ipaserver.plugins.idrange.idrange_mod.post_callback`. Tests: Added `messages` with sssd restart required (`ipalib.messages.ServiceRestartRequired`) to cases with idrange_mod where output is expected in `ipatests.test_xmlrpc.test_range_plugin.test_range'. Fixes: https://pagure.io/freeipa/issue/7708 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Don't fail if config-show does not return serversChristian Heimes2019-03-282-2/+2
| | | | | | | | | | When uninstalling a cluster and only hidden servers are left, config-show can return a result set without ipa_master_server entry. Fixes: https://pagure.io/freeipa/issue/7892 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Don't allow to hide last server for a roleChristian Heimes2019-03-281-0/+30
| | | | | | | | | | DNSSec key master and CA renewal master can't be hidden. There must be at least one enabled server available for each role, too. Fixes: https://pagure.io/freeipa/issue/7892 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Improve config-show to show hidden serversChristian Heimes2019-03-282-13/+68
| | | | | | | | | | | | | | config-show only used to show enabled servers. Now also show hidden servers on separate lines. Additionally include information about KRA and DNS servers. The augmented config-show output makes it easier to diagnose a cluster and simplifies sanity checks. Fixes: https://pagure.io/freeipa/issue/7892 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Implement server-state --state=enabled/hiddenChristian Heimes2019-03-281-2/+56
| | | | | | | | | | | server-state modified the hidden / enabled flags of all configured services of a server. Since the command does not directly modify the server LDAP entry, the command has to be implemented as a dedicated plugin. Fixes: https://pagure.io/freeipa/issue/7892 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Add hidden replica featureChristian Heimes2019-03-281-1/+1
| | | | | | | | | | | | A hidden replica is a replica that does not advertise its services via DNS SRV records, ipa-ca DNS entry, or LDAP. Clients do not auto-select a hidden replica, but are still free to explicitly connect to it. Fixes: https://pagure.io/freeipa/issue/7892 Co-authored-by: Francois Cami <fcami@redhat.com>: Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Consolidate container_masters queriesChristian Heimes2019-03-284-76/+15
| | | | | | | | Replace manual queries of container_masters with new APIs get_masters() and is_service_enabled(). Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use api.env.container_mastersChristian Heimes2019-03-282-11/+4
| | | | | | | | Replace occurences of ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc') with api.env.container_masters. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* domainlevel-get: fix various issues when running as non-adminAlexander Bokovoy2019-03-252-8/+21
| | | | | | | | | | | | | | | | | | | | Use proper filter that is caught up by the ACI for 'permission:System: Read Domain Level' to allow any authenticated user to see the domain level. If the server doesn't have domain level set, callers in replica installer expect errors.NotFound but never get it. Return the right exception here and change the other caller to follow the same convention. Inability to retrieve ipaDomainLevel attribute due to a filter mismatch casues ipa-replica-install to fail if run as a replica host principal. Use DOMAIN_LEVEL_0 constant instead of 0 as used by the rest of the code. Fixes: https://pagure.io/freeipa/issue/7876 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* CRL generation master: new utility to enable|disableFlorence Blanc-Renaud2019-03-142-0/+111
| | | | | | | | | | | Implement a new command ipa-clrgen-manage to enable, disable, or check the status of CRL generation on the localhost. The command automates the manual steps described in the wiki https://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_Master Fixes: https://pagure.io/freeipa/issue/5803 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
* cert-request: handle missing zoneFraser Tweedale2019-03-081-3/+9
| | | | | | | | | | | | SAN IP address validation, while determining the zone for a DNS name or IP address, does not handle missing zones. The resulting dns.resolver.NoNameservers exception is not caught. As a result, InternalError is returned to client. Update cert-request IP address name validation to handle this case. Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* cert-request: more specific errors in IP address validationFraser Tweedale2019-03-041-44/+55
| | | | | | | | | | | | | | | | | | | | | | | | Update the IP address validation to raise different error messages for: - inability to reach IP address from a DNS name - missing PTR records for IP address - asymmetric PTR / forward records If multiple scenarios apply, indicate the first error (from list above). The code should now be a bit easier to follow. We first build dicts of forward and reverse DNS relationships, keyed by IP address. Then we check that entries for each iPAddressName are present in both dicts. Finally we check for PTR-A/AAAA symmetry. Update the tests to check that raised ValidationErrors indicate the expected error. Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* cert-request: report all unmatched SAN IP addressesFraser Tweedale2019-03-041-9/+12
| | | | | | | | | | | During SAN validation, it is possible that more than one iPAddressName does not match a known IP address for the DNS names in the SAN. But only one unmatched IP address is reported. Update the error message to mention all unmatched iPAddressName values. Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* cert-request: generalise _san_dnsname_ips for arbitrary cname depthFraser Tweedale2019-03-041-13/+10
| | | | | | | | | | Generalise _san_dnsname_ips to allow arbitrary cname depths. This also clarifies the code and avoids boolean blindness. Update the call site to maintain the existing behvaiour (one cname allowed). Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* cert-request: collect only qualified DNS names for IPAddress validationFraser Tweedale2019-03-041-10/+35
| | | | | | | | | | | | | | | Collect only qualified DNS names for IPAddress validation. This is necessary because it is undecidable whether the name 'ninja' refers to 'ninja.my.domain.' or 'ninja.' (assuming both exist). Remember that even a TLD can have A records. Now that we are only checking qualified names for the purpose of IPAddressName validation, remove the name length hack from _san_dnsname_ips(). Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* cert-request: restrict IPAddress SAN to host/service principalsFraser Tweedale2019-03-041-0/+7
| | | | | | Part of: https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Allow issuing certificates with IP addresses in subjectAltNameIan Pilcher2019-03-041-2/+128
| | | | | | | | | | | | | | | | Allow issuing certificates with IP addresses in the subject alternative name (SAN), if all of the following are true. * One of the DNS names in the SAN resolves to the IP address (possibly through a CNAME). * All of the DNS entries in the resolution chain are managed by this IPA instance. * The IP address has a (correct) reverse DNS entry that is managed by this IPA instance https://pagure.io/freeipa/issue/7451 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Optimize cert remove caseChristian Heimes2019-01-292-4/+11
| | | | | | | | | The cert_remove and mod subcommands for service and host now pass in the name to cert_find() to benefit from special cases. See: https://pagure.io/freeipa/issue/7835 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add workaround for slow host/service delChristian Heimes2019-01-291-0/+16
| | | | | | | | | | | | | | host-del and service-del are slow because cert revokation is implemented inefficiently. The internal cert_find() call retrieves all certificates from Dogtag. The workaround special cases service and host find without additional RA search options. A search for service and host certs limits the scope to certificate with matching subject common name. See: https://pagure.io/freeipa/issue/7835 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't use cross-origin requestStanislav Levin2019-01-161-3/+3
| | | | | | | | | | | | | | | 'Origin' for IPA login page is 'httpS://xxx'. But 'configured' link has URL like 'http://xxx/ssbrowser.html'. Since IPA web server doesn't use any kind of Access-Control-Allow-Origin rules Mozilla Firefox blocks Cross-Origin request due to the Same Origin policy violation. So, just follow the Same Origin policy. Fixes: https://pagure.io/freeipa/issue/7832 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Serhii Tsymbaliuk <stsymbal@redhat.com>
* Handle service_del with bad service nameChristian Heimes2018-12-111-1/+5
| | | | | | | | | | | | | | | | The command 'ipa service-del badservice' used to fail with an internal server error, because check_required_principal() could not handle a principal that is not a service principal. All del commands have less strict error checking of primary keys so they can reference any stored key, even illegal ones. check_required_principal() skips required principal check if the principal is not a service principal. A non-service principal can never be a required principal. Fixes: https://pagure.io/freeipa/issue/7793 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Resolve user/group names in idoverride*-findChristian Heimes2018-12-071-0/+52
| | | | | | | | | | | ipa idoverrideuser-find and ...group-find have an --anchor argument. The anchor argument used to support only anchor UUIDs like ':IPA:domain:UUID' or ':SID:S-sid'. The find commands now detect regular user or group names and translate them to anchors. Fixes: https://pagure.io/freeipa/issue/6594 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Unify and simplify LDAP service discoveryChristian Heimes2018-11-212-81/+28
| | | | | | | | | Move LDAP service discovery and service definitions from ipaserver.install to ipaserver. Simplify and unify different implementations in favor of a single implementation. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* radiusproxy: add permission for reading radius proxy serversFlorence Blanc-Renaud2018-11-131-0/+19
| | | | | | | | | | | | | | | | A non-admin user which has the "User Administrator" role cannot add a user with ipa user-add --radius=<proxy> because the call needs to read the radius proxy server entries. The fix adds a System permission for reading radius proxy server entries (all attributes except the ipatokenradiussecret). This permission is added to the already existing privileges "User Administrators" and "Stage User Administrators", so that the role "User Administrator" can call ipa [stage]user-add|mod --radius=<proxy> Fixes: https://pagure.io/freeipa/issue/7570 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa user-add: add optional objectclass for radius-usernameFlorence Blanc-Renaud2018-11-131-2/+16
| | | | | | | | | | | | | | | | | | The command "ipa user-add --radius-username" fails with ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed because it does not add the objectclass ipatokenradiusproxyuser that is required by the attribute ipatokenradiususername. The issue happens with ipa user-add / stageuser-add / user-mod / stageuser-mod. The fix adds the objectclass when needed in the pre_common_callback method of baseuser_add and baseuser_mod (ensuring that user and stageuser commands are fixed). Fixes https://pagure.io/freeipa/issue/7569 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Copy-paste error in permssions plugin, CID 323649Christian Heimes2018-11-081-1/+1
| | | | | | | | | | | | | | | | Address a bug in the code block for attributeLevelRights for old clients. The backward compatibility code for deprecated options was not triggered, because the new name was checked against wrong dict. Coverity Scan issue 323649, Copy-paste error The copied code will not have its intended effect. In postprocess_result: A copied piece of code is inconsistent with the original (CWE-398) See: Fixes: https://pagure.io/freeipa/issue/7753 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Find orphan automember rulesThomas Woerner2018-10-101-0/+59
| | | | | | | | | | | | | | | | | | | | | | If groups or hostgroups have been removed after automember rules have been created using them, then automember-rebuild, automember-add, host-add and more commands could fail. A new command has been added to the ipa tool: ipa automember-find-orphans --type={hostgroup,group} [--remove] This command retuns the list of orphan automember rules in the same way as automember-find. With the --remove option the orphan rules are also removed. The IPA API version has been increased and a test case has been added. Using ideas from a patch by: Rob Crittenden <rcritten@redhat.com> See: https://pagure.io/freeipa/issue/6476 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-051-1/+1
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
generated by cgit (git 2.34.1) at 2026-04-20 02:00:27 +0000