summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* DNS Location: add list of roles and DNS servers to location-showMartin Basti2016-06-171-14/+25
| | | | | | | | | Add to output list of DNS servers which advertise location and list fo roles per server https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: Rename ipalocationweight to ipaserviceweightMartin Basti2016-06-172-16/+16
| | | | | | | | | Service weight explains better meaning of attribute than location weight, because location itself have no weight only services have. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: location-del: remove location recordMartin Basti2016-06-171-0/+5
| | | | | | | | Remove unused location records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: prevent to remove used locationsMartin Basti2016-06-171-5/+11
| | | | | | | | | User should be notified that location is used by IPA server(s) and deletion should be aborted. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: show warning if there is no DNS servers in locationMartin Basti2016-06-172-0/+28
| | | | | | | | | DNS servers must be in each location, otherwise DNS location without DNS server assigned will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: require to restart named-pkcs11 affter location changeMartin Basti2016-06-171-1/+6
| | | | | | | | | Send a warning message that named-pkcs11 service must be restarted after changes related to locations or server weight https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: set proper substitution variableMartin Basti2016-06-171-0/+20
| | | | | | | | | DNS Server (bind-dyndb-ldap) needs to have set 'idnsSubstitutionVariable;ipalocation' in ldap to the proper location https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS Locations: dnsserver-* commandsMartin Basti2016-06-174-56/+199
| | | | | | | | | | | | | New commands for manipulation with DNS server configuration were added: * dnsserver-show * dnsserver-mod * dnsserver-find https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: server-mod: add automatic records updateMartin Basti2016-06-171-1/+6
| | | | | | | | | For any location or server weight change is required to update records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: command dns-update-system-recordsMartin Basti2016-06-171-0/+105
| | | | | | | | | | | | | | command dns-update-system-records updates/fixes DNS records for IPA services: * updating A, AAAA records for CA * updating SRV records for LDAP, kerberos and AD trust * updating TXT record in _kerberos with proper realm * updating dns locations if used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: add ACI for template attributeMartin Basti2016-06-171-2/+5
| | | | | | | | | | | | | DNS Servers and DNS Administrators must have access to 'idnsTemplateAttribute' to be able set/read template for generating CNAME records pointing to proper location records. Also user must be able to add objectclass for idnsTemplateAttribute https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: permission: allow to read status of servicesMartin Basti2016-06-171-1/+6
| | | | | | | | | | | New permission was added: "System: Read Status of Services on IPA Servers" This permission is needed for detection which records should be created on which servers. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: DNS data managementMartin Basti2016-06-171-0/+1
| | | | | | | | | | | | Adding module that allows to work with IPA DNS system records: * getting system records * updating system records * work with DNS locations https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: fix location-delMartin Basti2016-06-171-1/+2
| | | | | | | | | The wrong option was used https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix minor typosYuri Chornoivan2016-06-162-3/+3
| | | | Reviewed-By: Petr Spacek <pspacek@redhat.com>
* schema: exclude local commandsJan Cholasta2016-06-151-8/+14
| | | | | | | | | Commands inherited from Local can't be executed remotely, so exclude them from API schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* dns, passwd: fix outputs of `dns_resolve` and `passwd` commandsJan Cholasta2016-06-152-2/+2
| | | | | | | | Use proper output type for the `value` output of the commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* batch, schema: use Dict instead of AnyJan Cholasta2016-06-152-14/+4
| | | | | | | | | Add new Dict parameter class and use it in the batch and command_defaults plugins. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Introduce "NTP server" roleMartin Babinsky2016-06-151-5/+9
| | | | | | | | | | | | | This makes IPA servers that publish their NTP services in LDAP searchable by `server-role-find` and `server-find` command. The list of active IPA NTP servers will be displayed in to output of `ipa config-show` command. https://fedorahosted.org/freeipa/ticket/5815 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: optimize forest root LDAP filterAlexander Bokovoy2016-06-151-5/+3
| | | | | | | | | | | | | | | | | | | | | | `ipa trust-find' command should only show trusted forest root domains The child domains should be visible via ipa trustdomain-find forest.root The difference between forest root (or external domain) and child domains is that root domain gets ipaIDObject class to allow assigning a POSIX ID to the object. This POSIX ID is used by Samba when an Active Directory domain controller connects as forest trusted domain object. Child domains can only talk to IPA via forest root domain, thus they don't need POSIX ID for their TDOs. This allows us a way to differentiate objects for the purpose of 'trust-find' / 'trustdomain-find' commands. Fixes https://fedorahosted.org/freeipa/ticket/5942 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Extend caacl entityPavel Vomacka2016-06-151-0/+4
| | | | | | | | | | | There is new checkbox in adding new caacl which can set whether the ACL applies on all CAs or not. Also there is a new table with CAs on which is current ACL applied. User can add and remove CAs from this table. Part of: https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend certificate entity pagePavel Vomacka2016-06-151-0/+2
| | | | | | | | | | Add field for choosing CA when issuing new certificate. Add new item to action menu on cert details page which allows user to download the certificate as file. Part of: https://fedorahosted.org/freeipa/ticket/5939 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add issuer options to cert-show and cert-findFraser Tweedale2016-06-152-0/+56
| | | | | | | | | | | | Add options to cert-show and cert-find for specifying the issuer as a DN, or a CA name. Also add the issuer DN to the output of cert-find. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update cert-request to allow specifying CAFraser Tweedale2016-06-151-3/+15
| | | | | | | | | | Add the '--ca' option to the 'ipa cert-request' command, for specifying the CA to which to direct the request. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add CA argument to ra.request_certificateFraser Tweedale2016-06-153-10/+17
| | | | | | | | | | Add the optional 'ca_id' argument to ra.request_certificate(), for passing an Authority ID to Dogtag. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update 'caacl' plugin to support lightweight CAsFraser Tweedale2016-06-152-36/+69
| | | | | | | | | | For backwards compatibility, an ACL that has no CAs and no CA category allows access to the IPA CA (host authority) only. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-152-1/+270
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add server roles on topology pagePavel Vomacka2016-06-141-0/+4
| | | | | | | | | Adds new tab on topology page which shows server roles. Also extends server details page and server config page (setting of ca renewal server). https://fedorahosted.org/freeipa/ticket/5906 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* batch command can be used to trigger internal errors on serverFlorence Blanc-Renaud2016-06-141-3/+21
| | | | | | | | | | | | | | | In ipalib, the batch command expects a specific format for arguments. The code did not check the format of the parameters, which could trigger internal errors on the server. With this fix: - a ConversionError is raised if the arg passed to batch() is not a list of dict - the result appended to the batch results is a ConversionError if the 'params' does not contain a tuple(list,dict) https://fedorahosted.org/freeipa/ticket/5810 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Server Roles: provide an API for setting CA renewal masterMartin Babinsky2016-06-131-1/+22
| | | | | | | | | | | | | `ipa config-mod` gained '--ca-renewal-master' options which can be used to set CA renewal master to a different server. Obviously, this server has to have CA role enabled. https://fedorahosted.org/freeipa/ticket/5689 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make *config-show consume relevant roles/attributesMartin Babinsky2016-06-134-4/+111
| | | | | | | | | | | | | | | | | | | | | This patch modifies config objects so that the roles/attributes relevant to the configuration are shown in the output: * config-{show,mod} will show list of all IPA masters, CA servers and CA renewal master * dnsconfig-{show,mod} will list all DNS server and DNS key master * trustconfig-{show,mod} will list all AD trust controllers and agents * vaultconfig-show will list all Key Recovery Agents http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: make server-{show,find} utilize role informationMartin Babinsky2016-06-131-4/+74
| | | | | | | | | | | | | | | server-show command will now display list of roles enabled on the master (unless `--raw` is given). server-find gained `--servroles` options which facilitate search for server having one or more enabled roles. http://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: public API for server rolesMartin Babinsky2016-06-131-0/+178
| | | | | | | | | | | | | | | | | | | This patch implements the `serverroles` API plugin which introduces the following commands: * server-role-show SERVER ROLE: show status of a single role on a server * server-role-find [--server SERVER [--role SERVROLE [--status=STATUS]]]: find role(s) SERVROLE and return their status on IPA masters. If --server option is given, the query is limited to this server. --status options filters the output by status [enabled vs. configurer vs. absent] https://fedorahosted.org/freeipa/ticket/5181 http://www.freeipa.org/page/V4/Server_Roles Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Server Roles: Backend plugin to query roles and attributesMartin Babinsky2016-06-131-0/+149
| | | | | | | | | | | | | | `serverroles` backend consumes the role/attribute instances defined in `ipaserver/servroles.py` module to provide low-level API for querying role/attribute status in the topology. This plugin shall be used to implement higher-level API commands. https://www.freeipa.org/page/V4/Server_Roles https://fedorahosted.org/freeipa/ticket/5181 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* webui: show UPN suffixes in trust propertiesAlexander Bokovoy2016-06-111-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5937 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* adtrust: support UPNs for trusted domain usersAlexander Bokovoy2016-06-111-19/+50
| | | | | | | | | | | | | | | | | | | | Add support for additional user name principal suffixes from trusted Active Directory forests. UPN suffixes are property of the forest and as such are associated with the forest root domain. FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued attribute of ipaNTTrustedDomain object class. In order to look up UPN suffixes, netr_DsRGetForestTrustInformation LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts. For more details on UPN and naming in Active Directory see https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-101-4/+0
| | | | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Part of https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Revert "adtrust: remove nttrustpartner parameter"Martin Basti2016-06-101-0/+4
| | | | | | | | | | This reverts commit 185806432d6dfccc5cdd73815471ce60a575b073. The wrong version of patch has been pushed. https://fedorahosted.org/freeipa/ticket/5354 Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: remove nttrustpartner parameterAlexander Bokovoy2016-06-101-4/+0
| | | | | | | | | | | | | MS-ADTS spec requires that TrustPartner field should be equal to the commonName (cn) of the trust. We used it a bit wrongly to express trust relationship between parent and child domains. In fact, we have parent-child relationship recorded in the DN (child domains are part of the parent domain's container). Remove the argument that was never used externally but only supplied by trust-specific code inside the IPA framework. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* trusts: Add support for an external trust to Active Directory domainAlexander Bokovoy2016-06-091-14/+47
| | | | | | | | | | | | | | | External trust is a trust that can be created between Active Directory domains that are in different forests or between an Active Directory domain. Since FreeIPA does not support non-Kerberos means of communication, external trust to Windows NT 4.0 or earlier domains is not supported. The external trust is not transitive and can be established to any domain in another forest. This means no access beyond the external domain is possible via the trust link. Resolves: https://fedorahosted.org/freeipa/ticket/5743 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* schema: fix topic command outputJan Cholasta2016-06-091-5/+11
| | | | | | | | | | Return topic names as text instead of binary blob. This fixes ipa help topic display. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-091-1/+1
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* schema: do not validate unrequested params in command_defaultsJan Cholasta2016-06-091-2/+1
| | | | | | | | | | | | Request specific params when getting the defaults instead of getting defaults for all params and filtering the result. This fixes command_defaults failing with validation errors on unrequested params. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Auth Indicators WebUI partPavel Vomacka2016-06-071-2/+9
| | | | | | | | | | Add custom_checkbox_widget on service page. The old aci.attribute_widget now inherits from the new base class custom_checkboxes_widget and overrides the populate method. https://fedorahosted.org/freeipa/ticket/5872 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Extend the certificate request dialogPavel Vomacka2016-06-061-1/+2
| | | | | | | | | The command for requesting certificate for hosts and services is extended. There is added how to add DNS name as subjectAltName. https://fedorahosted.org/freeipa/ticket/5645 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Removed dead code from LDAP{Remove,Add}ReverseMemberStanislav Laznicka2016-06-061-16/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5892 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove service and host cert issuer validationFraser Tweedale2016-06-062-8/+0
| | | | | | | | | | | When adding certifiates to a host or service entry, we currently check that the issuer matches the issuer DN of the IPA CA. Now that sub-CAs have been implemented, this check is no longer valid and will cause false negatives. Remove it and update call sites. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change 'Restore' to 'Remove Hold'Pavel Vomacka2016-06-031-4/+6
| | | | | | | | | To be consistent with CLI the restoring certificate is renamed to removing certificate hold in all WebUI components. https://fedorahosted.org/freeipa/ticket/5878 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add option to stage user from details pagePavel Vomacka2016-06-031-0/+1
| | | | | | | | Add 'stage' option to the activity dropdown menu on preserved user details page. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add ability to stage multiple usersPavel Vomacka2016-06-031-0/+3
| | | | | | | | Add 'Stage' button on search page where preserved users are listed. https://fedorahosted.org/freeipa/ticket/5371 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-06 02:06:53 +0000