summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
* DNS Locations: fix update-system-records unpacking errorMartin Basti2016-07-221-2/+2
| | | | | | | | | Method IPASystemRecords.records_list_from_node returns only list consists only from record names not tuple, which caused unpacking error https://fedorahosted.org/freeipa/ticket/6117 Reviewed-By: Nikhil Dehadrai <ndehadra@redhat.com>
* help: Add dnsserver commands to help topic 'dns'David Kupka2016-07-221-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/6069 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Host-del: fix behavior of --updatedns and PTR recordsMartin Basti2016-07-221-11/+15
| | | | | | | | | | * target for ptr record must be absolute domain name * zone is detected using DNS system instead of random splitting of hostname https://fedorahosted.org/freeipa/ticket/6060 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* trust-add: handle `--all/--raw` options properlyMartin Babinsky2016-07-211-14/+27
| | | | | | | | | | `trust-add` command did not handle these options correctly often resulting in internal errors or mangled output. This patch implements a behavior which is more in-line with the rest of the API commands. https://fedorahosted.org/freeipa/ticket/6059 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* prevent search for RADIUS proxy servers by secretMartin Babinsky2016-07-211-0/+8
| | | | | | | | | radiusproxy-find should not allow search by proxy secret even for privileged users so we should hide it from CLI. https://fedorahosted.org/freeipa/ticket/6078 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* expose `--secret` option in radiusproxy-* commandsMartin Babinsky2016-07-211-1/+0
| | | | | | | | | | | Option `--secret` was hidden from radiusproxy CLI preventing setting a secret on existing server or searching by secret. Since thin client implementation it was also not recognized by the interactive prompt code in CLI frontend since it never got there. https://fedorahosted.org/freeipa/ticket/6078 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* allow 'value' output param in commands without primary keyMartin Babinsky2016-07-202-0/+5
| | | | | | | | | | | | | | | | | `PrimaryKey` output param works only for API objects that have primary keys, otherwise it expects None (nothing is associated with this param). Since the validation of command output was tightened durng thin client effort, some commands not honoring this contract began to fail output validation. A custom output was implemented for them to restore their functionality. It should however be considered as a fix for broken commands and not used further. https://fedorahosted.org/freeipa/ticket/6037 https://fedorahosted.org/freeipa/ticket/6061 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Show full error message for selinuxusermap-add-hostgroupFlorence Blanc-Renaud2016-07-201-38/+15
| | | | | | | | | | | | | | | | While investigating the issue for selinuxusermap-add-hostgroup, we discovered that other commands were missing output. A first patch fixes most of the issues: freeipa-jcholast-677-frontend-copy-command-arguments-to-output-params-on-.patch This patch fixes servicedelegation CLI, where servicedelegation.takes_params was missing ipaallowedtarget_servicedelegationtarget, ipaallowedtoimpersonate and memberprincipal https://fedorahosted.org/freeipa/ticket/6026 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Create server and host certs with DNS altnameFraser Tweedale2016-07-191-2/+6
| | | | | | | | | | | | | | Currently server (HTTP / LDAP) certs are created without a Subject Alternative Name extension during server install, replica prepare and host enrolment, a potentially problematic violation of RFC 2818. Add the hostname as a SAN dNSName when these certs are created. (Certmonger adds an appropriate request extension when renewing the certificate, so nothing needs to be done for renewal). Fixes: https://fedorahosted.org/freeipa/ticket/4970 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* DNS install: Ensure that DNS servers container existsMartin Babinsky2016-07-152-11/+23
| | | | | | | | | | | | | during DNS installation it is assumed that the cn=servers,cn=dns container is always present in LDAP backend when migrating DNS server info to LDAP. This may not always be the case (e.g. when a new replica is set up against older master) so the code must take additional steps to ensure this container is present. https://fedorahosted.org/freeipa/ticket/6083 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* schema: Fix subtopic -> topic mappingDavid Kupka2016-07-151-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/6069 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Preserve user principal aliases during rename operationMartin Babinsky2016-07-151-0/+46
| | | | | | | | | | | | | | | | When a MODRDN is performed on the user entry, the MODRDN plugin resets both krbPrincipalName and krbCanonicalName to the value constructed from uid. In doing so, hovewer, any principal aliases added to the krbPrincipalName are wiped clean. In this patch old aliases are fetched before the MODRDN operation takes place and inserted back after it is performed. This also preserves previous user logins which can be used further for authentication as aliases. https://fedorahosted.org/freeipa/ticket/6028 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* host-find: do not show SSH key by defaultMartin Basti2016-07-131-1/+0
| | | | | | | | | Only function 'remove_sshpubkey_from_output_list_post' should be used in postcallbacks of *-find, otherwise only one entry will be cleaned up https://fedorahosted.org/freeipa/ticket/6043 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* caacl: expand plugin documentationFraser Tweedale2016-07-131-6/+28
| | | | | | | | | | Expand the 'caacl' plugin documentation to explain some common confusions including the fact that CA ACLs apply to the target subject principal (not necessarily the principal requesting the cert), and the fact that CA-less CA ACL implies the 'ipa' CA. Fixes: https://fedorahosted.org/freeipa/ticket/6002 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-advise: correct handling of plugin namespace iterationMartin Babinsky2016-07-121-4/+4
| | | | | | | | | | The API object namespace iterators now yield plugin classes themselves instead of their names as strings. The method enumerating through available plugins needs to be made aware of this change. https://fedorahosted.org/freeipa/ticket/6044 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* uninstall: untrack lightweight CA certsFraser Tweedale2016-07-121-0/+6
| | | | | Fixes: https://fedorahosted.org/freeipa/ticket/6020 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix incorrect check for principal type when evaluating CA ACLsMartin Babinsky2016-07-011-1/+3
| | | | | | | | This error prevented hosts to request certificates for themselves. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow unexpiring passwordsDavid Kupka2016-07-011-1/+1
| | | | | | | | | | Treat maxlife=0 in password policy as "never expire". Delete krbPasswordExpiration in user entry when password should never expire. https://fedorahosted.org/freeipa/ticket/2795 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3Fraser Tweedale2016-07-012-4/+12
| | | | | | | | | | | | | | ipa-server-upgrade from pre-lightweight CAs version fails when Dogtag is also being upgraded from pre-lightweight CAs version, because Dogtag needs to be restarted after adding the lightweight CAs container, before requesting information about the host authority. Move the addition of the Dogtag lightweight CAs container entry a bit earlier in the upgrade procedure, ensuring restart. Fixes: https://fedorahosted.org/freeipa/ticket/6011 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix internal errors in host-add and other commands caused by DNS resolutionPetr Spacek2016-07-011-10/+3
| | | | | | | | | | | | | | | | | | Previously resolver was returning CheckedIPAddress objects. This internal server error in cases where DNS actually returned reserved IP addresses. Now the resolver is returning UnsafeIPAddress objects which do syntactic checks but do not filter IP addresses. From now on we can decide if some IP address should be accepted as-is or if it needs to be contrained to some subset of IP addresses using CheckedIPAddress class. This regression was caused by changes for https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add --cn option to cert-statusFraser Tweedale2016-07-011-8/+8
| | | | | | | | | Add the 'cacn' option to the cert-status command. Right now there is nothing we need to (or can) do with it, but we add it anyway for future use. Fixes: https://fedorahosted.org/freeipa/ticket/5999 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add widgets for kerberos aliasesPavel Vomacka2016-07-011-0/+6
| | | | | | | | Create own custom_command_multivalued_widget for kerberos aliases. https://fedorahosted.org/freeipa/ticket/5927 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Unify display of principal names/aliases across entitiesMartin Babinsky2016-07-013-6/+11
| | | | | | | | | | | | Since now users, hosts, and service all support assigning multiple principal aliases to them, the display of kerberos principal names should be consistent across all these objects. Principal aliases and canonical names will now be displayed in all add, mod, show, and find operations. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Provide API for management of host, service, and user principal aliasesMartin Babinsky2016-07-014-31/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | New commands (*-{add,remove}-principal [PKEY] [PRINCIPAL ...]) were added to manage principal aliases. 'add' commands will check the following: * the correct principal type is supplied as an alias * the principals have correct realm and the realm/alternative suffix (e.g. e-mail) do not overlap with those of trusted AD domains If the entry does not have canonical principal name, the first returned principal name will be set as one. This is mostly to smoothly operate on entries created on older servers. 'remove' commands will check that there is at least one principal alias equal to the canonical name left on the entry. See also: http://www.freeipa.org/page/V4/Kerberos_principal_aliases https://fedorahosted.org/freeipa/ticket/1365 https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make framework consider krbcanonicalname as service primary keyMartin Babinsky2016-07-011-4/+80
| | | | | | | | | | | | | | The framework does not allow single param to appear as both positional argument and option in a single command, or to represent two different positional arguments for that matter. Since principal aliases shall go to krbprincipalname attribute, the framework has to be tricked to believe krbcanonicalname is the service's primary key. The entry DN stored in LDAP remains the same. https://fedorahosted.org/freeipa/ticket/1365 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow for commands that use positional parameters to add/remove attributesMartin Babinsky2016-07-015-31/+80
| | | | | | | | | | | | | | | Commands that modify a single multivalued attribute of an entry should use positional parameters to specify both the primary key and the values to add/remove. Named options are redundant in this case. The `--certificate option` of `*-add/remove-cert` commands was turned mandatory to avoid EmptyModlist when it is omitted. https://fedorahosted.org/freeipa/ticket/3961 https://fedorahosted.org/freeipa/ticket/5413 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migrate management framework plugins to use Principal parameterMartin Babinsky2016-07-017-195/+160
| | | | | | | | | | | | All plugins will now use this parameter and common code for all operations on Kerberos principals. Additional semantic validators and normalizers were added to determine or append a correct realm so that the previous behavior is kept intact. https://fedorahosted.org/freeipa/ticket/3864 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* schema: Decrease schema TTL to one hourDavid Kupka2016-07-011-1/+4
| | | | | | | | | | Since checking schema is relatively cheap operation (one round-trip with almost no data) we can do it offten to ensure schema will fetched by client ASAP after it was updated on server. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix migration from pre-lightweight CAs masterFraser Tweedale2016-07-011-1/+30
| | | | | | | | | Some container objects are not added when migrating from a pre-lightweight CAs master, causing replica installation to fail. Make sure that the containers exist and add an explanatory comment. Fixes: https://fedorahosted.org/freeipa/ticket/5963 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Split CA replica installation steps for domain level 0Fraser Tweedale2016-07-011-1/+6
| | | | | | | | | | | Installation from replica file is broken because lightweight CA replication setup is attempted before Kerberos is set up. To fix the issue, explicitly execute step 1 before Kerberos setup, and step 2 afterwards. Part of: https://fedorahosted.org/freeipa/ticket/5963 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix minor typoYuri Chornoivan2016-07-011-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add --ca option to cert-revoke and cert-remove-holdFraser Tweedale2016-07-011-15/+32
| | | | | | | | | | | | | | Implement the --ca option for cert-revoke and cert-remove-hold. Defaults to the IPA CA. Raise NotFound if the cert with the given serial was not issued by the nominated CA. Also default the --ca option of cert-show to the IPA CA. Add commentary to cert-status to explain why it does not use the --ca option. Fixes: https://fedorahosted.org/freeipa/ticket/5999 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* service: Added permissions for auth. indicators read/modifyStanislav Laznicka2016-06-301-2/+2
| | | | | | | Added permissions for Kerberos authentication indicators reading and modifying to service objects. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* host: Added permissions for auth. indicators read/modifyStanislav Laznicka2016-06-301-1/+2
| | | | | | | | | Added permissions for Kerberos authentication indicators reading and modifying to host objects. https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* server: exclude Local commands from RPCJan Cholasta2016-06-303-10/+23
| | | | | | | | | | Local API commands are not supposed to be executed over RPC but only locally on the server. They are already excluded from API schema, exclude them also from RPC and `batch` and `json_metadata` commands. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* cert: fix CLI output of cert_remove_holdJan Cholasta2016-06-301-8/+0
| | | | | | | | | | cert_remove_hold uses output params instead of exceptions to convey unsuccessful result. Move the output params to the client side before the command is fixed to use exceptions. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* user: add object plugin for user_statusJan Cholasta2016-06-303-27/+45
| | | | | | | | | | | Change user_status from a method of user to a method of a new userstatus class, which defines the extra attributes returned by user_status. This fixes user_status CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* server: define missing virtual attributesJan Cholasta2016-06-3012-166/+147
| | | | | | | | | | | Move virtual attributes defined in output params of methods into params of the related object. This fixes the virtual attributes being ommited in CLI output. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Check for CA subject name collision before attempting creationFraser Tweedale2016-06-301-0/+7
| | | | | | | | | | Lightweight CA subject name collisions are prevented by Dogtag (response code 409 Conflict), however, we do not want to expose the Dogtag error. Perform the check in the IPA framework as well, raising DuplicateEntry on collision. Fixes: https://fedorahosted.org/freeipa/ticket/5981 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* cert-request: better error msg when 'add' not supportedFraser Tweedale2016-06-301-3/+18
| | | | | | | | | | | | cert-request supports adding service principals that don't exist. If add is requested for other principal types, the error message just says "the principal doesn't exist". Add a new error type with better error message to explain that 'add' is not supported for host or user principals. Fixes: https://fedorahosted.org/freeipa/ticket/5991 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix ipa-server-certinstall with certs signed by 3rd-party CAFlorence Blanc-Renaud2016-06-301-3/+17
| | | | | | | | | | | | | | | | | | | | | | | Multiple issues fixed: - when untracking a certificate, the path to the NSS directory must be exactly identical (no trailing /), otherwise the request is not found and the old certificate is still tracked. - when a cert is issued by a 3rd party CA, no need to track it - the server_cert should not be found using cdb.find_server_certs()[0][0] because this function can return multiple server certificates. For instance, /etc/httpd/alias contains ipaCert, Server-Cert and Signing-Cert with the trust flags u,u,u. This leads to trying to track ipaCert (which is already tracked). The workaround is looking for server certs before and after the import, and extract server-cert as the certificate in the second list but not in the first list. https://fedorahosted.org/freeipa/ticket/4785 https://fedorahosted.org/freeipa/ticket/4786 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add button for server-del commandPavel Vomacka2016-06-301-0/+4
| | | | | | WebUI counterpart of: https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Simplify the confirmation messagesPavel Vomacka2016-06-301-2/+2
| | | | | | | | | The confirmation of revoke and remove the certificate hold action is simplier and more consistent with another parts of WebUI. Part of: https://fedorahosted.org/freeipa/ticket/5381 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS: Reinitialize DNS resolver after changing resolv.confPetr Spacek2016-06-301-0/+6
| | | | | | | | | | | | | | Previously the installer did not reinitialize resolver so queries for records created using --ip-address option might not be answered. This led to incorrect results during 'Updating DNS system records' phase at the end of installation. This is kind of hack but right now we do not have enough time to extend python-dns's interface with resolver_reinit() method. https://fedorahosted.org/freeipa/ticket/5962 Reviewed-By: Martin Basti <mbasti@redhat.com>
* xmlserver: initialize RPC server plugins only in server contextJan Cholasta2016-06-301-1/+1
| | | | | | | | | | | | Do not initialize the plugins for all in-server API instances, as they are used only in the server context. This prevents code using in-server API instances from attempting to initialize the session manager. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* session: do not initialize session manager on importJan Cholasta2016-06-303-6/+19
| | | | | | | | | | Removes the side effect of attempting to connect to memcached when the session module is imported, which caused user visible warnings and/or SELinux AVC denials. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* session: move the session module from ipalib to ipaserverJan Cholasta2016-06-305-4/+1282
| | | | | | | | | The module is used only on the server, so there's no need to have it in ipalib, which is shared by client and server. https://fedorahosted.org/freeipa/ticket/5988 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add authentication identificator to host pagePavel Vomacka2016-06-301-3/+3
| | | | | | | | | | Also move strings which are connected with authentication indicators to authtype dict. This place is more general than have them in service dict. It's nicer when these strings are not used only on service page. Part of: https://fedorahosted.org/freeipa/ticket/5872 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add authentication indicators support to Host objectsNathaniel McCallum2016-06-301-1/+16
| | | | | | | https://fedorahosted.org/freeipa/ticket/433 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* cert.py split module docstring to multiple ugetext stringMartin Basti2016-06-301-37/+37
| | | | | | | | | It is hard to translate whole dosctring again and again aftear each minor change. This split will make life for translators easier. (Just note: dosctring was changed and that is the reason why I'm sending this, because translators must translate it again anyway) Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 04:32:58 +0000