summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Add a DRM to IPAalee_drm_installAde Lee2014-04-1412-297/+869
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the capability of installing a Dogtag DRM to an IPA instance. With this patch, when ipa-server-install is run, a Dogtag CA and a Dogtag DRM are created. The DRM shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. It is also possible to clone the DRM. When the IPA instance is cloned, if --enable-ca and --enable-drm are specified, the DRM is cloned as well. Installing a DRM requires the user to have a Dogtag CA instance. We can look into possibly relaxing that requirement in a later patch. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to DRM and CA installs. This will become very useful when we add more PKI subsystems. I am still working on patches for a ipa-drm-install script, which would be used to add a DRM to an existing master (that includes a dogtag CA), or an existing clone.
* Add managed read permissions to pwpolicy and cosentryPetr Viktorin2014-04-142-0/+41
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to hostPetr Viktorin2014-04-141-0/+26
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_realmdomains_plugin: Add default ACI to expected outputPetr Viktorin2014-04-111-0/+9
| | | | | | | Since realmdomains is only one entry, _show with --all will return the ACI on it. Add it to expected output. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission for SELinux user mapPetr Viktorin2014-04-111-0/+14
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to realmdomainsPetr Viktorin2014-04-111-0/+11
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to RBAC objectsPetr Viktorin2014-04-114-0/+62
| | | | | | | Add default read permissions to roles, privileges and permissions. Also add permission to read ACIs. This is required for legacy permissions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* Fix update_ca_renewal_master plugin on CA-less installs.Jan Cholasta2014-04-101-26/+53
| | | | | | | | | This also fixes updates from ancient versions of IPA which did not have automatic CA subsystem certificate renewal. https://fedorahosted.org/freeipa/ticket/4294 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add mechanism for adding default permissions to privilegesPetr Viktorin2014-04-101-0/+11
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* CA-less tests: Use sequential certificate serial numbersPetr Viktorin2014-04-101-1/+4
| | | | | | | | When serial numbers were generated with $RANDOM, there could be collisions. Use sequential numbers instead. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add managed read permission to hostgroupPetr Viktorin2014-04-091-0/+19
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to groupPetr Viktorin2014-04-091-0/+20
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to Sudo objectsPetr Viktorin2014-04-093-0/+56
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipalib.errors: Fix TaskTimeout doctestPetr Viktorin2014-04-091-1/+1
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* plugin registration refactoring for automembershipAdam Misnyovszki2014-04-091-24/+17
| | | | | | | | decorators used for plugin registration in automembership according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* automember rebuild nowait feature addedAdam Misnyovszki2014-04-096-25/+149
| | | | | | | | | | | | | | | automember-rebuild uses asynchronous 389 task, and returned success even if the task didn't run. this patch fixes this issue adding a --nowait parameter to 'ipa automember-rebuild', defaulting to False, thus when the script runs without it, it waits for the 'nstaskexitcode' attribute, which means the task has finished. Old usage can be enabled using --nowait, and returns the DN of the task for further polling. New tests added also. https://fedorahosted.org/freeipa/ticket/4239 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Allow overriding all attributes of default permissionsPetr Viktorin2014-04-091-12/+40
| | | | | | | | | | | | Allow overriding ipapermtarget, ipapermtargetfilter, ipapermlocation, objectclass of default managed permissions. This allows defining permissions that are not tied to an object type. Default values are same as before. Also, do not reset ipapermbindruletype when updating an existing managed permission. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Document the managed permission updater operationPetr Viktorin2014-04-091-0/+34
| | | | | | | | | The method was explained on the [Design] page, but as the updater is extended the design page would become obsolete. Document the operation in the docstring of the plugin itself. Design: http://www.freeipa.org/page/V3/Managed_Read_permissions#Default_Permission_Updater Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to HBAC objectsPetr Viktorin2014-04-093-0/+38
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Extend ipa-range-check DS plugin to handle range typesTomas Babej2014-04-081-40/+260
| | | | | | | | | | | | | | | | | | | | | | | | | The ipa-range-check plugin used to determine the range type depending on the value of the attributes such as RID or secondary RID base. This approached caused variety of issues since the portfolio of ID range types expanded. The patch makes sure the following rules are implemented: * No ID range pair can overlap on base ranges, with exception of two ipa-ad-trust-posix ranges belonging to the same forest * For any ID range pair of ranges belonging to the same domain: * Both ID ranges must be of the same type * For ranges of ipa-ad-trust type or ipa-local type: * Primary RID ranges can not overlap * For ranges of ipa-local type: * Primary and secondary RID ranges can not overlap * Secondary RID ranges cannot overlap For the implementation part, the plugin was extended with a domain ID to forest root domain ID mapping derivation capabilities. https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-range-check: Fix memory leaks when freeing range objectTomas Babej2014-04-081-4/+12
| | | | | | | | When cleaning the range_info struct, simple free of the struct is not enough, we have to free contents of char pointers in the struct as well. https://fedorahosted.org/freeipa/ticket/4276
* ipa-pwd-extop: Fix memory leak in ipapwd_pre_bindTomas Babej2014-04-081-0/+1
| | | | | | We need to free the entry before returning from the function. https://fedorahosted.org/freeipa/ticket/4295
* CA-less tests generate failureAdam Misnyovszki2014-04-081-0/+37
| | | | | | | | | | | CA-less test suite always generate failures when installing revoked certificates. This is a known issue, described in https://fedorahosted.org/freeipa/ticket/4270 , this fix skips these tests, outputting a warning for the later ticket. https://fedorahosted.org/freeipa/ticket/4271 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix upload of CA certificate to LDAP in CA-less install.Jan Cholasta2014-04-081-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4300 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow anonymous read access to containersPetr Viktorin2014-04-081-0/+8
| | | | | | | | | | | | | All nsContainer objects, except ones in cn=etc, can now be read anonymously. The allowed attributes are cn and objectclass. These are the same in all IPA installations so they don't provide any sensitive information. Also, $SUFFIX itself can now be read anonymously. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cacheTomas Babej2014-04-041-0/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: legacy_clients: Relax regex checksTomas Babej2014-04-041-3/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: legacy_clients: Use hostname instead of external hostname for AD ↵Tomas Babej2014-04-041-1/+1
| | | | | | subdomain Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Make sure that remnants of PKI are removedTomas Babej2014-04-041-0/+9
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add wait_for_dns option to default.conf.Petr Spacek2014-04-044-4/+241
| | | | | | | | | | | This option makes record changes in DNS tree synchronous. IPA calls will wait until new data are visible over DNS protocol or until timeout. It is intended only for testing. It should prevent tests from failing if there is bigger delay between changes in LDAP and DNS. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* freeipa.spec.in: update dependencies to 389-ds and selinux-policyAlexander Bokovoy2014-04-041-3/+3
| | | | | | | | | | | | | 389-ds-base 1.3.2.16 implements reordering of sub-plugins based on the ordering of the main plugin. We need it to make OTP working over compat tree. selinux-polic 3.12.1-135 fixes issues which prevented httpd to work with kernel keyring-based credentials caches. This change is Fedora 20+. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* schema-compat: set precedence to 49 to allow OTP binds over compat treeAlexander Bokovoy2014-04-042-0/+11
| | | | | | | | | | | | | schema-compat plugin rewrites bind DN to point to the original entry on LDAP bind operation. To work with OTP tokens this requires that schema-compat's pre-bind callback is called before pre-bind callback of the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have a nsslapd-pluginprecedence value lower than (default) 50 which is used by the ipa-pwd-extop plugin. Note that this will only work if ticket 47699 is fixed in 389-ds. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* webui-tests: binding test suitePetr Vobornik2014-04-034-2/+154
| | | | | | Add basic tests for two-way binding between a field and two widgets Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: change widget updated event into value change eventPetr Vobornik2014-04-0310-47/+38
| | | | | | | | | | This change allow us to use proper two way binding between a field and a widget. In previous implementation field was not changed if something changed the value of a widget in 'update'. Now listeners are notified when the widget value is changed by: calling 'update', 'set_value' or by user change. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: replace widget's hidden property with visiblePetr Vobornik2014-04-032-17/+39
| | | | | | | Hidden was used only in ACI. There is no reason to have two properties which are negations of each other. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: field and widget binding refactoringPetr Vobornik2014-04-0325-921/+1741
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a Web UI wide change. Fields and Widgets binding was refactored to enable proper two-way binding between them. This should allow to have one source of truth (field) for multiple consumers - widgets or something else. One of the goal is to have fields and widget implementations independent on each other. So that one could use a widget without field or use one field for multiple widgets, etc.. Basically a fields logic was split into separate components: - adapters - parsers & formatters - binder Adapters - extract data from data source (FreeIPA RPC command result) - prepares them for commands. Parsers - parse extracted data to format expected by field - parse widget value to format expected by field Formatters - format field value to format suitable for widgets - format field value to format suitable for adapter Binder - is a communication bridge between field and widget - listens to field's and widget's events and call appropriate methods Some side benefits: - better validation reporting in multivalued widget Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Make ipa-client-automount backwards compatibleMartin Kosek2014-04-021-1/+6
| | | | | | | | | | | | | | ipa-client-automount calls automountlocation-show command during the process. Unfortunately, FreeIPA commands are forward compatible only and thus fail the installer. Similarly to ipa-client-install, call XML-RPC interface directly with version fixed to 2.0 (command was already available at that version) to fix the failure. https://fedorahosted.org/freeipa/ticket/4290 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Extending user plugin with inetOrgPerson fieldsAdam Misnyovszki2014-03-285-11/+136
| | | | | | | | | | | | | | | According to http://tools.ietf.org/html/rfc2798 ipa client and web ui extended with inetOrgPerson fields: - employeenumber - employeetype - preferredlanguage - departmentnumber carlicenseplate is now multivalued https://fedorahosted.org/freeipa/ticket/4165 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Add requires for pki-core-10.1.1-1.fc20Martin Kosek2014-03-281-1/+1
| | | | | | Fixes PKI installation errors on Fedora 20. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui: replace IPA.command usage with rpc.commandPetr Vobornik2014-03-2725-168/+189
| | | | | | | Replace all IPA.command, IPA.batch_command and IPA.concurrent_command usages by equivalents from rpc module. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: move RPC code from IPA module to its own modulePetr Vobornik2014-03-272-884/+930
| | | | | | | | - moves RPC code from ipa.js to it's own module - part of ongoing effort where the ultimate goal is to get rid of ipa.js and IPA namespace Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: make navigation module independent on app modulePetr Vobornik2014-03-274-109/+122
| | | | | | | | | | | | When some module used 'freeipa/navigation' it pulled the entire Web UI because navigation depended on app. This patch splits the app into two modules: app and app_container. App specifies the entities which are part of final application. app_container module represents the application boot classes. Navigation now depends on app_container. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add missing dependencies to freeipa-python packageMartin Kosek2014-03-261-1/+2
| | | | | | | | | python-pyasn1 and python-qrcode were imported by ipalib but not required by python subpackage. https://fedorahosted.org/freeipa/ticket/4275 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Do not depend on the case of the attributes when testing ID rangesTomas Babej2014-03-261-4/+11
| | | | | | | | | In test_trust.py, several tests did case sensitive search on the output of the ipa idrange-show command. This could cause false negatives. Part of: https://fedorahosted.org/freeipa/ticket/4267 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui: rename domNode to dom_nodePetr Vobornik2014-03-265-39/+39
| | | | | | - unites domNode and dom_node usage to dom_node Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Remove unused method is_master of CAInstance.Jan Cholasta2014-03-251-15/+0
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Support exporting CSRs in dogtag-ipa-ca-renew-agent.Jan Cholasta2014-03-251-0/+27
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Update certmonger configuration in ipa-upgradeconfig.Jan Cholasta2014-03-251-57/+90
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Use the same certmonger configuration for both CA masters and clones.Jan Cholasta2014-03-252-102/+48
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Merge restart_httpd functionality to renew_ra_cert.Jan Cholasta2014-03-252-10/+12
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-05 23:45:35 +0000