summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Become IPA 2.2.0release-2-2-0Rob Crittenden2012-05-021-3/+3
|
* Update hostname validator error messages in testsPetr Viktorin2012-05-033-7/+8
| | | | | A recent patch changed the error message from the hostname validator. Update the tests to reflect this change.
* Make ipa 2.2 client capable of joining an older serverMartin Kosek2012-05-011-2/+24
| | | | | | | | | | | | | | | | | IPA server of version 2.2 and higher supports Kerberos S4U2Proxy delegation, i.e. ipa command no longer forwards Kerberos TGT to the server during authentication. However, when IPA client of version 2.2 and higher tries to join an older IPA server, the installer crashes because the pre-2.2 server expects the TGT to be forwarded. This patch adds a fallback to ipa-client-install which would detect this situation and tries connecting with TGT forwarding enabled again. User is informed about this incompatibility. Missing realm was also added to keytab kinit as it was reported to fix occasional install issues. https://fedorahosted.org/freeipa/ticket/2697
* Set the "KerberosAuthentication" option in sshd_config to "no" instead of "yes".Jan Cholasta2012-04-291-1/+1
| | | | | | Setting it to "yes" causes sshd to handle kinits itself, bypassing SSSD. ticket 2689
* Improve error message in zonemgr validatorMartin Kosek2012-04-291-18/+22
| | | | | | | | | This patch consolidates zonemgr function to move the most of the checks to common functions in order to provide consistent output. The error messages produced by the validator should now be more helpful when identifying the source of error. https://fedorahosted.org/freeipa/ticket/1966
* Revert "Validate attributes in permission-add"Rob Crittenden2012-04-292-121/+0
| | | | | | | | This reverts commit 1356988b7a40a60af39807db143860efb4a2f435. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Revert "Search allowed attributes in superior objectclasses"Rob Crittenden2012-04-292-38/+0
| | | | | | | | This reverts commit a58cbb985ec007c0ef83010b32408efb2f4784d2. We are going to take another approach to this. Instead of erroring out on attributes that don't seem to be allowed we are going to eventually return a warning.
* Paging disable for password policiesPetr Vobornik2012-04-261-1/+3
| | | | | | | | | | Password policies are sorted by priority. When paging is enabled, table facet uses pwpolicy-find --pkey-only to get all pwpolicies keys. Those keys are sorted on server by priority but table facet sorts them again. This breaks the priority sorting. This patch disables the paging in passord policy serch page so the keys are sorted by priority. TODO: we should inspect sorting in table facet more deeply and disable it if it don't break anything. https://fedorahosted.org/freeipa/ticket/2676
* Additional tests for pwpolicyPetr Viktorin2012-04-261-1/+34
| | | | | | | Test that `pwpolicy_find --pkey-only` works as expected Test that deleting a group removes its password policy Rename the test module to be consistent with other plugin tests.
* Sort password policies properly with --pkey-onlyMartin Kosek2012-04-262-12/+31
| | | | | | | | | | | | | | | | | | | | | | Password policy plugin sorts password policies by its COS priority. However, when the pwpolicy-find command is run with --pkey-only, the resulting entries do not contain COS priority and the sort function crashes. This patch makes sure that cospriority is present in the time of the result sorting process and removes the cospriority again when the sorting is done. This way, the entries are sorted properly both with and without --pkey-only flag. Previous entries_sortfn member attribute of LDAPSearch class containing custom user sorting function was replaced just with a flag indicating if a sorting in LDAPSearch shall be done at all. This change makes it possible to sort entries in a custom post_callback which is much more powerful (and essential for sorting like in pwpolicy plugin) approach than a plain sorting function. https://fedorahosted.org/freeipa/ticket/2676
* Update docs for user-status, always show disabled, time for each server.Rob Crittenden2012-04-231-2/+31
| | | | | | | | | | | | Provide some guidance on how to read and understand the output. Some manual work is needed to identify which master the user is locked on. Always display the enabled/disabled status. Include the time that the master was contacted in the output for each master as lockout is very time sensitive. https://fedorahosted.org/freeipa/ticket/2162
* Use mixed-case for Read DNS Entries permissionRob Crittenden2012-04-232-6/+6
| | | | https://fedorahosted.org/freeipa/ticket/2569
* Fix help of --hostname option in ipa-client-installMartin Kosek2012-04-191-1/+1
| | | | | | | | Replace word "server" with "machine" to clearly distinguish between IPA server and other machines (clients) and to also match the help with ipa-client-install man pages. https://fedorahosted.org/freeipa/ticket/1967
* Fix name error in hbactestJohn Dennis2012-04-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Ticket #2512 In hbactest.py there is a name error wrapped inside a try/except block that ignores all errors so the code block exits prematurely leaving a critical variable uninitialized. The name error is the result of a cut-n-paste error that references a variable that had never been initialized in the scope of the code block. Python generates an exception when this variable is referenced but because it's wrapped in a try/except block that catches all errors and ignores all errors there is no evidence that something went wrong. The fix is to use the correct variables. At some point we may want to revist if ignoring all errors and proceding as if nothing happened is actually correct. Alexander tells me this mimics what SSSD does in the hbac rule processing, thus the ignoring of errors is intentional. But in a plugin whose purpose is to test and exercise hbac rules I'm not sure ignoring all errors is really the right behavior.
* Added permission field to delegationPetr Vobornik2012-04-171-0/+11
| | | | | | | | | | Permission field is missing in delegation so it can't be set/modified. It was added to delegation details facet and adder dialog. The field is using checkboxes instead of multivalued textbox because it can have only two effective values: 'read' and 'write'. https://fedorahosted.org/freeipa/ticket/2635
* Fix internal error when renaming user with an empty string.Jan Cholasta2012-04-181-1/+1
| | | | ticket 2629
* Do not fail migration because of duplicate groupsMartin Kosek2012-04-171-1/+6
| | | | | | | | | | | When 2 groups in a remote LDAP server share the same GID number, the migration may fail entirely with incomprehensible message. This should not be taken as unrecoverable error - GID number check is just a sanity check, a warning is enough. This patch also makes sure that GID check warnings include a user name to make an investigation easier. https://fedorahosted.org/freeipa/ticket/2644
* Raise proper exception when LDAP limits are exceededMartin Kosek2012-04-162-6/+20
| | | | | | | | | | | | | | | | | | | ldap2 plugin returns NotFound error for find_entries/get_entry queries when the server did not manage to return an entry due to time limits. This may be confusing for user when the entry he searches actually exists. This patch fixes the behavior in ldap2 plugin to 1) Return even a zero search results + truncated bool set in ldap2.find_entries 2) Raise LimitsExceeded in ldap2.get_entry and ldap2.find_entry_by_attr instead of NotFound error This changed several assumptions about ldap2.find_entries results. Several calls accross IPA code base had to be amended. https://fedorahosted.org/freeipa/ticket/2606
* don't append basedn to container if it is includedJohn Dennis2012-04-161-2/+8
| | | | | | | | | | | ticket #2566 When specifying a container to ds-migrate we should not automatically append the basedn if it is provided by the end-user. This is easy to detect using DN objects because DN objects have a endswith() method which can easily and correctly ascertain if a base already exists.
* User is notified that password needs to be reset in forms-based loginPetr Vobornik2012-04-163-17/+67
| | | | | | | | Forms-based login procedure detects if 401 unauthorized response contains 'X-IPA-Rejection-Reason' http header with 'password-expired' value. If so it displays an error message that user needs to reset his password. https://fedorahosted.org/freeipa/ticket/2608
* Return consistent expiration message for forms-based loginRob Crittenden2012-04-162-4/+42
| | | | | | | | | | | | | | We need to inform users when a forms-based login fails due to the password needing to be reset. Currently there is no way to distinguish a reset case vs an incorrect password. This will bind the user using a simple LDAP bind over ldapi (by default) and if that is successful, check the expiration date against the current time. The UI portion of this that uses this message will come later. https://fedorahosted.org/freeipa/ticket/2608
* Fix empty external member processingOndrej Hamada2012-04-171-1/+1
| | | | | | | Validation of external member was failing for empty strings because of wrong condition. https://fedorahosted.org/freeipa/ticket/2447
* Fix DNS and permissions unit testsMartin Kosek2012-04-172-3/+3
| | | | | Amend unit tests to match the latest changes in DNS (tickets 2627, 2628) and hardened exception error message checks.
* Remove the running state when uninstalling DS instances.Rob Crittenden2012-04-172-0/+6
| | | | | | | | We don't need to do anything with the state but if it exists in the sysrestore index at the end of uninstallation the uninstaller will complain about it. https://fedorahosted.org/freeipa/ticket/2637
* Fix dnsrecord_add interactive modeMartin Kosek2012-04-152-1/+50
| | | | | | | | | | dnsrecord_add interactive mode did not work correctly when more than one DNS record part was entered as command line option. It asked for remaining options more than once. This patch fixes this situation and also adds tests to cover this use case properly. https://fedorahosted.org/freeipa/ticket/2641
* Return correct record name in DNS pluginMartin Kosek2012-04-161-0/+6
| | | | | | | | | | | | | | When dnsrecord-add or dnsrecord-mod commands are used on a root zone record (it has a special name "@"), a zone name is returned instead of a special name "@". This confuses DNS part of Web UI which is then not able to manipulate records in the root zone when these commands are used. This patch fixes these 2 commands to return correct value when a root zone is modified. https://fedorahosted.org/freeipa/ticket/2627 https://fedorahosted.org/freeipa/ticket/2628
* Validate DN & RDN parameters for migrate commandJohn Dennis2012-04-163-10/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2555 We were generating a traceback (server error) if a malformed RDN was passed as a parameter to the migrate command. * add parameter validation functions validate_dn_param() and validate_rdn_param() to ipalib.util. Those functions simply invoke the DN or RDN constructor from our dn module passing it the string representation. If the constructor does not throw an error it's valid. * Add the parameter validation function pointers to the Param objects in the migrate command. * Make the usercontainer and groupcontainer parameters required. passing --usercontainer= on the command line will produce ipa: ERROR: 'user_container' is required * Fix _get_search_bases() so if a container dn is empty it it just uses the base dn alone instead of faulting (currently bullet-proofing because now the containers are required). * Update the doc for usercontainer and groupcontainer to reflect the fact they are DN's not RDN's. A RDN can only be one level and it should be possible to have a container more than one RDN removed from the base.
* Document the 'nonempty' flagPetr Viktorin2012-04-131-0/+6
| | | | Missing documentation for commit 7cfc16c/c6e4372
* Unable to rename permission objectOndrej Hamada2012-04-112-12/+52
| | | | | | | The update was failing because of the case insensitivity of permission object DN. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2571
* Pass make-test arguments through to NosePetr Viktorin2012-04-111-28/+6
| | | | | | | | | | | Currently, our test script forwards a select few command line arguments to nosetests. This patch removes the filtering, passing all arguments through. This allows things like disabling output redirection (--nocapture), dropping into a debugger (--pdb, --pdb-failures), coverage reporting (--with-cover, if installed), etc. https://fedorahosted.org/freeipa/ticket/2135
* Remove pattern_errmsg from API.txtPetr Viktorin2012-04-122-53/+54
| | | | https://fedorahosted.org/freeipa/ticket/2619
* Fix expected error messages in testsPetr Viktorin2012-04-1020-183/+338
| | | | | | | | | | | | | | | | | Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
* text unit test should validate using installed mo fileJohn Dennis2012-04-103-147/+228
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use custom gettext classes (e.g. GettextFactory & NGettextFactory). We should exercise those classes with an installed binary mo file to demonstrate we are actually returning the expected translated strings for all strings defined as being translatable. The test logic in install/po/test_i18n.py was recently enhanced to make this type of testing easier and more complete. tests/test_ipalib/test_text.py should import the new i18n test support and run it. Previously tests/test_ipalib/test_text.py made a feeble but incomplete attempt to do the above but even that was often not run because the test would skip because the necessary test files were not available unless they had been manually created in the install/po subdir. It is now possible to correct those deficiencies in the test. This patch does the following: * Moves the location of i18n test code and adjust references to it. install/po/test_i18n.py was moved to tests/i18n.py. This permits tests/test_ipalib/test_text.py to import the i18n test utilities in a clean fashion. The Makefile in install/po now calls this same file. * Modfies test function in test_i18n.py to accept function pointers for retreiving a translation. * Imports test_i18n.py from the install/po directory in the tree * Creates a tmp directory for the test localedir * Parses the current ipa.pot file in install/po and generates a test po and mo file with special unicode markers. It installs the test mo file in the tmp localedir. This is accomplished by calling create_po() from the test_i18n.py file. * If any of the above does not work it raises nose.SkipTest with the reason, and skips the test. * It sets up functions to get a translation and a plural translation via our text.GettextFactory class and text.NGettextFactory class respectively. This are the functions we use intenally to get translations. It set the localdir and lang which are used by those classes to match our test configuration. It then runs a validation test on every translation and it's plural found in the test.po file by calling po_file_iterate and passed it the function pointers to our internal routines. * At the conclusion of the test it cleans up after itself. Note: extraneous files are not created in the tree, only a tmp directory is utilized. Validating msgid's in C code was insufficient. * Make the discovery of format conversions much more robust by authoring a new function parse_printf_fmt() that is able to discover each format conversion in a string and break it into it's individual subparts. One of those subparts is the argument selector index. In c code we need to know if the argumenet selector index is present to know if translator can reorder the substitution strings. This replaces the simplistic python_anonymous_substitutions_regexp which was insufficient to deal with other programming languages (e.g. c). * Add get_prog_langs() function to return the set of programming languages a msgid appears in. This is necessar because the msdid validation is programming language specific. https://fedorahosted.org/freeipa/ticket/2582
* Use indexed format specifiers in i18n stringsJohn Dennis2012-04-103-16/+16
| | | | | | | | | | Translators need to reorder messages to suit the needs of the target language. The conventional positional format specifiers (e.g. %s %d) do not permit reordering because their order is tied to the ordering of the arguments to the printf function. The fix is to use indexed format specifiers. https://fedorahosted.org/freeipa/ticket/2596
* Configure certmonger to execute restart scripts on renewal.Rob Crittenden2012-04-1011-10/+73
| | | | | | | | certmonger now has the ability to execute a script when it renews a certificate. This can be used to automatically restart servers so the certificate doesn't expire in the running server. https://fedorahosted.org/freeipa/ticket/2050
* Removal of memberofindirect_permissons from privilegesPetr Vobornik2012-04-091-4/+1
| | | | | | | | | | | | | Problem: In the Privilege page, can list Permissions. This "Shows Results" for "Direct Membership". But there is an option to list this for "Indirect Membership" also. There isn't a way to nest permissions, so this option is not needed. Solution: This patch removes the memberofindirect_persmission definition from server plugin. It fixes the problem in Web UI. https://fedorahosted.org/freeipa/ticket/2611
* Convert --setattr values for attributes marked no_updatePetr Viktorin2012-04-094-4/+32
| | | | | | | | | | | | | Attribute Patrams marked no_update never get cloned to Update commands, and thus never receive the `attribute` flag. This makes their `encode` method a no-op, which meant they don't get properly encoded when used with --setattr, making the --setattr fail. Introduce a `force` argument to encode, which overrides checking for the attribute flag. Use this in set/add/delattr normalization, where we know we are dealing with attributes. https://fedorahosted.org/freeipa/ticket/2616
* Limit permission and selfservice names to alphanumerics, -, _, spacePetr Viktorin2012-04-096-14/+46
| | | | | | | | The DN and ACI code doesn't always escape special characters properly. Rather than trying to fix it, this patch takes the easy way out and enforces that the names are safe. https://fedorahosted.org/freeipa/ticket/2585
* Dereference pointer when comparing password history in qsort compare.Rob Crittenden2012-04-101-1/+1
| | | | | | | | | | | | The man page for qsort(3) says that the comparison function is called with pointers to pointers to char but memcmp(3) wants a pointer to void so we need to cast and dereference. Without this the qsort() call wasn't properly sorting the elements so a random password was being removed rather than the oldest when the list overflowed. https://fedorahosted.org/freeipa/ticket/2613
* Removed mutex option from checkboxesPetr Vobornik2012-04-101-10/+0
| | | | | | Mutually exclusive checkboxes were unusual. They are not in use anymore. The functionality is removed. https://fedorahosted.org/freeipa/ticket/2599
* DNS forward policy: checkboxes changed to radio buttonsPetr Vobornik2012-04-104-14/+41
| | | | | | | | DNS forward policy fields were using mutually exclusive checkboxes. Such behavior is unusual for users. Checkboxes were changed to radios. https://fedorahosted.org/freeipa/ticket/2599
* Added attrs field to permission for target=subtreePetr Vobornik2012-04-102-1/+4
| | | | | | | | Permission form was missing attrs field for target=subtree. All other target types have it. It uses multivalued text widget, same as filter, because we can't predict the target type. https://fedorahosted.org/freeipa/ticket/2592
* Fixed: permission attrs table didn't update its available options on loadPetr Vobornik2012-04-101-1/+11
| | | | | | It could lead to state where attributes from other object type were displayed instead of the correct ones. https://fedorahosted.org/freeipa/ticket/2590
* Reworked netgroup Web UI to allow setting user/host categoryPetr Vobornik2012-04-103-32/+265
| | | | | | | | This patch is changing netgroup web ui to look more like hbac or sudo rule UI. This change allows to define and display user category, host category and external host. The core of the change is changing member attributes (user, group, host, hostgroup) to use rule_details_widget instead of separate association facets. In host case it allows to display and add external hosts. https://fedorahosted.org/freeipa/ticket/2578
* Fix installation when server hostname is not in a default domainMartin Kosek2012-04-083-13/+40
| | | | | | | | | | | | | | | | | | | When IPA server is configured with DNS and its hostname is not located in a default domain, SRV records are not valid. Additionally, httpd does not serve XMLRPC interface because it IPA server domain-realm mapping is missing in krb5.conf. All CLI commands were then failing. This patch amends this configuration. It fixes SRV records in served domain to include full FQDN instead of relative hostname when the IPA server hostname is not located in served domain. IPA server forward record is also placed to correct zone. When IPA server is not in a served domain a proper domain-realm mapping is configured to krb5.conf. The template was improved in order to be able to hold this information. https://fedorahosted.org/freeipa/ticket/2602
* Check configured maximum user login length on user rename.Jan Cholasta2012-04-082-0/+17
| | | | ticket 2587
* Return consistent value when hostcat and usercat is all.Rob Crittenden2012-04-084-2/+15
| | | | | | | | | | We were returning '' for the first entry when hostcat and usercat were set to all. All subsequent entries were padded with - which effectively denied access. This requires slapi-nis 0.40+ https://fedorahosted.org/freeipa/ticket/2192
* Confusing default user groupsOndrej Hamada2012-04-052-18/+23
| | | | | | | Added 'fallback' into the labels for default automember group and hostgroup. https://fedorahosted.org/freeipa/ticket/2354
* Add missing comma to list of services that cannot be disabled.Rob Crittenden2012-04-051-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2487
* improve handling of ds instances during uninstallJohn Dennis2012-04-042-14/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2502 * remove the "running" flag from backup_state in cainstance.py and dsinstance.py because it does not provide the correct information. In cainstance the running flag was never referenced because restarting dirsrv instances occurs later in dsinstance. In dsinstance when the running flag is set it incorrectly identifed the PKI ds instance configured earlier by cainstance. The intent was to determine if there were any ds instances other than those owned by IPA which will need to be restarted upon uninstall. Clearly the PKI ds instance does not qualify. We were generating a traceback when at the conclusion of dsinstance.uninstall we tried to start the remaining ds instances as indicated by the running flag, but there were none to restart (because the running flag had been set as a consequence of the PKI ds instance). * We only want to restart ds instances if there are other ds instances besides those owned by IPA. We shouldn't be stopping all ds instances either, but that's going to be covered by another ticket. The fix for restarting other ds instances at the end of uninstall is to check and see if there are other ds instances remaining after we've removed ours, if so we restart them. Also it's irrelevant if those ds instances were not present when we installed, it only matters if they exist after we restore things during uninstall. If they are present we have to start them back up because we shut them down during uninstall. * Add new function get_ds_instances() which returns a list of existing ds instances. * fixed error messages that incorrectly stated it "failed to restart" a ds instance when it should be "failed to create".
generated by cgit (git 2.34.1) at 2024-06-07 22:18:05 +0000