summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* webui: fix OTP Token add regressionPetr Vobornik2014-04-171-1/+1
| | | | | | | | | | | | OTP Token add failed because of invalid function call. qr_widget doesn't contain `on_value_changed` method since it inherits from `IPA.widget` and not from `IPA.input_widget`. Emitting the event was preserved for future possible usage. https://fedorahosted.org/freeipa/ticket/4306 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipatests: Fix incorrect UID/GID reference for subdomain users and groupsTomas Babej2014-04-171-4/+8
| | | | | | | | | In legacy client integration test, the test cases that query information from subdomain about subdomain users and group expected subdomain users and groups to have the UIDs/GIDs as users and groups in the root domain. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Allow using FQDN with trailing dot as final hostnameTomas Babej2014-04-171-1/+5
| | | | | | | | | | | | | | | When creating a BaseHost instance, the machine's hostname was reconfigured to have the same shortname prepended the domain name of the domain where it was defined. However, it makes sense in certain use cases to define hosts that have hostnames other than belonging directly in the domain they were defined in. Treat input hostnames with trailing dots as static FQDNs that will not be changed by the name of the domain they were defined in. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: tasks: Accept extra arguments when installing clientTomas Babej2014-04-171-2/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Fix apache semaphores prior to installing IPA serverTomas Babej2014-04-171-0/+14
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* CI - test_forced_client_reenrollment stability fixAdam Misnyovszki2014-04-171-0/+4
| | | | | | | | fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19 https://fedorahosted.org/freeipa/ticket/4298 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Add managed read permissions to automemberPetr Viktorin2014-04-172-0/+36
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Do not ask for memberindirect when updating managed permissionsPetr Viktorin2014-04-171-1/+2
| | | | | | | | | | | | | One of the default_attributes of permission is memberofindirect, a virtual attribute manufactured by ldap2, which is set when a permission is part of a role. When update_entry is called on an entry with memberofindirect, ipaldap tries to add the attribute to LDAP and fails with an objectclass violation. Do not ask for memberindirect when retrieving the entry. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission to automountPetr Viktorin2014-04-171-0/+15
| | | | | | | | | A single permission is added to cover automountlocation, automountmap, and automountkey. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission to idrangePetr Viktorin2014-04-161-0/+13
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Allow anonymous read access to Kerberos containersPetr Viktorin2014-04-161-0/+4
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to krbtpolicyPetr Viktorin2014-04-163-5/+81
| | | | | | | | | | | | Unlike other objects, the ticket policy is stored in different subtrees: global policy in cn=kerberos and per-user policy in cn=users,cn=accounts. Add two permissions, one for each location. Also, modify tests so that adding new permissions in cn=users doesn't cause failures. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* webui: remove IPA.unauthorized_dialogPetr Vobornik2014-04-152-469/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-ci: adapt to new login screenPetr Vobornik2014-04-151-15/+17
| | | | | | https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: fix combobox styles to work with selenium testingPetr Vobornik2014-04-152-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: use asynchronous call for authenticationPetr Vobornik2014-04-153-38/+57
| | | | | | | | | | | | | | Change `IPA.login_password` and `IPA.get_credentials` to use async AJAX and to return promise instead of blocking the code. IPA.get_credentials is still partially blocking because of negotiate process. We can't do anything about that. It allows activity indicators to do their job. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: authentication modulePetr Vobornik2014-04-155-54/+317
| | | | | | | | General purpose authentication interface and state. See doc of 'freeipa/auth' module. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: login pagePetr Vobornik2014-04-155-2/+101
| | | | | | | | A facet with login sreen widget. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: login screen widgetPetr Vobornik2014-04-159-2/+723
| | | | | | | | | | | | | | | | | | Reimplementation of unauthorized dialog into separate widget. It uses RCUE design. New features compared to unauthorized dialog: - reflects auth methods from `auth` module - validation summary - differentiates Kerberos auth failure with session expiration - Caps Lock warning - form based method doesn't allow password only submission https://fedorahosted.org/freeipa/ticket/4017 https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: validation summary widgetPetr Vobornik2014-04-152-0/+91
| | | | | | | | A widget which aggregates warnings and errors and shows them on one place. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: load pagePetr Vobornik2014-04-156-7/+110
| | | | | | | | | | Load page is a simple facet which is displayed up to 'runtime' phase. On application start it tells the user that there is ongoing activity. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: publish network activity topicsPetr Vobornik2014-04-151-1/+7
| | | | | | | | | Network activity is now published through global topics. It allows other components like activity_widget to listen to them. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: activity widgetPetr Vobornik2014-04-153-2/+120
| | | | | | | | | | | | A widget for showing ongoing activity. Displays a text with changing dots. It listens to `network-activity-start` and `network-activity-end` topics. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: standalone facetPetr Vobornik2014-04-156-2/+355
| | | | | | | | | | `facet.Facet` is a new base class for facets. It doesn't have any dependencies on entities so it's usable for general purpose facets, e.g., future API browser, load facet or login facet. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: ContainerMixinPetr Vobornik2014-04-151-0/+154
| | | | | | | | | | | | | A mixin which implements widget storing logic. Similar logic is already implemented in details facet and dialog. Long term goal is to replace that with this one. Separating the logic into mixin makes it usable in other components. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: FormMixinPetr Vobornik2014-04-153-2/+207
| | | | | | | | | | | | | | a mixin used for fields validation. Basically implements a logic which is already in details facet and dialog. Now this logic can be used in any component. The long term goal is to replace the logic in details facet and dialog with this mixin. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: facet containerPetr Vobornik2014-04-155-14/+159
| | | | | | | | | | | A widget which servers as container for facets. FacetContainer is a base class. App is specialization. Doing this abstraction will allow us to implement various facet containers. https://fedorahosted.org/freeipa/ticket/3903 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add managed read permission to configPetr Viktorin2014-04-151-0/+22
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix expected output in permission testsPetr Viktorin2014-04-152-4/+14
| | | | | | | There is now a second permission affecting krbMinPwdLife. Add it to expected output. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to pwpolicy and cosentryPetr Viktorin2014-04-142-0/+41
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to hostPetr Viktorin2014-04-141-0/+26
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_realmdomains_plugin: Add default ACI to expected outputPetr Viktorin2014-04-111-0/+9
| | | | | | | Since realmdomains is only one entry, _show with --all will return the ACI on it. Add it to expected output. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission for SELinux user mapPetr Viktorin2014-04-111-0/+14
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to realmdomainsPetr Viktorin2014-04-111-0/+11
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to RBAC objectsPetr Viktorin2014-04-114-0/+62
| | | | | | | Add default read permissions to roles, privileges and permissions. Also add permission to read ACIs. This is required for legacy permissions. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
* Fix update_ca_renewal_master plugin on CA-less installs.Jan Cholasta2014-04-101-26/+53
| | | | | | | | | This also fixes updates from ancient versions of IPA which did not have automatic CA subsystem certificate renewal. https://fedorahosted.org/freeipa/ticket/4294 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add mechanism for adding default permissions to privilegesPetr Viktorin2014-04-101-0/+11
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* CA-less tests: Use sequential certificate serial numbersPetr Viktorin2014-04-101-1/+4
| | | | | | | | When serial numbers were generated with $RANDOM, there could be collisions. Use sequential numbers instead. Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Add managed read permission to hostgroupPetr Viktorin2014-04-091-0/+19
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to groupPetr Viktorin2014-04-091-0/+20
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to Sudo objectsPetr Viktorin2014-04-093-0/+56
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/1313 and: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipalib.errors: Fix TaskTimeout doctestPetr Viktorin2014-04-091-1/+1
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* plugin registration refactoring for automembershipAdam Misnyovszki2014-04-091-24/+17
| | | | | | | | decorators used for plugin registration in automembership according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* automember rebuild nowait feature addedAdam Misnyovszki2014-04-096-25/+149
| | | | | | | | | | | | | | | automember-rebuild uses asynchronous 389 task, and returned success even if the task didn't run. this patch fixes this issue adding a --nowait parameter to 'ipa automember-rebuild', defaulting to False, thus when the script runs without it, it waits for the 'nstaskexitcode' attribute, which means the task has finished. Old usage can be enabled using --nowait, and returns the DN of the task for further polling. New tests added also. https://fedorahosted.org/freeipa/ticket/4239 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Allow overriding all attributes of default permissionsPetr Viktorin2014-04-091-12/+40
| | | | | | | | | | | | Allow overriding ipapermtarget, ipapermtargetfilter, ipapermlocation, objectclass of default managed permissions. This allows defining permissions that are not tied to an object type. Default values are same as before. Also, do not reset ipapermbindruletype when updating an existing managed permission. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Document the managed permission updater operationPetr Viktorin2014-04-091-0/+34
| | | | | | | | | The method was explained on the [Design] page, but as the updater is extended the design page would become obsolete. Document the operation in the docstring of the plugin itself. Design: http://www.freeipa.org/page/V3/Managed_Read_permissions#Default_Permission_Updater Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to HBAC objectsPetr Viktorin2014-04-093-0/+38
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Extend ipa-range-check DS plugin to handle range typesTomas Babej2014-04-081-40/+260
| | | | | | | | | | | | | | | | | | | | | | | | | The ipa-range-check plugin used to determine the range type depending on the value of the attributes such as RID or secondary RID base. This approached caused variety of issues since the portfolio of ID range types expanded. The patch makes sure the following rules are implemented: * No ID range pair can overlap on base ranges, with exception of two ipa-ad-trust-posix ranges belonging to the same forest * For any ID range pair of ranges belonging to the same domain: * Both ID ranges must be of the same type * For ranges of ipa-ad-trust type or ipa-local type: * Primary RID ranges can not overlap * For ranges of ipa-local type: * Primary and secondary RID ranges can not overlap * Secondary RID ranges cannot overlap For the implementation part, the plugin was extended with a domain ID to forest root domain ID mapping derivation capabilities. https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-range-check: Fix memory leaks when freeing range objectTomas Babej2014-04-081-4/+12
| | | | | | | | When cleaning the range_info struct, simple free of the struct is not enough, we have to free contents of char pointers in the struct as well. https://fedorahosted.org/freeipa/ticket/4276
* ipa-pwd-extop: Fix memory leak in ipapwd_pre_bindTomas Babej2014-04-081-0/+1
| | | | | | We need to free the entry before returning from the function. https://fedorahosted.org/freeipa/ticket/4295
generated by cgit (git 2.34.1) at 2024-09-28 10:08:49 +0000