summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ipatests: Add Sudo integration testTomas Babej2014-05-092-1/+336
| | | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-install: Configure sudo to use SSSD as data sourceTomas Babej2014-05-092-1/+86
| | | | | | | | | | | Makes ipa-client-install configure SSSD as the data provider for the sudo service by default. This behaviour can be disabled by using --no-sudo flag. https://fedorahosted.org/freeipa/ticket/3358 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client: Set NIS domain name in the installerTomas Babej2014-05-094-1/+75
| | | | | | | | | | | | | | | | Provides two new options for the ipa-client-install: --nisdomain: specifies the NIS domain name --no_nisdomain: flag to aviod setting the NIS domain name In case no --nisdomain is specified and --no_nisdomain flag was not set, the IPA domain is used. Manual pages updated. http://fedorahosted.org/freeipa/ticket/3202 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui static site delete command fixedAdam Misnyovszki2014-05-071-1/+2
| | | | | | | | When the static test site called batch delete, it always referred to batch.json. This patch fixes it, by referring entityname + '_batch_del.json' Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui OTP token test data addedAdam Misnyovszki2014-05-077-0/+301
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* migration: fix import of wsgiref.utilPetr Vobornik2014-05-071-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4293 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: otptoken-adder dialog - remove obsolete commentPetr Vobornik2014-05-071-1/+0
| | | | | | | - hotp tokens are also supported Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Trust add datetime fixAdam Misnyovszki2014-05-061-1/+1
| | | | | | | Fixes trust add, since now datetime object is returned for 'modifytimestamp', which cannot be split like a string. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* plugin registration refactoring for pwpolicyAdam Misnyovszki2014-05-061-24/+15
| | | | | | | | decorators used for plugin registration in pwpolicy according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Adding verb to error message to make it less confusing.Jan Pazdziora2014-05-061-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixed various typos in ipa-client-install man pageThorsten Scherf2014-05-061-3/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixed typo in ipa-test-task man pageThorsten Scherf2014-05-061-2/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix a typo in the otptoken doc stringNathaniel McCallum2014-05-061-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4289 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fixed typo how to create an example gpg keyThorsten Scherf2014-05-061-1/+1
| | | | Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipatests: Add test for denying expired principalsTomas Babej2014-05-051-4/+45
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3305 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <simo@redhat.com>
* ipatests: Add coverage for setting krbPrincipalExpirationTomas Babej2014-05-051-0/+30
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipatests: Fix formatting errors in test_user_plugin.pyTomas Babej2014-05-051-131/+120
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Expose krbPrincipalExpiration in CLITomas Babej2014-05-053-7/+15
| | | | | | | | | Adds a krbPrincipalExpiration attribute to the user class in user.py ipalib plugin as a DateTime parameter. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipatests: Cover DateTime in test_parameters.pyTomas Babej2014-05-052-1/+48
| | | | | | | | | Adds tests for newly added DateTime parameter, focusing on conversion of accepted datetime formats. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Add DateTime parameterTomas Babej2014-05-059-8/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a parameter that represents a DateTime format using datetime.datetime object from python's native datetime library. In the CLI, accepts one of the following formats: Accepts LDAP Generalized time without in the following format: '%Y%m%d%H%M%SZ' Accepts subset of values defined by ISO 8601: '%Y-%m-%dT%H:%M:%SZ' '%Y-%m-%dT%H:%MZ' '%Y-%m-%dZ' Also accepts above formats using ' ' (space) as a separator instead of 'T'. As a simplification, it does not deal with timezone info and ISO 8601 values with timezone info (+-hhmm) are rejected. Values are expected to be in the UTC timezone. Values are saved to LDAP as LDAP Generalized time values in the format '%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid confusion, in addition to subset of ISO 8601 values, the LDAP generalized time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the format user will see on the output). Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: fix switching between multiple_choice_section choicesPetr Vobornik2014-05-051-3/+4
| | | | | | | | | | | | | - required indicators are not present for all sections except the last - validation has wrong color for the same sections There was only one layout for all choices. Layout should not be reused because `create` method will reset layout's rows therefore it worked properly only for the last choice. https://fedorahosted.org/freeipa/ticket/4327 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-ci: adjust id range tests to new validatorPetr Vobornik2014-05-054-38/+37
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipa-pwd-extop: Deny LDAP binds for accounts with expired principalsTomas Babej2014-05-051-1/+34
| | | | | | | | | | | | | Adds a check for krbprincipalexpiration attribute to pre_bind operation in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is denied and LDAP_UNWILLING_TO_PERFORM along with the error message is sent back to the client. Since krbprincipalexpiration attribute is not mandatory, if there is no value set, the check is passed. https://fedorahosted.org/freeipa/ticket/3305 Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipalib.aci: Allow alternate "aci" keyword in ACIsPetr Viktorin2014-04-302-1/+5
| | | | | | | | | | | Dogtag adds some ACIs that use an alternate keyword: version 3.0; aci instead of version 3.0; acl Add support for this so the parser does not fail on these ACIs. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ACI tests to the testsuitePetr Viktorin2014-04-302-52/+89
| | | | | | Make old debug code into regression tests for ACI parsing and output. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipalib.aci: Add support for == and != operators to ACIPetr Viktorin2014-04-301-0/+6
| | | | | | This allows more natural comparisons. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Implement an IPA Foreman smartproxy serverRob Crittenden2014-04-3017-7/+1274
| | | | | | | | | | | | | | | | | | This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: regression - enable fields on idrange type change (add)Petr Vobornik2014-04-291-8/+9
| | | | | | | | | | ID range adder was not properly addressed in field binding refactoring. The usage of reset caused some weird loops. https://fedorahosted.org/freeipa/ticket/4326 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: select all checkbox remains selected after operationAdam Misnyovszki2014-04-293-1/+9
| | | | | | | | | | The select all checkbox remained selected after bulk operation. This patch fixes it, after any bulk modify or delete operation, unselect_all function is called. https://fedorahosted.org/freeipa/ticket/4245 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make trust objects available to regular usersMartin Kosek2014-04-281-11/+19
| | | | | | | | With global read ACI removed, some of the trust and trustdomain attributes are not available. Make trust plugin resilient to these missing attributes and let it return the available information. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add managed read permissions to trustPetr Viktorin2014-04-281-0/+15
| | | | | | | | A single permission is added to cover trust, trustconfig, and trustdomain. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* trust plugin: Remove ipatrustauth{incoming,outgoing} from default attrsPetr Viktorin2014-04-281-4/+3
| | | | | | | | | These attributes contain secrets for the trusts and should not be returned by default. Also, search_display_attributes is modified to better match default_attributes Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* aci-update: Add ACI for read-only admin attributesPetr Viktorin2014-04-251-0/+2
| | | | | | | | | | | Most admin access is granted with the "Admin can manage any entry" ACI, but before the global anonymous read ACI is removed, read-only admin access must be explicitly given. Add an ACI for read-only attributes. https://fedorahosted.org/freeipa/ticket/4319 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci-update: Trim the admin write blacklistPetr Viktorin2014-04-253-9/+13
| | | | | | | | | | | | | | | | | | | These attributes are removed from the blacklist, which means high-level admins can now modify them: - krbPrincipalAliases - krbPrincipalType - krbPwdPolicyReference - krbTicketPolicyReference - krbUPEnabled - serverHostName The intention is to only blacklist password attributes and attributes that are managed by DS plugins. Also, move the admin ACIs from ldif and trusts.update to aci.update. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_ldap: Read a publicly accessible attribute when testing anonymous bindPetr Viktorin2014-04-251-5/+4
| | | | | | | The usercertificate attribute is slated to not be readable for anonymous users. Use associateddomain in $SUFFIX instead. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add several managed read permissions under cn=etcPetr Viktorin2014-04-242-2/+84
| | | | | | | | | | | | | | This adds permissions to: - cn=masters,cn=ipa (with new privilege) - cn=dna,cn=ipa (authenticated users) - cn=ca_renewal,cn=ipa (authenticated users) - cn=CAcert,cn=ipa (anonymous) - cn=replication (authenticated users) - cn=ad (authenticated users) Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add support for non-plugin default permissionsPetr Viktorin2014-04-241-2/+12
| | | | | | | | | Add support for managed permissions that are not tied to an object class and thus can't be defined in an Object plugin. A dict is added to hold templates for the non-plugin permissions. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission to servicePetr Viktorin2014-04-241-0/+15
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Extend anonymous read ACI for containersPetr Viktorin2014-04-241-1/+4
| | | | | | | | | | | | - Allow cn=etc,$SUFFIX with these exceptions: - cn=masters,cn=ipa,cn=etc,$SUFFIX - virtual operations - cn=replicas,cn=ipa,cn=etc,$SUFFIX - Disallow anonymous read access to Kerberos password policy Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add a new ipaVirtualOperation objectClass to virtual operationsPetr Viktorin2014-04-243-36/+40
| | | | | | | | The entries are moved from the ldif file to an update file. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui doc: typo fixes in guidesAdam Misnyovszki2014-04-232-3/+3
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipatests: Extend test suite for ID rangesTomas Babej2014-04-231-81/+383
| | | | | | | | | Add tests coverage for recently added ID range checks dependant on the ID range types. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa_range_check: Change range_check return values from int to ↵Tomas Babej2014-04-231-16/+26
| | | | | | | | | | | | range_check_result_t enum Using integers for return values that are used for complex casing can be fragile and typo-prone. Change range_check function to return range_check_result_t enum, whose values properly describes each of the range_check results. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa_range_check: Fix typo when comparing strings using strcasecmpTomas Babej2014-04-231-4/+4
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Do not fail when no trusted domain is availableTomas Babej2014-04-231-2/+10
| | | | | | | | | | When building the domain to forest root map, we need to take the case of IPA server having no trusted domains configured at all. Do not abort the checks, but return an empty map instead. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Make a new copy of forest_root_id attribute for range_info ↵Tomas Babej2014-04-231-1/+1
| | | | | | | | | | | | struct Not making a new copy of this attribute creates multiple frees caused by multiple pointers to the same forest_root_id from all the range_info structs for all the domains belonging to given forest. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Connect the new node of the linked listTomas Babej2014-04-231-0/+1
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Use special attributes to determine presence of RID basesTomas Babej2014-04-231-9/+21
| | | | | | | | | | | | | | The slapi_entry_attr_get_ulong which is used to get value of the RID base attributes returns 0 in case the attribute is not set at all. We need to distinguish this situation from the situation where RID base attributes are present, but deliberately set to 0. Otherwise this can cause false negative results of checks in the range_check plugin. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* test_integration.host: Export the hostname to dict as stringPetr Viktorin2014-04-221-1/+1
| | | | | | Our tests do strict type-checking, using unicode string causes failures. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Keep original name when setting attribute in LDAPEntry.Jan Cholasta2014-04-182-35/+22
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-11 09:02:04 +0000