summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fixed various typos in ipa-client-install man pageThorsten Scherf2014-05-061-3/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixed typo in ipa-test-task man pageThorsten Scherf2014-05-061-2/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix a typo in the otptoken doc stringNathaniel McCallum2014-05-061-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4289 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fixed typo how to create an example gpg keyThorsten Scherf2014-05-061-1/+1
| | | | Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipatests: Add test for denying expired principalsTomas Babej2014-05-051-4/+45
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3305 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <simo@redhat.com>
* ipatests: Add coverage for setting krbPrincipalExpirationTomas Babej2014-05-051-0/+30
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipatests: Fix formatting errors in test_user_plugin.pyTomas Babej2014-05-051-131/+120
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Expose krbPrincipalExpiration in CLITomas Babej2014-05-053-7/+15
| | | | | | | | | Adds a krbPrincipalExpiration attribute to the user class in user.py ipalib plugin as a DateTime parameter. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipatests: Cover DateTime in test_parameters.pyTomas Babej2014-05-052-1/+48
| | | | | | | | | Adds tests for newly added DateTime parameter, focusing on conversion of accepted datetime formats. Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: Add DateTime parameterTomas Babej2014-05-059-8/+96
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a parameter that represents a DateTime format using datetime.datetime object from python's native datetime library. In the CLI, accepts one of the following formats: Accepts LDAP Generalized time without in the following format: '%Y%m%d%H%M%SZ' Accepts subset of values defined by ISO 8601: '%Y-%m-%dT%H:%M:%SZ' '%Y-%m-%dT%H:%MZ' '%Y-%m-%dZ' Also accepts above formats using ' ' (space) as a separator instead of 'T'. As a simplification, it does not deal with timezone info and ISO 8601 values with timezone info (+-hhmm) are rejected. Values are expected to be in the UTC timezone. Values are saved to LDAP as LDAP Generalized time values in the format '%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid confusion, in addition to subset of ISO 8601 values, the LDAP generalized time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the format user will see on the output). Part of: https://fedorahosted.org/freeipa/ticket/3306 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* webui: fix switching between multiple_choice_section choicesPetr Vobornik2014-05-051-3/+4
| | | | | | | | | | | | | - required indicators are not present for all sections except the last - validation has wrong color for the same sections There was only one layout for all choices. Layout should not be reused because `create` method will reset layout's rows therefore it worked properly only for the last choice. https://fedorahosted.org/freeipa/ticket/4327 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-ci: adjust id range tests to new validatorPetr Vobornik2014-05-054-38/+37
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipa-pwd-extop: Deny LDAP binds for accounts with expired principalsTomas Babej2014-05-051-1/+34
| | | | | | | | | | | | | Adds a check for krbprincipalexpiration attribute to pre_bind operation in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is denied and LDAP_UNWILLING_TO_PERFORM along with the error message is sent back to the client. Since krbprincipalexpiration attribute is not mandatory, if there is no value set, the check is passed. https://fedorahosted.org/freeipa/ticket/3305 Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipalib.aci: Allow alternate "aci" keyword in ACIsPetr Viktorin2014-04-302-1/+5
| | | | | | | | | | | Dogtag adds some ACIs that use an alternate keyword: version 3.0; aci instead of version 3.0; acl Add support for this so the parser does not fail on these ACIs. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ACI tests to the testsuitePetr Viktorin2014-04-302-52/+89
| | | | | | Make old debug code into regression tests for ACI parsing and output. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipalib.aci: Add support for == and != operators to ACIPetr Viktorin2014-04-301-0/+6
| | | | | | This allows more natural comparisons. Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Implement an IPA Foreman smartproxy serverRob Crittenden2014-04-3017-7/+1274
| | | | | | | | | | | | | | | | | | This currently server supports only host and hostgroup commands for retrieving, adding and deleting entries. The incoming requests are completely unauthenticated and by default requests must be local. Utilize GSS-Proxy to manage the TGT. Configuration information is in the ipa-smartproxy man page. Design: http://www.freeipa.org/page/V3/Smart_Proxy https://fedorahosted.org/freeipa/ticket/4128 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* webui: regression - enable fields on idrange type change (add)Petr Vobornik2014-04-291-8/+9
| | | | | | | | | | ID range adder was not properly addressed in field binding refactoring. The usage of reset caused some weird loops. https://fedorahosted.org/freeipa/ticket/4326 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui: select all checkbox remains selected after operationAdam Misnyovszki2014-04-293-1/+9
| | | | | | | | | | The select all checkbox remained selected after bulk operation. This patch fixes it, after any bulk modify or delete operation, unselect_all function is called. https://fedorahosted.org/freeipa/ticket/4245 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Make trust objects available to regular usersMartin Kosek2014-04-281-11/+19
| | | | | | | | With global read ACI removed, some of the trust and trustdomain attributes are not available. Make trust plugin resilient to these missing attributes and let it return the available information. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add managed read permissions to trustPetr Viktorin2014-04-281-0/+15
| | | | | | | | A single permission is added to cover trust, trustconfig, and trustdomain. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* trust plugin: Remove ipatrustauth{incoming,outgoing} from default attrsPetr Viktorin2014-04-281-4/+3
| | | | | | | | | These attributes contain secrets for the trusts and should not be returned by default. Also, search_display_attributes is modified to better match default_attributes Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* aci-update: Add ACI for read-only admin attributesPetr Viktorin2014-04-251-0/+2
| | | | | | | | | | | Most admin access is granted with the "Admin can manage any entry" ACI, but before the global anonymous read ACI is removed, read-only admin access must be explicitly given. Add an ACI for read-only attributes. https://fedorahosted.org/freeipa/ticket/4319 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* aci-update: Trim the admin write blacklistPetr Viktorin2014-04-253-9/+13
| | | | | | | | | | | | | | | | | | | These attributes are removed from the blacklist, which means high-level admins can now modify them: - krbPrincipalAliases - krbPrincipalType - krbPwdPolicyReference - krbTicketPolicyReference - krbUPEnabled - serverHostName The intention is to only blacklist password attributes and attributes that are managed by DS plugins. Also, move the admin ACIs from ldif and trusts.update to aci.update. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* test_ldap: Read a publicly accessible attribute when testing anonymous bindPetr Viktorin2014-04-251-5/+4
| | | | | | | The usercertificate attribute is slated to not be readable for anonymous users. Use associateddomain in $SUFFIX instead. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add several managed read permissions under cn=etcPetr Viktorin2014-04-242-2/+84
| | | | | | | | | | | | | | This adds permissions to: - cn=masters,cn=ipa (with new privilege) - cn=dna,cn=ipa (authenticated users) - cn=ca_renewal,cn=ipa (authenticated users) - cn=CAcert,cn=ipa (anonymous) - cn=replication (authenticated users) - cn=ad (authenticated users) Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add support for non-plugin default permissionsPetr Viktorin2014-04-241-2/+12
| | | | | | | | | Add support for managed permissions that are not tied to an object class and thus can't be defined in an Object plugin. A dict is added to hold templates for the non-plugin permissions. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permission to servicePetr Viktorin2014-04-241-0/+15
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Extend anonymous read ACI for containersPetr Viktorin2014-04-241-1/+4
| | | | | | | | | | | | - Allow cn=etc,$SUFFIX with these exceptions: - cn=masters,cn=ipa,cn=etc,$SUFFIX - virtual operations - cn=replicas,cn=ipa,cn=etc,$SUFFIX - Disallow anonymous read access to Kerberos password policy Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add a new ipaVirtualOperation objectClass to virtual operationsPetr Viktorin2014-04-243-36/+40
| | | | | | | | The entries are moved from the ldif file to an update file. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* webui doc: typo fixes in guidesAdam Misnyovszki2014-04-232-3/+3
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipatests: Extend test suite for ID rangesTomas Babej2014-04-231-81/+383
| | | | | | | | | Add tests coverage for recently added ID range checks dependant on the ID range types. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa_range_check: Change range_check return values from int to ↵Tomas Babej2014-04-231-16/+26
| | | | | | | | | | | | range_check_result_t enum Using integers for return values that are used for complex casing can be fragile and typo-prone. Change range_check function to return range_check_result_t enum, whose values properly describes each of the range_check results. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa_range_check: Fix typo when comparing strings using strcasecmpTomas Babej2014-04-231-4/+4
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Do not fail when no trusted domain is availableTomas Babej2014-04-231-2/+10
| | | | | | | | | | When building the domain to forest root map, we need to take the case of IPA server having no trusted domains configured at all. Do not abort the checks, but return an empty map instead. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Make a new copy of forest_root_id attribute for range_info ↵Tomas Babej2014-04-231-1/+1
| | | | | | | | | | | | struct Not making a new copy of this attribute creates multiple frees caused by multiple pointers to the same forest_root_id from all the range_info structs for all the domains belonging to given forest. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Connect the new node of the linked listTomas Babej2014-04-231-0/+1
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa_range_check: Use special attributes to determine presence of RID basesTomas Babej2014-04-231-9/+21
| | | | | | | | | | | | | | The slapi_entry_attr_get_ulong which is used to get value of the RID base attributes returns 0 in case the attribute is not set at all. We need to distinguish this situation from the situation where RID base attributes are present, but deliberately set to 0. Otherwise this can cause false negative results of checks in the range_check plugin. Part of: https://fedorahosted.org/freeipa/ticket/4137 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* test_integration.host: Export the hostname to dict as stringPetr Viktorin2014-04-221-1/+1
| | | | | | Our tests do strict type-checking, using unicode string causes failures. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Keep original name when setting attribute in LDAPEntry.Jan Cholasta2014-04-182-35/+22
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Use raw attribute values in command result when --raw is specified.Jan Cholasta2014-04-182-5/+14
| | | | | | | For backward compatibility, the values are converted to unicode, unless the attribute is binary or the conversion fails. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Replace get_syntax method of IPASimpleObject with new get_type method.Jan Cholasta2014-04-181-13/+15
| | | | | | get_type returns the Python type for an LDAP attribute. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Support API version-specific RPC marshalling.Jan Cholasta2014-04-183-32/+42
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Allow primary keys to use different type than unicode.Jan Cholasta2014-04-1846-447/+538
| | | | | | | | | | Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: fix OTP Token add regressionPetr Vobornik2014-04-171-1/+1
| | | | | | | | | | | | OTP Token add failed because of invalid function call. qr_widget doesn't contain `on_value_changed` method since it inherits from `IPA.widget` and not from `IPA.input_widget`. Emitting the event was preserved for future possible usage. https://fedorahosted.org/freeipa/ticket/4306 Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* ipatests: Fix incorrect UID/GID reference for subdomain users and groupsTomas Babej2014-04-171-4/+8
| | | | | | | | | In legacy client integration test, the test cases that query information from subdomain about subdomain users and group expected subdomain users and groups to have the UIDs/GIDs as users and groups in the root domain. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Allow using FQDN with trailing dot as final hostnameTomas Babej2014-04-171-1/+5
| | | | | | | | | | | | | | | When creating a BaseHost instance, the machine's hostname was reconfigured to have the same shortname prepended the domain name of the domain where it was defined. However, it makes sense in certain use cases to define hosts that have hostnames other than belonging directly in the domain they were defined in. Treat input hostnames with trailing dots as static FQDNs that will not be changed by the name of the domain they were defined in. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: tasks: Accept extra arguments when installing clientTomas Babej2014-04-171-2/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipatests: Fix apache semaphores prior to installing IPA serverTomas Babej2014-04-171-0/+14
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* CI - test_forced_client_reenrollment stability fixAdam Misnyovszki2014-04-171-0/+4
| | | | | | | | fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19 https://fedorahosted.org/freeipa/ticket/4298 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-09 07:50:52 +0000