summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* changes for new basednHEADalee_0414_drm_addAde Lee2014-07-111-8/+4
|
* Formatting fixes and change in security domain apiAde Lee2014-05-274-25/+56
| | | | Re-added function for rebase.
* Allow ipa-replica-install to be used for installing replicasAde Lee2014-05-276-102/+140
|
* set drm to not install by default with ipa-server-installAde Lee2014-05-271-1/+4
|
* Added dogtag plugin for DRMAde Lee2014-05-272-76/+271
| | | | | | This is an initial commit providing the basic vault functionality. This plugin will likely be modified as we create the code to call some of these functions.
* Added nolog to pkispawn and some additional fixes from review.Ade Lee2014-05-276-38/+66
|
* Fix various pep 8 issues and comments from reviewAde Lee2014-05-277-119/+142
|
* Added ipa-drm-installAde Lee2014-05-279-95/+297
| | | | | | | | | | ipa-drm-install can be used (with no arguments) to add a DRM to an existing ipa instance that already contains a Dogtag CA. In a subsequent patch, I will add logic to this script to detect if a drm naming context exists, and if so, to look for a replica file for installing on a replica.
* Add a DRM to IPAAde Lee2014-05-2712-297/+869
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the capability of installing a Dogtag DRM to an IPA instance. With this patch, when ipa-server-install is run, a Dogtag CA and a Dogtag DRM are created. The DRM shares the same tomcat instance and DS instance as the Dogtag CA. Moreover, the same admin user/agent (and agent cert) can be used for both subsystems. Certmonger is also confgured to monitor the new subsystem certificates. It is also possible to clone the DRM. When the IPA instance is cloned, if --enable-ca and --enable-drm are specified, the DRM is cloned as well. Installing a DRM requires the user to have a Dogtag CA instance. We can look into possibly relaxing that requirement in a later patch. The install scripts have been refactored somewhat to minimize duplication of code. A new base class dogtagintance.py has been introduced containing code that is common to DRM and CA installs. This will become very useful when we add more PKI subsystems. I am still working on patches for a ipa-drm-install script, which would be used to add a DRM to an existing master (that includes a dogtag CA), or an existing clone.
* Call generate-rndc-key.sh during ipa-server-installAdam Misnyovszki2014-05-273-1/+29
| | | | | | | | | | | | | | | | | | | | | | Since systemd has by default a 2 minute timeout to start a service, the end of ipa-server-install might fail because starting named times out. This patch ensures that generate-rndc-key.sh runs before named service restart. Also, warning message is displayed before KDC install and generate-rndc-key.sh, if there is a lack of entropy, to notify the user that the process could take more time than expected. Modifications done by Martin Kosek: - removed whitespace at the end of installutils.py - the warning in krbinstance.py moved right before the step requiring entropy - slightly reworded the warning message https://fedorahosted.org/freeipa/ticket/4210 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* admin tools: Log IPA versionPetr Viktorin2014-05-279-0/+9
| | | | | | | | | | | Add the IPA version, and vendor version if applicable, to the beginning of admintool logs -- both framework and indivitual tools that don't yet use the framework. This will make debugging easier. https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipalib.version: Add VENDOR_VERSIONPetr Viktorin2014-05-273-2/+12
| | | | | | | | | This will allow us to make vendors' lives easier by embedding a vendor tag to installation logs. Part of the work for: https://fedorahosted.org/freeipa/ticket/4219 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase Java stack size for Web UI build on aarch64Petr Vobornik2014-05-261-1/+1
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* rpcserver: login_password datetime fix in expiration checkPetr Vobornik2014-05-261-8/+2
| | | | | | | | | krbpasswordexpiration conversion to time failed because now we get datetime object instead of string. https://fedorahosted.org/freeipa/ticket/4339 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ldap2.find_entries: Do not modify attrs_list in-placePetr Viktorin2014-05-261-6/+9
| | | | | | | | | | | | | | | dap2.find_entries modified the passed in attrs_list to remove the virtual attributes memberindirect and memberofindirect before passing the list to LDAP. This means that a call like ldap2.get_entry(dn, attrs_list=some_framework_object.default_attributes) would permanently remove the virtual attributes from some_framework_object's definition. Create a copy of the list instead. https://fedorahosted.org/freeipa/ticket/4349 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove the global anonymous read ACIPetr Viktorin2014-05-266-115/+30
| | | | | | | | | | | | | | Also remove - the deny ACIs that implemented exceptions to it: - no anonymous access to roles - no anonymous access to member information - no anonymous access to hbac - no anonymous access to sudo (2×) - its updater plugin Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.xPetr Viktorin2014-05-262-0/+31
| | | | | | | | | | | | | | | When upgrading from an "old" IPA, or installing the first "new" replica, we need to keep allowing anonymous access to many user attributes. Add an optional 'fixup_function' to the managed permission templates, and use it to set the bind rule type to 'anonymous' when installing (or upgrading to) the first "new" master. This assumes that the anonymous read ACI will be removed in a "new" IPA. Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* update_managed_permissions: Pass around anonymous ACI rather than its blacklistPetr Viktorin2014-05-261-17/+18
| | | | | | | | It turns out the ACI object of the anonymous read ACI, rather than just the list of its attributes, will be useful in the future. Change the plugin so that the ACI object is passed around. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add managed read permissions to userPetr Viktorin2014-05-261-0/+70
| | | | | | Part of the work for: https://fedorahosted.org/freeipa/ticket/3566 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Default the token owner to the person adding the tokenNathaniel McCallum2014-05-231-1/+8
| | | | | | | | Creating tokens for yourself is the most common operation. Making this the default optimizes for the common case. Reviewed-By: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Only specify the ipatokenuniqueid default in the add operationNathaniel McCallum2014-05-233-9/+12
| | | | | | | | | | | Specifying the default in the LDAP Object causes the parameter to be specified for non-add operations. This is especially problematic when performing the modify operation as it causes the primary key to change for every modification. https://fedorahosted.org/freeipa/ticket/4227 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipalib.cli: Add filename argument to ipa consolePetr Viktorin2014-05-221-6/+25
| | | | | | | | | This allows writing simple IPA scripts using the shebang #! /usr/bin/ipa console https://fedorahosted.org/freeipa/ticket/4351 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* kdb: Don't provide password expiration when using only RADIUSNathaniel McCallum2014-05-221-0/+4
| | | | | | | | | | If the KDC doesn't use the FreeIPA password for authentication, then it is futile to provide this information. Doing so will only confuse the user. It also causes password change dialogues when the password is irrelevant. https://fedorahosted.org/freeipa/ticket/4299 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Replace "replica admins read access" ACI with a permissionPetr Viktorin2014-05-213-5/+66
| | | | | | | | | Add a 'Read Replication Agreements' permission to replace the read ACI for cn=config. https://fedorahosted.org/freeipa/ticket/3829 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipa-client-automount should not configure nsswitch.conf manuallyGabe2014-05-161-6/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/3733 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa-client-automount: Use rpcclient, not xmlclient, for automountlocation_showPetr Viktorin2014-05-141-1/+1
| | | | | Fix for a regression in 66fb4d5e849a049e95d3ef4fcf2b86217488634d https://fedorahosted.org/freeipa/ticket/4290
* Clean up Smartproxy support, drop unused codeRob Crittenden2014-05-136-51/+4
| | | | | | | | | Drop the logrotate file because Apache manages the logs Drop the systemd configuration because we run in Apache Import json_encode_binary from ipalib Fix Requires Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* webui-ci: decorate all webui tests with screenshot decoratorPetr Vobornik2014-05-1223-0/+79
| | | | Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* webui-ci: save screenshot on test failurePetr Vobornik2014-05-121-0/+34
| | | | | | | | | | | | | New decorator: ui_driver.screenshot created. It should be applied on test methods. Screenshot is saved on each exception except SkipTest. Configuration: - add: `save_screenshots: True` to ~/.ipa/ui_test.conf to enable saving screenshots - optionally add `screenshot_dir: /path/to/dir` to specify target directory otherwise screenshots are saved to current directory Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Fixed typo in ipa-replica-manage man pageThorsten Scherf2014-05-121-1/+1
| | | | Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* webui tests: range test extendedAdam Misnyovszki2014-05-121-0/+9
| | | | | | | Range test extended with checking of disabled field according to trust types. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui tests: callback, assert_disabled feature addedAdam Misnyovszki2014-05-121-2/+20
| | | | | | | | | Added a callback feature to webui tests, to extend functionality. Also added assert_disabled function to ui_driver, to check if a field is disabled in the browser. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipatests: Enable SSSD debugging on legacy clients with SSSDTomas Babej2014-05-091-2/+11
| | | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: Setup SSSD debugging mode by defaultTomas Babej2014-05-093-0/+43
| | | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: legacy clients: Do not use external hostnames for testing login to ↵Tomas Babej2014-05-091-2/+2
| | | | | | | legacy clients from master Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: Add Sudo integration testTomas Babej2014-05-092-1/+336
| | | | | Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-install: Configure sudo to use SSSD as data sourceTomas Babej2014-05-092-1/+86
| | | | | | | | | | | Makes ipa-client-install configure SSSD as the data provider for the sudo service by default. This behaviour can be disabled by using --no-sudo flag. https://fedorahosted.org/freeipa/ticket/3358 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client: Set NIS domain name in the installerTomas Babej2014-05-094-1/+75
| | | | | | | | | | | | | | | | Provides two new options for the ipa-client-install: --nisdomain: specifies the NIS domain name --no_nisdomain: flag to aviod setting the NIS domain name In case no --nisdomain is specified and --no_nisdomain flag was not set, the IPA domain is used. Manual pages updated. http://fedorahosted.org/freeipa/ticket/3202 Reviewed-By: Jakub Hrozek <jhrozek@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* webui static site delete command fixedAdam Misnyovszki2014-05-071-1/+2
| | | | | | | | When the static test site called batch delete, it always referred to batch.json. This patch fixes it, by referring entityname + '_batch_del.json' Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* webui OTP token test data addedAdam Misnyovszki2014-05-077-0/+301
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* migration: fix import of wsgiref.utilPetr Vobornik2014-05-071-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4293 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* webui: otptoken-adder dialog - remove obsolete commentPetr Vobornik2014-05-071-1/+0
| | | | | | | - hotp tokens are also supported Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
* Trust add datetime fixAdam Misnyovszki2014-05-061-1/+1
| | | | | | | Fixes trust add, since now datetime object is returned for 'modifytimestamp', which cannot be split like a string. Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* plugin registration refactoring for pwpolicyAdam Misnyovszki2014-05-061-24/+15
| | | | | | | | decorators used for plugin registration in pwpolicy according to: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* Adding verb to error message to make it less confusing.Jan Pazdziora2014-05-061-1/+1
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixed various typos in ipa-client-install man pageThorsten Scherf2014-05-061-3/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fixed typo in ipa-test-task man pageThorsten Scherf2014-05-061-2/+2
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix a typo in the otptoken doc stringNathaniel McCallum2014-05-061-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4289 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fixed typo how to create an example gpg keyThorsten Scherf2014-05-061-1/+1
| | | | Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
* ipatests: Add test for denying expired principalsTomas Babej2014-05-051-4/+45
| | | | | | | Part of: https://fedorahosted.org/freeipa/ticket/3305 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-26 01:08:06 +0000