summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins
Commit message (Collapse)AuthorAgeFilesLines
* Only apply validation rules when adding and updating.Rob Crittenden2012-02-297-16/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There may be cases, for whatever reason, that an otherwise illegal entry gets created that doesn't match the criteria for a valid user/host/group name. If this happens (i.e. migration) there is no way to remove this using the IPA tools because we always applied the name pattern. So you can't, for example, delete a user with an illegal name. Primary keys are cloned with query=True in PKQuery which causes no rules to be applied on mod/show/find. This reverts a change from commit 3a5e26a0 which applies class rules when query=True (for enforcing no white space). Replace rdnattr with rdn_is_primary_key. This was meant to tell us when an RDN change was necessary to do a rename. There could be a disconnect where the rdnattr wasn't the primary key and in that case we don't need to do an RDN change, so use a boolean instead so that it is clear that RDN == primary key. Add a test to ensure that nowhitespace is actually enforced. https://fedorahosted.org/freeipa/ticket/2115 Related: https://fedorahosted.org/freeipa/ticket/2089 Whitespace tickets: https://fedorahosted.org/freeipa/ticket/1285 https://fedorahosted.org/freeipa/ticket/1286 https://fedorahosted.org/freeipa/ticket/1287
* Added logout buttonPetr Voborník2012-02-281-1/+3
| | | | | | | | | | Logout button was added to Web UI. Click on logout button executes session_logout command. If command succeeds or xhr stutus is 401 (unauthorized - already logged out) page is redirected to logout.html. logout.html is a simple page with "You have been logged out" text and a link to return back to main page. https://fedorahosted.org/freeipa/ticket/2363
* Improve FQDN handling in DNS and host pluginsMartin Kosek2012-02-292-31/+40
| | | | | | | | | | | | | | | | | | | | | DNS and host plugin does not work well with domain names ending with dot. host plugin creates a record with two fqdn attributes when such hostname is created which then has to be manually fixed. DNS plugin handled zones with and without trailing dot as two distinct zones, which may lead to issues when both zones are created. This patch sanitizes approach to FQDNs in both DNS and host plugin. Hostnames are now always normalized to the form without trailing dot as this form did not work before and it would keep hostname form consistent without changes in our server/client enrollment process. As DNS zones always worked in both forms this patch rather makes sure that the plugin works with both forms of one zone and prevents creating 2 identical zones with just different format. https://fedorahosted.org/freeipa/ticket/2420
* Improve hostname and domain name validationMartin Kosek2012-02-292-25/+35
| | | | | | | | | | | | | | | DNS plugin did not check DNS zone and DNS record validity and user was thus able to create domains like "foo bar" or other invalid DNS labels which would really confuse both user and bind-dyndb-ldap plugin. This patch at first consolidates hostname/domain name validators so that they use common functions and we don't have regular expressions and other checks defined in several places. These new cleaned validators are then used for zone/record name validation. https://fedorahosted.org/freeipa/ticket/2384
* Improve dnsrecord-add interactive modeMartin Kosek2012-02-291-4/+9
| | | | | | | | | | | When an invalid record type is entered during dnsrecord-add interactive mode, user is provided with a list of allowed values (record types). However, the provided list contains also unsupported record types (APL, DHCID, etc.) and any attempt to add such records would end with error. This patch limits the list to supported record types only. https://fedorahosted.org/freeipa/ticket/2378
* Don't set migrated user's GID to that of default users group.Rob Crittenden2012-02-291-3/+8
| | | | | | The GID should be the UID unless UPG is disabled. https://fedorahosted.org/freeipa/ticket/2430
* Validate attributes in permission-addOndrej Hamada2012-02-281-0/+55
| | | | | | | | | | | When adding or modifying permission with both type and attributes specified, check whether the attributes are allowed for specified type. In case of disallowed attributes raises the ObjectclassViolation exception. New tests were also added to the unit-tests. https://fedorahosted.org/freeipa/ticket/2293
* Add support defaultNamingContext and add --basedn to migrate-dsRob Crittenden2012-02-291-13/+28
| | | | | | | | | | | | | | | | | | | | There are two sides to this, the server and client side. On the server side we attempt to add a defaultNamingContext on already installed servers. This will fail on older 389-ds instances but the failure is not fatal. New installations on versions of 389-ds that support this attribute will have it already defined. On the client side we need to look for both defaultNamingContext and namingContexts. We still need to check that the defaultNamingContext is an IPA server (info=IPAV2). The migration change also takes advantage of this and adds a new option which allows one to provide a basedn to use instead of trying to detect it. https://fedorahosted.org/freeipa/ticket/1919 https://fedorahosted.org/freeipa/ticket/2314
* Added unsupported_validatorPetr Voborník2012-02-291-0/+1
| | | | | | | | dnszone attributes idnsallowquery and idnsallowtransfer have valid but currently unsupported values: 'localhost' and 'localnets'. New validator was introduced for unsuported values. By using this validator user can see that the value is currently unsupported instead of showing 'invalid value' or passing the value to server and creating error there. https://fedorahosted.org/freeipa/ticket/2351
* New UI for DNS global configurationPetr Voborník2012-02-291-0/+3
| | | | | | UI for DNS global configuration was implemented. https://fedorahosted.org/freeipa/ticket/2350
* DNS Zone UI: added new attributesPetr Voborník2012-02-291-0/+1
| | | | | | | | | | | | | | | | | New attributes were added to DNS zone details facet. Attributes: idnsallowquery idnsallowtransfer idnsforwarders idnsforwardpolicy idnsallowsyncptr New network address validator created for idnsallowquery and idnsallowtransfer attributes. Network address validator also added to dnszone adder dialog - from_ip field. https://fedorahosted.org/freeipa/ticket/2351
* Use stricter semantics when checking IP address for DNS recordsPetr Viktorin2012-02-291-1/+1
| | | | https://fedorahosted.org/freeipa/ticket/2379
* Improve dns error messageMartin Kosek2012-02-281-2/+8
| | | | | | | | | | Improve AttrValueNotFound exception error message raised in the DNS module when a deleted (modified) attribute value is not found in a record. In order to be consistent with previous DNS module implementation this error message should include an attribute label instead of an attribute name. https://fedorahosted.org/freeipa/ticket/2377
* Limit allowed characters in a netgroup name to alpha, digit, -, _ and .Rob Crittenden2012-02-272-0/+9
| | | | | | Apply this to hostgroup names as well since they can be linked. https://fedorahosted.org/freeipa/ticket/2221
* Add reverse DNS record when forward is createdMartin Kosek2012-02-272-139/+308
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
* Don't consider virtual attributes when validating custom objectclassesRob Crittenden2012-02-271-0/+5
| | | | | | | | | We verify user and group default objectclasses when changing them to be sure that required objectclasses aren't being dropped. We need to ignore virtual attributes or it will raise an error because they aren't defined in schema. https://fedorahosted.org/freeipa/ticket/2406
* Add gidnumber minvalueMartin Kosek2012-02-232-0/+2
| | | | | | Do not accept invalid GID values in IPA user/group plugins. https://fedorahosted.org/freeipa/ticket/2335
* Add API for PTR sync controlMartin Kosek2012-02-241-0/+5
| | | | | | | | | | | | | | | | New version of bind-dyndb-ldap plugin have an ability to automatically update machine reverse address when its forward address is updated via GSS-TSIG update. The reverse zone must be managed by FreeIPA as well in order of this feature to work. As it would not be secure to enable this behaviour for all zones there is a global attribute that can enable PTR sync for all zones and also a per-zone attribute that can enable for chosen zones only. This patch adds an API for this control. https://fedorahosted.org/freeipa/ticket/2176
* Add DNS conditional forwardingMartin Kosek2012-02-241-1/+21
| | | | | | | | Add ability configure per-zone forwarder for DNS zones. Any data in such zone will then be considered as non-authoritative and all queries will be sent to specified forwarder. https://fedorahosted.org/freeipa/ticket/2108
* Query and transfer ACLs for DNS zonesMartin Kosek2012-02-241-2/+85
| | | | | | | | | | | | | | Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
* Global DNS optionsMartin Kosek2012-02-241-0/+50
| | | | | | | | | | | | Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
* Don't allow IPA master hosts or important services be deleted.Rob Crittenden2012-02-233-0/+25
| | | | | | | | | Deleting these would cause the IPA master to blow up. For services I'm taking a conservative approach and only limiting the deletion of known services we care about. https://fedorahosted.org/freeipa/ticket/2425
* Added missing configuration optionsPetr Voborník2012-02-201-0/+1
| | | | | | | | | | Missing options were added to Web UI's IPA Server/Configuration page. * ipaconfigstring * ipaselinuxusermaporder * ipaselinuxusermapdefault https://fedorahosted.org/freeipa/ticket/2285 https://fedorahosted.org/freeipa/ticket/2400
* Redirection to PTR records from A,AAAA recordsPetr Voborník2012-02-151-0/+11
| | | | | | | | | | | | | | | | | | | Address column in A, AAAA DNS records was exented of redirection capabilities. Redirection dialog is shown after a click on a value. Dialog does following steps: 1) fetch all dns zones 2) find most accurate reverse zone for IP address 2 -fail) show error message, stop 3) checks if target record exists in the zone 3 -fail) show 'dns record create link', stop 4) redirects Click on 'dns record create link': 1) creates record 1 -fail) show error, stop 2) redirects https://fedorahosted.org/freeipa/ticket/1975
* UI support for ssh keysPetr Voborník2012-02-151-0/+11
| | | | | | | | To user and host details pages was added ipasshpubkey attribute. New widget for ssh public keys was created. https://fedorahosted.org/freeipa/ticket/2340
* Base64-decode unicode values in Bytes parameters.Jan Cholasta2012-02-131-2/+6
| | | | | | | | | | | Fix wrong handling of strings in --setattr/--addattr/--delattr. These changes make it possible to use Bytes in --setattr/--addattr/ --delattr without errors. Fixes managing SSH keys on command-line https://fedorahosted.org/freeipa/ticket/754
* Add support for SSH public keys to user and host objects.Jan Cholasta2012-02-132-29/+124
| | | | | | | | | | | This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
* Internationalization for HBAC and ipalib.outputPetr Viktorin2012-02-142-7/+7
| | | | | | | | | | | * hbacrule: Internationalize HBAC rule "all" category exceptions https://fedorahosted.org/freeipa/ticket/2267 * hbactest: Use internationalized names (doc) instead of names for output items Also don't convert result to bool, `not` does it implicitly * ipalib.output: Internationalize descriptions of some standard entries
* Removed question marks from field labelsPetr Voborník2012-02-141-2/+2
| | | | | | | In user group adder dialog, the "Is this a POSIX group?" was replaced with "POSIX group". In host search facet, the "Enrolled?" was replaced with "Enrolled". https://fedorahosted.org/freeipa/ticket/2353
* Clean up i18n stringsPetr Viktorin2012-02-104-18/+20
| | | | | | | | | | | This patch switches to named ("%(name)s") instead of positional ("%s") substitutions for internationalized strings, so translators can reorder the words. This fixes https://fedorahosted.org/freeipa/ticket/2179 (xgettext no longer gives warnings). Also, some i18n calls are rewritten to translate the template before substitutions, not after.
* Honor default home directory and login shell in user_addPetr Viktorin2012-02-091-9/+6
| | | | | | | | | | | | | | | | The homedirectory argument had a default_from '/home/<name>', ignoring the ipahomesrootdir config setting. This patch removes that default, and adds a test case for ipahomesrootdir. https://fedorahosted.org/freeipa/ticket/2332 The login shell had the same problem. Again this patch removes the client-side default and adds a test. Building the home directory from the default is changed to use posixpath.join instead of string formatting and ad-hoc cleanup, and to use '/home' instead of failing when the ipahomesrootdir setting is not present for some reason.
* Make ipaconfigstring modifiable by users.Rob Crittenden2012-02-091-4/+6
| | | | | | | | | | | Convert from a freeform string into a enumeration. Only values currently allowed are AllowLMhash and AllowNThash. To add more than one value on the command-line either specify --ipaconfigstring multiple times or add the values comma-separated. https://fedorahosted.org/freeipa/ticket/1433
* Memberof attribute control and updateOndrej Hamada2012-02-081-15/+21
| | | | | | | | | | | | | | | Checking of parameters used by _make_aci funcion was rewritten. Additional attributes of ACI(type, attribute, memberof, targetgroup, subtree, filter) could be unset. Permission plugin now allows to unset memberof value. https://fedorahosted.org/freeipa/ticket/2255 Added checking of existence of groups that are specified in permission and delegation module. https://fedorahosted.org/freeipa/ticket/2286 https://fedorahosted.org/freeipa/ticket/2305
* Consolidate external member code into two functions in baseldap.pyRob Crittenden2012-02-084-282/+94
| | | | | | | | | | External members (users and hosts) are assumed when doing member management on certain attributes. If the member isn't in IPA it is assumed to be external. When doing member management we need to sift through the list of failures and pull out all those that were simply not found in IPA. https://fedorahosted.org/freeipa/ticket/1734
* Automember UI - Fixed I18n labelsPetr Voborník2012-02-071-0/+15
| | | | | | | Hard-coded labels in Automember UI have been moved into internal.py to allow translation. https://fedorahosted.org/freeipa/ticket/2195
* Switch --group and --membergroup in example for delegationPetr Viktorin2012-02-061-2/+2
| | | | | | | | The example mistakenly showed how to allow "employees" to edit addresses of "managers". This fixes the example by switching the two options. https://fedorahosted.org/freeipa/ticket/2317
* Return proper DN in netgroup-addMartin Kosek2012-02-061-2/+2
| | | | | | | This patch fixes netgroup unit test failures which expect the original DN. https://fedorahosted.org/freeipa/ticket/2069
* Make submount automount maps work.Rob Crittenden2012-02-061-6/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Indirect automount nesting is achieved by adding a key that references another map. This isn't heirarchical, in fact, you can have multiple duplicate keys all pointing at the same map, which itself is mounted in other places. It can be a real mess if you want. In any case, a submount map has its information set to "-fstype=autofs <type>:<map>" The type can be any valid automount type: file, nis, yp, ldap, etc. We are going to hardcode ldap in when we create these using automountmap-add-indirect. If a user wants a different type they can create the key themselves (or edit it later). Here is an example of creating a submount: $ ipa automountlocation-add baltimore $ ipa automountmap-add-indirect baltimore auto.share --mount=/share $ ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.sub $ ipa automountkey-add baltimore auto.sub --key=share --info=attic:/share $ ls /share/sub/share builds lost+found This looks like: etc/auto.master: /- /etc/auto.direct /share /etc/auto.share --------------------------- /etc/auto.direct: --------------------------- /etc/auto.share: sub -fstype=autofs ldap:auto.sub maps not connected to /etc/auto.master: --------------------------- /etc/auto.sub: share attic:/share I've also added a catch-all when using the tofiles function. We were missing any maps that weren't attached to auto.master. They will now be shown along with whatever keys they have. https://fedorahosted.org/freeipa/ticket/1268
* Add argument help to CLIMartin Kosek2012-02-061-1/+3
| | | | | | | | | | | | CLI command help contains a documentation for all options that can be passed to commands. However, help strings for positional arguments are not included. This patch uses an OptionParser description field to list all command arguments as OptionParser does not have a native support to provide such information to user. https://fedorahosted.org/freeipa/ticket/1974
* Remove debug messagesMartin Kosek2012-02-061-4/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2323 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Fix raw format for ACI commandsMartin Kosek2012-02-033-66/+69
| | | | | | | | | | | | | ACI plugins (permission, selfservice and delegation) were not prepared to serve ACIs in a raw format, i.e. raw "aci" attribute taken from LDAP. This patch fixes all these plugins and their commands to provide provide this format. Few ACI raw format unit tests were added for all these plugins. https://fedorahosted.org/freeipa/ticket/2010 https://fedorahosted.org/freeipa/ticket/2223 https://fedorahosted.org/freeipa/ticket/2228 https://fedorahosted.org/freeipa/ticket/2232
* Improve migration helpMartin Kosek2012-02-031-8/+21
| | | | | | | | | Improve migration help topic so that it easier understandable: - Add missing list of Topic commands - Add one more example to demonstrate migration abilities - Add breaks to too long lines to improve readibility https://fedorahosted.org/freeipa/ticket/2174
* Improve dnszone-add error messageMartin Kosek2012-02-031-0/+7
| | | | | | | | | | When a new DNS record is being added to DNS zone via command ipa dnsrecord-add ZONE @ and the target ZONE does not exist it returns ObjectclassViolation which may confuse users. Make sure that standard DNS Zone NotFound exception is returned. https://fedorahosted.org/freeipa/ticket/2270
* Add data field for A6 recordMartin Kosek2012-02-031-2/+10
| | | | | | | | | | | | | Since A6 is an obsolete RR type, no DNS part option was created. This is, however, not consistent with the rest of per-type API and may cause problems. This patch adds at least a DNS part for raw A6 record data so that the record type is treated consistently. This patch also fixes interactive mode for A6 records. Their data were not detected correctly as dnsrecord_add didn't expect a number in DNS part option name. https://fedorahosted.org/freeipa/ticket/2309
* Add SRV record target validatorMartin Kosek2012-02-031-0/+7
| | | | | | | Add missing SRV record target validator to filter out possible user errors. https://fedorahosted.org/freeipa/ticket/2308
* Fix NSEC record conversionMartin Kosek2012-02-031-6/+18
| | | | | | | | | | | | | NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
* Fix TXT record parsingMartin Kosek2012-02-031-0/+6
| | | | | | | | | TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
* Improve netgroup-add error messagesMartin Kosek2012-02-031-7/+11
| | | | | | | | | | | | These two situations in netgroup-add need to be distinguished: 1) Netgroup cannot be added because a hostgroup with the same name created a colliding managed netgroup 2) Another native netgroup with the same name exists This patch checks the colliding netgroup and raise appropriate error message based on this finding. https://fedorahosted.org/freeipa/ticket/2069
* Show password expiration date.Endi Sukma Dewata2012-02-011-0/+1
| | | | | | | | | | | The user details page was modified to show the password expiration date next to the existing password field. Fixed problem resetting password in self-service mode. The JSON interface for the passwd command requires the username to be specified although the equivalent CLI command doesn't require it. Ticket #2064
* Modifying DNS UI to benefit from new DNS APIPetr Voborník2012-01-301-0/+2
| | | | | | DNS UI was modified to offer structured way of defining DNS records. https://fedorahosted.org/freeipa/ticket/2208
generated by cgit (git 2.34.1) at 2024-10-04 10:36:16 +0000