public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,349 Commits 9 Branches 0 Tags
14992a07fc7ea6bb5c028e5fefaf7394af00a555
Commit Graph
2639 Commits
Author SHA1 Message Date
Alexander Bokovoy 47e1de7604 trusts: pass AD DC hostname if specified explicitly 
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 01:56:52 +02:00
Alexander Bokovoy 03c2d76186 ipa-adtrust-install: add IPA master host principal to adtrust agents 
Fixes https://fedorahosted.org/freeipa/ticket/4951

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-08 01:56:52 +02:00
Martin Babinsky ea7f392bb9 add option to skip client API version check 
This can be either set in IPA config file or specified as
'ipa --skip-version-check [COMMAND]'.

part of https://fedorahosted.org/freeipa/ticket/4768

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-07-08 00:35:05 +02:00
Fraser Tweedale 462e0b9eb1 certprofile: add ability to update profile config in Dogtag 
Add the `--file=FILENAME' option to `certprofile-mod' which, when
given, will update the profile configuration in Dogtag to the
contents of the file.

Fixes: https://fedorahosted.org/freeipa/ticket/5093
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-07-08 00:25:46 +02:00
Fraser Tweedale bed6f402e2 certprofile: add option to export profile config 
Add the `--out=FILENAME' option to `certprofile-show'.  When given,
it exports the profile configuration from Dogtag and writes it to
the named file.

Fixes: https://fedorahosted.org/freeipa/ticket/5091
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-07-08 00:25:46 +02:00
Tomas Babej 62e8002bc4 Hide topology and domainlevel features 
* Hide topology and domainlevel commands in the CLI
* Hide topology and domainlevel in the WebUI
* Set maximum allowed domain level to 0
* Do not configure and enable the topology plugin

https://fedorahosted.org/freeipa/ticket/5097

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-07-08 00:09:09 +02:00
Endi S. Dewata 475ade4bec Added ipaVaultPublicKey attribute. 
A new attribute ipaVaultPublicKey has been added to replace the
existing ipaPublicKey used to store the vault public key.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-07 07:44:56 +00:00
Endi S. Dewata fc5c614950 Added symmetric and asymmetric vaults. 
The vault plugin has been modified to support symmetric and asymmetric
vaults to provide additional security over the standard vault by
encrypting the data before it's sent to the server. The encryption
functionality is implemented using the python-cryptography library.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-07 07:44:56 +00:00
Petr Vobornik ba0a1c6b33 include more information in metadata 
added to commands: doc, proper args, NO_CLI

added to options: default_from, cli_name, cli_short_name and others

https://fedorahosted.org/freeipa/ticket/3129

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-03 10:42:16 +02:00
Martin Basti 884afb5d38 Server Upgrade: use debug log level for upgrade instead of info 
Upgrade contains too many unnecessary info logs.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-03 07:47:59 +00:00
Petr Vobornik 66ea322e7e topology: make cn of new segment consistent with topology plugin 
Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-03 08:47:23 +02:00
Petr Vobornik 2b8e1caa7b topologysegment: hide direction and enable options 
These options should not be touched by users yet.

https://fedorahosted.org/freeipa/ticket/5061

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-07-03 08:47:23 +02:00
Martin Babinsky 76eea85701 new commands to manage user/host/service certificates 
A new group of commands is introduced that simplifies adding and removing
binary certificates to entries. A general form of the command is

ipa [user/host/service]-[add/remove]-cert [pkey] --certificate=[BASE64 BLOB]

Part of http://www.freeipa.org/page/V4/User_Certificates and
https://fedorahosted.org/freeipa/ticket/4238

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-02 14:43:44 +00:00
Martin Babinsky 53b11b6117 reworked certificate normalization and revocation 
Validation of certificate is now handled by `x509.validate_certificate'.

Revocation of the host and service certificates was factored out to a separate
function.

Part of http://www.freeipa.org/page/V4/User_Certificates

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-02 14:43:44 +00:00
Martin Babinsky 93dab56ebf baseldap: add support for API commands managing only a single attribute 
This patch extends the API framework with a set of classes which add/remove
 values to a single LDAPObject attribute.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-07-02 14:43:44 +00:00
Tomas Babej 6462530440 idviews: Fallback to AD DC LDAP only if specifically allowed 
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-02 13:23:21 +02:00
Tomas Babej bff7a748d6 idviews: Do not abort the find & show commands on conversion errors 
https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-02 13:23:21 +02:00
Thierry Bordaz b5cb95431b Display the wrong attribute name when mandatory attribute is missing 
When activating a stageuser, if 'sn' or 'cn' or 'uid' is missing
	it displays an error with 'cn'

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-02 12:01:07 +02:00
Martin Basti 96c23659fc DNS: Do not traceback if DNS is not installed 
Instead of internal error show 'DNS is not configured' message, when a
dns* command is executed.

https://fedorahosted.org/freeipa/ticket/5017

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-01 20:19:01 +02:00
Jan Cholasta 5b39bc1003 plugable: Remove unused call method of Plugin 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 2b12bca660 plugable: Specify plugin base classes and modules using API properties 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 4b277d0477 plugable: Change is_production_mode to method of API 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 1a21fd971c plugable: Remove SetProxy, DictProxy and MagicDict 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta b1fc875c3a plugable: Lock API on finalization rather than on initialization 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 860088208b plugable: Do not use DictProxy for API 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta e39fe4ed31 plugable: Pass API to plugins on initialization rather than using set_api 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 2d1515323a plugable: Load plugins only from modules imported by API 
Previously all plugin modules imported from anywhere were added to the API.

https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 481f8ddaa3 plugable: Specify plugins to import in API by module names 
This change removes the automatic plugins sub-package magic and allows
specifying modules in addition to packages.

https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta 7715d5bb04 ipalib: Move find_modules_in_dir from util to plugable 
https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta fe2accf776 ipalib: Load ipaserver plugins when api.env.in_server is True 
https://fedorahosted.org/freeipa/ticket/3090
https://fedorahosted.org/freeipa/ticket/5073

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Jan Cholasta f87ba5ee08 plugable: Move plugin base class and override logic to API 
Each API object now maintains its own view of registered plugins. This change
removes the need to register plugin base classes.

This reverts commit 2db741e847.

https://fedorahosted.org/freeipa/ticket/3090
https://fedorahosted.org/freeipa/ticket/5073

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-07-01 13:05:30 +00:00
Tomas Babej e21dad4e1c idviews: Remove ID overrides for permanently removed users and groups 
For IPA users and groups we are able to trigger a removal of
any relevant ID overrides in user-del and group-del commands.

https://fedorahosted.org/freeipa/ticket/5026

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-01 13:06:40 +02:00
Tomas Babej 77b64e6023 idviews: Allow users specify the raw anchor directly as identifier 
For various reasons, it can happen that the users or groups that
have overrides defined in a given ID view are no longer resolvable.

Since user and group names are used to specify the ID override objects
too by leveraging the respective user's or group's ipaUniqueID,
we need to provide a fallback in case these user or group entries
no longer exist.

https://fedorahosted.org/freeipa/ticket/5026

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-01 13:00:07 +02:00
Tomas Babej a6d448b8bf idviews: Set dcerpc detection flag properly 
The availability of dcerpc bindings is being checked on the client
side as well, hence we need to define it properly.

https://fedorahosted.org/freeipa/ticket/5025

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2015-07-01 12:57:22 +02:00
Rob Crittenden 57429c1cfa Don't rely on positional arguments for python-kerberos calls 
Upstream PyKerberos uses a different argument ordering than
from the patch that Fedora/RHEL was carrying for
authGSSClientInit().

Using named arguments provides forwards and backwards
compatibility.

https://fedorahosted.org/freeipa/ticket/5085

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2015-07-01 12:20:07 +02:00
Fraser Tweedale 7f923f922a certprofile: fix doc error 
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-29 17:14:00 +02:00
Petr Vobornik 5397150979 Verify replication topology for a suffix 
Checks done:
  1. check if the topology is not disconnected. In other words if
     there are replication paths between all servers.
  2. check if servers don't have more than a recommended number of
     replication agreements(4)

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-06-29 17:11:53 +02:00
Petr Vobornik 659b88b820 topology: check topology in ipa-replica-manage del 
ipa-replica-manage del now:
- checks the whole current topology(before deletion), reports issues
- simulates deletion of server and checks the topology again, reports issues

Asks admin if he wants to continue with the deletion if any errors are found.

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-06-29 17:11:08 +02:00
root ffd6b039a7 User life cycle: permission to delete a preserved user 
Add permission to delete an entry from Delete container

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-29 13:50:04 +02:00
Milan Kubík b3c7805e88 Fix for a typo in certprofile mod command. 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2015-06-23 10:30:49 +02:00
Petr Vobornik baca55c665 webui: adjust user deleter dialog to new api 
In user_del, flags 'permanently' and 'preserve' were replaced with single
bool option 'preserve'

part of: https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-06-18 15:50:44 +02:00
Jan Cholasta 1d60825138 User life cycle: change user-del flags to be CLI-specific 
Rename --permanently to --no-preserve.

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-06-18 15:48:53 +02:00
Martin Basti 3ababb763b DNS: add UnknownRecord to schema 
defintion of UnknownRecord attributetype

https://fedorahosted.org/freeipa/ticket/4939

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-06-18 14:37:28 +02:00
Nathaniel McCallum 4dfa23256d Fix OTP token URI generation 
Google Authenticator fails if the algorithm is not uppercase.

https://fedorahosted.org/freeipa/ticket/5047

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-06-17 16:46:25 +02:00
Jan Cholasta 69607250b9 User life cycle: provide preserved user virtual attribute 
https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2015-06-15 16:13:22 +02:00
Petr Vobornik d58bdf29a5 server: add "del" command 
this command is internal and is supposed to be used by ipa-replica-managed to
delete replica.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-15 16:06:48 +02:00
Thierry Bordaz 44cced658b Stage User: Fix permissions naming and split them where apropriate. 
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2015-06-15 09:52:42 +02:00
Petr Vobornik bb6c0b9c63 topology: fix swapped topologysegment-reinitialize behavior 
setting "nsds5BeginReplicaRefresh;left" to "start" reinintializes the
right node and not the left node. This patch fixes API to match the
behavior.

part of: https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-15 09:41:48 +02:00
Petr Vobornik 6b153ba876 topology: restrict direction changes 
topology plugin doesn't properly handle:
- creation of segment with direction 'none' and then upgrade to other
  direction
- downgrade of direction

These situations are now forbidden in API.

part of: https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-06-15 09:38:46 +02:00
Petr Spacek d84680473b DNSSEC: Detect zone shadowing with incorrect DNSSEC signatures. 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-11 16:08:42 +02:00