public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,276 Commits 9 Branches 0 Tags
2ff14607b170c86ccd93cff60f5a34d64cd1e419
Commit Graph
7276 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David Kupka 2ff14607b1 Fix ipa-client-install --uninstall crash 
Fix ipa-client-install crash when chronyd service fails to start.

https://fedorahosted.org/freeipa/ticket/4273

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-08 10:29:13 +02:00
Petr Viktorin 1e58588ec2 Become IPA 4.0.0 2014-07-07 16:59:07 +02:00
Petr Viktorin 518c8a5f9d Update translations 
Pull new translations from Transifex
Thanks to all translators!
 2014-07-07 16:05:21 +02:00
Petr Vobornik d0c12fb0c0 webui: display messages contained in API responses 
API responses can contain warnings in "messages" array. This patch
also adds support for displaying multiple notifications at the same
time in order to show the message and a status of finished operation.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-07 15:30:41 +02:00
Petr Viktorin afe067b1ab makeaci: Use the DN where the ACI is stored, not the permission's DN 
Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-07-07 14:42:52 +02:00
Martin Kosek 5434851efd Prepare spec for 4.0 release 
- Bump 389-ds-base requires to fix the deref call with new ACIs:
  https://fedorahosted.org/freeipa/ticket/4389
- Bump bind-dyndb-ldap Conflicts to fetch the DNSSEC capability
- Bump selinux-policy to fix the CRL retrieval:
  https://fedorahosted.org/freeipa/ticket/4369
- Remove conditionals for Fedora < 20 as FreeIPA 4.0 is not planned
  to be released on these platforms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:57:41 +02:00
Martin Basti 80cb95da36 Test DNS: add zone with consecutive dash characters 
Test for ticket: https://fedorahosted.org/freeipa/ticket/4268

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:01 +02:00
Martin Basti 2203abfca8 Test DNS: TLSA record 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:01 +02:00
Martin Basti c48cee99a2 Test DNS: test zone normalization 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:00 +02:00
Petr Vobornik 0b0e77cf99 webui: new navigation structure 
https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:31:38 +02:00
Martin Basti 2637116eab Allow to add managed permission for reverse zones 
Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:10:33 +02:00
Petr Viktorin 23feb4e027 Allow read access to services in cn=masters to auth'd users 
https://fedorahosted.org/freeipa/ticket/4425

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 15:58:14 +02:00
Petr Viktorin 2f99140c92 ldapupdate: Restore 'replace' functionality 
The replace directive was made a no-op by mistake in commit 6381d76.
Restore it.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 15:51:55 +02:00
Martin Basti f8b6595f49 Restore privileges after forward zones update 
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 12:48:50 +02:00
Martin Basti 3461be5c78 Fix: Missing ACI for records in 40-dns.update 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 12:27:24 +02:00
Martin Kosek ef83a0c678 Add Modify Realm Domains permission 
The permission is required for DNS Administrators as realm domains
object is updated when a master zone is added.

https://fedorahosted.org/freeipa/ticket/4423

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 12:17:04 +02:00
Martin Basti 52bcf5345c Fix tests dns_realmdomains_integration 
Added warning message about forwarders

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 10:22:30 +02:00
Martin Basti 29951ada9f Non IDNA zonename should be normalized to lowercase 
Before IDNA support zone was normalized.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 09:26:49 +02:00
Petr Viktorin 6f2451ce9e test_ipaserver: Add OTP token test data to ipatests package 
The missing files caused test failures when running tests out of tree.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 09:03:49 +02:00
Petr Viktorin a7e400fa65 test_ipagetkeytab: Fix expected error message 
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 08:51:42 +02:00
Petr Vobornik bc1979ac09 webui: change ipatokennotbefore and ipatokennotafter types to datetime 
https://fedorahosted.org/freeipa/ticket/3369

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 08:47:58 +02:00
Tomas Babej 9bf29c270d ipalib: Use DateTime parameter class for OTP token timestamp attributes 
For ipatokennotbefore and ipatokennotafter attributes use DateTime
parameter class instead of Str, since these are represented as
LDAP Generalized Time in LDAP.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-04 08:17:37 +02:00
Alexander Bokovoy a9fe37e066 ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration 
When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 08:13:23 +02:00
Petr Vobornik 76ec9384fb webui-build: use /usr/share/java/js.jar instead of rhino.jar 
/usr/share/java/rhino.jar is a Fedora's symlink to /usr/share/java/js.jar

Debian doesn't have it. Direct usage of upstream /usr/share/java/js.jar should
work on both systems.

Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
 2014-07-03 14:19:25 +02:00
Martin Basti 21c829ffa5 Fix incompatible permission name *zone-del 
Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 14:04:57 +02:00
Martin Basti eea1015441 Fix upgrade to forward zones 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 14:04:57 +02:00
Martin Basti 1c5fa1c28d Split dns docstring 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d22d971575 Help for forward zones 
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d18eea4578 Use documentation addresses in dns help 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 70224597a8 Add DNSSEC experimental support warning message 
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 33cf958b98 Add warning about semantic change for zones 
--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:08 +02:00
Martin Basti 3b310d6b4f DNSSEC: Add experimental support for DNSSEC 
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-02 18:41:57 +02:00
Martin Basti 5c2ddaf660 Allow to add non string values to named conf 
Non string values should not start and end with '"' in options section
in named.conf

Required by ticket: https://fedorahosted.org/freeipa/ticket/4408

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-02 18:41:57 +02:00
Martin Kosek c4b63dc48a Clear NSS session cache when socket is closed 
Even when NSS connection is closed, there may be still cached
certificates in the NSS lib. This may cause subsequent NSS
initialization to crash. This problem especially reproduces in the
unit tests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-02 16:31:50 +02:00
Petr Viktorin 8c98561c20 Do not fail if there are multiple nsDS5ReplicaId values in cn=replication,cn=etc 
On systems installed before #3394 was fixed and nsDS5ReplicaId became
single-valued, there are two replica ID values stored in cn=replication:
the default (3) and the actual value we want.
Instead of failing when multiple values are found, use the largest one.

https://fedorahosted.org/freeipa/ticket/4375

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-02 16:16:09 +02:00
Tomas Babej a5bb758978 ipaldap: Override conversion of nsds5replicalast{update,init}{start,end} 
The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-02 16:12:05 +02:00
Martin Basti 01b95805ab NSEC3PARAM tests 
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:42 +02:00
Martin Basti 30551a8aa3 Add NSEC3PARAM to zone settings 
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti ff7b44e3b0 Remove NSEC3PARAM record 
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Kosek 21e1e4ac3b Update X-ORIGIN for 4.0 
It was decided not to change the OID space for FreeIPA 4.0+ objectclasses.
However, we should still at least properly mark the X-ORIGIN to make
analyzing schema easier.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-01 13:57:06 +02:00
Martin Basti c655aa2832 Fix ACI in DNS 
Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-01 12:43:55 +02:00
Martin Basti 8e911fcabc DNSSEC: WebUI: add TLSA record 
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-01 12:37:08 +02:00
Martin Basti 12cb31575c DNSSEC: add TLSA record type 
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-01 12:37:08 +02:00
Petr Vobornik 99c5f0511f webui: focus invalid widget on validation error 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:46 +02:00
Petr Vobornik c693b28bab webui: fix required error notification in multivalued widget 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:46 +02:00
Petr Vobornik 93de5db39e webui: show notification instead of modal dialog on validation error 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:45 +02:00
Petr Viktorin d1ede20680 Allow admins to write krbLoginFailedCount 
Without write access to this attribute, admins could not unlock users.

https://fedorahosted.org/freeipa/ticket/4409

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 10:02:02 +02:00
Martin Basti 152c8f210b Check normalization only for IDNA domains 
Backward compability with older IPA versions which allow to use uppper
case. Only IDNA domains will be checked.

https://fedorahosted.org/freeipa/ticket/4382

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-01 09:58:42 +02:00
Petr Viktorin fdef2e1bd8 permission plugin: Ignore unparseable ACIs 
When manipulating a permission for an entry that has an ACI
that the parser cannot process, skip this ACI instead of
failing.

Add a test that manipulates permission in cn=accounts,
where there are complex ipaAllowedOperation-based ACIs.

Workaround for: https://fedorahosted.org/freeipa/ticket/4376

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 09:35:38 +02:00
Martin Kosek 5ff8e3d8b3 Remove python-cherrypy BuildRequires 
As FreeIPA Foreman Smartproxy was moved to separate repo,
python-cherrypy is no longer required as a build dependency.
 2014-07-01 09:25:42 +02:00