public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,398 Commits 9 Branches 0 Tags
4832f2986d1a457acf3ff000433aa0732364c19c
Commit Graph
2436 Commits
Author SHA1 Message Date
Petr Vobornik 4832f2986d webui: login screen - improved button switching 
- added cancel button to reset password view of login screen
- re-implemented buttons hiding mechanism
- switching between 'Reset Password' and 'Reset Password and Login' according to presence of value in OTP field

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 19:28:06 +02:00
Petr Vobornik cba5247f99 webui: improved info msgs on login/token sync/reset pwd pages 
- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 19:28:06 +02:00
Petr Vobornik a94fc09b57 webui: display expired session notification in a more visible area 
The notification is a primary information of the page. It should be more highlighted.

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 19:28:06 +02:00
Petr Vobornik e995d2b827 webui: better error reporting 
On page:
- styled to use proper line breaks
- "centered" by .container class and not by huge padding

Console:
- proper line breaks
- links in stack trace are clickable(Chrome)

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 10:42:57 +02:00
Thierry bordaz (tbordaz) 04ea75a7a5 User Life Cycle: create containers and scoping DS plugins 
User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
		Active: cn=users,cn=accounts,$SUFFIX
		Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
		Stage:  cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX

Plugins scopes:
		krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
			cn=accounts,SUFFIX
			cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
		DNA:
			cn=accounts,SUFFIX

		Plugins exclude subtree:
		IPA UUID, Referential Integrity, memberOf:
			cn=provisioning,SUFFIX

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-08-19 09:48:20 +02:00
Jan Cholasta 359dfe58b9 Convert external CA chain to PKCS#7 before passing it to pkispawn. 
https://fedorahosted.org/freeipa/ticket/4397

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-08-14 10:06:27 +02:00
Jan Cholasta 044c5c833a Enable NSS PKIX certificate path discovery and validation for Dogtag. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 03b29b4c8e Update external CA cert in Dogtag NSS DB on IPA CA cert renewal. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta d27e77adc5 Allow upgrading CA-less to CA-full using ipa-ca-install. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 8bbdfff102 Allow adding CA certificates to certificate store in ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 1b8a1e5564 Update CS.cfg on IPA CA certificate chaining change in renew_ca_cert. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 18aa3216e0 Allow changing chaining of the IPA CA certificate in ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta f1e186d7d8 Export full CA chain to /etc/ipa/ca.crt in ipa-server-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2b7a7c356c Get up-to-date CA certificates from certificate store in ipa-replica-install. 
Previously it used CA certificate from the replica info file directly.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 9e223e6fd4 Upload renewed CA cert to certificate store on renewal. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 586373cf07 Add permissions for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta fd80cc1c59 Configure attribute uniqueness for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 1c612ad3e1 Add container for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 25c10bc161 Add LDAP schema for certificate store. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 61f166da5d Add LDAP schema for wrapped cryptographic keys. 
This is part of the schema at
<http://www.freeipa.org/page/V4/PKCS11_in_LDAP/Schema>.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta d2bf0b8b54 Fix trust flags in HTTP and DS NSS databases. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 52f72ec058 Do not treat the IPA RA cert as CA cert in DS NSS database. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 1778f0ebc9 Allow IPA master hosts to read and update IPA master information. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 61159b7ff2 Check that renewed certificates coming from LDAP are actually renewed. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 7086183519 Do not use ldapi in certificate renewal scripts. 
This prevents SELinux denials when accessing the ldapi socket.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta d1386be4d5 Pick new CA renewal master when deleting a replica. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 031096324d Alert user when externally signed CA is about to expire. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta ba3c7b4a89 Add CA certificate management tool ipa-cacert-manage. 
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2c43a3d0d5 Move external cert validation from ipa-server-install to installutils. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 2f6990c256 Track CA certificate using dogtag-ipa-ca-renew-agent. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 9393c3978e Automatically update CA certificate in LDAP on renewal. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 73d8db6d92 Allow IPA master hosts to update CA certificate in LDAP. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 35857026e6 Support CA certificate renewal in dogtag-ipa-ca-renew-agent. 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 1313537736 Check if /root/ipa.csr exists when installing server with external CA. 
Remove the file on uninstall.

https://fedorahosted.org/freeipa/ticket/4303

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-28 19:28:27 +02:00
Martin Basti 42d035f64c FIX: named_enable_dnssec should verify if DNS is installed 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-28 17:42:38 +02:00
Petr Vobornik 8288135b5b webui: add bounce url to reset_password.html 
reset_password.html now redirects browser to URL specified in 'redirect'
uri component (if present).

The component has to be URI encoded. ie (in browser console):

$ encodeURIComponent('http://pvoborni.fedorapeople.org/doc/#!/guide/Debugging')

-->
"http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging"

-->

https://my.freeipa.server/ipa/ui/reset_password.html?redirect=http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging

https://fedorahosted.org/freeipa/ticket/4440

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:36:08 +02:00
Petr Vobornik ac7df79a43 webui: remove remaining action-button-disabled occurrences 
Buttons in hbactest check for 'action-button-disabled' but it's never set.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:24:21 +02:00
Petr Vobornik 3966417779 webui: replace action_buttons with action_widget 
Simplify code base by reuse of 'disable' feature of button_widget. All
occurrences of action-button which were disabled/enabled were replaced
by button-widget.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:24:21 +02:00
Petr Vobornik 9aed114d82 webui: detach facet nodes 
Detach/attach facet nodes when switching facets instead of
hiding/showing.

Keeps dom-tree more simple.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:21:37 +02:00
Petr Vobornik fb975bba20 webui: internet explorer fixes 
Fixed:
1. IE doesn't support value 'initial' in CSS rule.
2. setting innerHTML='' also destroys content of child nodes in
LoginScreen in IE -> reattached buttons have no text.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:20:15 +02:00
Petr Vobornik 4059aa12a4 webui: fix nested items creation in dropdown list 
Items nested in other items were created in root list instead of nested list.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:18:44 +02:00
Petr Vobornik 855c59c7fc webui: support wildcard attribute level rights 
Reproduction:
* add 'extensibleObject' object class to target object

https://fedorahosted.org/freeipa/ticket/4380

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-28 10:13:24 +02:00
Nathaniel McCallum d3638438fc Add TOTP watermark support 
This prevents the reuse of TOTP tokens by recording the last token
interval that was used. This will be replicated as normal. However,
this patch does not increase the number of writes to the database
in the standard authentication case. This is because it also
eliminates an unnecessary write during authentication. Hence, this
patch should be write-load neutral with the existing code.

Further performance enhancement is desired, but is outside the
scope of this patch.

https://fedorahosted.org/freeipa/ticket/4410

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-25 10:41:17 +02:00
Martin Kosek 15eb343b9c Allow hashed passwords in DS 
Without nsslapd-allow-hashed-passwords being turned on, user password
migration fails.

https://fedorahosted.org/freeipa/ticket/4450

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-25 10:36:47 +02:00
David Kupka 603842867c Improve password validity check. 
Allow use of characters that no longer cause troubles. Check for
leading and trailing characters in case of 389 Direcory Manager password.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-24 14:22:40 +02:00
Petr Vobornik ad593a5c06 webui: fix disabled state of service's PAC type 
Nested options (MS-PAC and PAD) of service's PAC type should be
disabled if no value is supplied (default value is "Inherited
from server configuration"). That was not the case - regression.

This patch fixes it and along with it simplifies the update method
of option_widget_base to be more comprehensible.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 12:39:16 +02:00
Petr Vobornik 8ba75506c2 webui: disable ipapermbindruletype if permission in a privilege 
User is not able to change Bind Rule Type if permission is already
member of a privilege. Let's disable it and don't confuse user.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 12:30:23 +02:00
Petr Vobornik 62ac6edcf4 webui: fix selection of empty value in a select widget 
Little regression - select widget could not handle empty or no array as an
input value.

It broke 'undo' operation in Permissions' 'Type' attribute while switching
between '' and some value.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 12:30:23 +02:00
Petr Vobornik 75a96fb4c2 webui: show managed fields as readonly and not disabled 
Visible read-only fields are no longer displayed as disabled in
permission details facet.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 12:30:23 +02:00
Petr Vobornik e60cfa2862 webui: fix add of input group class 
The input-group class was added based on visibility of child elements.

This failed when it had to be determined *before* displaying the widget.

Now it's added if the buttons are not hidden by `display: none` CSS rule.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 12:30:23 +02:00