public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,474 Commits 9 Branches 0 Tags
5fef2ecb399129b7d4e96eb47ec1d03f586a2b52
Commit Graph
1478 Commits
Author SHA1 Message Date
Tomas Babej 1f8f762b84 ipalib: host_del: Extend LDAPDelete's takes_options instead of overriding 
The host-del command did not accept --continue option, since the
takes_options was overriden and did not take the options from LDAPDelete.

Fix the behaviour.

https://fedorahosted.org/freeipa/ticket/4473

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-17 09:36:27 +02:00
Petr Viktorin 6ce44c4f05 permission plugin: Auto-add operational atttributes to read permissions 
The attributes entryusn, createtimestamp, and modifytimestamp
should be readable whenever thir entry is, i.e. when we allow reading
the objectclass.
Automatically add them to every read permission that includes objectclass.

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-12 18:22:17 +02:00
Petr Vobornik 15e85db8f8 webui: add i18n for the rest of QR code strings 
https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-11 17:55:17 +02:00
Petr Vobornik 325bbf5bbf webui: add token from user page 
Add 'Add OTP Token' action to user action menu.

This option is disabled in self-service when viewing other users.

https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-11 17:55:17 +02:00
Petr Vobornik 475f6e293e webui: better otp token type label 
https://fedorahosted.org/freeipa/ticket/4402

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-11 17:55:17 +02:00
Nathaniel McCallum 9c50f9f957 Update qrcode support for newer python-qrcode 
This substantially reduces the FreeIPA dependencies and allows
QR codes to fit in a standard terminal.

https://fedorahosted.org/freeipa/ticket/4430

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-09-11 12:48:07 +02:00
Petr Viktorin 68d656f80a Fix: Add managed read permissions for compat tree and operational attrs 
This is a fix for an earlier version, which was committed by mistake as:
master: 418ce870bf
ipa-4-0: 3e2c86aeabbd2e3c54ad73a40803ef2bf5b0cb17
ipa-4-1: 9bcd88589e30d31d3f533cd42d2f816ef01b07c7

Thanks to Alexander Bokovoy for contributions

https://fedorahosted.org/freeipa/ticket/4521
 2014-09-05 15:40:13 +02:00
Petr Viktorin 418ce870bf Add managed read permissions for compat tree 
https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-05 13:50:29 +02:00
Martin Basti 16ecbb1507 FIX DNS wildcard records (RFC4592) 
Make validation more strict

* DS, NS, DNAME owners should not be a wildcard domanin name
* zone name should not be a wildcard domain name

Ticket: https://fedorahosted.org/freeipa/ticket/4488
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-09-05 12:29:29 +02:00
Martin Basti d0130195a9 DNS fix NS record coexistence validator 
NS can coexistent only with A, AAAA, DS, NS record

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 12:11:39 +02:00
Martin Basti 3be8ff6c46 DNSSEC: fix DS record validation 
Part of: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 12:11:39 +02:00
Martin Basti 62a2559493 Fix dnsrecord-mod raise error if last record attr is removed 
Removing last record attribute causes output type validation error

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 10:34:11 +02:00
Nathaniel McCallum e26b3e14eb Ensure ipaUserAuthTypeClass when needed on user creation 
Also, remove the attempt to load the objectClasses when absent. This
never makes sense during an add operation.

https://fedorahosted.org/freeipa/ticket/4455

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-09-03 13:13:16 +02:00
Petr Viktorin c8aefc23a4 permission plugin: Improve description of the target option 
https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-03 12:57:04 +02:00
Petr Viktorin 4fbba3f7b8 permission plugin: Make --target available in the CLI 
This was left out by mistake when permissions were refactored.
The API is already tested.

https://fedorahosted.org/freeipa/ticket/4522
 2014-09-03 12:16:43 +02:00
Thorsten Scherf a2eab057d4 pwpolicy-add: Added better error handling 
Make error message more meaningful when a password policy is added for a non
    existing group.

    https://fedorahosted.org/freeipa/ticket/4334

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-02 10:40:12 +02:00
Gabe 9415aba877 ipa trust-add command should be interactive 
- Make ipa trust-add command interactive for realm_admin and realm_passwd
- Fix 'Active directory' typo to 'Active Directory'

https://fedorahosted.org/freeipa/ticket/3034

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-08-25 12:32:29 +02:00
Petr Viktorin a8ba6b3b8c service: Normalize service principal in get_dn 
This will make any lookup go through the normalization.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Petr Viktorin 8fabd6dde1 Support delegating RBAC roles to service principals 
https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Petr Vobornik 27128bd8f5 webui: better authentication types description 
Tooltips were added to "User authentication types" and "Default user
authentication types" to describe their relationship and a meaning of
not-setting a value.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-21 10:47:08 +02:00
Petr Vobornik cba5247f99 webui: improved info msgs on login/token sync/reset pwd pages 
- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 19:28:06 +02:00
David Kupka 724391a71b Verify otptoken timespan is valid 
When creating or modifying otptoken check that token validity start is not after
validity end.

https://fedorahosted.org/freeipa/ticket/4244

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-29 17:09:29 +02:00
David Kupka 6119c21441 Fix group-remove-member crash when group is removed from a protected group 
https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-29 13:10:51 +02:00
Jan Cholasta 785e13dd1e Exclude attributelevelrights from --raw result processing in baseldap. 
https://fedorahosted.org/freeipa/ticket/4371

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-29 12:00:13 +02:00
Tomas Babej e74307caa6 ipalib: idrange: Make non-implemented range types fail the validation 
The ipa-ipa-trust and ipa-ad-winsync ID Range types were allowed to
pass the validation tests, however, they are not implemented nor
checked by the 389 server plugin.

https://fedorahosted.org/freeipa/ticket/4323

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-28 12:18:23 +02:00
Petr Vobornik c475c093c9 baseldap: return 'none' attr level right as unicode string 
Returning non-unicode causes serialization into base64 which causes havoc
in Web UI.

https://fedorahosted.org/freeipa/ticket/4454

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-25 13:27:33 +02:00
Tomas Babej 3812ca03f2 baseldap: Remove redundant search from LDAPAddReverseMember and LDAPRemoveReverseMember 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-23 15:12:30 +02:00
Petr Vobornik 4aefc0d6fe webui: custom attr in attributes widget 
Web UI doesn't always know what are the possible attributes
for target object. This will allow to add custom attributes
if necessary.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 10:47:06 +02:00
Petr Vobornik 740d42257f webui: add filter to attributes widget 
Adds filter field to attribute box in permissions for better user
experience. User can then quickly find the desired attribute.

Initial version of the patch authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 10:47:06 +02:00
Gabe 9a0aae0133 Fix typos in dns.py 
https://fedorahosted.org/freeipa/ticket/4429

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
 2014-07-18 10:05:25 +02:00
Tomas Babej e672a39637 trusts: Validate missing trust secret properly 
Detect the situation if the user passes empty trust secret and
error out properly.

https://fedorahosted.org/freeipa/ticket/4266

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-14 16:04:58 +02:00
Petr Viktorin fcd2922d86 baseldap: Return empty string when no effective rights are found 
DS returns the string "none" when no rights were found. All clients
would need to special-case this value when checking the rights.
Return empty string instead.

https://fedorahosted.org/freeipa/ticket/4359

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-09 11:39:34 +02:00
Petr Vobornik 03c25bd98e webui: capitalize labels of undo and undo all buttons 
Make the label of these buttons consistent with other buttons which have
capital first letters.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2014-07-08 12:00:30 +02:00
Petr Vobornik 0b0e77cf99 webui: new navigation structure 
https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:31:38 +02:00
Martin Basti 2637116eab Allow to add managed permission for reverse zones 
Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:10:33 +02:00
Martin Kosek ef83a0c678 Add Modify Realm Domains permission 
The permission is required for DNS Administrators as realm domains
object is updated when a master zone is added.

https://fedorahosted.org/freeipa/ticket/4423

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 12:17:04 +02:00
Martin Basti 29951ada9f Non IDNA zonename should be normalized to lowercase 
Before IDNA support zone was normalized.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 09:26:49 +02:00
Tomas Babej 9bf29c270d ipalib: Use DateTime parameter class for OTP token timestamp attributes 
For ipatokennotbefore and ipatokennotafter attributes use DateTime
parameter class instead of Str, since these are represented as
LDAP Generalized Time in LDAP.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-04 08:17:37 +02:00
Martin Basti 21c829ffa5 Fix incompatible permission name *zone-del 
Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 14:04:57 +02:00
Martin Basti 1c5fa1c28d Split dns docstring 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d22d971575 Help for forward zones 
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d18eea4578 Use documentation addresses in dns help 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 70224597a8 Add DNSSEC experimental support warning message 
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 33cf958b98 Add warning about semantic change for zones 
--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:08 +02:00
Martin Basti 30551a8aa3 Add NSEC3PARAM to zone settings 
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti ff7b44e3b0 Remove NSEC3PARAM record 
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti c655aa2832 Fix ACI in DNS 
Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-01 12:43:55 +02:00
Martin Basti 12cb31575c DNSSEC: add TLSA record type 
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-01 12:37:08 +02:00
Petr Viktorin fdef2e1bd8 permission plugin: Ignore unparseable ACIs 
When manipulating a permission for an entry that has an ACI
that the parser cannot process, skip this ACI instead of
failing.

Add a test that manipulates permission in cn=accounts,
where there are complex ipaAllowedOperation-based ACIs.

Workaround for: https://fedorahosted.org/freeipa/ticket/4376

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 09:35:38 +02:00
Martin Kosek 50c30c8401 Let Host Administrators use host-disable command 
Host Administrators could not write to service keytab attribute and
thus they could not run the host-disable command.

https://fedorahosted.org/freeipa/ticket/4284

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-30 14:59:27 +02:00