public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,474 Commits 9 Branches 0 Tags
5fef2ecb399129b7d4e96eb47ec1d03f586a2b52
Commit Graph
105 Commits
Author SHA1 Message Date
Tomas Babej 1f8f762b84 ipalib: host_del: Extend LDAPDelete's takes_options instead of overriding 
The host-del command did not accept --continue option, since the
takes_options was overriden and did not take the options from LDAPDelete.

Fix the behaviour.

https://fedorahosted.org/freeipa/ticket/4473

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-17 09:36:27 +02:00
Petr Viktorin 6ce44c4f05 permission plugin: Auto-add operational atttributes to read permissions 
The attributes entryusn, createtimestamp, and modifytimestamp
should be readable whenever thir entry is, i.e. when we allow reading
the objectclass.
Automatically add them to every read permission that includes objectclass.

https://fedorahosted.org/freeipa/ticket/4534

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-12 18:22:17 +02:00
Martin Basti 028b3d1009 Tests: DNS wildcard records 
Ticket: https://fedorahosted.org/freeipa/ticket/4488
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-09-05 12:29:29 +02:00
Martin Basti 7e76bba512 Fix DNS record rename test 
bind-dyndb-ldap's bug caused test failure
https://fedorahosted.org/bind-dyndb-ldap/ticket/123

Owners with NS record works with the bug

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 12:11:39 +02:00
Martin Basti 2b3be21b25 Test: DNS NS validation 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 12:11:39 +02:00
Martin Basti 155126b524 Tests: DNS dsrecord validation 
Part of: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-05 12:11:39 +02:00
Martin Basti 62a2559493 Fix dnsrecord-mod raise error if last record attr is removed 
Removing last record attribute causes output type validation error

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 10:34:11 +02:00
Petr Viktorin a8ba6b3b8c service: Normalize service principal in get_dn 
This will make any lookup go through the normalization.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Petr Viktorin 8fabd6dde1 Support delegating RBAC roles to service principals 
https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Martin Basti 4b5a488249 Tests: host tests with dns 
Test for: https://fedorahosted.org/freeipa/ticket/4164

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-08-11 16:01:38 +02:00
Martin Basti ca001814ab Allow to add host if AAAA record exists 
http://fedorahosted.org/freeipa/ticket/4164

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-08-11 16:01:38 +02:00
Jan Cholasta 34de95545d Add test for baseldap.entry_to_dict. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-08-04 11:21:32 +02:00
David Kupka f7e00b9ad6 test group: remove group from protected group. 
Related to https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-29 17:07:11 +02:00
Petr Viktorin cd4fd60c0e test_xmlrpc: Update tests 
- The number of permissions in $SUFFIX changed.
- A new ACI was added to realmdomains

Update the tests.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-18 15:03:12 +02:00
Martin Basti 80cb95da36 Test DNS: add zone with consecutive dash characters 
Test for ticket: https://fedorahosted.org/freeipa/ticket/4268

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:01 +02:00
Martin Basti 2203abfca8 Test DNS: TLSA record 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:01 +02:00
Martin Basti c48cee99a2 Test DNS: test zone normalization 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-04 18:45:00 +02:00
Martin Basti 2637116eab Allow to add managed permission for reverse zones 
Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:10:33 +02:00
Martin Basti 52bcf5345c Fix tests dns_realmdomains_integration 
Added warning message about forwarders

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-04 10:22:30 +02:00
Martin Basti 01b95805ab NSEC3PARAM tests 
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:42 +02:00
Martin Basti ff7b44e3b0 Remove NSEC3PARAM record 
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti 152c8f210b Check normalization only for IDNA domains 
Backward compability with older IPA versions which allow to use uppper
case. Only IDNA domains will be checked.

https://fedorahosted.org/freeipa/ticket/4382

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-01 09:58:42 +02:00
Petr Viktorin fdef2e1bd8 permission plugin: Ignore unparseable ACIs 
When manipulating a permission for an entry that has an ACI
that the parser cannot process, skip this ACI instead of
failing.

Add a test that manipulates permission in cn=accounts,
where there are complex ipaAllowedOperation-based ACIs.

Workaround for: https://fedorahosted.org/freeipa/ticket/4376

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 09:35:38 +02:00
Petr Viktorin 628bed8673 test_permission_plugin: Fix permission_find test for legacy permissions 
Most of the legacy permissions have been removed.
Do not test that there are many of them.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:41 +02:00
Petr Viktorin ac8539bd34 Add posixgroup to groups' permission object filter 
Private groups don't have the 'ipausergroup' objectclass.
Add posixgroup to the objectclass filters to make
"--type group" permissions apply to all groups.

https://fedorahosted.org/freeipa/ticket/4372

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-23 10:54:43 +02:00
Petr Viktorin 013bf3d4e2 Test and docstring fixes 
The recent conversions to managed permissions left behind a few
failing tests. Fix them.

Also fix a now incorrect docstring in ipalib.config.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-23 10:54:42 +02:00
Martin Basti ee6e634c28 DNSSEC: Test: DLV record 
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-06-20 16:46:03 +02:00
Martin Basti 4c88fdd904 Tests: tests for NSEC3PARAM records 
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-06-20 15:41:40 +02:00
Martin Basti cbc64454b0 Tests: remove unused records from tests 
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-06-20 15:41:40 +02:00
Martin Basti 11c250a612 Tests DNS: forward zones 
design: http://www.freeipa.org/page/V4/Forward_zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-06-20 13:14:45 +02:00
Tomas Babej 637ef11109 sudorule: Allow unsetting sudoorder 
After setting sudoorder, you are unable to unset it, since the
check for uniqueness of order of sudorules is applied incorrectly.

Fix the behaviour and cover it in the test suite.

https://fedorahosted.org/freeipa/ticket/4360

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-18 12:59:25 +02:00
Tomas Babej 4d2ef43f28 ipaplatform: Move all filesystem paths to ipaplatform.paths module 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:20 +02:00
Petr Viktorin ba53299b98 ipalib.frontend: Do API version check before converting arguments 
This results in the proper message being shown if the client sends
an option the server doesn't have yet.

It also adds the check to commands that override run() but not __call__,
such as `ipa ping`, and to commands run on the server. Adjust tests
for these changes.

https://fedorahosted.org/freeipa/ticket/3963

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-13 14:15:06 +02:00
Petr Viktorin 3974c75053 test_permission_plugin: limit results in targetfilter find test 
The test was finding recently added default permissions. Limit it to
the test permission only.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
 2014-06-04 13:35:13 +02:00
Martin Basti c123d95084 Test DNS: dnsrecord-* zone.test. zone.test. should work 
Old ipa versions allows only "dnsrecord-* zone.test. @"

This issue was fixed in ticket:
https://fedorahosted.org/freeipa/ticket/3169

Ticket: https://fedorahosted.org/freeipa/ticket/4232
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-03 16:43:09 +02:00
Martin Basti 67565d38af Test DNS: wildcard in RR owner 
Only test, issue was fixed in
https://fedorahosted.org/freeipa/ticket/3169

Ticket: https://fedorahosted.org/freeipa/ticket/3148
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-03 16:43:09 +02:00
Martin Basti 7860c63fb1 DNS new tests 
Added new internationalized DNS tests

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-06-03 15:55:32 +02:00
Martin Basti ef71d88bdf DNS modified tests 
* working with absolute zone names
* working with DNSName as returned value

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-06-03 15:55:32 +02:00
Petr Viktorin 8bbd52e347 pwpolicy-mod: Fix crash when priority is changed 
The exc_callback was expecting the old update_entry signature,
(dn, attrs). This was changed to just (entry) for ticket #2660,
see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API.

Update the exc_callback to expect the entry as first argument,
and add some tests.

https://fedorahosted.org/freeipa/ticket/4309

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-05-28 15:58:24 +02:00
Tomas Babej 004071a246 ipatests: Add test for denying expired principals 
Part of: https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <simo@redhat.com>
 2014-05-05 19:06:39 +03:00
Tomas Babej 473a9fd238 ipatests: Add coverage for setting krbPrincipalExpiration 
Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-05-05 19:01:04 +03:00
Tomas Babej 4568a52953 ipatests: Fix formatting errors in test_user_plugin.py 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-05-05 19:01:04 +03:00
Tomas Babej ecaf87c007 ipatests: Cover DateTime in test_parameters.py 
Adds tests for newly added DateTime parameter, focusing on conversion
of accepted datetime formats.

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-05-05 18:57:29 +03:00
Tomas Babej 01558a77df ipatests: Extend test suite for ID ranges 
Add tests coverage for recently added ID range checks dependant
on the ID range types.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-23 13:19:57 +02:00
Jan Cholasta a8dd7aa337 Use raw attribute values in command result when --raw is specified. 
For backward compatibility, the values are converted to unicode, unless the
attribute is binary or the conversion fails.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-04-18 14:59:20 +02:00
Jan Cholasta 4314d02fbf Allow primary keys to use different type than unicode. 
Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-04-18 14:59:20 +02:00
Petr Viktorin b53f2d28fd Add managed read permissions to krbtpolicy 
Unlike other objects, the ticket policy is stored in different
subtrees: global policy in cn=kerberos and per-user policy in
cn=users,cn=accounts.
Add two permissions, one for each location.

Also, modify tests so that adding new permissions in cn=users
doesn't cause failures.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
 2014-04-16 16:10:43 +02:00
Petr Viktorin 3deb76cf17 Fix expected output in permission tests 
There is now a second permission affecting krbMinPwdLife.
Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-15 09:45:40 +02:00
Petr Viktorin db85ea32c1 test_realmdomains_plugin: Add default ACI to expected output 
Since realmdomains is only one entry, _show with --all will return
the ACI on it. Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-04-11 12:45:14 +02:00
Adam Misnyovszki 8b91d9a6e8 automember rebuild nowait feature added 
automember-rebuild uses asynchronous 389 task, and returned
success even if the task didn't run. this patch fixes this
issue adding a --nowait parameter to 'ipa automember-rebuild',
defaulting to False, thus when the script runs without it,
it waits for the 'nstaskexitcode' attribute, which means
the task has finished. Old usage can be enabled using --nowait,
and returns the DN of the task for further polling.
New tests added also.

https://fedorahosted.org/freeipa/ticket/4239

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-04-09 13:45:32 +02:00