public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,028 Commits 9 Branches 0 Tags
7ef4e9eb810063243fcc575434d856c854b14eee
Commit Graph
3313 Commits
Author SHA1 Message Date
Petr Vobornik 99c5f0511f webui: focus invalid widget on validation error 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:46 +02:00
Petr Vobornik c693b28bab webui: fix required error notification in multivalued widget 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:46 +02:00
Petr Vobornik 93de5db39e webui: show notification instead of modal dialog on validation error 
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-01 10:19:45 +02:00
Petr Viktorin d1ede20680 Allow admins to write krbLoginFailedCount 
Without write access to this attribute, admins could not unlock users.

https://fedorahosted.org/freeipa/ticket/4409

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 10:02:02 +02:00
Petr Viktorin dfbd7170e9 install/ui/build: Build core.js 
The make-ui.sh script builds both app.js and core.js,
but only one was specified in the Makefile.
Correct the mistake.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-06-30 18:17:28 +02:00
Petr Vobornik 35d3f03843 webui: support unlock user command 
Call user-unlock command from Web UI.

It will unlock displayed user on current master.

https://fedorahosted.org/freeipa/ticket/4407

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 13:11:53 +02:00
Petr Vobornik b36a3c693b webui: add sync_otp.html 
standalone page for OTP token synchronization. It reuses SyncOTPScreen
widget instead of reimplementing the logic as in other standalone pages.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:05 +02:00
Petr Vobornik 46a42de532 webui: layer for standalone pages which use WebUI framework 
Current compiled Web UI layer (app.js) contains every FreeIPA plugin and
not just the UI framework. It's not possible to start just a simple facet.

This commit creates a basis for a layer (core.js) which contains only
framework code and not entity related code.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:05 +02:00
Petr Vobornik c2c1131a7a webui: fix confirmation mixin origin check 
Current check is not enough.

https://fedorahosted.org/freeipa/ticket/4098

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:04 +02:00
Petr Vobornik 9dbeeb7556 webui: bind Login facet and OTP sync facet 
Simple plugin which handles transition from login facet to OTP sync facet
and vice versa.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:04 +02:00
Petr Vobornik d9a7fcb5e1 webui: support global notifications in all containers 
Global notifications were limited to "main" container. Now they have their
own container which is displayed over other ones. It makes them usable
everywhere.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:04 +02:00
Petr Vobornik 72a107c9d7 webui: add link pointing to OTP sync page to login 
https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:04 +02:00
Petr Vobornik 30b1256b62 webui: add OTP token synchronization 
New SyncOTPScreen widget and related facet.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:03 +02:00
Petr Vobornik d159662ade webui: base class for LoginScreen-like facets 
LoginScreen has layout which can be reused for other facets/widgets,
e.g. for Sync OTP facet

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:03 +02:00
Petr Viktorin 36d261e843 Update translations 
Pull fresh translations from Transifex.
Update the POT file.

Thanks to all translators!
 2014-06-27 16:40:02 +02:00
Martin Kosek bd29d3cbbc Fix objectClass casing in LDIF to prevent schema update error 
When a new objectclass was defined as "objectclass" and not
"objectClass", it made the schema updater skip some objectclasses.

https://fedorahosted.org/freeipa/ticket/4405

Reviewed-By: Rich Megginson <rmeggins@redhat.com>
 2014-06-27 16:29:57 +02:00
Petr Vobornik 5568e357d1 webui: extract rpc value from object envelope 
adapt Web UI to a newer style of encapsulation object data

https://fedorahosted.org/freeipa/ticket/4394

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:23:22 +02:00
Petr Vobornik 9aac0524c9 webui: send API version in RPC requests 
Currently there is an incorrect behavior that server doesn't send datetime
and dnsname data in new format.

This patch adds the version to each RPC request making the UI look as  the
latest client. Server then sends data in correct format. It also removes
the "unknown version" warning from each RPC response.

https://fedorahosted.org/freeipa/ticket/4394

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:23:21 +02:00
Petr Vobornik 59f66a156b webui: fix detection of RPC command 
old detection did not work with the static version used for test and
demonstration purposes.

https://fedorahosted.org/freeipa/ticket/4357

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:35 +02:00
Petr Vobornik e6a373e930 webui-test: dns forward zone json data 
Fake API results for testing and presentation purposes of DNS Forward
Zones.

https://fedorahosted.org/freeipa/ticket/4357

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:35 +02:00
Petr Vobornik db2666d276 webui-test: static metadata update 
Regular update of static metadata for testing and presentation purposes.
It should also contain new DNS Forward Zones metadata.

https://fedorahosted.org/freeipa/ticket/4357

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:34 +02:00
Petr Vobornik 7a25168a3c webui: dns forward zones 
Add DNS Forward Zones Web UI.

- pages under: Identity/DNS/DNS Forward Zones

https://fedorahosted.org/freeipa/ticket/4357

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:34 +02:00
Petr Vobornik 8ca5793160 webui: add confirmation for dns zone permission actions 
All header actions should require confirmation.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:33 +02:00
Nathaniel McCallum 14b38b7704 Add /session/token_sync POST support 
This HTTP call takes the following parameters:
 * user
 * password
 * first_code
 * second_code
 * token (optional)

Using this information, the server will perform token synchronization.
If the token is not specified, all tokens will be searched for synchronization.
Otherwise, only the token specified will be searched.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-26 15:55:24 +02:00
Petr Vobornik 70c77e6a3c webui: support otp in reset_password.html 
https://fedorahosted.org/freeipa/ticket/4262

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:40 +02:00
Petr Vobornik 870db2f677 webui: rebase user password dialog on password dialog and add otp support 
https://fedorahosted.org/freeipa/ticket/4262

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:39 +02:00
Petr Vobornik e3de467676 webui: add placeholders to login screen 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:39 +02:00
Petr Vobornik 6e7d4ad468 webui: placeholder attribute support in textbox and textarea 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:39 +02:00
Petr Vobornik f9adc5a5f3 webui: support password change with OTP in login screen 
https://fedorahosted.org/freeipa/ticket/4262

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:39 +02:00
Simo Sorce 5c0e7a5fb4 keytab: Add new extended operation to get a keytab. 
This new extended operation allow to create new keys or retrieve
existing ones. The new set of keys is returned as a ASN.1 structure
similar to the one that is passed in by the 'set keytab' extended
operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute named
ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the
operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
 2014-06-26 10:30:53 +02:00
Tomas Babej e5e42fc83a ipaplatform: Move paths from installers to paths module 
Part of: https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-26 09:22:21 +02:00
Tomas Babej b1275c5b1c sudorule: Enforce category ALL checks on dirsrv level 
https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:51 +02:00
Tomas Babej 3a56b155e8 sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute 
Makes sure we dereference the correct attribute. Also adds object class
checking.

https://fedorahosted.org/freeipa/ticket/4324

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:50 +02:00
Tomas Babej 9304b649a3 sudorule: Allow using external groups as groups of runAsUsers 
Adds a new attribute ipaSudoRunAsExtUserGroup and corresponding hooks
sudorule plugin.

https://fedorahosted.org/freeipa/ticket/4263

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:49 +02:00
Tomas Babej a228d7a3cb sudorule: Allow using hostmasks for setting allowed hosts 
Adds a new --hostmasks option to sudorule-add-host and sudorule-remove-host
commands, which allows setting a range of hosts specified by a hostmask.

https://fedorahosted.org/freeipa/ticket/4274

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:49 +02:00
Petr Vobornik 6dab9123be webui: don't limit permission search in privileges 
Search for privileges was limited to bindruletype==permission. There
was no reason to do that.

This patch removes the restriction.

Related to:
https://fedorahosted.org/freeipa/ticket/4079

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-25 16:23:14 +02:00
Petr Vobornik bfdf9039ce webui: fix field's default value 
Fields with default value, such as DNS Zone's idnsforwardpolicy, were
marked as dirty when no value was loaded and when default value of
input control was other than empty.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-25 16:23:14 +02:00
Tomas Babej c2e6b74029 trusts: Allow reading system trust accounts by adtrust agents 
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-25 15:01:52 +02:00
Nathaniel McCallum 5baa941317 Implement OTP token importing 
This patch adds support for importing tokens using RFC 6030 key container
files. This includes decryption support. For sysadmin sanity, any tokens
which fail to add will be written to the output file for examination. The
main use case here is where a small subset of a large set of tokens fails
to validate or add. Using the output file, the sysadmin can attempt to
recover these specific tokens.

This code is implemented as a server-side script. However, it doesn't
actually need to run on the server. This was done because importing is an
odd fit for the IPA command framework:
1. We need to write an output file.
2. The operation may be long-running (thousands of tokens).
3. Only admins need to perform this task and it only happens infrequently.

https://fedorahosted.org/freeipa/ticket/4261

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-25 12:55:02 +02:00
Petr Viktorin 52003a9ffb Convert Sudo Command Group default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:41 +02:00
Petr Viktorin 6b478628dc Convert Sudo Command default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:41 +02:00
Petr Viktorin 439dd7fa74 Convert Service default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:41 +02:00
Petr Viktorin f8dc51860c Convert SELinux User Map default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:41 +02:00
Petr Viktorin 820a60420d Convert Role default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin f881f06364 Convert the Modify privilege membership permission to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin 0c4d13e136 Convert Netgroup default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin 978af07dd5 Convert Hostgroup default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin 8e8e6b1ae7 Convert HBAC Service Group default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin 49abbb1ead Convert HBAC Service default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00
Petr Viktorin 81d8c8acb5 Convert HBAC Rule default permissions to managed 
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-24 13:53:40 +02:00