public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,654 Commits 9 Branches 0 Tags
8f2f5dfbdf6864b7f522aaf2fcf4e337488c87c8
Commit Graph
2537 Commits
Author SHA1 Message Date
Martin Basti ca030a089f DNSSEC: validate forwarders 
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-21 12:23:03 +02:00
Martin Basti 9101cfa60f DNSSEC: opendnssec services 
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-21 12:23:03 +02:00
Martin Basti eb54814741 DNSSEC: DNS key synchronization daemon 
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-21 12:23:03 +02:00
Martin Basti 9184d9a1bb DNSSEC: schema 
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-21 12:23:03 +02:00
Petr Vobornik 34d3f99aae webui: update combobox input on list click 
Change event of combobox is not triggered when there is only one value. Calling it's handler even for option's 'click' event makes sure that value of input gets always updated.

https://fedorahosted.org/freeipa/ticket/4655

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-21 10:32:46 +02:00
Petr Vobornik 41a7d0bf47 webui: do not show closed dialog 
Fixes issues when dialog is not removed from `IPA.opened_dialogs` registry when dialog.close() is called while the dialog is not shown, i.e., while other dialog is shown. Without it, the dialog is could be incorrectly displayed.

New dialog's property `opened` handles whether dialog is intended to be opened.

How to test:

Add new host with IP address outside of managed reverse zones to get error 4304.

https://fedorahosted.org/freeipa/ticket/4656

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-21 10:29:53 +02:00
Alexander Bokovoy 85ce380759 Change ipaOverrideTarget OID to avoid conflict with DNSSEC feature 2014-10-21 10:47:02 +03:00
Martin Basti c655b7bf76 Remove ipaContainer, ipaOrderedContainer objectclass 
https://fedorahosted.org/freeipa/ticket/4646

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-20 16:58:16 +02:00
Alexander Bokovoy bd98ab0356 Support idviews in compat tree 
Reviewed-By: Tomas Babej <tbabej@redhat.com>
 2014-10-20 16:47:49 +02:00
Petr Vobornik df1ed11b48 webui: do not offer ipa users to Default Trust View 
https://fedorahosted.org/freeipa/ticket/4616

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:29:10 +02:00
Petr Vobornik 01a9e7ef9e webui: hide (un)apply buttons for Default Trust View 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:25:22 +02:00
Petr Vobornik d3f46d4e78 webui: hide applied to hosts tab for Default Trust View 
because applying Default Trust view on hosts is not allowed

https://fedorahosted.org/freeipa/ticket/4615

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:25:22 +02:00
Petr Vobornik 2e27f1ee69 webui: change order of idview's facet groups 
Applied to hosts facet should not be default because, e.g., for Default Trust View it shouldn't be even visible(o use).

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:25:22 +02:00
Petr Vobornik 896d47c92f webui: make Evented a part of base IPA.object 
1. All framework objects to use event interface
2. Framework objects can be part of specification objects but they are not deep-cloned as the rest of specification objects - usually it would cause infinite loop. This make easier to add context as a $pre-op object without a need for $pre-op function.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:25:22 +02:00
Petr Vobornik 741c31c2b4 webui: allow --force in dnszone-mod and dnsrecord-add 
Allow to use --force when changing authoritative nameserver address in DNS zone.

Same for dnsrecord-add for NS record.

https://fedorahosted.org/freeipa/ticket/4573

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 12:06:02 +02:00
Nathaniel McCallum 68825e7ac6 Configure IPA OTP Last Token plugin on upgrade 
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-20 10:18:47 +02:00
Petr Vobornik d8f05d8841 webui: management of keytab permissions 
https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-20 10:13:47 +02:00
Nathaniel McCallum 41bf0ba940 Create ipa-otp-counter 389DS plugin 
This plugin ensures that all counter/watermark operations are atomic
and never decrement. Also, deletion is not permitted.

Because this plugin also ensures internal operations behave properly,
this also gives ipa-pwd-extop the appropriate behavior for OTP
authentication.

https://fedorahosted.org/freeipa/ticket/4493
https://fedorahosted.org/freeipa/ticket/4494

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-20 10:12:36 +02:00
Nathaniel McCallum 560606a991 Display token type when viewing token 
When viewing a token from the CLI or UI, the type of the token
should be displayed.

https://fedorahosted.org/freeipa/ticket/4563

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-20 09:59:19 +02:00
Petr Vobornik 0a924603d0 webui: add new iduseroverride fields 
- add gecos, gidnumber, loginshell, sshkeys fields

https://fedorahosted.org/freeipa/ticket/4617

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-17 15:57:11 +02:00
Petr Vobornik 43d3593873 webui: add link to OTP token app 
- display info message which points user to FreeOTP project page
- the link or the text can be easily changed by a plugin if needed

https://fedorahosted.org/freeipa/ticket/4469

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-10-17 15:53:34 +02:00
Jan Cholasta 608851d3f8 Check LDAP instead of local configuration to see if IPA CA is enabled 
The check is done using a new hidden command ca_is_enabled.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-17 12:53:11 +02:00
Jan Cholasta 6227ebb0cd Do not fix trust flags in the DS NSS DB in ipa-upgradeconfig 
It is necessary to fix trust flags only in the HTTP NSS DB, as it is used as
a source in the upload_cacrt update plugin.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-17 12:53:11 +02:00
Jan Cholasta cbb4caa350 Do not create ipa-pki-proxy.conf if CA is not configured in ipa-upgradeconfig 
This fixes upgrade from CA-less to CA-full after IPA upgrade.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-17 12:53:11 +02:00
Martin Kosek 588e7bc899 Remove changetype attribute from update plugin 
The attribute addition had no effect, but it should not be there.
 2014-10-17 12:02:25 +02:00
Nathaniel McCallum c5f7ca58a1 Remove token ID from self-service UI 
Also, fix labels to properly use i18n strings for token types.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-10-16 17:53:27 +02:00
Jan Cholasta cf860c7154 Allow specifying signing algorithm of the IPA CA cert in ipa-ca-install 
The --ca-signing-algorithm option is available in ipa-server-install, make
it available in ipa-ca-install as well.

https://fedorahosted.org/freeipa/ticket/4447

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-10-16 13:33:40 +02:00
David Kupka 47731f4584 Fix printing of reverse zones in ipa-dns-install. 
This was forgotten in patch for ticket
https://fedorahosted.org/freeipa/ticket/3575

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-10-16 08:02:02 +02:00
David Kupka c44f4dcbea Stop dogtag when updating its configuration in ipa-upgradeconfig. 
Modifying CS.cfg when dogtag is running may (and does) result in corrupting
this file.

https://fedorahosted.org/freeipa/ticket/4569

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-10-15 09:12:11 +02:00
Martin Basti 7ad70025eb Make named.conf template platform independent 
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-10-14 13:55:02 +02:00
Martin Basti 97195eb07c Add missing attributes to named.conf 
Ticket: https://fedorahosted.org/freeipa/ticket/3801#comment:31
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-10-14 13:55:02 +02:00
Ludwig Krispenz 08c3fe17ef Ignore irrelevant subtrees in schema compat plugin 
For changes in cn=changelog or o=ipaca the scheam comapat plugin doesn't need to be
executed. It saves many internal searches and reduces contribution to lock
contention across backens in DS.

https://fedorahosted.org/freeipa/ticket/4586

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-10-14 11:00:43 +02:00
Jan Cholasta 4cdeacdedf Support MS CS as the external CA in ipa-server-install and ipa-ca-install 
Added a new option --external-ca-type which specifies the type of the
external CA. It can be either "generic" (the default) or "ms-cs". If "ms-cs"
is selected, the CSR generated for the IPA CA will include MS template name
extension (OID 1.3.6.1.4.1.311.20.2) with template name "SubCA".

https://fedorahosted.org/freeipa/ticket/4496

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-13 12:18:09 +02:00
David Kupka 35c7bd05af Check that port 8443 is available when installing PKI. 
https://fedorahosted.org/freeipa/ticket/4564

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-10-10 11:57:44 +02:00
Jan Cholasta 92a08266af Fix certmonger configuration in installer code 
https://fedorahosted.org/freeipa/ticket/4619

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-10 08:48:25 +02:00
Martin Basti 57c510dcc7 Fix ipactl service ordering 
Ipactl sorted service start order as string, which causes service with start order
100 starts before service with start order 30.

Patch fixes ipactl to use integers for ordering.

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-09 12:52:31 +02:00
Petr Vobornik 00d598bab0 webui: add link from host to idview 
https://fedorahosted.org/freeipa/ticket/4535

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 0e76bc1cb6 webui: list only not-applied hosts in "apply to host" dialog 
https://fedorahosted.org/freeipa/ticket/4535

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 2cc78acf9b webui: facet group labels for idview's facets 
https://fedorahosted.org/freeipa/ticket/4535

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik ae5a34cbbc webui: new ID views section 
https://fedorahosted.org/freeipa/ticket/4535

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 749101db74 webui: add simple link column support 
Usual link columns are link with primary key of current entity.

This patch allows to create a link to arbitrary non-nested entity.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 8b0e2ed991 webui: allow to skip link widget link validation 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 27196b92c6 webui: do not show internal facet name to user 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 26bd309c96 webui: treat value as pkey in link widget 
Current default mechanism of a link widget assumes that pkeys of a current facet are pkeys for the link. It works for the only usage - in password policy. It's rather inflexible since it can't be used if the keys are in other attribute. This behavior is also bad in nested entities - creates a link to itself which is pointless.

This patch changes the default behavior to assume that the supplied value are the pkeys and that the last pkey is the value to display.

It also keeps the old method of overriding `other_pkeys` method so if the last and only pkey is the actual value to display then the method can tranform it into the pkeys which keeps compatibility with descendant widgets (`host_dnsrecord_entity_link_widget`, `dnsrecord_host_link_widget`).

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Petr Vobornik 15b6ed6705 webui: improve breadcrumb navigation 
Fixes issue when:
- user navigates to a nested facet
- refreshes browser
- uses breadcrumb navigation to go to parent entity page which requires a pkey. E.g. from automount keys to maps.

The old code relies on the facet, that user visited the parent facet before and therefore the facet has pkey stored. It fails after the browser reload.

Allows to specify a containing_facet. It allows breadcrumb navigation to return to a different facet than the 'default'.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-09-30 10:47:03 +02:00
Tomas Babej b9425751b4 idviews: Add Default Trust View as part of adtrustinstall 
Add a Default Trust View, which is used by SSSD as default mapping for AD users.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej bba3769196 idviews: Update the referential plugin config to watch for ipaAssignedIDView 
We need the referential plugin config to watch for changes in the ID view
objects, since hosts refer to them in ipaAssignedIDView attribute.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 277b762d36 idviews: Add ipaOriginalUid 
For slapi-nis plugin, we need to cache the original uid value of the user in the override
object.

Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 6b14030e90 idviews: Create container for ID views under cn=accounts 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00
Tomas Babej 16f3786d25 idviews: Add necessary schema for the ID views 
Part of: https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-09-30 10:42:06 +02:00