Commit Graph
3205 Commits
Author SHA1 Message Date
Jan Cholasta 73d8db6d92 Allow IPA master hosts to update CA certificate in LDAP.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta 35857026e6 Support CA certificate renewal in dogtag-ipa-ca-renew-agent.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta 1313537736 Check if /root/ipa.csr exists when installing server with external CA.
Remove the file on uninstall.

https://fedorahosted.org/freeipa/ticket/4303

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-28 19:28:27 +02:00
Martin Basti 42d035f64c FIX: named_enable_dnssec should verify if DNS is installed
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-28 17:42:38 +02:00
Petr Vobornik 8288135b5b webui: add bounce url to reset_password.html
reset_password.html now redirects browser to URL specified in 'redirect'
uri component (if present).

The component has to be URI encoded. ie (in browser console):

$ encodeURIComponent('http://pvoborni.fedorapeople.org/doc/#!/guide/Debugging')

-->
"http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging"

-->

https://my.freeipa.server/ipa/ui/reset_password.html?redirect=http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging

https://fedorahosted.org/freeipa/ticket/4440

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:36:08 +02:00
Petr Vobornik ac7df79a43 webui: remove remaining action-button-disabled occurrences
Buttons in hbactest check for 'action-button-disabled' but it's never set.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:24:21 +02:00
Petr Vobornik 3966417779 webui: replace action_buttons with action_widget
Simplify code base by reuse of 'disable' feature of button_widget. All
occurrences of action-button which were disabled/enabled were replaced
by button-widget.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:24:21 +02:00
Petr Vobornik 9aed114d82 webui: detach facet nodes
Detach/attach facet nodes when switching facets instead of
hiding/showing.

Keeps dom-tree more simple.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:21:37 +02:00
Petr Vobornik fb975bba20 webui: internet explorer fixes
Fixed:
1. IE doesn't support value 'initial' in CSS rule.
2. setting innerHTML='' also destroys content of child nodes in
LoginScreen in IE -> reattached buttons have no text.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:20:15 +02:00
Petr Vobornik 4059aa12a4 webui: fix nested items creation in dropdown list
Items nested in other items were created in root list instead of nested list.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:18:44 +02:00
Petr Vobornik 855c59c7fc webui: support wildcard attribute level rights
Reproduction:
* add 'extensibleObject' object class to target object

https://fedorahosted.org/freeipa/ticket/4380

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:13:24 +02:00
Nathaniel McCallum d3638438fc Add TOTP watermark support
This prevents the reuse of TOTP tokens by recording the last token
interval that was used. This will be replicated as normal. However,
this patch does not increase the number of writes to the database
in the standard authentication case. This is because it also
eliminates an unnecessary write during authentication. Hence, this
patch should be write-load neutral with the existing code.

Further performance enhancement is desired, but is outside the
scope of this patch.

https://fedorahosted.org/freeipa/ticket/4410

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-25 10:41:17 +02:00
Martin Kosek 15eb343b9c Allow hashed passwords in DS
Without nsslapd-allow-hashed-passwords being turned on, user password
migration fails.

https://fedorahosted.org/freeipa/ticket/4450

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-25 10:36:47 +02:00
David Kupka 603842867c Improve password validity check.
Allow use of characters that no longer cause troubles. Check for
leading and trailing characters in case of 389 Direcory Manager password.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-24 14:22:40 +02:00
Petr Vobornik ad593a5c06 webui: fix disabled state of service's PAC type
Nested options (MS-PAC and PAD) of service's PAC type should be
disabled if no value is supplied (default value is "Inherited
from server configuration"). That was not the case - regression.

This patch fixes it and along with it simplifies the update method
of option_widget_base to be more comprehensible.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:39:16 +02:00
Petr Vobornik 8ba75506c2 webui: disable ipapermbindruletype if permission in a privilege
User is not able to change Bind Rule Type if permission is already
member of a privilege. Let's disable it and don't confuse user.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik 62ac6edcf4 webui: fix selection of empty value in a select widget
Little regression - select widget could not handle empty or no array as an
input value.

It broke 'undo' operation in Permissions' 'Type' attribute while switching
between '' and some value.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik 75a96fb4c2 webui: show managed fields as readonly and not disabled
Visible read-only fields are no longer displayed as disabled in
permission details facet.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik e60cfa2862 webui: fix add of input group class
The input-group class was added based on visibility of child elements.

This failed when it had to be determined *before* displaying the widget.

Now it's added if the buttons are not hidden by `display: none` CSS rule.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik 1a904708cc webui: reflect readonly state
Separate update of read-only state from update of value.

It should be possible to switch from read-only UI to editable UI without
value change.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik 8fcf6d6b34 webui: option_widget_base: sort options
https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Petr Vobornik d2f2fc5add webui: attr widget: get list of possible attrs from ipapermdefaultattr
Very useful for managed permissions since the list of attrs in metadata
might be smaller that default attributes. This smooths behavior if one
removes an attr from effective attrs which is not in metadata. Without
this it will disappear from the list and one has to add it manually
through 'Add'.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Petr Vobornik 4aefc0d6fe webui: custom attr in attributes widget
Web UI doesn't always know what are the possible attributes
for target object. This will allow to add custom attributes
if necessary.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Petr Vobornik 9fa447cb6e webui: optimize (re)creation of option widget
There is a case where attributes widget can contain > 1000 items.
It's about 3000 nodes. It's slow in jQuery. Simple move to dojo
speeds it up (is closer to native calls) while maintaining developer
friendliness.

Now the biggest lag is in browser's render. It's probably not worth
developer time to optimize that.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Petr Vobornik 740d42257f webui: add filter to attributes widget
Adds filter field to attribute box in permissions for better user
experience. User can then quickly find the desired attribute.

Initial version of the patch authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Petr Vobornik b68f819de7 webui: improve usability of attributes widget
Attributes widget layour was changed from tiny table which allowed
to display only few options to a checkbox list with multiple
columns (depends on container).

Check all attributes option was removed to force the user
to read through the attributes which he selects.

Initial version authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 10:47:06 +02:00
Tomas Babej b7a1401e9d trusts: Make cn=adtrust agents sysaccount nestedgroup
Since recent permissions work references this entry, we need to be
able to have memberOf attributes created on this entry. Hence we
need to include the nestedgroup objectclass.

https://fedorahosted.org/freeipa/ticket/4433

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-07-18 10:08:04 +02:00
Petr Vobornik 03c25bd98e webui: capitalize labels of undo and undo all buttons
Make the label of these buttons consistent with other buttons which have
capital first letters.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2014-07-08 12:00:30 +02:00
Petr Viktorin 518c8a5f9d Update translations
Pull new translations from Transifex
Thanks to all translators!
2014-07-07 16:05:21 +02:00
Petr Vobornik d0c12fb0c0 webui: display messages contained in API responses
API responses can contain warnings in "messages" array. This patch
also adds support for displaying multiple notifications at the same
time in order to show the message and a status of finished operation.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-07 15:30:41 +02:00
Petr Vobornik 0b0e77cf99 webui: new navigation structure
https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 16:31:38 +02:00
Petr Viktorin 23feb4e027 Allow read access to services in cn=masters to auth'd users
https://fedorahosted.org/freeipa/ticket/4425

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-04 15:58:14 +02:00
Martin Basti 3461be5c78 Fix: Missing ACI for records in 40-dns.update
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 12:27:24 +02:00
Petr Vobornik bc1979ac09 webui: change ipatokennotbefore and ipatokennotafter types to datetime
https://fedorahosted.org/freeipa/ticket/3369

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-04 08:47:58 +02:00
Petr Vobornik 76ec9384fb webui-build: use /usr/share/java/js.jar instead of rhino.jar
/usr/share/java/rhino.jar is a Fedora's symlink to /usr/share/java/js.jar

Debian doesn't have it. Direct usage of upstream /usr/share/java/js.jar should
work on both systems.

Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>
2014-07-03 14:19:25 +02:00
Martin Basti 3b310d6b4f DNSSEC: Add experimental support for DNSSEC
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-02 18:41:57 +02:00
Martin Basti 30551a8aa3 Add NSEC3PARAM to zone settings
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-02 14:54:41 +02:00
Martin Basti ff7b44e3b0 Remove NSEC3PARAM record
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-02 14:54:41 +02:00
Martin Kosek 21e1e4ac3b Update X-ORIGIN for 4.0
It was decided not to change the OID space for FreeIPA 4.0+ objectclasses.
However, we should still at least properly mark the X-ORIGIN to make
analyzing schema easier.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-01 13:57:06 +02:00
Martin Basti c655aa2832 Fix ACI in DNS
Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-01 12:43:55 +02:00
Martin Basti 8e911fcabc DNSSEC: WebUI: add TLSA record
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 12:37:08 +02:00
Martin Basti 12cb31575c DNSSEC: add TLSA record type
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 12:37:08 +02:00
Petr Vobornik 99c5f0511f webui: focus invalid widget on validation error
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-01 10:19:46 +02:00
Petr Vobornik c693b28bab webui: fix required error notification in multivalued widget
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-01 10:19:46 +02:00
Petr Vobornik 93de5db39e webui: show notification instead of modal dialog on validation error
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-01 10:19:45 +02:00
Petr Viktorin d1ede20680 Allow admins to write krbLoginFailedCount
Without write access to this attribute, admins could not unlock users.

https://fedorahosted.org/freeipa/ticket/4409

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-01 10:02:02 +02:00
Petr Viktorin dfbd7170e9 install/ui/build: Build core.js
The make-ui.sh script builds both app.js and core.js,
but only one was specified in the Makefile.
Correct the mistake.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-30 18:17:28 +02:00
Petr Vobornik 35d3f03843 webui: support unlock user command
Call user-unlock command from Web UI.

It will unlock displayed user on current master.

https://fedorahosted.org/freeipa/ticket/4407

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-30 13:11:53 +02:00
Petr Vobornik b36a3c693b webui: add sync_otp.html
standalone page for OTP token synchronization. It reuses SyncOTPScreen
widget instead of reimplementing the logic as in other standalone pages.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-30 12:27:05 +02:00
Petr Vobornik 46a42de532 webui: layer for standalone pages which use WebUI framework
Current compiled Web UI layer (app.js) contains every FreeIPA plugin and
not just the UI framework. It's not possible to start just a simple facet.

This commit creates a basis for a layer (core.js) which contains only
framework code and not entity related code.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-06-30 12:27:05 +02:00