Commit Graph
3060 Commits
Author SHA1 Message Date
Jan Cholasta 1bcf08aab6 automount: do not inherit automountlocation_import from LDAPQuery
automountlocation_import is a client-side command which does not use LDAP
directly. Inherit it from Command rather than LDAPQuery and copy its
arguments from automountlocation_show.

This will make it possible to move automountlocation_import to ipaclient.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta f28cd62285 frontend: move the interactive_prompt callback type to Command
Move interactive_prompt callback type from baseldap.BaseLDAPCommand to
Command.

This will make it possible to move all interactive_prompt callbacks to
ipaclient.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 60fa6ed444 frontend: merge baseldap.CallbackRegistry into Command
Also make it possible for subclasses to introduce new callback types.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta a30bc8a351 plugable: switch API to Registry-based plugin discovery
Merge Registrar into Registry. Use the Registry instance of each plugin
module to discover plugins in the module instead of the global Registrar
instance.

This removes the side-effect of all plugins in a module being re-registered
every time the module is imported.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 88c0b66abc plugable: remove the unused deprecated API.register method
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 15a4c0d276 ipalib, ipaserver: fix incorrect API.register calls in docstrings
Use API.add_plugin to load specific plugins into API objects. Use Registry
to register plugins.

This fixes doctests.

https://fedorahosted.org/freeipa/ticket/4739
https://fedorahosted.org/freeipa/ticket/5115

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta bed546ee82 ipalib, ipaserver: migrate all plugins to Registry-based registration
Do not use the deprecated API.register method.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 0d62968b6f plugable: replace API.import_plugins with new API.add_package
Replace API.import_plugins with a new method API.add_package which allows
loading plugin packages into an API object from a package object.

This makes loading of plugin packages loading consistent with loading of
plugin modules and classes.

Rename API.modules to API.packages and use package objects where
implemented to reflect the change.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta b08f771518 ipalib: remove the unused csv argument of Param
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 77e27de147 makeapi: optimize API.txt
Change Param formatting to:
* always use quantified names rather than the `required` and `multivalue`
  kwargs,
* ignore kwargs with default value,
* ignore kwargs related to validation, as validation is now strictly
  server-side,
* ignore the `attribute` and `primary_key` kwargs, as they are relevant
  only on object params,
* ignore the `include` and `exclude` kwargs, as makeapi takes into account
  only params available in the 'cli' context,
* ignore the unused `csv` kwarg.

Format optional Output arguments as kwargs.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta ac2e9e84cf frontend: do not forward argument defaults to server
When forwarding a command call to a server, use only arguments which were
explicitly specified by the caller.

This increases compatibility between new clients and old servers.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 213237c7fe user: do not assume the preserve flags have value in user_del
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 3eaafe42b5 frontend: do not forward unspecified positional arguments to server
When forwarding a command call to a server, do not use a value of None in
place of unspecified positional arguments.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 71f960457e ipalib: make optional positional command arguments actually optional
Fix several plugins not to assume optional positional arguments have a
value of None when not specified.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta f8cf136c55 batch: do not crash when no argument is specified
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 278fa29906 frontend: perform argument value validation only on server
Do not validate values of command arguments on the client and let the
server handle validation.

This will make the client more lightweight by not having it to carry
validation code and metadata with itself for the price of increasing
network traffic in case the validation fails.

Types of the arguments are still validated on both the client and the
server.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 13b010685b frontend: remove the unused Command.soft_validate method
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 2f6b333187 frontend: re-raise remote RequirementError using CLI name in CLI
https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta e0275abe6f rpc: include structured error information in responses
Include keyword arguments of exceptions in RPC responses. This is limited
to JSON-RPC, as XML-RPC does not support additional data in error
responses.

Include keyword arguments of messages in RPC responses.

Include keyword arguments of exceptions in batch command result.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta 861294c0d6 parameters: remove unused ConversionError and ValidationError arguments
Do not set the `value`, `index` and `rule` arguments when raising
ConversionError and ValidationError. The arguments are unused and are not
specified consistently accross the framework and plugins.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Jan Cholasta c37aba291f rpc: do not crash when unable to parse JSON
When unable to parse JSON response from the server, properly raise
JSONError not to cause a crash.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Martin Basti ad1cac1283 Fix referenced before assigment variables in except statements
Variable msg may not exists in the last except context, and even it
contains improper value because it is not related to catched exception

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-05-20 15:05:25 +02:00
Jan Cholasta 83f6ddb473 makeapi: use the same formatting for int and long values
This prevents validation failures on architectures where integer is less
than 32 bits.

https://fedorahosted.org/freeipa/ticket/5894

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-19 16:43:58 +02:00
Petr Spacek 89cdf6ee1e Batch command: avoid accessing potentially undefined context.principal
This might happen when the command is called directly in Python,
e.g. in installers and so on.

Pylint pylint-1.5.5-1.fc24.noarch caught this.

https://fedorahosted.org/freeipa/ticket/5838

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-12 13:28:00 +02:00
Petr Viktorin 5dbb0f6fec ipalib.cli: Improve reporting of binary values in the CLI
Make sure the base64-encoded value is a string, so it is printed
without the b'' markers.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-10 12:41:15 +02:00
Tomas Babej 6adf863781 idviews: Add user certificate attribute to user ID overrides
https://fedorahosted.org/freeipa/ticket/4955

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-06 07:12:01 +02:00
Petr Viktorin 6ddf0d657f certprofile plugin: Use binary mode for file with binary data
Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-05-05 16:42:46 +02:00
Petr Viktorin baaa041b8a ipalib.rpc: Send base64-encoded data as string under Python 3
Python 3's JSON library cannot deal with bytes, so decode
base64-encoded data to string.

Part of the work for https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-05-05 16:42:46 +02:00
Petr Viktorin 890f83b0bb radiusproxy plugin: Use str(error) rather than error.message
In Python 3, the "message" attribute has been removed in favor of
calling str() on the error.

Part of the work for https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-05-05 16:42:46 +02:00
Abhijeet Kasurde 3d07c889ce Added fix for notifying user about locked user account in WebUI
User in now notified about "Locked User account" message instead of
"The password or username you entered is incorrect" or any generic error
message

Fixes : https://fedorahosted.org/freeipa/ticket/5076

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2016-04-28 17:04:37 +02:00
Petr Viktorin 28b0bfaefe dns plugin: Fix zone normalization under Python 3
In Python 3, str.encode('ascii') converts to bytes, and str()
(nicknamed unicode() in IPA) returns the string representation
of an object, which is b'...' for bytes.

So, unicode('...'.encode('ascii')) results in "b'...'".

Change the code to only call encode() for the error.

Part of the work for https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-28 16:22:07 +02:00
Martin Basti 14ee02dcbd Do not do extra search for ipasshpubkey to generate fingerprints
Host, user and idview commands do unnnecessary extra search for
ipasshpubkey attribute to generate fingerprints.

Note: Host and user plugins shows ipasshpubkey only when the attribute
is changed, idviews show ipasshpubkey always. This behavior has been
kept by this commit.

common_pre/post_callbacks were fixed in [base|stage]user modules.
common_callbacks requires the same arguments as pre/post_callbacks now
(except baseuser_find.post_common_callback)

Note2: in *-add commands there is no need for managing ipasshpubkey as
this attribute should be shown always there.

https://fedorahosted.org/freeipa/ticket/3376

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-04-26 13:37:23 +02:00
Martin Basti fe2ce02a6f Performace: don't download password attributes in host/user-find
For each entry in user/host-find was executed an extra search for password
attributes what has significant impact on performance (for 2000 users
there were 2000 additional searches)

http://www.freeipa.org/page/V4/Performance_Improvements

https://fedorahosted.org/freeipa/ticket/5281

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-22 13:28:57 +02:00
Pavel Vomacka f446792353 Add 'skip overlap check' checkbox into add zone dialog
https://fedorahosted.org/freeipa/ticket/5773

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-22 10:11:48 +02:00
Fraser Tweedale c2b92b5735 caacl: correctly handle full user principal name
The caacl HBAC request is correct when just the username is given,
but the full 'user@REALM' form was not handled correctly.

Fixes: https://fedorahosted.org/freeipa/ticket/5733
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-04-20 18:07:19 +02:00
Abhijeet Kasurde 2a20c74633 Added fix for notifying user about Kerberos principal expiration in WebUI
- User is now notified about "Kerberos Principal expiration" message instead of
  "Wrong username or password" message.
- User is also notified about "Invalid password" message instead of
  generic error message.

https://fedorahosted.org/freeipa/ticket/5077

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-04-15 17:58:04 +02:00
Pavel Vomacka d01f7e8556 Add activate option to stage user details page
Add activate option to the action menu on stage user details page.

https://fedorahosted.org/freeipa/ticket/5369

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-04-15 16:41:55 +02:00
Martin Basti 93871bf017 Limit max username length to 255 in config-mod
This value is same as is used in user and stageuser commands.

https://fedorahosted.org/freeipa/ticket/5774

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-15 13:24:34 +02:00
Martin Babinsky 62bb478e11 specify type of exceeded limit when warning about truncated search results
API commands inheriting from LDAPSearch should mention which limit was
exceeded in the warning message sent with truncated results.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Babinsky 1f0959735f differentiate between limit types when LDAP search exceeds configured limits
When LDAP search fails on exceeded limits, we should raise an specific
exception for the type of limit raised (size, time, administrative) so that
the consumer can distinguish between e.g. searches returning too many entries
and those timing out.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Basti b23ad42269 host-del --updatedns: print warnings instead of error
When DNS records do not exist, print warnings instead of hard error

https://fedorahosted.org/freeipa/ticket/5627

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:47:53 +02:00
Martin Basti 54e3859595 host_del: update help for --updatedns option
Clarify that dns removes only A, AAAA, PTR, SSHFP records of the host(s) managed by IPA DNS.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti e8c8134eee host_del: remove only A, AAAA, SSHFP, PTR records
only A, AAAA, SSHPF and PTR records are managed by IPA. The other
records should be removed by user.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti 1e70d6b914 host_del: split removing A/AAAA and PTR records to separate functions
This change is needed because A/AAAA and PTR record will be handled
separately.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti bea066c336 host_del: remove unneeded dnszone-show command call
This command has no effect in that block of code, dnsrecord_show is
enough for detection if records exists.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti 9a0f92be0d host_del: replace dns-record find command with show
Due the configuration of dnsrecord_find, it works as dnsrecord-show,
thus it can be replaced.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti 40e3a0bf63 host_del: fix removal of host records
Originally only the first A/AAAA record is removed, and one other record. This commit fixes it
and all records are removed.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti d9fe502e83 Add missing pre_common_callback to stageuser_add
This pre_callback contains method to preprocessing usercertificate that
was not called during stageuser-add. This commit adds missing
pre_common_callback call to stageuser_add.

https://fedorahosted.org/freeipa/ticket/5759

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-04-12 10:09:12 +02:00
Martin Babinsky 7febe569ce otptoken-add: improve the robustness of QR code printing
The python-qrcode print_ascii() method does not work in terminals with
non-UTF-8 encoding. When this is the case do not render QR code but print a
warning instead. Also print a warning when the QR code size is greater that
terminal width if the output is a tty.

https://fedorahosted.org/freeipa/ticket/5700

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-24 14:35:19 +01:00
Martin Basti d1e29fe60e Fix: catch Exception instead of more specific exception types
Regression caused by commit 491447cc5a,
ValueErrori and AttributeError are too much specific for these cases, multiple types of
exception can be raised.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-22 17:33:02 +01:00