public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,856 Commits 9 Branches 0 Tags
c4ed025001895bfc65c613cabbbfcb27c19cc29f
Commit Graph
823 Commits
Author SHA1 Message Date
Simo Sorce 077d6a0d35 Make KDC listen to TCP port as well by default 2009-01-26 14:44:40 -05:00
Simo Sorce 0fb3f394a5 read_file() was a remnant of the conversion of ldapupdate.py to a library and 
is not accessible directly. Use ipautil.template_file, this works.
 2009-01-26 14:44:34 -05:00
Simo Sorce 2b8b87b4d6 memberof was not indexed in older versions of fedora-ds, keep it around 
as an update so that if it is not there it will be added
 2008-12-05 18:18:14 -05:00
Simo Sorce 7c5ae7f402 Fix stupid typo in update file 2008-12-03 12:03:04 -05:00
Simo Sorce 80cc2c3715 Change ipa-compat-manage to work on older python versions too. Break try,except,finally into a try,try,finally,except Add also checks for LDAPError, errors. 2008-12-03 11:17:55 -05:00
Simo Sorce b3b4435d0e One line fix for ipa-server spec file 2008-12-03 11:17:51 -05:00
Simo Sorce d006587937 Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster. 2008-12-02 19:28:51 -05:00
Simo Sorce 0e6928dd1b Forgot to add ipa-compat-manage to the sbin programs 2008-12-02 16:50:21 -05:00
Simo Sorce e0e784f77f Add man page for ipa-compat-manage 2008-12-02 16:39:57 -05:00
Simo Sorce 3fb6343149 Fix makefiles after schema compat changes 2008-12-02 16:39:57 -05:00
Nathan Kinder f9d6ac9529 Corrected usage messages and manpage to match the logic for the ipa-replica-manage init command. 2008-12-01 17:19:10 -05:00
Simo Sorce ef0bb46923 Fix typo, thanks to Michele for pointing it out 2008-12-01 17:19:10 -05:00
Simo Sorce 78166d949c Run updates on the replica too, otherwise changes to cn=config will be missing. 2008-12-01 17:19:10 -05:00
Simo Sorce 3a263e9466 Make sure the CA cert is copied to the replica, fail if no ca.crt is available. Cope with some versions of ipa that forgot to copy the ca.crt cert in the right place. 2008-12-01 17:19:10 -05:00
Simo Sorce 5d1d292c15 Add tool to enable or disable the schema compatibility plugin 2008-12-01 17:19:10 -05:00
Rich Megginson ebd2fe8385 add passsync to ipa-replica-manage man page 2008-11-25 18:09:55 -05:00
Rich Megginson 502aff73a2 do not use ipaerror directly in ipa-replica-manage - use ldap exception instead 2008-11-25 18:09:49 -05:00
Simo Sorce 83a4c7207d Fix memleaks found by valgrind 2008-11-20 19:54:03 -05:00
Simo Sorce 00e8af8ac3 We must always zero out the target ientry unconditionally where it is used 
and never free it in the destructor.
 2008-11-20 14:03:19 -05:00
Simo Sorce 16bb6e19df Avoid potential crashbug on invalid DNs (not in the tree). 2008-11-19 14:00:30 -05:00
Rob Crittenden 8da5dc4f79 Fix error in validation when editing new groups via the UI 
471808
 2008-11-19 13:11:32 -05:00
Simo Sorce 7156f2ddfb Fix a free before use bug, it may lead to crashes but usually just corrupts 
the changepw dn we store so that it won't match. This causes normal password
changes to be interpreted as password resets instead, and the new legit
password is immediately expired.
 2008-11-14 10:23:43 -05:00
Rich Megginson e3929e60d5 set winsync account disable sync default value to both instead of none 2008-11-13 11:36:37 -05:00
Rich Megginson 716d51c22a wait for sync agreement to be ready before starting 
Added checking for error status - Added maxtries so that the script won't wait forever if there is something wrong
 2008-11-13 11:19:02 -05:00
Rob Crittenden 891068087e Remove the column width from #details table.details td 
This should make the User Find results page look nicer.

470428
 2008-11-12 15:53:07 -05:00
Rob Crittenden 93c2e4e3b4 Present a less-cryptic error if the replication agreement doesn't exist 2008-11-12 15:53:00 -05:00
Rob Crittenden 17261c2520 Create a user for Windows PassSync and grant password changing permissions 
This does 3 things:
1. Create a user for the Windows PassSync service
2. Add this use to the list of users that can skip password policies
3. Add an aci that grants permission to write the password attributes

471130
 2008-11-12 15:52:57 -05:00
Rob Crittenden 49e4876ba9 Fix deleting a winsync replication agreement. 2008-11-12 15:52:51 -05:00
Simo Sorce 8929075150 Make the list of users that can skip passwrod policies configurable. 
Addresses bz#471130

Also fix bugs in ipapwd_start.
Also remove mutex, it is not necessary with the current code,
we needed it when we used to change reload the configuration and
keep it referenced in a static pointer.
ipapwd_start runs only once and the global variables it sets are fixed
in stone until DS is restarted.
 2008-11-12 13:21:03 -05:00
Rich Megginson 47863ac169 Make DNA work with internal operations 2008-11-10 09:38:39 -05:00
Rob Crittenden c7c2cf0956 Use the local connection when getting a replication ID for winsync. 
We can't connect to the windows AD server to get a unique repliation ID.
So first see if this master already has one and if not, get an id from
the local DS.

469977
 2008-11-05 12:02:20 -05:00
Rich Megginson 4ed44a06a1 use ipautil.CalledProcessError instead of CalledProcessError 2008-11-04 21:57:34 -05:00
Rob Crittenden 5f6f20ffaa Fix error in validation when adding new groups via the UI 
469256
 2008-10-31 14:27:58 -04:00
Rob Crittenden 08c49c5806 Install replication update file 2008-10-31 12:34:30 -04:00
Rob Crittenden c13726ff66 Gracefully handle running on an unconfigured IPA server 2008-10-30 10:25:01 -04:00
Rob Crittenden 4699fc534b Don't report spurious upgrade message if IPA has not been configured yet. 
This was throwing the error
"Unable to determine hostname from ipa-rewrite.conf"
during RPM %post on unconfigured servers where there is nothing to do.

468947
 2008-10-29 17:08:32 -04:00
Rob Crittenden f305864d90 Ensure that every replica gets a unique replication ID. Otherwise changes won't propogate between all replicas. 
468732
 2008-10-29 17:08:27 -04:00
Rob Crittenden 4862a8f9d9 Fix error if more than one values is being set in an only. The first entry wasn't being properly converted into a list so subsequent values caused it to crap out. 
467102
 2008-10-15 15:29:08 -04:00
Rich Megginson f02d1429ca add update to fix the index for the winsync attributes 2008-10-13 14:09:15 -04:00
Rich Megginson 5c56c43693 do not store the OUs from the AD DN in the IPA user entry when flattening 2008-10-13 14:09:14 -04:00
Rich Megginson 9f18858e58 add --win-subtree argument to ipa-replica-manage 2008-10-13 14:09:13 -04:00
Rich Megginson 0988e1c53c Do not depend on MMR plugin - start before MMR plugin 
The ipa-winsync plugin needs to start before the MMR plugin, so that it
can register the API functions.  Also, the slapi-nis schema compat
plugin creates an entry that looks exactly like the default IPA group
gidNumber entry, so I added an extra (objectclass=groupOfNames) to the
filter since the slapi-nis entry doesn't have that.
 2008-10-13 14:09:13 -04:00
Rich Megginson d3637dde7c Just add eq,pres to the existing indices 
There are already indexes created for ntUniqueID and ntUserDomainID by default
We just need to make sure they are indexed for equality and presence
 2008-10-13 14:09:12 -04:00
Rich Megginson 38154073a8 Don't try to conditionally stop the server - it doesn't seem to work 
Just call stop() - if it's not already running, no big deal
 2008-10-13 14:09:11 -04:00
Rich Megginson 28195610f6 Add more winsync support to cli 
The ipa-replica-manage list, init, and synch commands do not work for winsync
agreements.  This patch adds that support and some additional verbose logging.

The synch_master did not work correctly.  The way it should work is to set
the replication schedule to some bogus value, then reset it back to its
original setting.  This will force replication to take place immediately.
 2008-10-13 14:09:10 -04:00
Rich Megginson 068ed81195 Do not add enabled user to activated group - clean up parse_acct_disable 
If a user needs to be enabled, just delete the user from the inactivated group,
but do not add to the activated group.  If a user is in no group, the user is
active by default.  IPA uses the activated group for override purposes.

parse_acct_disable is only used when the config changes, but I cleaned it
up anyway to make the code clearer.
 2008-10-13 14:09:10 -04:00
Rich Megginson 0e346ff6fb add winsync options to ipa-replica-manage man page 2008-10-13 14:09:09 -04:00
Rich Megginson 69180c2dcc Adds winsync account disable and force sync 2008-10-13 14:09:08 -04:00
Rich Megginson e8bebebc23 fix issues brought up by initial review of ipa winsync enhancements 2008-10-13 14:09:08 -04:00
Rich Megginson be5e783f72 add --no-host-dns option to ipa-server-install - allows specifying a hostname that might actually exist but you do not want to even attempt to resolve it via DNS 2008-10-13 14:09:07 -04:00