public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7,423 Commits 9 Branches 0 Tags
c8aefc23a40acbf94c11d8a09d73d4e4c1312c5f
Commit Graph
1465 Commits
Author SHA1 Message Date
Petr Viktorin c8aefc23a4 permission plugin: Improve description of the target option 
https://fedorahosted.org/freeipa/ticket/4521

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-09-03 12:57:04 +02:00
Petr Viktorin 4fbba3f7b8 permission plugin: Make --target available in the CLI 
This was left out by mistake when permissions were refactored.
The API is already tested.

https://fedorahosted.org/freeipa/ticket/4522
 2014-09-03 12:16:43 +02:00
Thorsten Scherf a2eab057d4 pwpolicy-add: Added better error handling 
Make error message more meaningful when a password policy is added for a non
    existing group.

    https://fedorahosted.org/freeipa/ticket/4334

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-02 10:40:12 +02:00
Gabe 9415aba877 ipa trust-add command should be interactive 
- Make ipa trust-add command interactive for realm_admin and realm_passwd
- Fix 'Active directory' typo to 'Active Directory'

https://fedorahosted.org/freeipa/ticket/3034

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-08-25 12:32:29 +02:00
Petr Viktorin a8ba6b3b8c service: Normalize service principal in get_dn 
This will make any lookup go through the normalization.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Petr Viktorin 8fabd6dde1 Support delegating RBAC roles to service principals 
https://fedorahosted.org/freeipa/ticket/3164

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-08-21 14:07:01 +02:00
Petr Vobornik 27128bd8f5 webui: better authentication types description 
Tooltips were added to "User authentication types" and "Default user
authentication types" to describe their relationship and a meaning of
not-setting a value.

https://fedorahosted.org/freeipa/ticket/4471

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-21 10:47:08 +02:00
Petr Vobornik cba5247f99 webui: improved info msgs on login/token sync/reset pwd pages 
- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-08-20 19:28:06 +02:00
David Kupka 724391a71b Verify otptoken timespan is valid 
When creating or modifying otptoken check that token validity start is not after
validity end.

https://fedorahosted.org/freeipa/ticket/4244

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-29 17:09:29 +02:00
David Kupka 6119c21441 Fix group-remove-member crash when group is removed from a protected group 
https://fedorahosted.org/freeipa/ticket/4448

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-29 13:10:51 +02:00
Jan Cholasta 785e13dd1e Exclude attributelevelrights from --raw result processing in baseldap. 
https://fedorahosted.org/freeipa/ticket/4371

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-29 12:00:13 +02:00
Tomas Babej e74307caa6 ipalib: idrange: Make non-implemented range types fail the validation 
The ipa-ipa-trust and ipa-ad-winsync ID Range types were allowed to
pass the validation tests, however, they are not implemented nor
checked by the 389 server plugin.

https://fedorahosted.org/freeipa/ticket/4323

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-28 12:18:23 +02:00
Petr Vobornik c475c093c9 baseldap: return 'none' attr level right as unicode string 
Returning non-unicode causes serialization into base64 which causes havoc
in Web UI.

https://fedorahosted.org/freeipa/ticket/4454

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-07-25 13:27:33 +02:00
Tomas Babej 3812ca03f2 baseldap: Remove redundant search from LDAPAddReverseMember and LDAPRemoveReverseMember 
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-23 15:12:30 +02:00
Petr Vobornik 4aefc0d6fe webui: custom attr in attributes widget 
Web UI doesn't always know what are the possible attributes
for target object. This will allow to add custom attributes
if necessary.

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 10:47:06 +02:00
Petr Vobornik 740d42257f webui: add filter to attributes widget 
Adds filter field to attribute box in permissions for better user
experience. User can then quickly find the desired attribute.

Initial version of the patch authored by: Adam Misnyovszki

https://fedorahosted.org/freeipa/ticket/4253

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-07-21 10:47:06 +02:00
Gabe 9a0aae0133 Fix typos in dns.py 
https://fedorahosted.org/freeipa/ticket/4429

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
 2014-07-18 10:05:25 +02:00
Tomas Babej e672a39637 trusts: Validate missing trust secret properly 
Detect the situation if the user passes empty trust secret and
error out properly.

https://fedorahosted.org/freeipa/ticket/4266

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-14 16:04:58 +02:00
Petr Viktorin fcd2922d86 baseldap: Return empty string when no effective rights are found 
DS returns the string "none" when no rights were found. All clients
would need to special-case this value when checking the rights.
Return empty string instead.

https://fedorahosted.org/freeipa/ticket/4359

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-09 11:39:34 +02:00
Petr Vobornik 03c25bd98e webui: capitalize labels of undo and undo all buttons 
Make the label of these buttons consistent with other buttons which have
capital first letters.

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
 2014-07-08 12:00:30 +02:00
Petr Vobornik 0b0e77cf99 webui: new navigation structure 
https://fedorahosted.org/freeipa/ticket/4418

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:31:38 +02:00
Martin Basti 2637116eab Allow to add managed permission for reverse zones 
Ticket: https://fedorahosted.org/freeipa/ticket/4422
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 16:10:33 +02:00
Martin Kosek ef83a0c678 Add Modify Realm Domains permission 
The permission is required for DNS Administrators as realm domains
object is updated when a master zone is added.

https://fedorahosted.org/freeipa/ticket/4423

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 12:17:04 +02:00
Martin Basti 29951ada9f Non IDNA zonename should be normalized to lowercase 
Before IDNA support zone was normalized.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-04 09:26:49 +02:00
Tomas Babej 9bf29c270d ipalib: Use DateTime parameter class for OTP token timestamp attributes 
For ipatokennotbefore and ipatokennotafter attributes use DateTime
parameter class instead of Str, since these are represented as
LDAP Generalized Time in LDAP.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-07-04 08:17:37 +02:00
Martin Basti 21c829ffa5 Fix incompatible permission name *zone-del 
Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 14:04:57 +02:00
Martin Basti 1c5fa1c28d Split dns docstring 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d22d971575 Help for forward zones 
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti d18eea4578 Use documentation addresses in dns help 
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 70224597a8 Add DNSSEC experimental support warning message 
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:09 +02:00
Martin Basti 33cf958b98 Add warning about semantic change for zones 
--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2014-07-03 10:32:08 +02:00
Martin Basti 30551a8aa3 Add NSEC3PARAM to zone settings 
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti ff7b44e3b0 Remove NSEC3PARAM record 
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-02 14:54:41 +02:00
Martin Basti c655aa2832 Fix ACI in DNS 
Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-01 12:43:55 +02:00
Martin Basti 12cb31575c DNSSEC: add TLSA record type 
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-07-01 12:37:08 +02:00
Petr Viktorin fdef2e1bd8 permission plugin: Ignore unparseable ACIs 
When manipulating a permission for an entry that has an ACI
that the parser cannot process, skip this ACI instead of
failing.

Add a test that manipulates permission in cn=accounts,
where there are complex ipaAllowedOperation-based ACIs.

Workaround for: https://fedorahosted.org/freeipa/ticket/4376

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-07-01 09:35:38 +02:00
Martin Kosek 50c30c8401 Let Host Administrators use host-disable command 
Host Administrators could not write to service keytab attribute and
thus they could not run the host-disable command.

https://fedorahosted.org/freeipa/ticket/4284

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-30 14:59:27 +02:00
Petr Vobornik 35d3f03843 webui: support unlock user command 
Call user-unlock command from Web UI.

It will unlock displayed user on current master.

https://fedorahosted.org/freeipa/ticket/4407

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 13:11:53 +02:00
Petr Vobornik 72a107c9d7 webui: add link pointing to OTP sync page to login 
https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:04 +02:00
Petr Vobornik 30b1256b62 webui: add OTP token synchronization 
New SyncOTPScreen widget and related facet.

https://fedorahosted.org/freeipa/ticket/4218

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-30 12:27:03 +02:00
Petr Vobornik 8ca5793160 webui: add confirmation for dns zone permission actions 
All header actions should require confirmation.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-27 14:18:33 +02:00
Nathaniel McCallum 0d21937995 Add otptoken-sync command 
This command calls the token sync HTTP POST call in the server providing
the CLI interface to synchronization.

https://fedorahosted.org/freeipa/ticket/4260

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-26 16:15:18 +02:00
Nathaniel McCallum 2767fb584a Add the otptoken-add-yubikey command 
This command behaves almost exactly like otptoken-add except:
1. The new token data is written directly to a YubiKey
2. The vendor/model/serial fields are populated from the YubiKey

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-26 16:10:16 +02:00
Petr Vobornik e3de467676 webui: add placeholders to login screen 
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:39 +02:00
Petr Vobornik 2df6542232 ipa-passwd: add OTP support 
https://fedorahosted.org/freeipa/ticket/4262

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
 2014-06-26 12:37:38 +02:00
Tomas Babej af4518b728 sudorule: Refactor add and remove external_post_callback 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:53 +02:00
Tomas Babej a1d6c9ab6b sudorule: Fix the order of the parameters to have less chaotic output 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:51 +02:00
Tomas Babej 9bb88a15e0 sudorule: Make sure all the relevant attributes are checked when setting category to ALL 
https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:51 +02:00
Tomas Babej af2eb4d695 sudorule: Allow adding deny commands when command category set to ALL 
https://fedorahosted.org/freeipa/ticket/4340

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:50 +02:00
Tomas Babej c7da22c1e6 sudorule: Include externalhost and ipasudorunasextgroup in the list of default attributes 
The following attributes were missing from the list of default attributes:

* externalhost
* ipasudorunasextuser
* ipasudorunasextgroup

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-25 20:14:50 +02:00