public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
918 Commits 9 Branches 0 Tags
cdba310f02a80d63452feb098b983dbbfbbc890a
Commit Graph
13 Commits
Author SHA1 Message Date
Rob Crittenden 03b3dbd2ab Don't let a user change their own uid. Fix some related errors if they try. 
440895
 2008-04-23 15:36:14 -04:00
Rob Crittenden c3a14e978c Don't error out if the user isn't in any groups. 
438222
 2008-03-26 16:45:06 -04:00
Rob Crittenden 4c288e653a Re-root the IPA web UI to /ipa and the XML-RPC interface to /ipaxml. 
438021
 2008-03-24 15:54:55 -04:00
Rob Crittenden 999bd4fb1e In the UI we don't want to display Edit links unless someone can actually 
edit things. We use the 'editors' group for this. This group itself grants
no permission other than displaying certain things in the UI.

In order to be in the editors group a user must be a member of a group that
is the source group in a delegation. The memberof plugin will do all the
hard work to be sure that a user's memberof contains cn=editors if they
are in a delegated group.

432874
 2008-02-27 15:14:52 -05:00
Rob Crittenden 97d9c235dd Set the license uniformly to GPLv2 only. 2008-02-04 15:15:52 -05:00
Rob Crittenden 69765f52ce Groups may be iterated over so should be an empty list, not None 2007-12-05 15:12:24 -05:00
Rob Crittenden 5011f64243 Restrict access to some parts of the UI to those in the admins group 2007-11-13 11:15:07 -05:00
Rob Crittenden 010fb65bfd define Self-Service as editting your own record. 
This has the side-effect of removing the realm from Loggin in as. This
can be changed by using user_name instead of display_name in master.kid.
 2007-11-02 17:41:24 -04:00
Kevin McCarthy 5cdfc5bd3b Add set_krbccache() calls to new controller methods. 
Small fix to proxyprovider for anonymous case.
 2007-09-20 14:53:23 -07:00
Simo Sorce fbfefe6b0e Merge conflicts between rob and kevin patches 2007-09-20 16:58:54 -04:00
rcritten@redhat.com b85668579e Use ticket forwarding with TurboGears. mod_proxy forwards the principal 
name and location of the keytab. In order for this keytab to be usable
 TurboGears and Apache will need to run as the same user. We will also need
 to listen only on localhost in TG.
 2007-09-14 17:19:02 -04:00
Kevin McCarthy b4297caa8b Small fixes to proxyprovider. 2007-09-11 14:45:53 -07:00
rcritten 182fbe3094 Enable mod_proxy to sit in front of TurboGears and pass along the 
kerberos principal name
Add an identity an visit class to TurboGears that can handle the user
 without requiring a database
Update the UI to show the user correctly.
Note that this is currently disabled. It is hardcoded to always return the
 principal test@FREEIPA.ORG in proxyprovider.py
It doesn't handle an unauthorized request because that can never happen.
 2007-09-10 16:33:01 -04:00