IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
809 Commits 11 Branches 63 Tags
2bb64e404c9d96532b5619b5801532d96f4ebb1f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rob Crittenden 2bb64e404c Don't prompt for confirmation of DM password when installing a replica. 
It implies that you are setting a new password and you really aren't.

Also added a catch for KeyboardInterrupt with instructions on how to
recover from a partial install.

441607
 2008-05-08 12:01:38 -04:00
Rob Crittenden 570b71372f Second half of the redoing how the version is managed. 2008-05-07 18:26:03 -04:00
Rob Crittenden 8e7561cff6 Refine our web space some more so that everything we reference is in /ipa 
UI: /ipa/ui
XML-RPC: /ipa/xml
errors: /ipa/errors
config: /ipa/config

I had to hardcode that URI into the CSS pages but TurboGears handles the
rest of the translations with tg.url().

Added a version to ipa.conf and ipa-rewrite.conf so we can update them
in the future if needed with ipa-upgradeconfig

440443
 2008-05-07 09:41:32 -04:00
Rob Crittenden 5ad2af3429 Redo the way versioning works in freeIPA. 
The file VERSION is now the sole-source of versioning.

The generated .spec files will been removed in the maintainer-clean targets
and have been removed from the repository.

By default a GIT build is done. To do a non-GIT build do:

 $ make TARGET IPA_VERSION_IS_GIT_SNAPSHOT=no

When updating the version you can run this to regenerate the version:

 $ make version-update

The version can be determined in Python by using ipaserver.version.VERSION
 2008-05-05 13:53:57 -04:00
Rob Crittenden 23fe67996c Remove duplicated "the" and add some formatting to the EXAMPLE for clarity. 
443012
 2008-05-05 11:10:40 -04:00
Rob Crittenden 274eb708c2 Fix ownership of the Apache NSS cert and key databases. 
The group "apache" needs to have read access to them so they will work in
Fedora 9+.
 2008-04-30 09:44:48 -04:00
Rob Crittenden 306d8241b3 Fix the client-side search size limit. 
I've changed the variable name searchlimit to sizelimit to match the
name in python-ldap (and hopefully therefore be more readable).

The big change was changing the default value from 0 to -1. As 0 we were
never using the value from cn=ipaconfig

python-ldap expects this to be an int type

In the UI sizelimit was hardcoded at 0 for users

439880
 2008-04-25 16:46:13 -04:00
Rob Crittenden 12ea8efc0b Add --verbose option so the HTTP headers and XML request/response can be seen. 
Also re-do the way modules are imported. I was attemping to have ^C handled
gracefully but the way I did it could mask other problems.

443987
 2008-04-25 10:35:22 -04:00
Rob Crittenden 47e6a75cff Add nfs as a service principal type. 
440242
 2008-04-23 15:42:41 -04:00
Rob Crittenden 03b3dbd2ab Don't let a user change their own uid. Fix some related errors if they try. 
440895
 2008-04-23 15:36:14 -04:00
Rob Crittenden 2427e7c130 Don't allow a replica to prepare a replica for itself. 
442756
 2008-04-23 15:36:13 -04:00
Rob Crittenden def28f3d5b Become version 1.0.0 2008-04-16 14:29:17 -07:00
Rob Crittenden dce8008167 Catch all errors when obtaining an LDAP connection. 
442582
 2008-04-15 21:08:55 -07:00
Rob Crittenden 78bdb75291 Move print statement to the correct scope so it displays both lock and unlock. 
442625
 2008-04-15 21:27:04 -04:00
Rob Crittenden 4eb7c51e59 Better detection of DS not starting. 
The dirsrv init script always returns 0 on status checks, even if an
instance is not started. So we have to look through the output instead.

442452
 2008-04-14 23:14:16 -04:00
Rob Crittenden b1f58e5441 Don't quit trying to lock a user if they aren't in the activated group. 
Users are considered activated by default so don't need to be in the
activated group explicitly. Ignore the "not in group" error when trying
to remove them.

442470
 2008-04-14 23:13:58 -04:00
Rob Crittenden ff3ca61f73 Handle exceptions more gracefully on systems with python-ldap 2.2.0 
442136
 2008-04-14 18:23:29 -04:00
Rob Crittenden ce3f79e51c Configure the ipa_pwd_extop plugin on replicas. 
If plugin isn't configured then the kerberos attributes don't get populated.
User's will get Preauthentication errors from the kerberos libraries
because there is no krbPrincipalKey to match against.

442134
 2008-04-14 17:55:25 -04:00
Rob Crittenden 27691b9e1c Use the same kpasswd.keytab on all replicas. 
If we generate a new keytab for each replica then effectively password
changes can only occur on the last replica created.

439905
 2008-04-09 16:57:41 -04:00
Rob Crittenden 3ec54383f9 Fix error where password was getting set wrong if passed in on command-line. 
439905
 2008-04-08 15:44:05 -04:00
Rob Crittenden 0f00ba24a2 SELinux fix from Dan Walsh 
440646
 2008-04-07 23:50:43 -04:00
Rob Crittenden f88f9f3cc0 Add (post) to Requires: ipa-server-spec 2008-04-07 23:45:00 -04:00
Rob Crittenden 039581d1ed Some SELinux policy changes provided by Dan Walsh. 
440651
 2008-04-07 23:38:51 -04:00
Rob Crittenden ac5a35086e Don't allow the admin user to be removed from the admins group. 
439281
 2008-04-04 17:41:32 -04:00
Rob Crittenden cb4648a8af Add missing normalizeDN() when removing members from a group. 
438387
 2008-04-04 16:30:36 -04:00
Rob Crittenden a761093a30 Create /etc/ipa/ipa.conf earlier in the installation process. 
Because the ipa.config() object raises an error if there is no configuration
file and auto-detection fails, ipa_webgui may fail to start at install time.

440475
 2008-04-03 15:49:07 -04:00
Rob Crittenden 8dafa9dc92 Add missing image 2008-04-03 15:40:11 -04:00
Rob Crittenden c30a533de6 Don't try to update ipauserobjectclasses or ipagroupobjectclasses 
since they aren't being displayed anymore. They will just get blanked.

Also add some error handling in ipahelper.fix_incoming_fields()

438256
 2008-04-02 21:15:49 -04:00
Rob Crittenden d567aa4441 Add missing start_creation() so the install process will get kicked off. 2008-04-02 22:04:24 -04:00
Rob Crittenden 05efbe9991 Fix typo in python directive. Fixes marking a group active. 
440142
 2008-04-01 22:01:23 -04:00
Rob Crittenden 6d136d7fff Fix crash when creating new groups. You can't iterate over a None variable. 
440081
 2008-04-01 15:46:50 -04:00
Rob Crittenden 04da7a1ecc Fix AVC when for reading /proc during password change on RHEL 5 
438007
 2008-04-01 15:40:42 -04:00
Rob Crittenden 98f8a31320 No need to use a regular expression to find the replication host 
430015
 2008-03-31 18:27:42 -04:00
Rob Crittenden 749c396aae On the delegation edit screen allow the direct entry of a group name 
Fix the redirection errors, it was going to back to the Add delegation page

438257
 2008-03-24 17:03:40 -04:00
Rob Crittenden 4b4a13c201 Don't try to add the default group to a user when creating the group. 
This is done automatically and trying to do so will return an error.

432106
 2008-03-31 15:17:39 -04:00
Rob Crittenden 58cfc7ab68 Fix account activation. 
We do account activation by using a Class of Service based on group
membership. A problem can happen if the entry itself has an nsaccountlock
attribute and you try doing Class of Service work as well because the
local attribute has priority. So try to detect that the entry has a local
nsAccountLock attribute and report an appropriate error.

Don't allow the admins or editors groups to be de-activated.

Return a better error message if account [in]activation fails.

Catch errors when doing group [in]activation.

439230
 2008-03-31 11:36:13 -04:00
Rob Crittenden 767acbee06 Put replica info file into /var/lib/ipa instead of the current directory 
439120
 2008-03-28 15:56:07 -04:00
Rob Crittenden b7924139d8 Don't allow the admin user to be removed using the XML-RPC Interface. 
If a site really wants it gone then can delete it via LDAP.

439281
 2008-03-28 15:28:28 -04:00
Rob Crittenden 034d9d6753 Do case-less comparisons when considering objectclass but store the 
current value to prevent unnecessary LPAP updates (and failed writes)

Don't check against these lists on updates, only add them on new entries.

Disable the ability to configure in the UI these values for now.

438256
 2008-03-28 14:47:53 -04:00
Rob Crittenden b387570fe6 Properly detect when ports are available. 
The DS setup program uses Perl and does a similar port available test.
It seems that perl always sets FD_CLOEXEC and python does not. This is
why the port test would pass in python but fail in perl.

439024
 2008-03-27 15:33:06 -04:00
Rob Crittenden 382ff1d29e Put the replica hostname back together properly 
439057
 2008-03-27 10:20:15 -04:00
Rob Crittenden c1ae716afc Normalize member DN's when determining whether they are in a group 
as a direct or indirect member.

438387
 2008-03-26 23:19:54 -04:00
Rob Crittenden bde9959091 When getting members let user indicate what type of member they want. 
The memberOf attribute includes members that are directly in the group
via the "member" attribute and those that are included as a result of
being in a group that is in the group.

The UI needs to be able to distinguish between the two.

438706
 2008-03-27 09:54:41 -04:00
Rob Crittenden fd92652ace Make the memberof task a public function. 
This is used when a new replica is created as well as whenever a replica
is re-initialized from another master.

In order for this to work when not creating an instance the __init__
function needs to be able to determine the suffix and the dm_password
is needed.

I've also added the time to the RDN of the member task to ensure
uniqueness.

438222
 2008-03-27 09:33:01 -04:00
Rob Crittenden 1a1e020258 Add additional detail to error messages. 
This runs the risk of showing too much and confusing users but on the other
hand it often includes required information detailing why the error
occurred such as what attribute the user lacks write access too and why
changing a password failed.

438057
 2008-03-25 09:48:23 -04:00
Rob Crittenden c3a14e978c Don't error out if the user isn't in any groups. 
438222
 2008-03-26 16:45:06 -04:00
Rob Crittenden 79db4c3aa2 Fix file permissions on ca.crt when it is installed. 
438220
 2008-03-26 12:11:58 -04:00
Rob Crittenden 5f72955bca Add some missing man pages 
436501
 2008-03-17 18:04:49 -04:00
Rob Crittenden 4c288e653a Re-root the IPA web UI to /ipa and the XML-RPC interface to /ipaxml. 
438021
 2008-03-24 15:54:55 -04:00
Rob Crittenden 0b7117596d We are really changing the kerberos principal key and not the password when 
we do updates, so use the right terminology internally. Also fix the actual
field we update (and grant permission appropriately in delegations).

The DS password handles updating userPassword and any Samba passwords
as necessary.

438256
 2008-03-24 10:53:33 -04:00
Rob Crittenden 6464c40424 Start ntpd after FDS so that the ntp user can be found. 
Start httpd after ipa_webgui becuse otherwise mod_proxy may not like it if it
can't connect to the UI listening port

438090
 2008-03-24 11:02:49 -04:00
Rob Crittenden e54a16ae1c Allow the realm to be included in the name passed to add_service_principal() 
This is more kerberos-like and it doesn't hurt anything, we just won't
allow realms other than our own to be used.

437566
 2008-03-17 14:09:44 -04:00
Rob Crittenden c3fedca013 Don't define bogus realm/server in configuration file by default 
Add default exception handler to avoid backtraces in cmdline tools
Enhance error message when the IPA server or realm can't be found

437565
 2008-03-17 13:16:56 -04:00
Rob Crittenden a39f38f65b Adding items to the set needs to be lower case to prevent duplicates. 
This function was assuming that the target list was all lower-case so the
set could end up with duplicate values which would get kicked out by LDAP.

433680
 2008-03-10 11:36:04 -04:00
Rob Crittenden 5547ed320a Remove ACI that was causing RDN changes to fail 
Fix for session code so RDN change can succeed

433523
 2008-03-10 10:04:15 -04:00
Rob Crittenden 092b1b694c Add ability to initialize a replication agreement 
Add ability to force a synch to occur
Clean up a lot of unused code in ipaldap.py. This lets us do a simple bind
  without being root (it used to try to read dse.ldif)

436237
 2008-03-07 10:56:03 -05:00
Rob Crittenden 03d7125eac Verify that the hostname is correct in /etc/hosts 
Don't ignore exceptions when getting the hostname from the user

433515
 2008-03-06 13:17:28 -05:00
Rob Crittenden 546155c3af Fix build breakage. We now provide a man file, need to specify location to rpm 2008-03-11 17:02:22 -04:00
Rob Crittenden 7fd656477a Prevent server and domain from being undefined or blank when we need them 
Improve LDAP error reporting
Don't return the str() of discovery values because it can return "None"

436130
 2008-03-05 16:33:12 -05:00
Rob Crittenden d7e30fa7ee Use standard size and alignment for the packed data so it works on 64-bit hosts 2008-03-06 21:59:19 -05:00
Rob Crittenden 2e46645ad5 Remove some duplicate id's that are not valid HTML 
Remove the footer. It was a leftover from the original TurboGears-generated
project that Kevin McCarthy had modified.
 2008-03-05 13:36:39 -05:00
Rob Crittenden 74c29b1bf6 Remove the ability for the average user to add/delete groups on user edit page 
If they have any delegations at all (are in editors group) they will have
these links.

433387
 2008-03-04 14:27:06 -05:00
Rob Crittenden ea53922951 Filter out K/M and krbtgt principals from the service principals list. 
435713
 2008-03-03 17:11:38 -05:00
Rob Crittenden 6301914941 Require that the hostname is a DNS A record and that the forward and reverse 
match.

433515
 2008-03-03 16:10:06 -05:00
Rob Crittenden e88d62ffcf Allow python to look in /usr/sbin for ipa_webgui 
429999
 2008-03-04 15:06:11 -05:00
Rob Crittenden f948904b5c KDC is Key Distribution Center, not Kerberos Domain Controller 
435949
 2008-03-04 14:47:47 -05:00
Rob Crittenden b3c8780c1d Fix build breakage. 2008-03-03 22:30:10 -05:00
Rob Crittenden b49942fe96 Close all fds when running another program. This fixes the SELinux AVCs. 
Put installation log files into /var/log.

430024
 2008-03-03 16:14:48 -05:00
Rob Crittenden 79557e6bf2 Do argument type checking in the XML-RPC interface 
Fix error in service principals where the service wasn't being removed before
doing the DNS lookup.
 2008-02-29 10:58:07 -05:00
Rob Crittenden cc3b9cddef Add small script to start/stop all of the services that IPA requires in the 
proper order.

435026
 2008-02-28 11:37:06 -05:00
Rob Crittenden 6b960c008a Allow groups to be added as a group membe 
435134
 2008-02-28 11:34:34 -05:00
Rob Crittenden ab86f52999 Fix off-by-one error in the number of steps to install a service 2008-02-28 21:57:52 -05:00
Rob Crittenden 6533bc1a84 Add action statement to ldap.conf update 
Move imports into try/except so that ctrl-C can always be caught
Fix typo
 2008-02-27 16:17:38 -05:00
Rob Crittenden 999bd4fb1e In the UI we don't want to display Edit links unless someone can actually 
edit things. We use the 'editors' group for this. This group itself grants
no permission other than displaying certain things in the UI.

In order to be in the editors group a user must be a member of a group that
is the source group in a delegation. The memberof plugin will do all the
hard work to be sure that a user's memberof contains cn=editors if they
are in a delegated group.

432874
 2008-02-27 15:14:52 -05:00
Rob Crittenden ad8096b51f - Centralize try/except so the entire program is covered. This make it 
possible to catch KeyboardInterrupt during the import process.
- Add function for handling python differences with GSSError

434798
 2008-02-27 10:40:18 -05:00
Rob Crittenden d5f5026454 Don't log passwords in ipaserver-install.log 
433509
 2008-02-26 10:48:45 -05:00
Rob Crittenden f49ed705b3 The admins group cannot be renamed. 
433880
 2008-02-27 10:50:17 -05:00
Rob Crittenden f02b5c1962 Use correct variable for determining the host name 
435055
 2008-02-26 22:34:06 -05:00
Rob Crittenden d6d12e9dc5 Require that service principals resolve to a DNS A record. 
There is a --force option for those who know what they are doing.

433483
 2008-02-26 13:51:56 -05:00
Rob Crittenden 111a475b15 Don't try to use options.realm_name unless it was passed in 
Don't allow empty responses to domain and realm name
Handle ctrl-C

434982
 2008-02-26 15:31:34 -05:00
Rob Crittenden 8f0d4a8ed3 Add failover to the XML-RPC client 
433506
 2008-02-22 14:47:15 -05:00
Rob Crittenden 66df51c754 Use the label "Full Name" for "Common Name" 
433525
 2008-02-26 09:33:39 -05:00
Rob Crittenden 3617100849 Compress man pages after installation 2008-02-25 16:34:00 -05:00
Rob Crittenden 6d759d7dcb Move ipa-getkeytab man page into proper subdir 
433878
 2008-02-25 14:56:09 -05:00
Rob Crittenden 02d3c5aff3 Don't allow a group to be a member of itself. 
434542
 2008-02-22 15:40:21 -05:00
Rob Crittenden 44797e3917 Command-line utility to manage password policy 
432814
 2008-02-25 13:11:15 -05:00
Rob Crittenden b9c7056a2a Remove HTML from Javascript error message and fix up language to be clearer 
433374
 2008-02-22 09:36:12 -05:00
Rob Crittenden 231913f3c2 Make sure KrbPrincipalName is unique server-wide 
Fix the build. Somehow this file didn't get committed.
 2008-02-21 23:22:31 -05:00
Rob Crittenden b4c11c9bea Remove reference to wrong command 
Clean up language around automatically appending the Kerberos realm

433800
 2008-02-21 22:37:36 -05:00
Rob Crittenden 49148dc34a Redirect users when they don't use the FQDN on both SSL and non-SSL ports 
We update the mod_nss configuration (nss.conf) during installation to include
ipa-rewrite.conf to handle the SSL side.

433054
 2008-02-21 16:25:09 -05:00
Rob Crittenden 84d1e08d76 Become freeipa-0.99.0 2008-02-21 16:11:42 -05:00
Rob Crittenden 3ede5e42a5 Don't clear out the uid from the session until the record has been updated. 2008-02-20 16:57:01 -05:00
Rob Crittenden 4c588b3d5f Don't let a regular user edit their own active status or manager 
433384
 2008-02-20 23:24:39 -05:00
Rob Crittenden 4bf136d95c Use basestring class when testing to see if an object is a string to support 
both Unicode and byte strings.

433651
 2008-02-21 11:09:53 -05:00
Rob Crittenden 87d9c037e4 Add some additional error handling 
433347
 2008-02-20 16:31:32 -05:00
Rob Crittenden e368fa1844 Create the selinux installation directory before installing files 2008-02-20 22:14:44 -05:00
Rob Crittenden 75ad48272a IE 6 doesn't support transparent PNG 
Remove stray character and a debug line from the CSS

429984
 2008-02-20 17:17:21 -05:00
Rob Crittenden cbb6b5a005 Provide feedback on what is being done during ipa-client-install 
429541
 2008-02-20 17:09:02 -05:00
Rob Crittenden e58774bf2e Fix for building on RHEL 5.x. 2008-02-20 12:51:03 -05:00
Rob Crittenden 936b84f569 Include and use policy icon in the UI 
430954
 2008-02-20 10:53:31 -05:00