IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
595 Commits 11 Branches 63 Tags
3accc13db9fe8dccdba335482c35845343522e6d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rob Crittenden 3accc13db9 Include --prefix in all invocations of autogen.sh. 
Resolves bz 430002
 2008-01-24 14:40:54 -05:00
Rob Crittenden 00e20c2003 Use Fedora package names for PyKerberos (python-kerberos) and pyasn1 
(python-pyasn1) for the specfile Requires.
 2008-01-24 13:44:38 -05:00
Rob Crittenden 3594157f54 Add a copy of the LICENSE and populate some README's 2008-01-23 10:30:18 -05:00
Rob Crittenden 3302dc7446 Enable server-side sessions. It is currently using files for sessions. 2008-01-23 09:45:46 -05:00
Rob Crittenden 042fb11fa1 Fix issues reported by rpmlint. 
- Removing shebangs (#!) from a bunch of python libraries
- Don't use a variable name in init scripts for the lock file
- Keep the init script name consistent with the binary name, so renamed
  ipa-kpasswd.init to ipa_kpasswd.init
- Add status option to the init scripts
- Move most python scripts out of /usr/share/ipa and into the python
  site-packages directories (ipaserver and ipaclient)
- Remove unnecessary sys.path.append("/usr/share/ipa")
- Fix the license string in the spec files
- Rename ipa-webgui to ipa_webgui everywhere
- Fix a couple of issues reported by pychecker in ipa-python
 2008-01-18 16:20:36 -05:00
Rob Crittenden aaa3cfd58c Fix case where a question was being asked in unattended mode. 
Catch permission errors on install.
Initialize srv so the error message works if the user presses enter
 2008-01-17 16:36:05 -05:00
Rob Crittenden f45ded96a6 Add cyrus-sasl-gssapi as a requirement. 2008-01-16 10:26:53 -05:00
Rob Crittenden c7f3c746cc Backup system state in ipa-server-install 
This patch adds a sysrestore module which allows ipa-server-install
code to backup any system state so that it can be restored again
with e.g. ipa-server-install --uninstall.

The idea is that any files ipa-server-install modifies gets backed
up to /var/cache/ipa/sysrestore/ while any "meta" state, like
whether a service is enabled with chkconfig, is saved to
/var/cache/ipa/sysrestore.state.

Signed-off-by: Mark McLoughlin <markmc@redhat.com>
 2008-01-14 12:43:26 -05:00
Rob Crittenden 29c42e853a Find and delete service principals from the command-line. 2008-01-11 12:52:41 -05:00
Rob Crittenden 42d5ddc559 Service principal deletion 2008-01-11 11:44:23 -05:00
Rob Crittenden 58071a759a Remove registration of get_keytab 2008-01-03 09:29:58 -05:00
Rob Crittenden bbe1fdd8e9 Run ipa-webgui as apache and not as root 2008-01-11 13:05:44 -05:00
Rob Crittenden b51a147a6b Fix help text of -a argument 2008-01-11 13:01:39 -05:00
Rob Crittenden 74d2153c5e Clean up the formatting a little. 2008-01-04 16:44:33 -05:00
Rob Crittenden 1db719691e Add man page 2008-01-04 16:42:33 -05:00
Rob Crittenden 1c4e4b3e14 Add function to retrieve a short list of attributes to make ipa-adddelegation 
easier to use.
 2008-01-04 16:39:41 -05:00
Rob Crittenden dd28d4e6f6 Make button test consistent with rest of page 2008-01-07 16:02:40 -05:00
Rob Crittenden 0576193015 In add_service_principal() don't let the user pass in the realm. 
This could result in a principal of the form: service/host@something@REALM
 2008-01-07 14:03:13 -05:00
Rob Crittenden db2e5b26b7 Use a more obvious name for the subject of the IPA self-signed CA 2008-01-04 11:22:43 -05:00
Rob Crittenden baaead2709 Allow for direct entry of group names when creating delegations. 
This requires a bit of trickery. I use the onblur() javascript function
to note when the field is left and store whatever was entered there.

Then when the page is submitted if a dn doesn't exist for that field
but they did enter something, do a lookup to see if there is a group by
that name.
 2007-12-13 04:32:22 -05:00
Rob Crittenden b5af99c51d Fix the UI indicators for mandatory fields. 
The source and target groups weren't highlighted but the entire block of
checkboxes was and it looked absolutely horrible.
 2007-12-12 15:18:28 -05:00
Rob Crittenden f796e50000 Add simple UI for command-line programs to be able to select when 
multiple entries are returned.
 2007-12-10 16:12:58 -05:00
Rob Crittenden 2675f35fdf Tie the logging module to 'PythonOption IPADebug' in /etc/httpd/conf.d/ipa.conf 2007-12-11 09:56:37 -05:00
Rob Crittenden 40ff6f21db Prompt user before downloading a keytab that this will create a new secret, 
breaking any existing keytabs for that principal.
 2007-12-06 11:56:14 -05:00
Rob Crittenden 592329af18 Use more common names for first and last name labels 2007-12-10 11:55:52 -05:00
Rob Crittenden 6390db3502 Add automatic browser configuration for kerberos SSO using javascript. 
This uses the UniversalPreferencesWrite function to set the browser
preferences to allow negotiation and ticket forwarding in the IPA domain.
A self-signed certificate is generated to sign the javascript.
 2007-12-12 09:36:32 -05:00
Rob Crittenden ca8e71d938 Move the sort arrow to the left of the column title and don't overlap the text 2007-12-10 21:55:12 -05:00
Rob Crittenden f169641aae Use title case for field labels 2007-12-10 17:44:04 -05:00
Rob Crittenden 00489597d8 Rework input validation to more closely match what we require in the UI 2007-12-07 17:07:03 -05:00
Rob Crittenden 5e4a162954 Fix delegation in the UI and add a missing aci that allows writes. 
Make ipa-deldelegation more user-friendly.
 2007-12-07 16:08:12 -05:00
Rob Crittenden 0c0cc370cf Fix spelling 2007-12-10 15:01:30 -05:00
Rob Crittenden b75d735b7e Add default e-mail domain to the IPA configuration 2007-12-10 11:53:00 -05:00
Rob Crittenden c95550a164 Remove some debugging statements 2007-12-10 11:54:42 -05:00
Rob Crittenden 059e8f00ef Add principal management templates 2007-12-10 09:58:18 -05:00
Rob Crittenden 299e457698 Convert krbmaxpwdlife and krbminpwdlife from seconds into days and hours 2007-12-03 18:07:47 -05:00
Rob Crittenden 03fe2a8d6a Increase default max password lifetime from 10 to 90 days 2007-12-03 18:09:14 -05:00
Rob Crittenden 2e7f629d91 Remove unnecessary attribute left over from testing 2007-11-26 20:34:59 -05:00
Rob Crittenden 50c383aeed Update text to reflect new CSS code (sidebar now on right) 2007-11-06 10:22:47 -05:00
Rob Crittenden b3fa02225a Add back in some CSS that was removed in the big UI update. 
This adds back required field colors and colored error and warning msgs.
 2007-12-05 16:15:52 -05:00
rcritten@redhat.com c32a960cae Compatibility changes to work on RHEL 5 with python 2.4 2007-11-30 15:53:02 -05:00
Rob Crittenden 99c676702b The uid_hidden field needs to be retained until after validation succeeds 
otherwise if it ever fails, uid_hidden will be lost which can cause uid
to not be set which cascades into lots of other errors.
 2007-12-06 17:00:38 -05:00
Rob Crittenden 04cccd4426 Improve the error message when an entry is not found. 
We used to return the entire argument string ala:

('dc=freeipa,dc=org', 2, 'uid=foo', ['*'])

This adds a regex to try to print anything after = in the filter.
Not perfect but better.
 2007-12-06 16:48:26 -05:00
Rob Crittenden 2a2d866552 Make uid an editable field in the Edit UI so we can do RDN changes 
Fix group RDN changes
Remove a copy/paste error in the group UI update that caused 2 updates
Fix variable name so groups don't get user objectclasses
Remove color CSS for field backgrounds as they override disabled field display
 2007-12-06 15:36:42 -05:00
Rob Crittenden 6ea3d9610e Utilize user and group objectclass lists in cn=ipaconfig 
Change the syntax on user and group objectclasses in cn=ipaconfig
 2007-12-06 00:30:26 -05:00
Rob Crittenden 8ff9f63d80 Require that the default users group exists 
Fix some copy-paste errors from the password policy update
 2007-11-30 13:27:33 -05:00
Rob Crittenden bac556557d Don't allow the admins or editors groups to be removed. 
Don't allow the default group for users to be removed.
 2007-11-30 12:49:08 -05:00
Rob Crittenden 72595ab1a5 delete_group() takes a DN, not a CN. Also do slightly better error reporting. 2007-11-30 12:04:16 -05:00
Rob Crittenden 5025e990e9 Remove optional arguments from the XML-RPC interface 2007-11-29 16:48:32 -05:00
Rob Crittenden 74d0fba899 Change the password expiration message to be more precise. 2007-11-29 16:43:38 -05:00
Rob Crittenden ab67029d94 Add utility to lock user accounts. Remove lock capability from ipa-deluser 
Fix bootstrap.ldif to add new Class of Service entries properly
Include some man pages that weren't being installed
 2007-11-26 22:28:53 -05:00
Rob Crittenden 0b1650e7ad Add ipa-python to maintainer-clean and clean up .pyc files 2007-11-28 12:33:14 -05:00
Rob Crittenden 86d80f12ca Add some javascript so we can put focus on the first field of the page. 2007-12-06 17:49:56 -05:00
Rob Crittenden 7e2f44df45 Add 'Edit Policy' button at top of page. 2007-12-06 17:46:09 -05:00
Rob Crittenden 849803d37a Always show the edit link on your own record 2007-12-06 17:07:40 -05:00
Rob Crittenden eb141b02ff Move dn removal to the XML-RPC side and remove empty attributes 2007-12-05 17:26:39 -05:00
Rob Crittenden 62b8091a83 Notify the user when the search results have been truncated 2007-12-05 15:25:05 -05:00
Rob Crittenden 15b7dc6ff9 Add UI for service principal creation and keytab retrieval 2007-12-05 15:17:11 -05:00
Rob Crittenden 2fbe5cbf49 Phase 1 of allowing admins to set the default object classes for users & groups 
This adds the UI and does error checking of the selected object classes but
it doesn't actually use the values yet.

It also generalizes some functions for doing multi-valued fields.
 2007-12-04 13:18:37 -05:00
Rob Crittenden 69765f52ce Groups may be iterated over so should be an empty list, not None 2007-12-05 15:12:24 -05:00
Rob Crittenden 23ffab533f Make the old entry option in update_*, check for empty parameters and 
fix some problems reported by pychecker.
 2007-12-11 17:34:15 -05:00
Rob Crittenden 5c217ce31a Change from "Common Name" to "Full Name" 2007-12-11 15:14:29 -05:00
Rob Crittenden 10ac6c3c61 Enable searching for multiple things at once 2007-12-11 15:06:01 -05:00
Rob Crittenden 010fb65bfd define Self-Service as editting your own record. 
This has the side-effect of removing the realm from Loggin in as. This
can be changed by using user_name instead of display_name in master.kid.
 2007-11-02 17:41:24 -04:00
Rob Crittenden 9d24003528 Distinguish between active and inactive users on the Find People page. 2007-11-02 11:42:38 -04:00
Rob Crittenden c54826653f 'make all' needs to depend on autogen.sh but we don't want to re-run it 
on every iteration. This lets the top-level 'make install' work properly.
 2007-11-02 11:34:02 -04:00
Rob Crittenden dc01ea0fe6 groups come back as a list where the first element is the number of 
groups returned. Skip that element.
 2007-11-02 11:35:50 -04:00
Rob Crittenden 6a0ca23577 Update the UI look and feel 2007-11-01 16:15:32 -04:00
Rob Crittenden 10917161a7 Use proper method of retrieving attributes 2007-11-01 13:21:13 -04:00
Rob Crittenden a51dd58278 TurboGears log files and log rotation 
The error log is rotated weekly on Sunday. 4 backups are saved.

The access log is not stored since it would be a duplicate of the
Apache logs. It can be enabled if desired.

Had to move the call to daemonize() in ipa-webgui so that the
fork is done before TurboGears is initialized. Otherwise the log
files end up getting closed.
 2007-11-01 11:55:53 -04:00
Rob Crittenden d9f809746b Completely remove an attribute 2007-10-31 17:11:55 -04:00
Rob Crittenden d3d89f754b Use same tzinfo as the time parser to avoid TypeError from being thrown 2007-11-21 00:27:50 -05:00
Rob Crittenden bf743087d2 Fix indentation error that occured in merge 2007-11-21 00:29:03 -05:00
Rob Crittenden f42f1f44c8 Enable group inactivation by using the Class of Service plugin. 
This adds 2 new groups: activated and inactivated.

If you, or a group you are a member of, is in inactivated then you are too.

If you, or a group you are a member of, is in the activated group, then you
are too.

In a fight between activated and inactivated, activated wins.

The DNs for doing this matching is case and white space sensitive.

The goal is to never have to actually set nsAccountLock in a user directly
but move them between these groups.

We need to decide where in the CLI this will happen. Right it is split
between ipa-deluser and ipa-usermod. To inactivate groups for now just
add the group to inactivate or active.
 2007-11-20 22:45:29 -05:00
Rob Crittenden 1967aafa39 Implement the password policy UI and finish IPA policy UI 
This includes a default password policy
Custom fields are now read from LDAP. The format is a list of
  dicts with keys: label, field, required.
The LDAP-based configuration now specifies:
    ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title
    ipaGroupSearchFields: cn,description
    ipaSearchTimeLimit: 2
    ipaSearchRecordsLimit: 0
    ipaCustomFields:
    ipaHomesRootDir: /home
    ipaDefaultLoginShell: /bin/sh
    ipaDefaultPrimaryGroup: ipausers
    ipaMaxUsernameLength: 8
    ipaPwdExpAdvNotify: 4
This could use some optimization.
 2007-11-16 12:59:32 -05:00
Rob Crittenden 0a3ed69746 Completely remove attributes when delattr argument in ipa-groupmod 2007-11-15 14:44:09 -05:00
Rob Crittenden b01c468e8c Completely remove attributes when delattr argument 2007-11-15 14:39:54 -05:00
Rob Crittenden 49aa82e932 Use same labels as UI for ipa-finduser and ipa-findgroup 
Add -a option to ipa-findgroup to print all attributes
 2007-11-15 14:20:50 -05:00
Rob Crittenden 3e24df161b Replace references to Person and People with User and Users 2007-11-15 13:13:35 -05:00
Rob Crittenden 949b4a0bf7 Check for existance of of the target file in update_file. It used to silently 
fail if the file it was to update didn't exist.
 2007-11-15 11:09:17 -05:00
Rob Crittenden 6f268a185c Broke invididual Requires and BuildRequires onto separate lines and 
reordered them
Added python-tgexpandingformwidget as a dependency
Require at least fedora-ds-base 1.1
 2007-11-15 10:57:26 -05:00
Rob Crittenden bfcc044db2 If unable to connect to the XML-RPC server print a more useful error msg. 2007-11-15 10:27:59 -05:00
Rob Crittenden abdd344073 Remove reference to a bogus system and make the error message more generic 2007-11-14 14:11:29 -05:00
Rob Crittenden 02e5a6599b Forgot to include FQDN in the substitition list 2007-11-13 17:51:29 -05:00
Rob Crittenden cb0476f223 Make the group cn an editable field though protected by default. 
Fix some issues with the multi-value to single-value reversion.
 2007-11-14 23:33:49 -05:00
Rob Crittenden 83dd42797e Include multi-value fields on the Add Person page 
Remove multi-valued cn from groups
 2007-11-14 17:50:46 -05:00
Rob Crittenden 3e715a04cf Add an editors group. This is used to generally grant access for users 
to edit other users (the Edit link won't appear otherwise). Additional
delegation is need to grant permission to individual attributes.
Update the failed login page to indicate that it is a permission issue.
Don't allow access to policy at all for non-admins.
By default users can only edit themselves.
 2007-11-14 10:49:03 -05:00
Rob Crittenden bd78fe0687 Add more fields to the IPA Policy form 2007-11-13 15:36:52 -05:00
Rob Crittenden 83dd26c6e3 Remove non-existent files from Makefile targets 2007-11-13 17:24:00 -05:00
Rob Crittenden eecbaf91e2 Use the dna plugin to automatically assign uid 
Set gid to the group "ipausers"
Add the user to this default group
 2007-11-13 15:03:20 -05:00
Rob Crittenden 79544637d6 The e-mail field should not be required. 2007-11-13 15:49:06 -05:00
Rob Crittenden 5011f64243 Restrict access to some parts of the UI to those in the admins group 2007-11-13 11:15:07 -05:00
Rob Crittenden cd489f0a73 Allow a user or group to change an attribute in its RDN 
Add secretary to the list of indexes otherwise RDN changing could be slow
Port --addattr, --setattr and --delattr from usermod to groupmod
 2007-11-12 23:11:55 -05:00
Rob Crittenden 99b84bfd01 Handle ldap.UNWILLING_TO_PERFORM more gracefully 2007-11-09 16:34:52 -05:00
Rob Crittenden f7358533d0 Add the capability to completely delete a user from the database. The 
default remains to inactivate them.
 2007-11-09 15:45:11 -05:00
Rob Crittenden d9194cdd09 Don't continue if a kerberos credentials cache is not available 
forked-model detection was incorrect.
Both of these return an error instead of raising one
 2007-11-09 14:55:41 -05:00
Rob Crittenden b7506a5ea6 Fix editing groups when cn is a single-valued field 
Fix some error messages that were printing the entire detail message
 2007-11-09 14:01:28 -05:00
Rob Crittenden 705d68ddcb Require uniqueness in the name/comment field of delegations 
Fix error reporting in the UI to include the detailed message
Sort delegations by name when displaying them
Update the name field from "Name" to "Delegation Name"
 2007-11-09 13:58:36 -05:00
Rob Crittenden 6f03dde1ab Underline columns on sort results page so users will know it is a link 
Restore the CSS to display the up/down arrow on sort columns
 2007-11-12 15:14:35 -05:00
Rob Crittenden 547e6e920e Redirect to the FQDN otherwise kerberos auth may fail 2007-11-12 14:47:48 -05:00
Rob Crittenden e1ca8c235c Initial support for policy editing 
More work is needed as the values are currently hardcoded and not saved
 2007-11-12 14:19:05 -05:00