Commit Graph

7702 Commits

Author SHA1 Message Date
Alexander Bokovoy
2bc287479e updater: enable uid uniqueness plugin for posixAccounts
https://fedorahosted.org/freeipa/ticket/4636

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-21 13:46:55 +02:00
Jan Cholasta
98100feb4e DNSSEC: remove container_dnssec_keys
Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-10-21 12:22:18 +02:00
Martin Basti
b84fc92fd7 DNSSEC: change link to ipa page
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
bcb1e91a19 DNSSEC: add files to backup
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Petr Spacek
dc5b3af72a DNSSEC: add ipa dnssec daemons
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
4ddc978cea DNSSEC: ACI
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
d254bcb146 DNSSEC: upgrading
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
45353245dd DNSSEC: uninstallation
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
877fedf6e4 DNSSEC: installation
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
cc50112f79 DNSSEC: modify named service to support dnssec
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
f01acf8e53 DNSSEC: validate forwarders
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
9af49ff97f DNSSEC: platform paths and services
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
abf4418c46 DNSSEC: opendnssec services
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
52acc54f9e DNSSEC: DNS key synchronization daemon
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
3c7bc2a4fd DNSSEC: add ipapk11helper module
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
3f0440f195 DNSSEC: schema
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
82961a03af DNSSEC: dependencies
Tickets:
https://fedorahosted.org/freeipa/ticket/3801
https://fedorahosted.org/freeipa/ticket/4417

Design:
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Martin Basti
f31f5f5344 Add mask, unmask methods for service
This patch allows mask and unmask services in IPA

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-21 12:18:55 +02:00
Tomas Babej
d969f73ed5 spec: Bump SSSD requires to 1.12.2
https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-21 10:34:03 +02:00
Petr Vobornik
9053673342 webui: update combobox input on list click
Change event of combobox is not triggered when there is only one value. Calling it's handler even for option's 'click' event makes sure that value of input gets always updated.

https://fedorahosted.org/freeipa/ticket/4655

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-21 10:32:46 +02:00
Petr Vobornik
d3de9c0ca1 webui: do not show closed dialog
Fixes issues when dialog is not removed from `IPA.opened_dialogs` registry when dialog.close() is called while the dialog is not shown, i.e., while other dialog is shown. Without it, the dialog is could be incorrectly displayed.

New dialog's property `opened` handles whether dialog is intended to be opened.

How to test:

Add new host with IP address outside of managed reverse zones to get error 4304.

https://fedorahosted.org/freeipa/ticket/4656

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-21 10:29:53 +02:00
Sumit Bose
99b10e5067 extdom: remove unused dependency to libsss_idmap
https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
2014-10-21 10:17:54 +02:00
Sumit Bose
85f229d06d extdom: add support for sss_nss_getorigbyname()
https://fedorahosted.org/freeipa/ticket/3979

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
2014-10-21 10:17:54 +02:00
Alexander Bokovoy
8629f17efc Change ipaOverrideTarget OID to avoid conflict with DNSSEC feature 2014-10-21 10:48:08 +03:00
Martin Basti
1b7bc35b03 Remove ipaContainer, ipaOrderedContainer objectclass
https://fedorahosted.org/freeipa/ticket/4646

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-20 16:58:16 +02:00
Alexander Bokovoy
50f46fdedd Support idviews in compat tree
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-10-20 16:47:49 +02:00
Petr Vobornik
34fb9f02ef webui: do not offer ipa users to Default Trust View
https://fedorahosted.org/freeipa/ticket/4616

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:29:10 +02:00
Petr Vobornik
3485c6e689 webui: hide (un)apply buttons for Default Trust View
Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:25:22 +02:00
Petr Vobornik
04a3dad96d webui: hide applied to hosts tab for Default Trust View
because applying Default Trust view on hosts is not allowed

https://fedorahosted.org/freeipa/ticket/4615

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:25:22 +02:00
Petr Vobornik
2046470be5 webui: change order of idview's facet groups
Applied to hosts facet should not be default because, e.g., for Default Trust View it shouldn't be even visible(o use).

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:25:22 +02:00
Petr Vobornik
b05f39510c webui: make Evented a part of base IPA.object
1. All framework objects to use event interface
2. Framework objects can be part of specification objects but they are not deep-cloned as the rest of specification objects - usually it would cause infinite loop. This make easier to add context as a $pre-op object without a need for $pre-op function.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:25:22 +02:00
Petr Vobornik
502bf56713 webui: allow --force in dnszone-mod and dnsrecord-add
Allow to use --force when changing authoritative nameserver address in DNS zone.

Same for dnsrecord-add for NS record.

https://fedorahosted.org/freeipa/ticket/4573

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 12:06:02 +02:00
Nathaniel McCallum
424b0999c8 Configure IPA OTP Last Token plugin on upgrade
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-20 10:18:47 +02:00
Petr Vobornik
905238fbee webui: management of keytab permissions
https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-20 10:13:47 +02:00
Nathaniel McCallum
2f8dc3b6cc Create ipa-otp-counter 389DS plugin
This plugin ensures that all counter/watermark operations are atomic
and never decrement. Also, deletion is not permitted.

Because this plugin also ensures internal operations behave properly,
this also gives ipa-pwd-extop the appropriate behavior for OTP
authentication.

https://fedorahosted.org/freeipa/ticket/4493
https://fedorahosted.org/freeipa/ticket/4494

Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-20 10:12:36 +02:00
Nathaniel McCallum
23878c36bb Display token type when viewing token
When viewing a token from the CLI or UI, the type of the token
should be displayed.

https://fedorahosted.org/freeipa/ticket/4563

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-20 09:59:19 +02:00
Martin Kosek
3e94aee790 Update contributors
Add missing developers contributing to project git. Cancel "Past and
Occcasional" section and merge the people in the right categories.

Update .mailmap so that the Developer list can be easily re-generated.

Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2014-10-20 08:18:09 +02:00
Petr Vobornik
ace4beca75 webui: add new iduseroverride fields
- add gecos, gidnumber, loginshell, sshkeys fields

https://fedorahosted.org/freeipa/ticket/4617

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-17 15:57:11 +02:00
Petr Vobornik
bb8740aec6 webui: add link to OTP token app
- display info message which points user to FreeOTP project page
- the link or the text can be easily changed by a plugin if needed

https://fedorahosted.org/freeipa/ticket/4469

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-10-17 15:53:34 +02:00
Petr Vobornik
47811d1ccf idviews: error out if appling Default Trust View on hosts
https://fedorahosted.org/freeipa/ticket/4615

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-17 14:28:13 +02:00
Petr Vobornik
7313ed4f9e tests: management of keytab permissions
https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-10-17 14:11:35 +02:00
Petr Vobornik
9cfcb03c70 keytab manipulation permission management
Adds new API:
  ipa host-allow-retrieve-keytab HOSTNAME --users=STR --groups STR
  ipa host-disallow-retrieve-keytab HOSTNAME --users=STR --groups STR
  ipa host-allow-create-keytab HOSTNAME --users=STR --groups STR
  ipa host-disallow-create-keytab HOSTNAME --users=STR --groups STR

  ipa service-allow-retrieve-keytab PRINCIPAL --users=STR --groups STR
  ipa service-disallow-retrieve-keytab PRINCIPAL --users=STR --groups STR
  ipa service-allow-create-keytab PRINCIPAL --users=STR --groups STR
  ipa service-disallow-create-keytab PRINCIPAL --users=STR --groups STR

these methods add or remove user or group DNs in `ipaallowedtoperform` attr with
`read_keys` and `write_keys` subtypes.

service|host-mod|show outputs these attrs only with --all option as:

  Users allowed to retrieve keytab: user1
  Groups allowed to retrieve keytab: group1
  Users allowed to create keytab: user1
  Groups allowed to create keytab: group1

Adding of object class is implemented as a reusable method since this code is
used on many places and most likely will be also used in new features. Older
code may be refactored later.

https://fedorahosted.org/freeipa/ticket/4419

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-10-17 14:11:35 +02:00
Petr Vobornik
895f350ebf dns: fix privileges' memberof during dns install
Permissions with member attrs pointing to privileges are created before the privileges.

Run memberof plugin task to fix other ends of the relationships.

https://fedorahosted.org/freeipa/ticket/4637

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-17 14:08:37 +02:00
Jan Cholasta
5303e6324e Check LDAP instead of local configuration to see if IPA CA is enabled
The check is done using a new hidden command ca_is_enabled.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-17 12:53:11 +02:00
Jan Cholasta
277850e02c Do not fix trust flags in the DS NSS DB in ipa-upgradeconfig
It is necessary to fix trust flags only in the HTTP NSS DB, as it is used as
a source in the upload_cacrt update plugin.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-17 12:53:11 +02:00
Jan Cholasta
63557c2ca3 Do not create ipa-pki-proxy.conf if CA is not configured in ipa-upgradeconfig
This fixes upgrade from CA-less to CA-full after IPA upgrade.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-17 12:53:11 +02:00
Martin Kosek
2e38855295 Remove changetype attribute from update plugin
The attribute addition had no effect, but it should not be there.
2014-10-17 12:02:25 +02:00
Jan Cholasta
b5f9d40dba Add ipa-client-install switch --request-cert to request cert for the host
The certificate is stored in /etc/ipa/nssdb under the nickname
"Local IPA host".

https://fedorahosted.org/freeipa/ticket/4550

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-10-16 19:11:52 +02:00
Jan Cholasta
68a36a2804 Fix certmonger.request_cert
https://fedorahosted.org/freeipa/ticket/4550

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-10-16 19:11:52 +02:00
Jan Cholasta
9607fe3b96 Fix CA cert validity check for CA-less and external CA installer options
https://fedorahosted.org/freeipa/ticket/4612

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-10-16 18:09:49 +02:00