Commit Graph

2436 Commits

Author SHA1 Message Date
Petr Vobornik
4832f2986d webui: login screen - improved button switching
- added cancel button to reset password view of login screen
- re-implemented buttons hiding mechanism
- switching between 'Reset Password' and 'Reset Password and Login' according to presence of value in OTP field

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-08-20 19:28:06 +02:00
Petr Vobornik
cba5247f99 webui: improved info msgs on login/token sync/reset pwd pages
- add info icons to distinguish and classify the messages.
- add info text for OTP fields
- fix login instruction inaccuracy related to position of login button

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-08-20 19:28:06 +02:00
Petr Vobornik
a94fc09b57 webui: display expired session notification in a more visible area
The notification is a primary information of the page. It should be more highlighted.

https://fedorahosted.org/freeipa/ticket/4470

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-08-20 19:28:06 +02:00
Petr Vobornik
e995d2b827 webui: better error reporting
On page:
- styled to use proper line breaks
- "centered" by .container class and not by huge padding

Console:
- proper line breaks
- links in stack trace are clickable(Chrome)

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-08-20 10:42:57 +02:00
Thierry bordaz (tbordaz)
04ea75a7a5 User Life Cycle: create containers and scoping DS plugins
User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management
It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging
containers needs to be created.
		Active: cn=users,cn=accounts,$SUFFIX
		Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX
		Stage:  cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX

Plugins scopes:
		krbPrincipalName, krbCanonicalName, ipaUniqueID, uid:
			cn=accounts,SUFFIX
			cn=deleted users,cn=accounts,cn=provisioning,SUFFIX
		DNA:
			cn=accounts,SUFFIX

		Plugins exclude subtree:
		IPA UUID, Referential Integrity, memberOf:
			cn=provisioning,SUFFIX

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-19 09:48:20 +02:00
Jan Cholasta
359dfe58b9 Convert external CA chain to PKCS#7 before passing it to pkispawn.
https://fedorahosted.org/freeipa/ticket/4397

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-14 10:06:27 +02:00
Jan Cholasta
044c5c833a Enable NSS PKIX certificate path discovery and validation for Dogtag.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
03b29b4c8e Update external CA cert in Dogtag NSS DB on IPA CA cert renewal.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
d27e77adc5 Allow upgrading CA-less to CA-full using ipa-ca-install.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
8bbdfff102 Allow adding CA certificates to certificate store in ipa-cacert-manage.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
1b8a1e5564 Update CS.cfg on IPA CA certificate chaining change in renew_ca_cert.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
18aa3216e0 Allow changing chaining of the IPA CA certificate in ipa-cacert-manage.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
f1e186d7d8 Export full CA chain to /etc/ipa/ca.crt in ipa-server-install.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
2b7a7c356c Get up-to-date CA certificates from certificate store in ipa-replica-install.
Previously it used CA certificate from the replica info file directly.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
9e223e6fd4 Upload renewed CA cert to certificate store on renewal.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
586373cf07 Add permissions for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
fd80cc1c59 Configure attribute uniqueness for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
1c612ad3e1 Add container for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
25c10bc161 Add LDAP schema for certificate store.
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
61f166da5d Add LDAP schema for wrapped cryptographic keys.
This is part of the schema at
<http://www.freeipa.org/page/V4/PKCS11_in_LDAP/Schema>.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
d2bf0b8b54 Fix trust flags in HTTP and DS NSS databases.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
52f72ec058 Do not treat the IPA RA cert as CA cert in DS NSS database.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
1778f0ebc9 Allow IPA master hosts to read and update IPA master information.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
61159b7ff2 Check that renewed certificates coming from LDAP are actually renewed.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
7086183519 Do not use ldapi in certificate renewal scripts.
This prevents SELinux denials when accessing the ldapi socket.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
d1386be4d5 Pick new CA renewal master when deleting a replica.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
031096324d Alert user when externally signed CA is about to expire.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
ba3c7b4a89 Add CA certificate management tool ipa-cacert-manage.
Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
2c43a3d0d5 Move external cert validation from ipa-server-install to installutils.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
2f6990c256 Track CA certificate using dogtag-ipa-ca-renew-agent.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
9393c3978e Automatically update CA certificate in LDAP on renewal.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
73d8db6d92 Allow IPA master hosts to update CA certificate in LDAP.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
35857026e6 Support CA certificate renewal in dogtag-ipa-ca-renew-agent.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-07-30 16:04:21 +02:00
Jan Cholasta
1313537736 Check if /root/ipa.csr exists when installing server with external CA.
Remove the file on uninstall.

https://fedorahosted.org/freeipa/ticket/4303

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-28 19:28:27 +02:00
Martin Basti
42d035f64c FIX: named_enable_dnssec should verify if DNS is installed
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-28 17:42:38 +02:00
Petr Vobornik
8288135b5b webui: add bounce url to reset_password.html
reset_password.html now redirects browser to URL specified in 'redirect'
uri component (if present).

The component has to be URI encoded. ie (in browser console):

$ encodeURIComponent('http://pvoborni.fedorapeople.org/doc/#!/guide/Debugging')

-->
"http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging"

-->

https://my.freeipa.server/ipa/ui/reset_password.html?redirect=http%3A%2F%2Fpvoborni.fedorapeople.org%2Fdoc%2F%23!%2Fguide%2FDebugging

https://fedorahosted.org/freeipa/ticket/4440

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:36:08 +02:00
Petr Vobornik
ac7df79a43 webui: remove remaining action-button-disabled occurrences
Buttons in hbactest check for 'action-button-disabled' but it's never set.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:24:21 +02:00
Petr Vobornik
3966417779 webui: replace action_buttons with action_widget
Simplify code base by reuse of 'disable' feature of button_widget. All
occurrences of action-button which were disabled/enabled were replaced
by button-widget.

https://fedorahosted.org/freeipa/ticket/4258

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:24:21 +02:00
Petr Vobornik
9aed114d82 webui: detach facet nodes
Detach/attach facet nodes when switching facets instead of
hiding/showing.

Keeps dom-tree more simple.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:21:37 +02:00
Petr Vobornik
fb975bba20 webui: internet explorer fixes
Fixed:
1. IE doesn't support value 'initial' in CSS rule.
2. setting innerHTML='' also destroys content of child nodes in
LoginScreen in IE -> reattached buttons have no text.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:20:15 +02:00
Petr Vobornik
4059aa12a4 webui: fix nested items creation in dropdown list
Items nested in other items were created in root list instead of nested list.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:18:44 +02:00
Petr Vobornik
855c59c7fc webui: support wildcard attribute level rights
Reproduction:
* add 'extensibleObject' object class to target object

https://fedorahosted.org/freeipa/ticket/4380

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-28 10:13:24 +02:00
Nathaniel McCallum
d3638438fc Add TOTP watermark support
This prevents the reuse of TOTP tokens by recording the last token
interval that was used. This will be replicated as normal. However,
this patch does not increase the number of writes to the database
in the standard authentication case. This is because it also
eliminates an unnecessary write during authentication. Hence, this
patch should be write-load neutral with the existing code.

Further performance enhancement is desired, but is outside the
scope of this patch.

https://fedorahosted.org/freeipa/ticket/4410

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-25 10:41:17 +02:00
Martin Kosek
15eb343b9c Allow hashed passwords in DS
Without nsslapd-allow-hashed-passwords being turned on, user password
migration fails.

https://fedorahosted.org/freeipa/ticket/4450

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-25 10:36:47 +02:00
David Kupka
603842867c Improve password validity check.
Allow use of characters that no longer cause troubles. Check for
leading and trailing characters in case of 389 Direcory Manager password.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-24 14:22:40 +02:00
Petr Vobornik
ad593a5c06 webui: fix disabled state of service's PAC type
Nested options (MS-PAC and PAD) of service's PAC type should be
disabled if no value is supplied (default value is "Inherited
from server configuration"). That was not the case - regression.

This patch fixes it and along with it simplifies the update method
of option_widget_base to be more comprehensible.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:39:16 +02:00
Petr Vobornik
8ba75506c2 webui: disable ipapermbindruletype if permission in a privilege
User is not able to change Bind Rule Type if permission is already
member of a privilege. Let's disable it and don't confuse user.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik
62ac6edcf4 webui: fix selection of empty value in a select widget
Little regression - select widget could not handle empty or no array as an
input value.

It broke 'undo' operation in Permissions' 'Type' attribute while switching
between '' and some value.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik
75a96fb4c2 webui: show managed fields as readonly and not disabled
Visible read-only fields are no longer displayed as disabled in
permission details facet.

https://fedorahosted.org/freeipa/ticket/4254

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00
Petr Vobornik
e60cfa2862 webui: fix add of input group class
The input-group class was added based on visibility of child elements.

This failed when it had to be determined *before* displaying the widget.

Now it's added if the buttons are not hidden by `display: none` CSS rule.

Reviewed-By: Endi Sukma Dewata <edewata@redhat.com>
2014-07-21 12:30:23 +02:00