Commit Graph

7082 Commits

Author SHA1 Message Date
Petr Viktorin
f802845a7a Add missing attributes to 'Modify Sudo rule' permission
https://fedorahosted.org/freeipa/ticket/4344

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-04 17:34:18 +02:00
Petr Viktorin
91a5aecd48 Convert Sudo rule default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-04 17:34:18 +02:00
Petr Viktorin
acb2ca47d6 Add mechanism for updating permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-04 17:34:17 +02:00
Petr Viktorin
3974c75053 test_permission_plugin: limit results in targetfilter find test
The test was finding recently added default permissions. Limit it to
the test permission only.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
2014-06-04 13:35:13 +02:00
Petr Viktorin
a2aca68f63 ipalib.aci: Fix bugs in comparison
- regression in be6edef6e4:
  The __ne__ special method was named incorrectly

- regression in 1ea6def129:
  The targetattr operator was never compared

Include some new comparison tests.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-04 10:10:08 +02:00
Martin Basti
c123d95084 Test DNS: dnsrecord-* zone.test. zone.test. should work
Old ipa versions allows only "dnsrecord-* zone.test. @"

This issue was fixed in ticket:
https://fedorahosted.org/freeipa/ticket/3169

Ticket: https://fedorahosted.org/freeipa/ticket/4232
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-03 16:43:09 +02:00
Martin Basti
7bf30ae773 Fix indentation
There was 5 spaces instead of 4, my bad.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-03 16:43:09 +02:00
Martin Basti
67565d38af Test DNS: wildcard in RR owner
Only test, issue was fixed in
https://fedorahosted.org/freeipa/ticket/3169

Ticket: https://fedorahosted.org/freeipa/ticket/3148
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-03 16:43:09 +02:00
Martin Basti
fa21899529 PTR record target can be relative
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:33 +02:00
Martin Basti
7860c63fb1 DNS new tests
Added new internationalized DNS tests

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
ef71d88bdf DNS modified tests
* working with absolute zone names
* working with DNSName as returned value

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
0827b95d0a move hostname validation from DNS to hosts
Validator is no more used in dns plugin

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
dafd162ae5 _domain_name_validatord moved from DNS to realmdomains
Validator is no more used in dns plugin

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
5b88b39499 Modified record and zone class to support IDN
* Records data are always returned as string
* Attributes idnsname, idnssoamname, idnssoarname are returned as
* DNSName, with
  option --raw as string
* option --raw returns all IDN domains punycoded

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
a4d3d01f3f Modified records and zone parameters to use DNSNameParam
* Zone is stored as an absolute name (ipa never support relative
* zonenames)
* compatible with relative zone names as was before
* PTR target can be relative domain name

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
b964d2130a Modified dns related global functions
* Modified functions to use DNSName type
* Removed unused functions

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
e70f88c696 Modified has_output attributes
Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
d0ce6472f7 DNSName conversion in ipaldap
Domain name has to be stored in LDAP in punycoded value

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
b9969c6afe CLI conversion of DNSName type
Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
d0cf1f3e94 get_ancestors_primary_keys clone
Fix: classes didnt inherite params from parent correctly

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
7625c02844 dns_name_values capability added
Added capability to transfer DNSName type between server and client

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169i

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
64d8da21c6 DNSNameParam parameter
New param type for domain names

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
9c7b0ad156 DNSName type
Type used to store domain names based on dnspython

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
47f473d0ca Allows to sort non text entries
Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Petr Viktorin
93ad23912e Add read permissions for automember tasks
Permission to read all tasks is given to high-level admins.
Managed permission for automember tasks is given to automember task admins.
"targetattr=*" is used because tasks are extensibleObject with
attributes that aren't in the schema.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-02 13:04:59 +02:00
Petr Viktorin
63a2147ac2 krbtpolicy plugin: Fix internal error when global policy is not readable
An ACIError is now raised if:
- the user doesn't have permission to read any one of the ticket policy
  attributes on the requested entry
  (checked using attribute-level rights)
- any ticket policy attribute from the default policy is not available
  (either not readable, or not there at all)
  (only checked if these are accessed, i.e. when the user entry doesn't
   override all of the defaults, or when requesting the global policy)

https://fedorahosted.org/freeipa/ticket/4354

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-05-30 15:50:18 +02:00
Petr Viktorin
b22bdfbb02 krbtpolicy plugin: Code cleanup
- Use the new plugin registration API
  See: http://www.freeipa.org/page/Coding_Best_Practices#Decorator-based_plugin_registration

- Remove the star import from baseldap
  Part of the work for: https://fedorahosted.org/freeipa/ticket/2653

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-05-30 15:50:18 +02:00
Nalin Dahyabhai
16092c3907 Restore krbCanonicalName handling
When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set,
rewrite the principal name to the canonical value, else error out,
instead of always returning an error if the requested name doesn't look
like the canonical one.

https://fedorahosted.org/freeipa/ticket/3966

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-05-30 09:48:05 +02:00
Nalin Dahyabhai
fabd5cd62f Accept any alias, not just the last value
If the entry's krbPrincipalName attribute is multi-valued, accept any of
the values, not just the last one we happen to examine.

https://fedorahosted.org/freeipa/ticket/3966

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-05-30 09:48:05 +02:00
Gabe
9f2c4705d7 ipa recursively adds old backups
- Added exclude for the ipa backup folder to the files tar

https://fedorahosted.org/freeipa/ticket/4331

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-30 08:15:22 +02:00
Petr Viktorin
4f89decc9a ldap2.has_upg: Raise an error if the UPG definition is not found
The UPG Definition is always present in IPA; if it can not be read
it's usually caused by insufficient privileges.
Previously the code assumed the absence of the entry meant that
UPG is disabled. With granular read permissions, this would mean
that users that can add users but can't read UPG Definition would
add users without UPG, and the reason for that would not be very clear.
It is better to fail early if the definition can't be read.

Raise an error if the UPG Definition is not available. This makes
read access to it a prerequisite for adding users.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-29 16:22:37 +02:00
Petr Viktorin
32efe5a887 Add managed read permission for the UPG Definition
Since user_add checks the UPG definition to see if UPG is enabled,
user admins need read access to add users correctly.

All attributes are allowed since UPG Definition is an extensibleObject;
the needed attributes are not in the schema.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-29 16:22:37 +02:00
Petr Viktorin
647fa1db85 aci plugin: Fix internal error when ACIs are not readable
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-29 16:22:37 +02:00
Petr Viktorin
8bbd52e347 pwpolicy-mod: Fix crash when priority is changed
The exc_callback was expecting the old update_entry signature,
(dn, attrs). This was changed to just (entry) for ticket #2660,
see http://www.freeipa.org/page/HowTo/Migrate_your_code_to_the_new_LDAP_API.

Update the exc_callback to expect the entry as first argument,
and add some tests.

https://fedorahosted.org/freeipa/ticket/4309

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 15:58:24 +02:00
Petr Viktorin
8b7daf675e dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone
Part of the work for: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 15:58:24 +02:00
Adam Misnyovszki
71c6d2f1eb Call generate-rndc-key.sh during ipa-server-install
Since systemd has by default a 2 minute timeout to start
a service, the end of ipa-server-install might fail
because starting named times out. This patch ensures that
generate-rndc-key.sh runs before named service restart.

Also, warning message is displayed before KDC install and
generate-rndc-key.sh, if there is a lack of entropy, to
notify the user that the process could take more time
than expected.

Modifications done by Martin Kosek:
- removed whitespace at the end of installutils.py
- the warning in krbinstance.py moved right before the step
  requiring entropy
- slightly reworded the warning message

https://fedorahosted.org/freeipa/ticket/4210

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-27 13:05:53 +02:00
Petr Viktorin
d6a4da30de admin tools: Log IPA version
Add the IPA version, and vendor version if applicable, to the beginning
of admintool logs -- both framework and indivitual tools that don't yet
use the framework.
This will make debugging easier.

https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-27 12:08:55 +02:00
Petr Viktorin
7f465e693c ipalib.version: Add VENDOR_VERSION
This will allow us to make vendors' lives easier by embedding a
vendor tag to installation logs.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-27 12:08:54 +02:00
Petr Vobornik
8cde6f0d6e Increase Java stack size for Web UI build on aarch64
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-26 13:25:58 +02:00
Petr Vobornik
1e96475a77 rpcserver: login_password datetime fix in expiration check
krbpasswordexpiration conversion to time failed because now we get
datetime object instead of string.

https://fedorahosted.org/freeipa/ticket/4339

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-05-26 13:08:34 +02:00
Petr Viktorin
988b2cebf4 ldap2.find_entries: Do not modify attrs_list in-place
dap2.find_entries modified the passed in attrs_list to remove
the virtual attributes memberindirect and memberofindirect
before passing the list to LDAP. This means that a call like
    ldap2.get_entry(dn, attrs_list=some_framework_object.default_attributes)
would permanently remove the virtual attributes from
some_framework_object's definition.

Create a copy of the list instead.

https://fedorahosted.org/freeipa/ticket/4349

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-26 12:39:33 +02:00
Petr Viktorin
193ced0bd7 Remove the global anonymous read ACI
Also remove
- the deny ACIs that implemented exceptions to it:
  - no anonymous access to roles
  - no anonymous access to member information
  - no anonymous access to hbac
  - no anonymous access to sudo (2×)
- its updater plugin

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-26 12:14:55 +02:00
Petr Viktorin
63becae88c Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.x
When upgrading from an "old" IPA, or installing the first "new" replica,
we need to keep allowing anonymous access to many user attributes.

Add an optional 'fixup_function' to the managed permission templates,
and use it to set the bind rule type to 'anonymous' when installing
(or upgrading to) the first "new" master.

This assumes that the anonymous read ACI will be removed in a "new" IPA.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-26 12:12:35 +02:00
Petr Viktorin
993c1c8557 update_managed_permissions: Pass around anonymous ACI rather than its blacklist
It turns out the ACI object of the anonymous read ACI, rather than just the
list of its attributes, will be useful in the future.
Change the plugin so that the ACI object is passed around.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-26 12:12:35 +02:00
Petr Viktorin
791ec1e014 Add managed read permissions to user
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-26 12:12:35 +02:00
Nathaniel McCallum
db7d0219ba Default the token owner to the person adding the token
Creating tokens for yourself is the most common operation. Making this the
default optimizes for the common case.

Reviewed-By: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-23 11:53:02 +03:00
Nathaniel McCallum
5afa3c1815 Only specify the ipatokenuniqueid default in the add operation
Specifying the default in the LDAP Object causes the parameter to be specified
for non-add operations. This is especially problematic when performing the
modify operation as it causes the primary key to change for every
modification.

https://fedorahosted.org/freeipa/ticket/4227

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-05-23 11:50:23 +03:00
Petr Viktorin
4d7351ef07 ipalib.cli: Add filename argument to ipa console
This allows writing simple IPA scripts using the shebang
    #! /usr/bin/ipa console

https://fedorahosted.org/freeipa/ticket/4351

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-05-22 18:22:57 +02:00
Nathaniel McCallum
58f8ebf491 kdb: Don't provide password expiration when using only RADIUS
If the KDC doesn't use the FreeIPA password for authentication, then it is
futile to provide this information. Doing so will only confuse the user. It
also causes password change dialogues when the password is irrelevant.

https://fedorahosted.org/freeipa/ticket/4299

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-22 16:46:01 +02:00
Petr Viktorin
86f943ca18 Replace "replica admins read access" ACI with a permission
Add a 'Read Replication Agreements' permission to replace
the read ACI for cn=config.

https://fedorahosted.org/freeipa/ticket/3829

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-21 09:57:16 +02:00