Commit Graph

7082 Commits

Author SHA1 Message Date
Petr Viktorin
baa72b68b1 Add a new ipaVirtualOperation objectClass to virtual operations
The entries are moved from the ldif file to an update file.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-24 11:19:51 +02:00
Adam Misnyovszki
260c5bd109 webui doc: typo fixes in guides
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-04-23 17:15:41 +02:00
Tomas Babej
01558a77df ipatests: Extend test suite for ID ranges
Add tests coverage for recently added ID range checks dependant
on the ID range types.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-23 13:19:57 +02:00
Tomas Babej
5e5d4818a1 ipa_range_check: Change range_check return values from int to range_check_result_t enum
Using integers for return values that are used for complex casing can be fragile
and typo-prone. Change range_check function to return range_check_result_t enum,
whose values properly describes each of the range_check results.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-23 13:18:41 +02:00
Tomas Babej
91d68864d1 ipa_range_check: Fix typo when comparing strings using strcasecmp
Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-04-23 13:16:35 +02:00
Tomas Babej
6c8b40afb5 ipa_range_check: Do not fail when no trusted domain is available
When building the domain to forest root map, we need to take the case
of IPA server having no trusted domains configured at all. Do not abort
the checks, but return an empty map instead.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-04-23 13:16:35 +02:00
Tomas Babej
246e722b4f ipa_range_check: Make a new copy of forest_root_id attribute for range_info struct
Not making a new copy of this attribute creates multiple frees caused by multiple
pointers to the same forest_root_id from all the range_info structs for all the
domains belonging to given forest.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-04-23 13:16:34 +02:00
Tomas Babej
2c4d41221a ipa_range_check: Connect the new node of the linked list
Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-04-23 13:16:34 +02:00
Tomas Babej
2011392246 ipa_range_check: Use special attributes to determine presence of RID bases
The slapi_entry_attr_get_ulong which is used to get value of the RID base
attributes returns 0 in case the attribute is not set at all. We need
to distinguish this situation from the situation where RID base attributes
are present, but deliberately set to 0.

Otherwise this can cause false negative results of checks in the range_check
plugin.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-04-23 13:16:34 +02:00
Petr Viktorin
d28d37ebdb test_integration.host: Export the hostname to dict as string
Our tests do strict type-checking, using unicode string causes failures.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-22 12:55:35 +02:00
Jan Cholasta
9814b272af Keep original name when setting attribute in LDAPEntry.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:21 +02:00
Jan Cholasta
a8dd7aa337 Use raw attribute values in command result when --raw is specified.
For backward compatibility, the values are converted to unicode, unless the
attribute is binary or the conversion fails.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
b4860d09b4 Replace get_syntax method of IPASimpleObject with new get_type method.
get_type returns the Python type for an LDAP attribute.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
8b6dc819d5 Support API version-specific RPC marshalling.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
4314d02fbf Allow primary keys to use different type than unicode.
Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Petr Vobornik
c644b47492 webui: fix OTP Token add regression
OTP Token add failed because of invalid function call. qr_widget doesn't
contain `on_value_changed` method since it inherits from `IPA.widget` and
not from `IPA.input_widget`.

Emitting the event was preserved for future possible usage.

https://fedorahosted.org/freeipa/ticket/4306

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-17 16:34:09 +02:00
Tomas Babej
f74ab3cba2 ipatests: Fix incorrect UID/GID reference for subdomain users and groups
In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
49a59d1292 ipatests: Allow using FQDN with trailing dot as final hostname
When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
24aa0a91e5 ipatests: tasks: Accept extra arguments when installing client
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
ceca0b5591 ipatests: Fix apache semaphores prior to installing IPA server
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Adam Misnyovszki
f85fe1e851 CI - test_forced_client_reenrollment stability fix
fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19

https://fedorahosted.org/freeipa/ticket/4298

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Petr Viktorin
1e46c0a361 Add managed read permissions to automember
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-17 12:38:50 +02:00
Petr Viktorin
81b0e7466d Do not ask for memberindirect when updating managed permissions
One of the default_attributes of permission is memberofindirect,
a virtual attribute manufactured by ldap2, which is set when a permission
is part of a role.
When update_entry is called on an entry with memberofindirect,
ipaldap tries to add the attribute to LDAP and fails with an objectclass
violation.

Do not ask for memberindirect when retrieving the entry.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-17 10:04:16 +02:00
Petr Viktorin
adde918f38 Add managed read permission to automount
A single permission is added to cover automountlocation,
automountmap, and automountkey.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-17 07:51:03 +02:00
Petr Viktorin
bb4e47d9ea Add managed read permission to idrange
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-16 16:37:43 +02:00
Petr Viktorin
5c8548a4ad Allow anonymous read access to Kerberos containers
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-16 16:10:43 +02:00
Petr Viktorin
b53f2d28fd Add managed read permissions to krbtpolicy
Unlike other objects, the ticket policy is stored in different
subtrees: global policy in cn=kerberos and per-user policy in
cn=users,cn=accounts.
Add two permissions, one for each location.

Also, modify tests so that adding new permissions in cn=users
doesn't cause failures.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
2014-04-16 16:10:43 +02:00
Petr Vobornik
6b0c6bf344 webui: remove IPA.unauthorized_dialog
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
466e32f9ec webui-ci: adapt to new login screen
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
ad48697ff9 webui: fix combobox styles to work with selenium testing
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
937533c48e webui: use asynchronous call for authentication
Change `IPA.login_password` and `IPA.get_credentials` to use async AJAX
and to return promise instead of blocking the code.

IPA.get_credentials is still partially blocking because of negotiate process.
We can't do anything about that.

It allows activity indicators to do their job.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
2ec5d969a2 webui: authentication module
General purpose authentication interface and state. See doc of 'freeipa/auth' module.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
7c068f036f webui: login page
A facet with login sreen widget.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Vobornik
efc9e66f4d webui: login screen widget
Reimplementation of unauthorized dialog into separate widget. It uses RCUE
design.

New features compared to unauthorized dialog:

- reflects auth methods from `auth` module
- validation summary
- differentiates Kerberos auth failure with session expiration
- Caps Lock warning
- form based method doesn't allow password only submission

https://fedorahosted.org/freeipa/ticket/4017
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
0c8b04699b webui: validation summary widget
A widget which aggregates warnings and errors and shows them on one place.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
cb486136db webui: load page
Load page is a simple facet which is displayed up to 'runtime' phase.

On application start it tells the user that there is ongoing activity.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
a1c2512278 webui: publish network activity topics
Network activity is now published through global topics. It allows other
components like activity_widget to listen to them.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
93c4a6388b webui: activity widget
A widget for showing ongoing activity.

Displays a text with changing dots.

It listens to  `network-activity-start` and `network-activity-end` topics.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
642345fd53 webui: standalone facet
`facet.Facet` is a new base class for facets. It doesn't have any dependencies
on entities so it's usable for general purpose facets, e.g., future API browser,
load facet or login facet.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
dec7f98aa9 webui: ContainerMixin
A mixin which implements widget storing logic. Similar logic is already implemented
in details facet and dialog.

Long term goal is to replace that with this one.

Separating the logic into mixin makes it usable in other components.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
f39f4aaae2 webui: FormMixin
a mixin used for fields validation. Basically implements a logic which
is already in details facet and dialog.

Now this logic can be used in any component.

The long term goal is to replace the logic in details facet and dialog
with this mixin.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Vobornik
2680d21402 webui: facet container
A widget which servers as container for facets. FacetContainer is a base
class. App is specialization.

Doing this abstraction will allow us to implement various facet containers.

https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:53 +02:00
Petr Viktorin
75eaf0bddf Add managed read permission to config
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-15 10:42:31 +02:00
Petr Viktorin
3deb76cf17 Fix expected output in permission tests
There is now a second permission affecting krbMinPwdLife.
Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-15 09:45:40 +02:00
Petr Viktorin
f10ec17c03 Add managed read permissions to pwpolicy and cosentry
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-14 12:05:40 +02:00
Petr Viktorin
c08f8d2f1e Add managed read permissions to host
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-14 10:57:37 +02:00
Petr Viktorin
db85ea32c1 test_realmdomains_plugin: Add default ACI to expected output
Since realmdomains is only one entry, _show with --all will return
the ACI on it. Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-11 12:45:14 +02:00
Petr Viktorin
3db9ce3204 Add managed read permission for SELinux user map
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-11 10:28:06 +02:00
Petr Viktorin
c97e1d96e3 Add managed read permissions to realmdomains
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-11 10:17:41 +02:00
Petr Viktorin
a185d45d87 Add managed read permissions to RBAC objects
Add default read permissions to roles, privileges and permissions.
Also add permission to read ACIs. This is required for legacy permissions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
2014-04-11 10:17:41 +02:00