Commands sysaccount-enable/sysaccount-disable allow to lock/unlock the
account. This is exposed via operational attribute `nsAccountLock`
which has to be explicitly requested to query the state. However, if
account wasn't explicitly disabled before, `nsAccountLock` will not be
returned by the LDAP server.
Ensure the nsaccountlock attribute is always retrieved, validated, and
normalized across sysaccount operations.
- Invoke validate_nsaccountlock in create and modify pre-callbacks to
enforce valid values
- Invoke convert_nsaccountlock in create, modify, list, reset, and
policy post-callbacks to normalize the nsaccountlock attribute and
default to False in case it is absent.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
The test edits krb5 client configuration in /etc/krb5.conf in order
to use a KDC proxy, but the configuration has moved to the snippet
file /etc/krb5.conf.d/freeipa-realm.
Fix the file path.
Fixes: https://pagure.io/freeipa/issue/9871
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
When a translation file does not contain any translation, the
build is broken. Remove the zh_Hant file as it is still empty.
Fix es.po
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 62.5% (3055 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.4% (3047 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.3% (3045 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 59.1% (2886 of 4881 strings)
Co-authored-by: Fco. Javier F. Serrador <fserrador@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/es/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 36.6% (1788 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.9% (1755 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.8% (1751 of 4881 strings)
Co-authored-by: Temuri Doghonadze <temuri.doghonadze@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
A previous commit overwrote the version of freeipa-webui and
went back before the patch that was fixing the copr build.
Refresh to the tip of freeipa-webui to include the copr fix.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Introduce support for LDAP-based system accounts by adding a dedicated
sysaccount plugin with full CLI commands, extending role membership to
include system accounts, and providing warnings for passsync
configuration updates across servers, along with corresponding
documentation and tests.
New Features:
Implement system accounts LDAP object with CLI commands for add,
delete, modify, find, show, enable, and disable.
Enhancements:
Extend role and baseldap plugins to support sysaccount membership
and manage passsync managers with a ServerSysacctMgrUpdateRequired
warning.
Documentation:
Add a design document for system accounts and regenerate API docs
for sysaccount commands and role membership.
Tests:
Update existing role and service plugin tests to cover sysaccount
membership.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Add new attribute, SysAcctManagersDNs, to store list of DNs allowed to
reset user passwords without forcing the users to change them
afterwards.
This list will differ from the use of PassSyncManagersDNs by the fact
that password policy checks will still apply to those password changes.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
- Test scenarios :
- AD users running commands as root via external groups
- AD users switching to other AD user accounts
- IPA users running commands as AD users
- Sudo rule disable/enable functionality
- Command allow/deny restrictions
- Access denial for users not in sudo rules
- Automated with Cursor+Claude
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Instead of modifying /etc/krb5.conf with all IPA realm configuration, follow
the practice of creating a separate config snippet file owned by IPA.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Instead of using chromium from the distribution, use the
browser provided with Pupeteer and disbale the sandbox
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The command launching autogen.sh ends with \ and on fedora 43
this causes a build failure
checking build system type... Invalid configuration '\': machine '\-unknown' not recognized
configure: error: /bin/sh ./config.sub \ failed
Remove the trailing \
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Fedora 43 is now available, switch azure CI to this version.
Fixes: IDM-3231
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The Modrdn plugin doesn't check whether the operation it processes is replicated.
This results in duplicate operations on each replica, for example, when deleting a saved user.
To fix this behavior, a check was added to the Modrdn plugin that the operation is not replicated.
Fixes: https://pagure.io/freeipa/issue/9867
Signed-off-by: vectinx <vectinx@yandex.ru>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Collation should be the same for API files or we will end up with
differences between development environments.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
There seem to be a difference between API notes in different files: some
contain CRLF, some LF only, and also some empty lines are present while
they should not be there.
Normalize the remaining API docs.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
In order to generate the private key for a a LWCA (subca)
on an HSM the name of the subca needs to be the HSM token
name : name_of_subca, e.g. ipa_token:test.
This works fine now without any code changes but it requires
that admins always remember to include the prefix which is
unlikely (everyone makes mistakes). So do it for them if
an HSM is present and a token is not provided. We only support
one token at a time in IPA so for now this is sufficient.
One can also mix-and-match including the token and not.
For example you can run:
$ ipa ca-add test --subject cn=test
$ ipa ca-show ipa_token:test
It shouldn't be an issue if a lwca name contains a colon.
Fixes: https://pagure.io/freeipa/issue/9865
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The test moves the date in the future, performs checks and in the
teardown method uninstalls and moves the date back to the current time.
It often fails in the teardown part because certmonger is in the process
of renewing the expired certificates.
Apply the same strategy as other tests fiddling with the date:
stop certmonger and remove the tracking requests before uninstallation.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The error message returned by ipa ca-show has changed with PKI 11.7.
Adapt the test to succeed with old and new versions.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Fedora 42 now ships PKI 11.7.0-5 and certmonger 0.79.21-1.
Update the vagrant image to 0.0.9 in order to pull the new versions.
Related: IDM-3437
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
It's required to install git for copr, so we can fetch the
webui submodule. Updates webui to use clean-install, updates
dependencies and replaces SWC with Babel for build due to
being architecture agnostic.
Signed-off-by: David Hanina <dhanina@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This repalces the straight string parsing from IPAv3.0.0.
It should be much more robust and result in a valid
configuration file when complete. aug.save() will
assure that as it will raise an error otherwise.
This will handle the following cases:
* db_library = ipadb.so : do nothing
* db_library is missing, set to ipadb.so
* db_library is something else, replace wih ipadb.so
Fixes: https://pagure.io/freeipa/issue/9862
Related: https://pagure.io/freeipa/issue/5913
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
- Tests to cover both root domain and subdomain users:
- Test that adding AD users/groups without the external group to
HBAC rules fails.
- Test HBAC rule denies SSH access for AD users.
- Test HBAC rule allows SSH access for AD users in external group.
- Test HBAC rule denies sudo access for AD users when rule doesn't
include them.
- Test HBAC rule allows sudo access for AD users in external group.
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Florence Blanc-Renaud
PRANAV THUBE
Alexander Bokovoy
Arif Budiman
Andi Chandler
Christian Rohr
Pejman Rezaei
Fco. Javier F. Serrador
Weblate Translation Memory
Temuri Doghonadze
Piotr Drąg
Weblate
Rafael Fontenelle
hsu zangmen
Anuja More
vectinx
Rob Crittenden
Aleksandr Sharov
David Hanina