Commit Graph

2031 Commits

Author SHA1 Message Date
Xiao-Long Chen
5e96fbc22a Use /usr/bin/python2
Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com
2014-01-03 09:46:05 +01:00
Tomas Babej
2a2f5ac4e6 Fix incorrect path in error message on sysrestore failure
On sysrestore failure, user is prompted out to remove the sysrestore
file. However, the path to the sysrestore file mentioned in the
sentence is not correct.

https://fedorahosted.org/freeipa/ticket/4080
2013-12-20 16:04:22 +01:00
Jan Cholasta
1357eade4c Prevent garbage from readline on standard output of dogtag-ipa-retrieve-agent.
https://fedorahosted.org/freeipa/ticket/4064
2013-12-20 14:31:05 +01:00
Petr Vobornik
ccac000012 Increase stack size for Web UI builder
Web UI build fails on some architectures or configuration due to
StackOverflow. This patch increases the stack size to solve it.

512k is usually enough but we encountered fail on ppc64 even with 2m,
therefore the 8m. The build is single threaded so it shouldn't waste
much memory.
2013-12-13 15:17:48 +01:00
Petr Viktorin
445634d6ac Add new permission schema
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Permissions_V2
2013-12-13 15:08:51 +01:00
Martin Kosek
9677308caa Allow kernel keyring CCACHE when supported
Server and client installer should allow kernel keyring ccache when
supported.

https://fedorahosted.org/freeipa/ticket/4013
2013-12-09 12:21:22 +01:00
Petr Vobornik
b6540e88d8 Fix license in some Web UI files
Modified web ui files had incorrect GPLv2 headers instead of GPLv3 ones.

All of the affected code is of FreeIPA origin.
2013-12-09 10:18:38 +01:00
Nathaniel McCallum
4cb2c2813d Add RADIUS proxy support to ipalib CLI
https://fedorahosted.org/freeipa/ticket/3368
2013-12-03 14:49:10 +01:00
Ana Krivokapic
2d86d7d85a Make Expression field required when adding automember condition
https://fedorahosted.org/freeipa/ticket/4053
2013-11-27 16:56:59 +01:00
Jan Cholasta
f20577ddc4 Remove mod_ssl port workaround.
https://fedorahosted.org/freeipa/ticket/4021
2013-11-26 12:58:17 +01:00
Petr Viktorin
56e3e12f12 Break long doc string in the Host plugin
Also split the translations in French and Ukraininan

Part of https://fedorahosted.org/freeipa/ticket/3587
2013-11-21 10:34:25 +01:00
Petr Viktorin
35c3a5f161 Update translations from Transifex 2013-11-21 10:34:25 +01:00
Ana Krivokapic
afbf528a83 WebUI: Add userClass attribute to user and host pages
Add userClass attribute to:
- user and host adder dialogs
- user and host detail facets

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3590
2013-11-19 14:27:50 +01:00
Ana Krivokapic
b216a7b610 Add userClass attribute for users
This new freeform user attribute will allow provisioning systems
to add custom tags for user objects which can be later used for
automember rules or for additional local interpretation.

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3588
2013-11-19 14:27:50 +01:00
Petr Viktorin
2bc7803b69 Unify capitalization of attribute names in schema files
Due to a bug[0], python-ldap doesn't parse schema LDIF files correctly
if they use inconsistent capitalization.

This patch works around the bug in IPA schema files.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1007820

Note: git's --word-diff option is recommended for viewing these changes
2013-11-18 16:54:22 +01:00
Petr Viktorin
ec1585f831 Add formerly update-only schema
Some schema was only delivered in updates. Add it back as ldif files.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Petr Viktorin
a1eb71768c Make schema files conform to new updater
The new schema updater only compares textual representations of schema
elements, as formatted by python-ldap.
This works well, but it is too strict for the current schema files in two ways:
- For attribute names in MAY and MUST, the correct letter case must be used
- AttributeTypes must specify explicit EQUALITY and SYNTAX fields even if
    they are the same as its supertype's.
When these restrictions are not followed, the updater will always overwrite
the schema element. This is harmless but it fills up the log unnecessarily.

Modify the schema files to conform to these restrictions.

Part of the work for https://fedorahosted.org/freeipa/ticket/3454

Note: git's --word-diff option is recommended for viewing these changes
2013-11-18 16:54:21 +01:00
Petr Viktorin
d9a1c09e7c Remove schema modifications from update files
As schema is now handled by the schema updater, these entries
are superfluous.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Petr Viktorin
b25f807fbf Update the man page for ipa-ldap-updater 2013-11-18 16:54:21 +01:00
Ana Krivokapic
b7c7eaf8d9 Add automember rebuild command to the web UI
Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3928
2013-11-15 13:28:16 +01:00
Ana Krivokapic
6c9b3b02a4 Fix error message when adding duplicate automember rule
Also fix object_name and object_name_plural for automember rules.

https://fedorahosted.org/freeipa/ticket/2708
2013-11-15 12:46:07 +01:00
Ana Krivokapic
dfea5989f7 Add a privilege and a permission needed for automember rebuild command
Design: http://www.freeipa.org/page/V3/Automember_rebuild_membership
https://fedorahosted.org/freeipa/ticket/3752
2013-11-15 12:46:06 +01:00
Nathaniel McCallum
3f85f09a83 Add support for managing user auth types
https://fedorahosted.org/freeipa/ticket/3368
2013-11-08 12:48:15 +01:00
Jan Cholasta
df5f4ee81d Turn LDAPEntry.single_value into a dictionary-like property.
This change makes single_value consistent with the raw property.

https://fedorahosted.org/freeipa/ticket/3521
2013-11-05 13:56:55 +01:00
Alexander Bokovoy
989493979d Guard import of adtrustinstance for case without trusts
https://fedorahosted.org/freeipa/ticket/4011
2013-11-04 16:37:24 +01:00
Martin Kosek
44d1886d39 Remove deprecated AllowLMhash config
Remove this ipaConfigString value as LM hash is deprecated and in
fact even insecure.

https://fedorahosted.org/freeipa/ticket/3795
2013-11-01 09:30:10 +01:00
Sumit Bose
b5e60c2020 Remove AllowLMhash from the allowed IPA config strings
Fixes https://fedorahosted.org/freeipa/ticket/3795
2013-11-01 09:28:35 +01:00
Petr Vobornik
e3d56597cd Fix password expiration notification
- was broken by navigation and application controller refactoring

https://fedorahosted.org/freeipa/ticket/4003
2013-10-30 13:31:12 +01:00
Jan Cholasta
e98abdca9b Track DS certificate with certmonger on replicas.
https://fedorahosted.org/freeipa/ticket/3975
2013-10-29 15:31:16 +01:00
Martin Kosek
4bed0de60d Remove mod_ssl conflict
Since mod_nss-1.0.8-24, mod_nss and mod_ssl can co-exist on one
machine (of course, when listening to different ports).

To make sure that mod_ssl is not configured to listen on 443
(default mod_ssl configuration), add a check to the installer checking
of either mod_nss or mod_ssl was configured to listen on that port.

https://fedorahosted.org/freeipa/ticket/3974
2013-10-25 15:35:39 +02:00
Martin Kosek
cdd2e9caff Do not add kadmin/changepw ACIs on new installs
These ACI were needed when FreeIPA had a custom ipa_kpasswd daemon,
now that a standard kadmin is used, ACIs are not needed anymore as
kadmin uses the same driver as the KDC.

The ACIs is not removed on upgrades to avoid breaking older
replicas which may still use FreeIPA version with the ipa_kpasswd
daemon.

https://fedorahosted.org/freeipa/ticket/3987
2013-10-25 15:26:51 +02:00
Ana Krivokapic
92cd987e0a Add ipa-advise plugins for nss-pam-ldapd legacy clients
Add three new ipa-advise plugins, to facilitate configuration of
legacy clients using nss-pam-ldapd:

* config-redhat-nss-pam-ldapd
* config-generic-linux-nss-pam-ldapd
* config-freebsd-nss-pam-ldapd

https://fedorahosted.org/freeipa/ticket/3672
2013-10-18 16:15:12 +02:00
Petr Vobornik
b599d44816 Registries and Build Guide 2013-10-16 18:08:17 +02:00
Petr Vobornik
dc97b7b460 Navigation Guide 2013-10-16 18:08:17 +02:00
Petr Vobornik
1950ff2411 Plugin Infrastructure Guide 2013-10-16 18:08:17 +02:00
Petr Vobornik
d212d48015 Debugging Web UI guide 2013-10-16 18:08:17 +02:00
Petr Vobornik
3781d33dbe Phases Guide 2013-10-16 18:08:17 +02:00
Petr Vobornik
cd6a2c431e Configuration for JSDuck documentation generator
Installation: https://github.com/senchalabs/jsduck/wiki/Installation Basically it requires ruby and jsduck gem.

Usage:
$ cd install/ui/doc
$ make

Documentation will be generated into: install/ui/build/code_doc directory
2013-10-16 18:08:17 +02:00
Petr Vobornik
efafd7fe87 Web UI source code annotation
Part of ongoing Web UI documentation effort. Source code is annotated in a way that it can be processed by documentation generator.
2013-10-16 18:08:17 +02:00
Petr Vobornik
3fa304d95e Removal of unused code 2013-10-16 18:08:16 +02:00
Petr Vobornik
b4fc6f4ba8 Load updated Web UI files after server upgrade
Issue:
* There was no caching policy specified.
* -> Browsers use their own default policy.
* -> After upgrade, some Web UI files might have been actualized some not.
* -> With schema change may result into weird bugs in Web UI

Solution considerations:

1. Detect server version change and hard-reload at runtime
Detection is easy. Problem is the reload. Obvious candidate 'window.location.reload(true)' works in Firefox but not in Chrome because expected behavior when parameter is used is not in standard and therefore Chromium/WebKit authors did not implement it.

2. Application Cache
HTML 5 technology which lets web apps to run offline. Besides weird issues with event handlers which I encountered, this would be an ideal candidate. Simple change of manifest file would lead to reload of all files (requires reload of page to used the new files).

Showstopper was usage with untrusted certificate. If user did not add exception for the cert or its CA and would visit the page for a second time, all AJAX calls would fail.

3. Set Expires to now() for everything
Web UI rarely changes so this is an overkill. Setting it to different value is not a solution either. We can't predict when the upgrade will happen and when new Web UI will be needed.

Solution:
* Implemented a mini loader which loads basic resources. Dojo loader takes action after Dojo is loaded.
* The loader adds a version parameter (?v=__NUM_VERSION__) to all requests.
* Version is defined in the loader. It's set to current in `make version-update`.
* All static pages use this loader to fetch their resources.
* Version is also passed to dojo loader as cache-bust for the same effect.
* Expire header was set to 'access time plus 1 year' for /ui folder. Exceptions are HTML files and loader (set to immediate expiration).

Possible issues:
* Images are cached but not requested with version param.
  * Images with version and without are considered different
  * -> We would have to attach version to all URIs - in CSS and in JS. But we should avoid changing jQuery UI CSS.
  * Proposed solution is to change image name when changing image. Image change is done rarely.
* Version is set by build and therefore updated just on server update. It might cause trouble with different update schedule of plugins.
  * No action taken to address this issue yet.
  * We might leave it on plugin devs (own .conf in /etc/httpd/conf.d/)
  * or set expires to now for all plugins
* running `make version-update` is required in order to use static version of UI for testing

https://fedorahosted.org/freeipa/ticket/3798
2013-10-16 18:06:30 +02:00
Tomas Babej
d769b124b0 adtrustinstance: Properly handle uninstall of AD trust instance
The uninstall method of the AD trust instance was not called upon
at all in the ipa-server-install --uninstall phase.

This patch makes sure that AD trust instance is unconfigured when
the server is uninstalled.

The following steps are undertaken:
  * Remove /var/run/samba/krb5cc_samba
  * Remove our keys from /etc/samba/samba.keytab using ipa-rmkeytab
  * Remove /var/lib/samba/*.tdb files

Additionally, we make sure winbind service is stopped from within the
stop() method.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Tomas Babej
45e310ecc4 ipa-adtrust-install: Add warning that we will break existing samba configuration
In case /etc/samba/smb.conf exists and it was not created by ipa-adtrust-install,
print a warning that we will break existing samba configuration and ask for
a confirmation in the interactive mode.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Tomas Babej
4a95a50596 ipa-upgradeconfig: Remove backed up smb.conf
Since we are not able to properly restore the Samba server to the
working state after running ipa-adtrust-install, we should not keep
the smb.conf in the fstore.

This patch makes sure that any backed up smb.conf is removed from
the backup and that this file is not backed up anymore.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Martin Kosek
dfa135e606 Winsync re-initialize should not run memberOf fixup task
Change re-initialize command to consider memberOf fixup task only
for non-winsync replication agreements.

https://fedorahosted.org/freeipa/ticket/3854
2013-10-11 10:08:21 +02:00
Martin Kosek
cb9331ebfc Remove --no-serial-autoincrement
Deprecate this option and do not offer it in installation tools.
Without this option enabled, advanced DNS features like DNSSEC
would not work.

https://fedorahosted.org/freeipa/ticket/3962
2013-10-11 09:47:59 +02:00
Martin Kosek
1480cf1603 Do not allow '%' in DM password
Having '%' in DM password causes pkispawn to crash. Do not allow
users to enter it until pkispawn is fixed.

https://bugzilla.redhat.com/show_bug.cgi?id=953488
2013-10-04 17:41:20 +02:00
Petr Viktorin
321e8635ae Update translations from Transifex 2013-10-04 14:51:19 +02:00
Martin Kosek
b1451373c4 Remove faulty DNS memberOf Task
This task was added with a DN colliding with privilege update memberOf
task being run later and caused this task to be ineffective and thus
miss some privilege membership, like "SELinux User Map Administrators"

DNS update plugin do not need to run any task at all as privileges
will be updated later in scope of 55-pbacmemberof.update

https://fedorahosted.org/freeipa/ticket/3877
2013-10-04 14:30:13 +02:00
Jan Cholasta
194556beb0 Allow PKCS#12 files with empty password in install tools.
https://fedorahosted.org/freeipa/ticket/3897
2013-10-04 10:27:23 +02:00