Commit Graph

5108 Commits

Author SHA1 Message Date
Petr Viktorin
5f69a06d1a Fix batch command error reporting
The Batch command did not report errors correctly: it reported
the text of *all* errors, not just PublicError, used unicode(e)
instead of e.strerror (which results in incorrect i18n), and only
reported the text of error messages, not their type and code.

Fix these problems. Update tests.

https://fedorahosted.org/freeipa/ticket/2874
https://fedorahosted.org/freeipa/ticket/2901
2012-07-11 10:49:02 +02:00
David Spångberg
e494650b2c Indirect roles in WebUI
Add a check in the WebUI to use the admin navigation if a user is a
indirect member of a role.
2012-07-11 08:54:45 +02:00
Petr Vobornik
0d11b8b056 Web UI: kerberos ticket policy measurement units
Added measurement units for kerberos ticket policy.

https://fedorahosted.org/freeipa/ticket/2444
2012-07-10 13:30:43 +02:00
Petr Vobornik
848bd0e9e7 Password policy measurement units.
When filling password policy it may be unclear what value to enter because user may not remember field's measurement unit.

This patch adds support for declaring measurement units. It's done in field's/widget's spec by entering key for unit's string (which is in IPA.messages.measurement_units[key]).

Measurement units in table layout are displayed in parenthesis after label. It is to be consistent with some fields which have measurement unit integrated in label.

This patch defines measurement units for password policy's 'History size', 'Failure reset interval' and 'Lockout duration' fields.

https://fedorahosted.org/freeipa/ticket/2437
2012-07-10 13:30:38 +02:00
Petr Vobornik
05cf7c53a6 Display loginas information only after login
Message 'Logged in as: user@FREEIPA.ORG' was displayed before user was logged in. It was wrong.

Now 'Logged in as: XXX' is displayed only when user XXX is logged in. So no more user@FREEIPA.ORG :) .

https://fedorahosted.org/freeipa/ticket/2882
2012-07-10 13:30:01 +02:00
Rob Crittenden
29fd982f7f Make client server option multi-valued, allow disabling DNS discovery
Let the --server option be specified multiple times on the command line.
The first one passed in is the one we enroll against.

Do additional verification before setting dnsok so we can be sure that
the record(s) were actually discovered in DNS.

If servers are provided on the CLI and --fixed-primary is set then
_srv_ is not added to ipa_server in sssd.conf.

https://fedorahosted.org/freeipa/ticket/2841
2012-07-10 10:45:39 +02:00
Martin Kosek
5ba8eeb970 Do not change LDAPObject objectclass list
__json__ method of LDAPObject may inadvertently append a list of possible
objectclasses to a list of basic objectclasses and thus change a behavior
of all subsequent LDAPSearch command. The command may only return objects
where all "possible" objectclasses are present and thus returning an
incomplete list.

Make sure that the LDAPObject object_class list is not modified during
the __json__ method.

https://fedorahosted.org/freeipa/ticket/2906
2012-07-09 14:53:11 +02:00
Sumit Bose
0ffb2022fe Fix typo
Signed-off-by: Simo Sorce <ssorce@redhat.com>
2012-07-09 08:36:05 -04:00
Simo Sorce
6ffb35d0f5 Fix wrong check after allocation. 2012-07-07 16:30:22 -04:00
Petr Vobornik
61c3b86d73 Moved configuration to last position in navigation
Configaration was the last navigation item in IPA server tab. Trusts changed it. It was wrong because configuration is like 'other settings' and so it should be last.

This patch moves configuration navigation item to the last position again.

https://fedorahosted.org/freeipa/ticket/2900
2012-07-06 13:46:49 +03:00
Alexander Bokovoy
8c5504d26a reduce redundant checks in ldapsam_search_users() to a single statement 2012-07-06 13:39:27 +03:00
Alexander Bokovoy
75cb9bb0e1 Use smb.conf 'dedicated keytab file' parameter instead of hard-coded value 2012-07-06 13:38:46 +03:00
Sumit Bose
76d809574b ipasam: replace testing code 2012-07-06 13:06:16 +03:00
Sumit Bose
abe40284cf ipasam: fixes for clang warnings 2012-07-06 13:06:16 +03:00
Sumit Bose
7fb9ca23a1 Allow silent build if available 2012-07-06 13:06:15 +03:00
Alexander Bokovoy
e88049ecee ipasam: improve SASL bind callback
SASL bind callback due to refactoring was referencing local variable which
didn't exist all the time. Fix that by including a copy of service principals
into ipasam long term private struct.

Rework ccache handling to avoid re-initing every time callback is called
2012-07-06 13:06:15 +03:00
Rob Crittenden
e5b6260008 Centralize timeout for waiting for servers to start.
All service start/restart currently go through ipapython/platform so
move the "wait for service to start" code there as well.

A dictionary of known services and ports to wait on is defined in base.py
This is referenced by the platforms by instance name to determine what
to wait for. For the case of dirsrv if we get that as a plain name
(no specific instance) it is assumed to be the main IPA service.

https://fedorahosted.org/freeipa/ticket/2375
https://fedorahosted.org/freeipa/ticket/2610
2012-07-02 17:08:58 -04:00
Rob Crittenden
6fb802152a Become IPA v3 beta 1 (3.0.0.pre1) 2012-07-01 18:07:11 -04:00
Sumit Bose
06b298e93a Use DN objects instead of strings in adtrustinstance 2012-07-01 17:41:57 -04:00
Martin Kosek
d5fe02999c Create default range entry after upgrade
Create default range both on new install and on upgrades. Also make
sure that all range object classes are present for upgraded machines.

Default range LDIF entry for new install was fixed so that new
installation does not crash.

https://fedorahosted.org/freeipa/ticket/2891
2012-07-02 16:27:33 +02:00
Rob Crittenden
a4d2bcde33 Fix compatibility with Fedora 18.
We need a Requires on openssl, the mod_rewrite syntax has changed so
we can dump some unused configuration and we need a newer version of
mod_auth_kerb to pick up the new location of delegated ccache.

https://fedorahosted.org/freeipa/ticket/2839
2012-07-02 15:20:13 +02:00
Petr Viktorin
03f247ec86 Explicitly filter options that permission-{add,mod} passes to aci-{add,mod}
Make permission commands not pass options that the underlying ACI commands
do not understand.

Update tests.

Remove some extraneous imports of the `copy` module.

https://fedorahosted.org/freeipa/ticket/2885
2012-07-02 08:31:03 +02:00
Rob Crittenden
50ebd1a339 Add missing option to range_add in API.txt
Fix build
2012-06-30 19:58:00 -04:00
Sumit Bose
bdb995194c Add range check preop plugin
To make sure that ID ranges do not overlap this plugin checks new
additions and changes for conflicts with existing ranges.

https://fedorahosted.org/freeipa/ticket/2185
2012-06-29 18:00:58 -04:00
Sumit Bose
fbebe82811 Add CLI for ID ranges
https://fedorahosted.org/freeipa/ticket/2185
2012-06-29 18:00:50 -04:00
Sumit Bose
e809802aed Set RID bases for local domain during ipa-adtrust-install 2012-06-29 16:21:23 -04:00
Sumit Bose
0350b5e8a1 Add objects for initial ID range 2012-06-29 16:21:20 -04:00
Sumit Bose
ab6097bc6a Extend LDAP schema
The objectclass ipaIDobject can be used to reserve local UIDs, GIDs or
SIDs for objects that are no neither users nor groups.

The ipa*IDRange objectclasses will be used to store the used Posix ID
ranges of the local domains (ipaDomainIDRange) or the ranges reserved
for AD domains (ipaTrustedADDomainRange). To be able to map the Posix
IDs to a RID and back the corresponding ranges can be saved here as
well.
2012-06-29 16:21:17 -04:00
Sumit Bose
876b1ec175 Use lower case names in LDAP to meet freeIPA convention 2012-06-29 11:59:39 +02:00
Petr Vobornik
5b103ca5b5 Continuation of removing of not supported command options from Web UI
This patch removes following non-existing command options:
 * all,rights in host_disable
 * record_type in dns_record_add
 * all,rights in various xxx_remove_xxx commands used in rule_association_table_field (removing association)

https://fedorahosted.org/freeipa/ticket/2878
2012-06-29 11:56:29 +02:00
Petr Vobornik
d46687ea91 Refactored associatin facet to use facet buttons with actions
Association facet was refactored to use new concept of control buttons. It is the last facet type which don't use this concept.
It fixes regression introduced by previous refactoring of table facet (delete button was never enabled).

https://fedorahosted.org/freeipa/ticket/2876
2012-06-29 11:56:04 +02:00
Petr Vobornik
5b7084aeb5 Web UI password is going to expire in n days notification
This patch adds pending password expiration notification support to Web UI. When user's password is going to expire in less or equal than configure days a bold red text 'Your password expires in N days.' and a link 'Reset your password' are shown in Web UI's header (on the left next to 'Logged in as...').

Clicking on 'Reset your password link' opens IPA.user_password_dialog. Successful reset of own password will reload user's information (whoami) and update header (it will most likely hide the warning and link).

https://fedorahosted.org/freeipa/ticket/2625
2012-06-29 11:55:53 +02:00
Alexander Bokovoy
a6ff85f425 Add support for external group members
When using ipaExternalGroup/ipaExternalMember attributes it is
possible to add group members which don't exist in IPA database.
This is primarily is required for AD trusts support and therefore
validation is accepting only secure identifier (SID) format.

https://fedorahosted.org/freeipa/ticket/2664
2012-06-28 16:53:33 +02:00
Martin Kosek
52f69aaa8a Per-domain DNS record permissions
IPA implements read/write permissions for DNS record or zones.
Provided set of permissions and privileges can, however, only grant
access to the whole DNS tree, which may not be appropriate.
Administrators may miss more fine-grained permissions allowing
them to delegate access per-zone.

Create a new IPA auxiliary objectclass ipaDNSZone allowing
a managedBy attribute for a DNS zone. This attribute will hold
a group DN (in this case a permission) which allows its members
to read or write in a zone. Member permissions in given zone
will only have 2 limitations:
1) Members cannot delete the zone
2) Members cannot edit managedBy attribute

Current DNS deny ACI used to enforce read access is removed so that
DNS privileges are based on allow ACIs only, which is much more
flexible approach as deny ACIs have always precedence and limit
other extensions. Per-zone access is allowed in 3 generic ACIs
placed in cn=dns,$SUFFIX so that no special ACIs has to be added
to DNS zones itselves.

2 new commands have been added which allows an administrator to
create the system permission allowing the per-zone access and
fill a zone's managedBy attribute:
 * dnszone-add-permission: Add per-zone permission
 * dnszone-remove-permission: Remove per-zone permission

https://fedorahosted.org/freeipa/ticket/2511
2012-06-28 15:21:21 +02:00
Martin Kosek
302d5afe8b Add missing libsss_idmap Requires on freeipa-server-trust-ad 2012-06-28 13:48:45 +02:00
Sumit Bose
316aac5a8d Add external domain extop DS plugin
This extop can be used by clients of the IPA domain, e.g. sssd, to
retrieve data from trusted external domains. It can be used e.g. to map
Windows SIDs to user or groups names and back.
2012-06-28 13:08:26 +02:00
Sumit Bose
ac6afd31f7 Add configure check for C Unit-Test framework check
The framework can be found at http://check.sourceforge.net.
2012-06-28 08:13:22 +02:00
Sumit Bose
dc3491ea42 Filter groups in the PAC
If one or more of the external groups given in the PAC can be found in
the ipaExternalGroup objects and these objects are members of local
groups, the SIDs of the local groups are added to the PAC.
2012-06-28 08:05:34 +02:00
Sumit Bose
65ad261663 Add sidgen postop and task
A postop plugin is added to create the SID for new created users and
groups. A directory server task allows to set the SID for existing
users and groups.

Fixes https://fedorahosted.org/freeipa/ticket/2825
2012-06-28 08:02:05 +02:00
Alexander Bokovoy
63567479df Add error condition handling to the SASL bind callback in ipasam
https://fedorahosted.org/freeipa/ticket/2877
2012-06-28 08:00:58 +02:00
Alexander Bokovoy
761cb71838 Support requests for DOMAIN$ account for trusted domains in ipasam module
https://fedorahosted.org/freeipa/ticket/2870
2012-06-28 07:57:29 +02:00
Rob Crittenden
db4c946f47 Defer adding ipa-cifs-delegation-targets until the Updates phase.
It was likely that this would fail being in an LDIF so let an update
file add this potentially conflicting entry instead.

https://fedorahosted.org/freeipa/ticket/2837
2012-06-27 16:50:02 +02:00
Ondrej Hamada
8ce7330c53 Change random passwords behaviour
Improved options checking so that host-mod operation is not changing
password for enrolled host when '--random' option is used.

Unit tests added.

https://fedorahosted.org/freeipa/ticket/2799

Updated set of characters that is used for generating random passwords
for ipa hosts. All characters that might need escaping were removed.

https://fedorahosted.org/freeipa/ticket/2800
2012-06-27 12:58:46 +02:00
Petr Vobornik
3c36fa8c0d Action panel for certificates
This is a continuation of effor which transforms status widgets with buttons executing actions to separate status widget and action panels. This patch strips certificate status widget of its buttons and separates the actions to their own objects. Appropriate modifications are taken in host and service details facets.

New certificate loader, facet policy and evaluator are introduced to make actions and status widget independent. On facet load event new certificate facet policy loads a certificate from result. Unfortunately results don't contain revocation reason so it also executes additional cert-show command to get the revocation reason. Policy store the certifacete to facet. It raises the certifacet_loaded event to notify certificate evaluator and status widget. Status widget updates its state. Certificate evaluater updates state and actions get disabled or enabled.

https://fedorahosted.org/freeipa/ticket/2250
2012-06-27 08:58:24 +02:00
Martin Kosek
32ef4efaca Remove ipaNTHash from global allow ACI
ipaNTHash contains security sensitive information, it should be hidden just
like other password attributes. As a part of preparation for ticket #2511,
the ACI allowing global access is also updated to hide DNS zones.

https://fedorahosted.org/freeipa/ticket/2856
2012-06-26 21:28:25 +02:00
Petr Viktorin
3021b3e9d5 Improve output validation
We only checked the length of Command output dictionaries. A misspelled
key in would not be caught.

Fix the problem by checking if the sets of keys are equal.

Add a test. Split the test methods into more manageable pieces.

https://fedorahosted.org/freeipa/ticket/2860
2012-06-25 22:04:14 -04:00
Petr Viktorin
ec5115a155 Typo fixes 2012-06-25 21:35:11 -04:00
Rob Crittenden
f4d2f2a65b Configure automount using autofs or sssd.
This script edits nsswitch.conf to use either ldap (autofs) or
sss (sssd) to find automount maps.

NFSv4 services are started so Kerberos encryption and/or integrity can
be used on the maps.

https://fedorahosted.org/freeipa/ticket/1233
https://fedorahosted.org/freeipa/ticket/2193
2012-06-25 17:24:34 -04:00
Petr Vobornik
d1fe43c56f Same password validator
This patch adds validator which compares passwords in two fields.

In future it should be used in various password reset dialogs.

A flags attribute was added to field. It's purpose is to define control flags. This patch uses it in details facet and adder dialog to not include fields to command option if the field has 'no_command' flag. Therefore there is no need to use hacks such as disabling of field or removing a value from command's option map when a non-command field is needed (ie verify password).

https://fedorahosted.org/freeipa/ticket/2829
2012-06-26 12:32:50 +02:00
Petr Vobornik
ae19cce7ad Trust Web UI
This patch adds Web UI for trusts.

Navigation path is IPA Server/Trust. It allows to add, deleted and show trust. Mod command doesn't have defined input options so update of a trust is not supported yet.

Adder dialog supports two ways if adding a trust:
1)  adding with domain name, admin name and admin password.
2) adding with domain name, shared secret

Search page shows only list of realm names which are trusts' cns.

Details page is read only. It contains following attributes:
* Realm name (cn)
* Domain NetBIOS name (ipantflatname)
* Domain Security Identifier (ipanttrusteddomainsid)
* Trust direction (trustdirection)
* Trust type (trusttype)

trust_output_params also defines 'Trust status' param. This param is not return by show command as well so it's commented out in code until it's fixed in plugin code.

Fields in details pages are using labels defined in internal.py. It is temporary solution until including of command.has_output_params will be added to metadata.

https://fedorahosted.org/freeipa/ticket/2829
2012-06-25 18:17:06 +02:00