IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
421 Commits 11 Branches 63 Tags
67cddce4d47791ad357ed5551ab58e16dbf87e0c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rob Crittenden d3d89f754b Use same tzinfo as the time parser to avoid TypeError from being thrown 2007-11-21 00:27:50 -05:00
Rob Crittenden bf743087d2 Fix indentation error that occured in merge 2007-11-21 00:29:03 -05:00
Rob Crittenden f42f1f44c8 Enable group inactivation by using the Class of Service plugin. 
This adds 2 new groups: activated and inactivated.

If you, or a group you are a member of, is in inactivated then you are too.

If you, or a group you are a member of, is in the activated group, then you
are too.

In a fight between activated and inactivated, activated wins.

The DNs for doing this matching is case and white space sensitive.

The goal is to never have to actually set nsAccountLock in a user directly
but move them between these groups.

We need to decide where in the CLI this will happen. Right it is split
between ipa-deluser and ipa-usermod. To inactivate groups for now just
add the group to inactivate or active.
 2007-11-20 22:45:29 -05:00
Rob Crittenden 1967aafa39 Implement the password policy UI and finish IPA policy UI 
This includes a default password policy
Custom fields are now read from LDAP. The format is a list of
  dicts with keys: label, field, required.
The LDAP-based configuration now specifies:
    ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title
    ipaGroupSearchFields: cn,description
    ipaSearchTimeLimit: 2
    ipaSearchRecordsLimit: 0
    ipaCustomFields:
    ipaHomesRootDir: /home
    ipaDefaultLoginShell: /bin/sh
    ipaDefaultPrimaryGroup: ipausers
    ipaMaxUsernameLength: 8
    ipaPwdExpAdvNotify: 4
This could use some optimization.
 2007-11-16 12:59:32 -05:00
Rob Crittenden 0a3ed69746 Completely remove attributes when delattr argument in ipa-groupmod 2007-11-15 14:44:09 -05:00
Rob Crittenden b01c468e8c Completely remove attributes when delattr argument 2007-11-15 14:39:54 -05:00
Rob Crittenden 49aa82e932 Use same labels as UI for ipa-finduser and ipa-findgroup 
Add -a option to ipa-findgroup to print all attributes
 2007-11-15 14:20:50 -05:00
Rob Crittenden 3e24df161b Replace references to Person and People with User and Users 2007-11-15 13:13:35 -05:00
Rob Crittenden 949b4a0bf7 Check for existance of of the target file in update_file. It used to silently 
fail if the file it was to update didn't exist.
 2007-11-15 11:09:17 -05:00
Rob Crittenden 6f268a185c Broke invididual Requires and BuildRequires onto separate lines and 
reordered them
Added python-tgexpandingformwidget as a dependency
Require at least fedora-ds-base 1.1
 2007-11-15 10:57:26 -05:00
Rob Crittenden bfcc044db2 If unable to connect to the XML-RPC server print a more useful error msg. 2007-11-15 10:27:59 -05:00
Rob Crittenden abdd344073 Remove reference to a bogus system and make the error message more generic 2007-11-14 14:11:29 -05:00
Rob Crittenden 02e5a6599b Forgot to include FQDN in the substitition list 2007-11-13 17:51:29 -05:00
Rob Crittenden cb0476f223 Make the group cn an editable field though protected by default. 
Fix some issues with the multi-value to single-value reversion.
 2007-11-14 23:33:49 -05:00
Rob Crittenden 83dd42797e Include multi-value fields on the Add Person page 
Remove multi-valued cn from groups
 2007-11-14 17:50:46 -05:00
Rob Crittenden 3e715a04cf Add an editors group. This is used to generally grant access for users 
to edit other users (the Edit link won't appear otherwise). Additional
delegation is need to grant permission to individual attributes.
Update the failed login page to indicate that it is a permission issue.
Don't allow access to policy at all for non-admins.
By default users can only edit themselves.
 2007-11-14 10:49:03 -05:00
Rob Crittenden bd78fe0687 Add more fields to the IPA Policy form 2007-11-13 15:36:52 -05:00
Rob Crittenden 83dd26c6e3 Remove non-existent files from Makefile targets 2007-11-13 17:24:00 -05:00
Rob Crittenden eecbaf91e2 Use the dna plugin to automatically assign uid 
Set gid to the group "ipausers"
Add the user to this default group
 2007-11-13 15:03:20 -05:00
Rob Crittenden 79544637d6 The e-mail field should not be required. 2007-11-13 15:49:06 -05:00
Rob Crittenden 5011f64243 Restrict access to some parts of the UI to those in the admins group 2007-11-13 11:15:07 -05:00
Rob Crittenden cd489f0a73 Allow a user or group to change an attribute in its RDN 
Add secretary to the list of indexes otherwise RDN changing could be slow
Port --addattr, --setattr and --delattr from usermod to groupmod
 2007-11-12 23:11:55 -05:00
Rob Crittenden 99b84bfd01 Handle ldap.UNWILLING_TO_PERFORM more gracefully 2007-11-09 16:34:52 -05:00
Rob Crittenden f7358533d0 Add the capability to completely delete a user from the database. The 
default remains to inactivate them.
 2007-11-09 15:45:11 -05:00
Rob Crittenden d9194cdd09 Don't continue if a kerberos credentials cache is not available 
forked-model detection was incorrect.
Both of these return an error instead of raising one
 2007-11-09 14:55:41 -05:00
Rob Crittenden b7506a5ea6 Fix editing groups when cn is a single-valued field 
Fix some error messages that were printing the entire detail message
 2007-11-09 14:01:28 -05:00
Rob Crittenden 705d68ddcb Require uniqueness in the name/comment field of delegations 
Fix error reporting in the UI to include the detailed message
Sort delegations by name when displaying them
Update the name field from "Name" to "Delegation Name"
 2007-11-09 13:58:36 -05:00
Rob Crittenden 6f03dde1ab Underline columns on sort results page so users will know it is a link 
Restore the CSS to display the up/down arrow on sort columns
 2007-11-12 15:14:35 -05:00
Rob Crittenden 547e6e920e Redirect to the FQDN otherwise kerberos auth may fail 2007-11-12 14:47:48 -05:00
Rob Crittenden e1ca8c235c Initial support for policy editing 
More work is needed as the values are currently hardcoded and not saved
 2007-11-12 14:19:05 -05:00
Rob Crittenden e9dfbfa773 Enable multi-value field support for some attributes on the edit pages 
Better error reporting in the GUI
Include a document describing how multi-valued fields work
 2007-11-08 22:12:42 -05:00
Rob Crittenden 50c383aeed Update text to reflect new CSS code (sidebar now on right) 2007-11-06 10:22:47 -05:00
Rob Crittenden 010fb65bfd define Self-Service as editting your own record. 
This has the side-effect of removing the realm from Loggin in as. This
can be changed by using user_name instead of display_name in master.kid.
 2007-11-02 17:41:24 -04:00
Rob Crittenden 9d24003528 Distinguish between active and inactive users on the Find People page. 2007-11-02 11:42:38 -04:00
Rob Crittenden c54826653f 'make all' needs to depend on autogen.sh but we don't want to re-run it 
on every iteration. This lets the top-level 'make install' work properly.
 2007-11-02 11:34:02 -04:00
Rob Crittenden dc01ea0fe6 groups come back as a list where the first element is the number of 
groups returned. Skip that element.
 2007-11-02 11:35:50 -04:00
Rob Crittenden 6a0ca23577 Update the UI look and feel 2007-11-01 16:15:32 -04:00
Rob Crittenden 10917161a7 Use proper method of retrieving attributes 2007-11-01 13:21:13 -04:00
Rob Crittenden a51dd58278 TurboGears log files and log rotation 
The error log is rotated weekly on Sunday. 4 backups are saved.

The access log is not stored since it would be a duplicate of the
Apache logs. It can be enabled if desired.

Had to move the call to daemonize() in ipa-webgui so that the
fork is done before TurboGears is initialized. Otherwise the log
files end up getting closed.
 2007-11-01 11:55:53 -04:00
Rob Crittenden d9f809746b Completely remove an attribute 2007-10-31 17:11:55 -04:00
Rob Crittenden 303d5ebad9 Have the GUI use memberOf() instead of looping through the member DNs 
Fix a bug in the local transport version of memberOf()
 2007-10-31 10:08:16 -04:00
Rob Crittenden 1d6e88565c Add memberOf API call to the XML-RPC interface 
Make find-groups use memberOf to have a prettier dispaly of members
 2007-10-30 15:07:02 -04:00
Rob Crittenden 402274af4b Allow adding, setting, deleting arbitrary attributes 2007-10-31 09:32:25 -04:00
Rob Crittenden ed387e2ebb Add inetUser to the admin user so memberOf will work 2007-10-30 14:42:19 -04:00
Rob Crittenden 3c8cfd94bd Create LDAP indeces on installation for fields the web GUI searches against 2007-10-30 13:41:41 -04:00
Rob Crittenden c116f8d739 Install the delegation tools 2007-10-29 14:16:44 -04:00
Rob Crittenden 6f5b692b5c Fix minor spelling issue 2007-10-29 14:15:21 -04:00
Rob Crittenden e40c583b12 Create configuration for MIT Windows kerberos client and install into 
http://hostname/config so users can point their MIT client at the IPA
server and automatically fetch the configuration.
 2007-10-29 12:00:48 -04:00
Rob Crittenden 28641544e7 Set the user password when adding a user 2007-10-26 12:35:32 -04:00
Rob Crittenden f5cc36507b Add dependency on python-krbV 2007-10-24 15:39:05 -04:00
Rob Crittenden 0d80589bcb Command-line delegation tools with man pages 2007-10-24 13:10:23 -04:00
Rob Crittenden 04636b8ae7 Add an LDAP attribute -> label mapping function to XML-RPC layer 
Move some ACI functions around in preparation for cli delegation
 2007-10-22 17:06:52 -04:00
Rob Crittenden a47f893957 update_user and update_group need to be defined differently in order 
to be available to the XML-RPC interface
 2007-10-22 10:09:39 -04:00
Rob Crittenden f018c2123c Require mod_nss-1.0.7-2 or higher. This version fixes an issue when 
using mod_nss with mod_proxy.
 2007-10-19 11:41:59 -04:00
Rob Crittenden ba0adcffb1 Require SSL for the XML-RPC interface 2007-10-19 10:14:30 -04:00
Rob Crittenden 6b0587726a Actually return a value to the shell 2007-10-19 09:59:07 -04:00
Rob Crittenden 53166669e7 Make distclean work again 2007-10-19 09:53:27 -04:00
Rob Crittenden d28b759e00 Fix build issues related to the autotools conversion 2007-10-18 22:03:54 -04:00
Rob Crittenden 3eba5d3b8d Add httpinstance.py 2007-10-18 16:20:00 -04:00
Rob Crittenden bc52446074 Fix build issues by combining patches submitted by Michael Gregg and 
Karl MacMillan
Remove #!/usr/bin/python from many files to quiet rpmlint
 2007-10-17 11:28:37 -04:00
Rob Crittenden 91ab2d3893 Add unique exit status to the ipa-find* tools when nothing is found 2007-10-16 12:19:43 -04:00
Rob Crittenden ed8f506b0f First step in enabling SSL in the IPA web server 2007-10-15 15:42:12 -04:00
Rob Crittenden a4143789da Add option -a to print all attributes 
Make sure we don't print out binary data
Remvoe any trailing white space when printing to avoid extra newlines
 2007-10-11 10:00:01 -04:00
Rob Crittenden 0a935d5be3 First draft of man pages for the admin tools 2007-10-11 10:49:32 -04:00
Rob Crittenden dac58ee693 Enabled memberof plugin 2007-10-16 10:17:39 -04:00
Rob Crittenden af0a1d989b Verify that the LDAP ports are available during installation. 2007-10-15 13:27:05 -04:00
Rob Crittenden 95f0c52013 Remove buggy connection caching. Create a new connection for each LDAP 
request.
 2007-10-12 10:37:36 -04:00
Rob Crittenden eddc5d4e42 New LDAP connection pool that does locking 2007-10-08 16:18:38 -04:00
rcritten@redhat.com 53e872fb72 Try to catch more error conditions during installation 
Modify the way we detect SELinux to use selinuxenabled instead of using
  a try/except.
Handle SASL/GSSAPI authentication failures when getting a connection
 2007-10-03 17:37:13 -04:00
rcritten@redhat.com e0b225b1b6 I broke add_groups_to_user and remove_groups_from_user with my 
"use group DN" patch. This fixes it.
 2007-10-02 17:26:09 -04:00
rcritten@redhat.com 6aa72b44e4 Do group operations based on the group DN, not the CN 
Add new class of errors for connections
Raise an exception if a connection cannot be made due to missing ccache
 2007-10-02 16:56:51 -04:00
rcritten@redhat.com 0cfccd0f8c Don't include opts in any public argument lists. It is used internally only. 2007-10-01 13:34:43 -04:00
rcritten@redhat.com f8eda3da3e Fix a couple of XML-RPC functions that were missing the opts argument 
Include a kerberized XML-RPC client that will list the XML-RPC API
 2007-09-26 16:31:43 -04:00
rcritten@redhat.com 0258d01792 Use a different directory for test programs 2007-09-25 09:50:30 -04:00
rcritten@redhat.com 0b65e95b57 Make doing basic testing of Kerberos ticket forwarding and system setup 
easier.
 2007-09-25 08:37:45 -04:00
rcritten@redhat.com fddae7a8a2 Fix error when using with TurboGears 2007-09-25 08:36:23 -04:00
rcritten@redhat.com 2807525128 Do per-user browser configuration 2007-09-24 17:29:51 -04:00
rcritten@redhat.com a53c4f107f Add a per-user re-configuration script 
rename browsersetup.sh to globalsetup.sh
 2007-09-24 15:50:38 -04:00
rcritten@redhat.com cf29177901 First crack at automated browser configuration. Requires running a 
script to set things up on the client machine.
 2007-09-24 15:26:35 -04:00
rcritten@redhat.com 337f0cf853 Install the error web pages 2007-09-24 15:25:44 -04:00
rcritten@redhat.com e606ad5606 Show (hopefully) useful information if the Kerberos connection fails. 2007-09-24 15:20:34 -04:00
rcritten@redhat.com a1196902aa Print the request environment for debugging purposes. 2007-09-24 15:24:44 -04:00
rcritten@redhat.com 2fec56d679 Enable LDAP debugging using the mod_python Apache configuration directive 
PythonOption IPADebug On/Off
 2007-09-21 14:39:52 -04:00
rcritten@redhat.com 7b96973711 Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode 
Add ipa-passwd tool
Add simple field validation package
This patch adds a package requirement, python-krbV. This is needed to
 determine the current user based on their kerberos ticket.
 2007-09-21 10:24:36 -04:00
rcritten@redhat.com 919d037189 Add a failed login page. In theory it should never been seen but it makes 
things nicer
Remove the login page
Remove the login link from master.kid
 2007-09-21 10:58:40 -04:00
rcritten@redhat.com e41bb1d6fe Don't fall back on proxy authentication. We don't generate the certificates 
anymore and that failure just causes more confusion.
 2007-09-24 15:23:50 -04:00
rcritten@redhat.com 2035297e22 Add a missing exception catcher 2007-09-24 15:22:17 -04:00
rcritten@redhat.com 370500ab1a Remove support for LDAP proxy connections 2007-09-20 09:01:23 -04:00
rcritten@redhat.com b85668579e Use ticket forwarding with TurboGears. mod_proxy forwards the principal 
name and location of the keytab. In order for this keytab to be usable
 TurboGears and Apache will need to run as the same user. We will also need
 to listen only on localhost in TG.
 2007-09-14 17:19:02 -04:00
rcritten@redhat.com ed6ab17c9c Add function to allow user's to set/reset their kerberos password 
Remove some unused calls to retrieve the current realm
 2007-09-11 02:48:53 -04:00
rcritten 182fbe3094 Enable mod_proxy to sit in front of TurboGears and pass along the 
kerberos principal name
Add an identity an visit class to TurboGears that can handle the user
 without requiring a database
Update the UI to show the user correctly.
Note that this is currently disabled. It is hardcoded to always return the
 principal test@FREEIPA.ORG in proxyprovider.py
It doesn't handle an unauthorized request because that can never happen.
 2007-09-10 16:33:01 -04:00
rcritten@redhat.com 2377e8bcb0 Add group command-line tools to the Makefile 
Updated installation instructions
 2007-09-07 17:49:44 -04:00
rcritten@redhat.com 861cda3cb5 Initial support for Groups 
Create separate object for Users and Groups (using same base class)
Check for uniqueness before adding new users and groups
Remove user_container from everything but add operations
Abstract out a number of functions that are common across users and groups
Make sure all strings passed in to be in a filter are checked
Add new error message: No modifications specified
 2007-08-24 15:42:56 -04:00
rcritten@redhat.com 240a99b6f3 Move add user logic to the server side 2007-08-23 11:57:25 -04:00
rcritten@redhat.com 8879ee173e Handle optional arguments by using the value __NONE__ over XML-RPC. 
rpcclient.py must call XML-RPC functions with all arguments.
Removed encode_args and decode_args. They were the source of most of the
  argument pain. Now opts is alwyas appended to the end of the arguments
  so MUST be the last argument in any server-side function (can be None)
Allow the User object to handle unicode data
Small fixes to command-line tools to be friendlier
Broke out get_user() into get_user_by_dn() and get_user_by_uid()
Need to request more than just 'nsAccountLock' attribute when trying to
  see if a user is already marked deleted. If it is blank the record
  coming back is empty. Add 'uid' to the list to guarantee something coming
  back (dn is handled specially)
Added user_container attribute to get_user_* and add_user so the caller
  can specify where in the tree the user will be searched for/added.
Added global default value for user_container
 2007-08-23 09:44:00 -04:00
rcritten@redhat.com eebaa73d3d Implement delete users and groups 
Implement adding a group to a group
Some other small fixups
Add new cmd-line tool ipa-delgroup
 2007-08-28 13:52:08 -04:00
rcritten@redhat.com 9b30f46744 Enable LDAP SASL authentication using a forwarded kerberos ticket 
Handle both SASL auth and proxied authentication
Refactor LDAP connection code to be simpler
Other small bug fixes
 2007-09-05 13:14:23 -04:00
rcritten@redhat.com a5b7e3f56b Include any LDAP error strings in XML-RPC Fault exceptions 
Put a try/except around attempts to determine user uniqueness
 2007-08-27 13:45:28 -04:00
rcritten@redhat.com 3daff667ac Pass string changes as a list so modifyModList works properly 2007-08-17 13:46:07 -04:00
rcritten@redhat.com 05f6a22110 Implement user inactivation 
Comment some functions
Add attribute argument to get_user()
 2007-08-17 10:03:33 -04:00