Commit Graph

5170 Commits

Author SHA1 Message Date
Jan Cholasta
72cc54bc27 Make --{set,add,del}attr more robust.
This fixes --addattr on single value attributes in add commands and --delattr
on non-unicode attributes in mod commands.

ticket 2954
2012-08-03 14:17:42 +02:00
Petr Viktorin
c8abd24ebe Create /etc/sysconfig/network if it doesn't exist
When the --hostname option is given to ipa-client-install, we
write HOSTNAME to /etc/sysconfig/network. When that file didn't exist,
the installer crashed.

Create the file if it doesn't exist and we need to write to it.

https://fedorahosted.org/freeipa/ticket/2840
2012-08-03 12:09:56 +02:00
Alexander Bokovoy
1be46b322f Handle exceptions when establishing trusts
Translate exceptions produced by DCERPC bindings when establishing trusts.
There are two types of errors that may be produced by DCERPC bindings:
- RuntimeError with a text (RuntimeError('NT_STATUS_OBJECT_NAME_NOT_FOUND')
- RuntimeError with a numeric code and 'friendly' message

Error codes could have two prefixes:
  - NT error codes, start with NT_STATUS_ prefix
  - Windows error codes, start with WERR_ prefix

Full list of errors is available in Samba source code:
  libcli/util/ntstatus.h: NT_STATUS error codes
  libcli/util/werror.h: Windows error codes

Majority of errors returned when dealing with trusts are of NT_STATUS type,
these also include all typical POSIX errors mapped to corresponding NT errors.

Unfortunately, in the textual RuntimeError case very little can be done to
get better clarification of the error. More error paths will need to be added
as they will be discovered -- DCERPC error messaging is complex.

https://fedorahosted.org/freeipa/ticket/2868
2012-08-03 11:00:54 +02:00
Jan Cholasta
9bfa905e72 Add --{set,add,del}attr options to commands which are missing them.
ticket 2963
2012-08-03 10:18:30 +02:00
Simo Sorce
c58836f29d Add PAC filtering
This check the PAC we receive is consistent.
realm, flat name and domain sid must much our understanding or the trustd
realm and no additional sids beyond the own realm ones must be present.

Ticket #2849
2012-08-02 11:28:19 -04:00
Simo Sorce
754d0bea06 Split out manipulation of logon_info blob
This way multiple functions can manipulate the logon info structure until all
operations we want to do on it are done and then fold it back once.
2012-08-02 11:28:12 -04:00
Simo Sorce
1bb9eb7da3 Properly name function to add ipa external groups
The function filter_pac was not filtering the pac at all, it was merely
augmenting it with additional data relevant to the IPA server.

Change the name of the function to avoid confusion.
While there I also simplified and cleaed up the code a bit with regard to
variable names and usage.
2012-08-02 11:28:06 -04:00
Simo Sorce
4baf6ad21c Load list of trusted domain on connecting to ldap
This list is used to validate data in mspac filtering
2012-08-02 11:27:59 -04:00
Simo Sorce
560b9416f6 Move mspac structure to be a private pointer
By keeping it's definition in the mspac file it is easier to modify and make
sure any opertion on it is handled in the same file.
2012-08-02 11:27:52 -04:00
Martin Kosek
8c7556db83 Bump bind-dyndb-ldap version for F18
bind-dyndb-ldap with SOA serial autoincrement was released. Bump
the package version in the spec file. The version is bumped for
F18 only as it was released only to rawhide and we don't want to
break development on F17.

https://fedorahosted.org/freeipa/ticket/2554
2012-08-02 17:22:19 +02:00
Martin Kosek
79a427277a Avoid redundant info message during RPM update
A change to ipa-ldap-updater (and thus an RPM update %post scriptlet)
avoiding redundat "IPA is not configured" message in stderr introdocued
in c20d4c71b8 was reverted in another
patch (b5c1ce88a4).

Return the change back to avoid this message during every RPM update
when IPA is not configured. admintool framework was also fixed to
avoid print an empty line when an exception without an error message
is raised.

https://fedorahosted.org/freeipa/ticket/2892
2012-08-02 16:14:40 +02:00
Petr Vobornik
c2783b9b54 Replace use of attr with prop for booleans
Recommened way of setting boolean HTML attributes is by $.prop(boolean) method not $.attr(boolean) because it sets DOM object property not an attribute. Latter works because of jquery's backward compatibility. This patch makes things clearer.

Some info about prop and attr: http://stackoverflow.com/a/5876747

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:17 +02:00
Petr Vobornik
1a94109f4a Fixed incorrect use of jQuery.attr for setting disabled attribute
Occurance: select_widget

Update to latest version of jQuery uncovered this issue.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:17 +02:00
Petr Vobornik
8ce157910a Web UI tests fix
ACI tests were crashing because of misconfigured facet.
Entity link test were crashing because of incorrect jquery selector.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:17 +02:00
Petr Vobornik
17a6b3f29d Unified buttons
Buttons in association dialog and action list have different style and behavior than buttons in dialogs. This patch unifies it by using jquery.button widget.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:17 +02:00
Petr Vobornik
1c79e283b1 Removal of unnecessary overrides of jquery-ui styles
ipa.css had to be updated to work with updated jquery-ui. This patch removes several duplicate styles.

Following issues were fixed:
 * dialogs titles in IE and Opera were black instead of green
 * no black line in first navigation level in IE and Opera
 * all browsers (FF, IE, Chrome, Opera) have the same style for buttons and headers
 * dialogs has borders again (should we remove its shadow?)

Known issues:
 * selected tab-1 in Chrome and Opera doesn't overlaps background line as in IE and FF. Not sure how to fix without breaking (there are border overlaps) the latter ones. I think it looks good enough.
 * some buttons are missing padding. Will be fixed in next patch.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:16 +02:00
Petr Vobornik
f805001242 Fix for incorrect event handler definition
Clicks events should be better defined by jquery calls (usually addEventListener) not as elements attributes. Definition as element attribute causes problems after upgrade to jquery 1.7.2. Two occurances were removed.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:16 +02:00
Petr Vobornik
2a7e557112 Update to jquery-ui-1.8.21.custom
jquery-ui was regenerated to up to date version.

Border radius and IPA custom colors were added to theme so we don't have to override them in ipa.css.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:16 +02:00
Petr Vobornik
c0dd19da4b Update to jquery.1.7.2.min
jquery library wasn't updated for a long time.

https://fedorahosted.org/freeipa/ticket/2817
2012-08-02 10:27:16 +02:00
Petr Vobornik
dc79b60ebb PAC Type options for services in Web UI
Following options were added to Web UI
    * PAC Type in service
    * PAC Type in configuration

Testing metadata for objects and commands were regenerated.

https://fedorahosted.org/freeipa/ticket/2958
2012-08-02 10:22:25 +02:00
Rob Crittenden
fb817d3401 Add per-service option to store the types of PAC it supports
Create a per-service default as well.

https://fedorahosted.org/freeipa/ticket/2184
2012-08-01 16:15:51 +02:00
Petr Vobornik
fd31396d51 Fixed: combobox stacking in service adder dialog
First select's content is displayed under second comboxes content when select is opened when second combobox is opened

Bonus for:
https://fedorahosted.org/freeipa/ticket/2834
2012-08-01 13:12:42 +02:00
Petr Vobornik
7a2587e6a1 Fixed: Unable to select option in combobox in IE and Chrome
There's probably a bug regarding z-index stacking in Chrome and IE. It appears when combobox is used in dialog. Combobox's select area had z-index=1010. When first jquery dialogs is open it has z-index=1000. Further dialogs have higher z-index. When dialog's z-index exceeds 1010 option in select control can't be selected. IMO it is a browser bug because select control lies in dialog content's stacking context so it should be functional even with z-index=1.

This patch raises select area's z-index to 9000000 which should prevent the issue for some time. Also it make's combobox's z-index configurable so we can solve combobox stacking (ie in service-add dialog).

Second part of:
https://fedorahosted.org/freeipa/ticket/2834
2012-08-01 13:12:33 +02:00
Alexander Bokovoy
68d5fe1ec7 Ensure ipa-adtrust-install is run with Kerberos ticket for admin user
When setting up AD trusts support, ipa-adtrust-install utility
needs to be run as:
   - root, for performing Samba configuration and using LDAPI/autobind
   - kinit-ed IPA admin user, to ensure proper ACIs are granted to
     fetch keytab

As result, we can get rid of Directory Manager credentials in ipa-adtrust-install

https://fedorahosted.org/freeipa/ticket/2815
2012-07-31 17:44:35 +02:00
Petr Viktorin
16ca564b10 Update translations
Update the pot file to match current source, and pull
translations from Transifex

The commands used to create this commit were:
  tx pull -fa  # needs an account and transifex client setup
  cd install/po
  make update-pot
  (update LINGUAS to contain all languages with translations, and no empty ones)
  make update-po
2012-07-31 15:43:54 +02:00
Alexander Bokovoy
051eb5f7e4 When ipaNTHash is missing, ask IPA to generate it from kerberos keys
Signed-off-by: Simo Sorce <ssorce@redhat.com>
2012-07-30 10:32:14 -04:00
Simo Sorce
38d98fd3aa Add special modify op to regen ipaNTHash
The NT Hash is the same thing as the RC4-HMAC key, so we add a function to
extract it from krb5 keys if they are available to avoid forcing a password
change when configuring trust relationships.
2012-07-30 10:31:59 -04:00
Simo Sorce
86d83654dc Improve loops around slapi mods
Avoid the need to allocate/free a Slapi_Mod and avoid checking for attribute
equvalence after a match (use if/else)
2012-07-30 10:31:55 -04:00
Simo Sorce
505bc85ec3 Move code into common krb5 utils
This moves the decoding function that reads the keys from the ber format
into a structure in the common krb5 util code right below the function
that encodes the same data structure into a ber format.
This way the 2 functions are in the same place and can be both used by
all ia components.
2012-07-30 10:31:47 -04:00
Rob Crittenden
03837bfd6d Use certmonger to renew CA subsystem certificates
Certificate renewal can be done only one one CA as the certificates need
to be shared amongst them. certmonger has been trained to communicate
directly with dogtag to perform the renewals. The initial CA installation
is the defacto certificate renewal master.

A copy of the certificate is stored in the IPA LDAP tree in
cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the
certificate, when a certificate is renewed. Only the most current
certificate is stored. It is valid to have no certificates there, it means
that no renewals have taken place.

The clones are configured with a new certmonger CA type that polls this
location in the IPA tree looking for an updated certificate. If one is
not found then certmonger is put into the CA_WORKING state and will poll
every 8 hours until an updated certificate is available.

The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case.
When this certificate is updated we also need to update its entry in
the dogtag tree, adding the updated certificate and telling dogtag which
certificate to use. This is the certificate that lets IPA issue
certificates.

On upgrades we check to see if the certificate tracking is already in
place. If not then we need to determine if this is the master that will
do the renewals or not. This decision is made based on whether it was
the first master installed. It is concievable that this master is no
longer available meaning that none are actually tracking renewal. We
will need to document this.

https://fedorahosted.org/freeipa/ticket/2803
2012-07-30 13:39:08 +02:00
Rob Crittenden
e345ad12eb Fix validator for SELinux user map settings in config plugin.
We need to compare two values and need to be aware of where those
values are coming from. They may come from options, setattr or
existing config. The format of that data is going to be different
depending on its source (always a list internally).

One may also set both at the same time so a standard validator cannot
be used because it lacks the context of the other value being set.

https://fedorahosted.org/freeipa/ticket/2938
https://fedorahosted.org/freeipa/ticket/2940
2012-07-26 23:57:25 -04:00
Simo Sorce
9d853483fe Do not check for DNA magic values
The DNA magic value can be arbitrarily changed by admins so we cannot use a
const value to check. And we relly do not need to check at all. If the DNA
plugin is broken and leaves magic values to reach the post-op stage we have
bigger problems. So just simply get rid of this check.
2012-07-26 14:30:39 -04:00
Simo Sorce
cc466e98ff Add all external samba libraries to BuildRequires
Also move them in the right spot (if ! only client) so that they are required
only when building the server.
2012-07-25 13:34:49 -04:00
Petr Viktorin
23e188f226 Arrange stripping .po files
The .po files we use for translations have two shortcomings when used in Git:
- They include file locations, which change each time the source is updated.
  This results in large, unreadable diffs that don't merge well.
- They include source strings for untranslated messages, wasting space
  unnecessarily.

Update the Makefile so that the extraneous information is stripped when the
files are updated or pulled form Transifex, and empty translation files are
removed entirely.
Also, translations are normalized to a common style. This should help diffs
and merges.

The validator requires file location comments to identify the programming
language, and to produce good error reports.
To make this work, merge the comments in before validation.

First patch for: https://fedorahosted.org/freeipa/ticket/2435
2012-07-24 16:54:21 -04:00
Alexander Bokovoy
cc42d19e35 Rework task naming in LDAP updates to avoid conflicting names in certain cases
There are two problems in task naming in LDAP updates:

1. Randomness may be scarce in virtual machines
2. Random number is added to the time value rounded to a second

The second issue leads to values that may repeat themselves as time
only grows and random number is non-negative as well, so
t2+r2 can be equal to t1+t2 generated earlier.

Since task name is a DN, there is no strict requirement to use an integer value.
Instead, we generate an UUID and use its 60-bit time, 14-bit sequential number,
and attribute name.

https://fedorahosted.org/freeipa/ticket/2942
2012-07-24 16:17:03 -04:00
Petr Vobornik
1235739122 Fix autoscroll to top in tables in IE
In IE when a window is small (horizontal scrollbar is displayed) click or keyboard input on various parts of UI makes search tables scroll to top. It prevents from selecting items in a table. This issue happens when using absolute positioned element with overflow style. It's a bug in IE.

Two workarounds were added to make UI usable in IE.
Adding position:relative; style to body element fixes the problem in search pages. It doesn't help in association dialogs though.
The bug doesn't occur when some child element has focus. It's possible to set focus to first visible checkbox while scrolling down but user experience is very bad. Better solution seems to scroll back when IE scrolls to top on mousedown. That way mouse click event happens on the target element and it can gain focus and therefore be selected. Some glitches still remains but is usable.

https://fedorahosted.org/freeipa/ticket/2835
2012-07-25 11:06:02 +02:00
Petr Vobornik
65bd82eaa1 IDs and names for dialogs
It's hard to detect if or which type dialog is displayed becouse not all dialogs have IDs.

On dialog open, it's id or name (if id is not set) is used for containing element id. Many of dialog types were missing id or name so name was added to each dialog type.

In HTML, element's id should be unique. Our framework allows opening two dialogs with the same id. It may lead to state where getElementById method may have unpredicted behaviour. Therefore attribute 'data-name' with dialog's name was added to dialog's containing element. Automation framework can search more reliable by using this attribute instead of id.

https://fedorahosted.org/freeipa/ticket/2853
2012-07-25 11:05:56 +02:00
Simo Sorce
dedb180ddc Add libtalloc-devel as spec file BuildRequire 2012-07-24 14:25:43 -04:00
Petr Viktorin
b5c1ce88a4 Framework for admin/install tools, with ipa-ldap-updater
Currently, FreeIPA's install/admin scripts are long pieces of code
that aren't very reusable, importable, or testable.
They have been extended over time with features such as logging and
error handling, but since each tool was extended individually, there
is much inconsistency and code duplication.
This patch starts a framework which the admin tools can use, and
converts ipa-ldap-updater to use the framework.

Common tasks the tools do -- option parsing, validation, logging
setup, error handling -- are represented as methods. Individual
tools can extend, override or reuse the defaults as they see fit.

The ipa-ldap-updater has two modes (normal and --upgrade) that
don't share much functionality. They are represented by separate
classes. Option parsing, and selecting which class to run, happens
before they're instantiated.

All code is moved to importable modules to aid future testing. The
only thing that remains in the ipa-ldap-updater script is a two-line
call to the library.

First part of the work for:
https://fedorahosted.org/freeipa/ticket/2652
2012-07-22 23:17:56 -04:00
Rob Crittenden
78810f9068 Default to no when trying trying to install a replica on wrong server.
When installing a replica file on the wrong server we warn that this will
likely fail and prompt to Continue. This prompt should default to
False, not True.

https://fedorahosted.org/freeipa/ticket/2325
2012-07-19 00:41:01 -04:00
Petr Viktorin
e578183ea2 Fix updating minimum_connections in ipa-upgradeconfig
The upgrade script set the "psearch" directive in some circumstances,
but did not remember that it was set, so later, when setting
minimum_connections, it assumed psearch is not set.

Also, the script did not set minimum_connections if the directive wasn't
already there. It should be set in that case.

Related to https://fedorahosted.org/freeipa/ticket/2554
2012-07-18 23:15:34 -04:00
Rob Crittenden
429edcfb72 Support per-principal sessions and handle session update failures
User had a system that refused to store keys into the kernel keyring.
Any operation at all on the keyring would return "Key has been revoked".

Wrap the operations in a try/except so we can ignore keyring failures.

This also adds per-principal sessions. The principal name is stored
in the session key so switching principals in the ccache doesn't
require clearing the keyring.

https://fedorahosted.org/freeipa/ticket/2880
2012-07-18 16:05:08 -04:00
Simo Sorce
32c1aa45b3 Fix detection of deleted masters
When setting up agreements we need to be careful in not allowing to
'reconnect' a master that was previously completely deleted as it would
misses entries that are vital for proper functioning.  This change in code
fixes 2 problems with the current approach.
1) it removes false positives when we are tryig to reconnect a replica that
was previosuly merely disconnected but was still part of the domain and just
replicating via a different topology and not a direct link
2) adds checks for entries that are deleted when an actual removal is
performed. so that we cannot 'reconnect' previously unrelated replicas when
one of the 2 has been permanently deleted from the masters tree.

Second part of ticket https://fedorahosted.org/freeipa/ticket/2925
2012-07-17 21:01:57 -04:00
Simo Sorce
87040c0af1 Fix safety checks to prevent orphaning replicas
This is just a typo, we were checking one side twice and never the other
side. So depending on which side you run the command you'd be able or not
to remove the replication agreement even if it was the last one.

First part of ticket: https://fedorahosted.org/freeipa/ticket/2925
2012-07-17 21:01:57 -04:00
Rob Crittenden
67dbde0156 Don't hardcode serial_autoincrement to True.
https://fedorahosted.org/freeipa/ticket/2554
2012-07-17 17:18:53 -04:00
Alexander Bokovoy
61b2f0a5d0 Follow change in samba4 beta4 for sid_check_is_domain to sid_check_is_our_sam
With c43505b621725c9a754f0ee98318d451b093f2ed in samba git master
the function sid_check_is_domain() was renamed to sid_check_is_our_sam().

https://fedorahosted.org/freeipa/ticket/2929
2012-07-18 16:56:04 +03:00
Alexander Bokovoy
dadfbf9d15 Handle various forms of admin accounts when establishing trusts
Realm administrator account may be specified using different form:
Administrator, DOM\Administrator, Administrator@DOMAIN

This patch introduces handling of the second two forms:
- In DOM\Administrator only user name is used, short domain name
  is then taken from a discovered record from the AD DC
- In Administrator@DOMAIN first DOMAIN is verified to be the same
  as the domain we are establishing trust to, and then user name
  is taken, together with short domain name taken from a discovered
  record from the AD DC

Note that we do not support using to-be-trusted domain's trusted domains'
accounts to establish trust as there is basically zero chance to verify
that things will work with them. In addition, in order to establish trust
one needs to belong to Enterprise Admins group in AD or have specially
delegated permissions. These permissions are unlikely delegated to the
ones in already trusted domain.

https://fedorahosted.org/freeipa/ticket/2864
2012-07-18 16:55:57 +03:00
Alexander Bokovoy
2d75d8cc05 ipalib/plugins/trust.py: ValidationError takes 'error' named argument, not 'reason'
https://fedorahosted.org/freeipa/ticket/2865
2012-07-18 16:55:51 +03:00
Petr Vobornik
3adebcf919 Bigger textarea for permission type=subtree
Adder dialog and details facet for permission type=subtree have small textarea for defining subtree filter. It was unconfortable to define the filter. This difference was removed.

https://fedorahosted.org/freeipa/ticket/2832
2012-07-18 15:52:00 +02:00
Petr Vobornik
a14d243fcd Fixed display of attributes_widget in IE9
Attributes widget is using overflow css rule in tbody element. IE9 doesn't handle it well.

To fix the issue, attributes widget was slightly modified and conditional css stylesheet was added just for fixing IE problems.

https://fedorahosted.org/freeipa/ticket/2822
2012-07-17 15:55:44 +02:00