Commit Graph

1847 Commits

Author SHA1 Message Date
Jan Cholasta
861294c0d6 parameters: remove unused ConversionError and ValidationError arguments
Do not set the `value`, `index` and `rule` arguments when raising
ConversionError and ValidationError. The arguments are unused and are not
specified consistently accross the framework and plugins.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-05-25 16:06:26 +02:00
Martin Basti
ad1cac1283 Fix referenced before assigment variables in except statements
Variable msg may not exists in the last except context, and even it
contains improper value because it is not related to catched exception

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-05-20 15:05:25 +02:00
Petr Spacek
89cdf6ee1e Batch command: avoid accessing potentially undefined context.principal
This might happen when the command is called directly in Python,
e.g. in installers and so on.

Pylint pylint-1.5.5-1.fc24.noarch caught this.

https://fedorahosted.org/freeipa/ticket/5838

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-12 13:28:00 +02:00
Tomas Babej
6adf863781 idviews: Add user certificate attribute to user ID overrides
https://fedorahosted.org/freeipa/ticket/4955

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-05-06 07:12:01 +02:00
Petr Viktorin
6ddf0d657f certprofile plugin: Use binary mode for file with binary data
Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-05-05 16:42:46 +02:00
Petr Viktorin
890f83b0bb radiusproxy plugin: Use str(error) rather than error.message
In Python 3, the "message" attribute has been removed in favor of
calling str() on the error.

Part of the work for https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-05-05 16:42:46 +02:00
Petr Viktorin
28b0bfaefe dns plugin: Fix zone normalization under Python 3
In Python 3, str.encode('ascii') converts to bytes, and str()
(nicknamed unicode() in IPA) returns the string representation
of an object, which is b'...' for bytes.

So, unicode('...'.encode('ascii')) results in "b'...'".

Change the code to only call encode() for the error.

Part of the work for https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-28 16:22:07 +02:00
Martin Basti
14ee02dcbd Do not do extra search for ipasshpubkey to generate fingerprints
Host, user and idview commands do unnnecessary extra search for
ipasshpubkey attribute to generate fingerprints.

Note: Host and user plugins shows ipasshpubkey only when the attribute
is changed, idviews show ipasshpubkey always. This behavior has been
kept by this commit.

common_pre/post_callbacks were fixed in [base|stage]user modules.
common_callbacks requires the same arguments as pre/post_callbacks now
(except baseuser_find.post_common_callback)

Note2: in *-add commands there is no need for managing ipasshpubkey as
this attribute should be shown always there.

https://fedorahosted.org/freeipa/ticket/3376

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-04-26 13:37:23 +02:00
Martin Basti
fe2ce02a6f Performace: don't download password attributes in host/user-find
For each entry in user/host-find was executed an extra search for password
attributes what has significant impact on performance (for 2000 users
there were 2000 additional searches)

http://www.freeipa.org/page/V4/Performance_Improvements

https://fedorahosted.org/freeipa/ticket/5281

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-22 13:28:57 +02:00
Pavel Vomacka
f446792353 Add 'skip overlap check' checkbox into add zone dialog
https://fedorahosted.org/freeipa/ticket/5773

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-22 10:11:48 +02:00
Fraser Tweedale
c2b92b5735 caacl: correctly handle full user principal name
The caacl HBAC request is correct when just the username is given,
but the full 'user@REALM' form was not handled correctly.

Fixes: https://fedorahosted.org/freeipa/ticket/5733
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-04-20 18:07:19 +02:00
Pavel Vomacka
d01f7e8556 Add activate option to stage user details page
Add activate option to the action menu on stage user details page.

https://fedorahosted.org/freeipa/ticket/5369

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-04-15 16:41:55 +02:00
Martin Basti
93871bf017 Limit max username length to 255 in config-mod
This value is same as is used in user and stageuser commands.

https://fedorahosted.org/freeipa/ticket/5774

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-04-15 13:24:34 +02:00
Martin Babinsky
62bb478e11 specify type of exceeded limit when warning about truncated search results
API commands inheriting from LDAPSearch should mention which limit was
exceeded in the warning message sent with truncated results.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Babinsky
1f0959735f differentiate between limit types when LDAP search exceeds configured limits
When LDAP search fails on exceeded limits, we should raise an specific
exception for the type of limit raised (size, time, administrative) so that
the consumer can distinguish between e.g. searches returning too many entries
and those timing out.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Basti
b23ad42269 host-del --updatedns: print warnings instead of error
When DNS records do not exist, print warnings instead of hard error

https://fedorahosted.org/freeipa/ticket/5627

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:47:53 +02:00
Martin Basti
54e3859595 host_del: update help for --updatedns option
Clarify that dns removes only A, AAAA, PTR, SSHFP records of the host(s) managed by IPA DNS.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
e8c8134eee host_del: remove only A, AAAA, SSHFP, PTR records
only A, AAAA, SSHPF and PTR records are managed by IPA. The other
records should be removed by user.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
1e70d6b914 host_del: split removing A/AAAA and PTR records to separate functions
This change is needed because A/AAAA and PTR record will be handled
separately.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
bea066c336 host_del: remove unneeded dnszone-show command call
This command has no effect in that block of code, dnsrecord_show is
enough for detection if records exists.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
9a0f92be0d host_del: replace dns-record find command with show
Due the configuration of dnsrecord_find, it works as dnsrecord-show,
thus it can be replaced.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
40e3a0bf63 host_del: fix removal of host records
Originally only the first A/AAAA record is removed, and one other record. This commit fixes it
and all records are removed.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
d9fe502e83 Add missing pre_common_callback to stageuser_add
This pre_callback contains method to preprocessing usercertificate that
was not called during stageuser-add. This commit adds missing
pre_common_callback call to stageuser_add.

https://fedorahosted.org/freeipa/ticket/5759

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-04-12 10:09:12 +02:00
Martin Babinsky
7febe569ce otptoken-add: improve the robustness of QR code printing
The python-qrcode print_ascii() method does not work in terminals with
non-UTF-8 encoding. When this is the case do not render QR code but print a
warning instead. Also print a warning when the QR code size is greater that
terminal width if the output is a tty.

https://fedorahosted.org/freeipa/ticket/5700

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-24 14:35:19 +01:00
Martin Basti
d1e29fe60e Fix: catch Exception instead of more specific exception types
Regression caused by commit 491447cc5a,
ValueErrori and AttributeError are too much specific for these cases, multiple types of
exception can be raised.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-22 17:33:02 +01:00
Martin Basti
da0318d4d7 Pylint: remove unnecessary-semicolon
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Martin Basti
b66028af18 Pylint: import max one module per line
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Martin Basti
491447cc5a pylint: remove bare except
Bare except should not be used.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Jakub Hrozek
c6371abeb3 sudo: Fix a typo in the --help output of sudocmdgroup
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-18 12:38:42 +01:00
Martin Basti
de8c6d81fd Fix broken trust warnings
Warning should be shown only for parent entries of trust domain. Subdomains do not contain ipaNTSecurityIdentifier attribute at all.

https://fedorahosted.org/freeipa/ticket/5737

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-03-16 13:50:56 +01:00
Martin Basti
4871cb5b54 stageuser-activate: Normalize manager value
Manager(s) were returned as list od DN, this commit fixes behavior and
managers are returned as list of logins.

https://fedorahosted.org/freeipa/ticket/5481

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-16 09:09:36 +01:00
Jérôme Fenal
67b806e5d9 Fix the man page part for shorter sentences, to avoid dual understanding, and punctuation, all spotted while translating to French.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-03-10 19:35:12 +01:00
Simo Sorce
3e45c9be0a Allow admins to disable preauth for SPNs.
Some legacy softare is not able to properly cope with preauthentication,
allow the admins to disable the requirement to use preauthentication for
all Service Principal Names if they so desire. IPA Users are excluded,
for users, which use password of lessere entrpy, preauthentication is
always required by default.

This setting does NOT override explicit policies set on service principals
or in the global policy, it only affects the default.

Signed-off-by: Simo Sorce <simo@redhat.com>

Ticket: https://fedorahosted.org/freeipa/ticket/3860
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-08 18:48:40 +01:00
Tomas Babej
8bf6aa2c1c ipalib: Fix user certificate docstrings
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-03-07 12:21:12 +01:00
Martin Basti
72d5499c5a pylint: supress false positive no-member errors
pylint 1.5 prints many false positive no-member errors which are
supressed by this commit.

https://fedorahosted.org/freeipa/ticket/5615

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-02 14:57:36 +01:00
Martin Basti
0d39abddc2 Remove duplicated except
Both exceptions have been catched before, so it is bacically dead code

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-25 13:48:44 +01:00
Stanislav Laznicka
d7efd8a33a Fixes minor issues
Fixes issues discovered by Coverity

plugins/baseldap.py:      possible undefined value in return
certmonger.py:            possible dereference of None value
i18n.py:                  fixed always True bug (+ cosmetic change)

https://fedorahosted.org/freeipa/ticket/5661

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-24 09:21:30 +01:00
Stanislav Laznicka
9757384c7c Cosmetic changes to the code
Fixes some Coverity issues

ipadiscovery.py:          added assert should universe break
plugins/dns.py:           removed dead code
dnssec/ldapkeydb.py:      attribute assert in the proper object
test_automount_plugin.py: fixed possible close() on None
xmlrpc_test.py:           Coverity does not like accessing None.__class__

https://fedorahosted.org/freeipa/ticket/5661

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-24 09:21:30 +01:00
Martin Basti
c96822f3e5 Warn user if trust is broken
Detect missing ipaNTSecurityIdentifier and print message for a user,
that the trust is broken as result of trust-show and trust-find commands.

https://fedorahosted.org/freeipa/ticket/5665

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-23 17:35:20 +01:00
Martin Basti
70bd7c8802 trusts: use ipaNTTrustPartner attribute to detect trust entries
Trust entries were found by presence of ipaNTSecurityIdentifier
attribute. Unfortunately this attribute might not be there due the bug.
As replacement for this, attribute ipaNTTrustPartner can be used.

Note: other non trust entries located in cn=trusts subtree can be
cross-realm principals.

https://fedorahosted.org/freeipa/ticket/5665

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-23 17:35:20 +01:00
Martin Basti
2ce8921fe6 make lint: use config file and plugin for pylint
Our custom implementation of pylint checker is often broken by
incompatible change on pylint side. Using supported solutions (config
file, pylint plugins) should avoid this issue.

The plugin adds missing (dynamic) member to classes in abstract syntax
tree generated for pylint, instead of just ignoring missing members and
all sub-members. This should improve pylint detection of typos and
missing members in api. env and test config.

make-lint python script has been removed, to run pylint execute 'make
lint'

https://fedorahosted.org/freeipa/ticket/5615

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-11 11:06:39 +01:00
Thorsten Scherf
d85d709473 Fixed typo in service-add
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-02 15:34:16 +01:00
Pavel Vomacka
d5674b1490 Add tool tips for Revert, Refresh, Undo, and Undo All
Add tool tips for buttons in detail view. New tooltips:
Reload - Reload current settings from the server.
Revert - Undo all unsaved changes.
Undo - Undo this change.
Undo all - Undo all changes in this field.

https://fedorahosted.org/freeipa/ticket/5428

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-01-27 14:14:56 +01:00
Martin Basti
9a945b201e Warn user when ipa *-find reach limit
Truncated entries were silently ignored, now a user receives warning.

https://fedorahosted.org/freeipa/ticket/4022

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2016-01-27 12:54:25 +01:00
Petr Viktorin
465dd9829c Don't index exceptions directly
In Python 3, exceptions don't behave as tuples of their arguments;
instead of e[1] it's necessary to use e.args[1].

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-20 11:59:21 +01:00
Petr Viktorin
126d899321 Use explicit truncating division
In Python 3, the truncating division operator, //, is needed to
get C-style "int division".

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-20 11:59:21 +01:00
Tomas Babej
ddf2c813b4 Loggger: Use warning instead of warn - dns plugin
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-19 14:26:52 +01:00
Tomas Babej
78c5bf9f8e logger: Use warning instead of warn
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-18 17:49:54 +01:00
Petr Spacek
17a4a29c25 Fix dns_is_enabled() API command to throw exceptions as appropriate
Previously the command returned False whenever an exception occured
which caused installed to continue even when there was a problem with
LDAP connection.

https://fedorahosted.org/freeipa/ticket/5564

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-01-08 10:14:51 +01:00
Petr Vobornik
a291ca8780 webui: add examples to network address validator error message
https://fedorahosted.org/freeipa/ticket/5532

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2016-01-08 09:57:42 +01:00