Commit Graph

2971 Commits

Author SHA1 Message Date
Martin Babinsky
1f0959735f differentiate between limit types when LDAP search exceeds configured limits
When LDAP search fails on exceeded limits, we should raise an specific
exception for the type of limit raised (size, time, administrative) so that
the consumer can distinguish between e.g. searches returning too many entries
and those timing out.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Basti
b23ad42269 host-del --updatedns: print warnings instead of error
When DNS records do not exist, print warnings instead of hard error

https://fedorahosted.org/freeipa/ticket/5627

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:47:53 +02:00
Martin Basti
54e3859595 host_del: update help for --updatedns option
Clarify that dns removes only A, AAAA, PTR, SSHFP records of the host(s) managed by IPA DNS.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
e8c8134eee host_del: remove only A, AAAA, SSHFP, PTR records
only A, AAAA, SSHPF and PTR records are managed by IPA. The other
records should be removed by user.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
1e70d6b914 host_del: split removing A/AAAA and PTR records to separate functions
This change is needed because A/AAAA and PTR record will be handled
separately.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
bea066c336 host_del: remove unneeded dnszone-show command call
This command has no effect in that block of code, dnsrecord_show is
enough for detection if records exists.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
9a0f92be0d host_del: replace dns-record find command with show
Due the configuration of dnsrecord_find, it works as dnsrecord-show,
thus it can be replaced.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
40e3a0bf63 host_del: fix removal of host records
Originally only the first A/AAAA record is removed, and one other record. This commit fixes it
and all records are removed.

https://fedorahosted.org/freeipa/ticket/5675

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:44:56 +02:00
Martin Basti
d9fe502e83 Add missing pre_common_callback to stageuser_add
This pre_callback contains method to preprocessing usercertificate that
was not called during stageuser-add. This commit adds missing
pre_common_callback call to stageuser_add.

https://fedorahosted.org/freeipa/ticket/5759

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-04-12 10:09:12 +02:00
Martin Babinsky
7febe569ce otptoken-add: improve the robustness of QR code printing
The python-qrcode print_ascii() method does not work in terminals with
non-UTF-8 encoding. When this is the case do not render QR code but print a
warning instead. Also print a warning when the QR code size is greater that
terminal width if the output is a tty.

https://fedorahosted.org/freeipa/ticket/5700

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-24 14:35:19 +01:00
Martin Basti
d1e29fe60e Fix: catch Exception instead of more specific exception types
Regression caused by commit 491447cc5a,
ValueErrori and AttributeError are too much specific for these cases, multiple types of
exception can be raised.

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-22 17:33:02 +01:00
Martin Basti
da0318d4d7 Pylint: remove unnecessary-semicolon
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Martin Basti
b66028af18 Pylint: import max one module per line
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Martin Basti
d46cd5d956 Pylint: enable reimported check
Fixes current reimports and enables pylint check for them

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Martin Basti
491447cc5a pylint: remove bare except
Bare except should not be used.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
2016-03-22 10:20:51 +01:00
Jakub Hrozek
c6371abeb3 sudo: Fix a typo in the --help output of sudocmdgroup
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-18 12:38:42 +01:00
Martin Basti
de8c6d81fd Fix broken trust warnings
Warning should be shown only for parent entries of trust domain. Subdomains do not contain ipaNTSecurityIdentifier attribute at all.

https://fedorahosted.org/freeipa/ticket/5737

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-03-16 13:50:56 +01:00
Martin Basti
4871cb5b54 stageuser-activate: Normalize manager value
Manager(s) were returned as list od DN, this commit fixes behavior and
managers are returned as list of logins.

https://fedorahosted.org/freeipa/ticket/5481

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-16 09:09:36 +01:00
Jérôme Fenal
67b806e5d9 Fix the man page part for shorter sentences, to avoid dual understanding, and punctuation, all spotted while translating to French.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-03-10 19:35:12 +01:00
Simo Sorce
3e45c9be0a Allow admins to disable preauth for SPNs.
Some legacy softare is not able to properly cope with preauthentication,
allow the admins to disable the requirement to use preauthentication for
all Service Principal Names if they so desire. IPA Users are excluded,
for users, which use password of lessere entrpy, preauthentication is
always required by default.

This setting does NOT override explicit policies set on service principals
or in the global policy, it only affects the default.

Signed-off-by: Simo Sorce <simo@redhat.com>

Ticket: https://fedorahosted.org/freeipa/ticket/3860
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-03-08 18:48:40 +01:00
Tomas Babej
8bf6aa2c1c ipalib: Fix user certificate docstrings
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2016-03-07 12:21:12 +01:00
Martin Basti
2c8e100c73 fix suspicious except statements
The "except ValueError as UnicodeDecodeError" looks very suspicious.
Commit change except to catch both exceptions.

https://fedorahosted.org/freeipa/ticket/5718

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-03-04 13:10:08 +01:00
Petr Viktorin
34db5759fa ipalib.x809: Accept bytes for make_pem
Part of the work for https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-03-03 10:31:55 +01:00
Jan Cholasta
3c57c305ad ipalib: add convenient Command method for adding messages
Call the add_message() method of Command from anywhere in the implementation
of a command to add a message to the result of the command.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-03 10:06:18 +01:00
Jan Cholasta
e5520dc347 ipalib: provide per-call command context
Add context which is valid for the duration of command call. The context
is accessible using the `context` attribute of Command and Object plugins.

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-03-03 10:06:18 +01:00
Martin Basti
72d5499c5a pylint: supress false positive no-member errors
pylint 1.5 prints many false positive no-member errors which are
supressed by this commit.

https://fedorahosted.org/freeipa/ticket/5615

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-02 14:57:36 +01:00
Martin Basti
0d39abddc2 Remove duplicated except
Both exceptions have been catched before, so it is bacically dead code

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-02-25 13:48:44 +01:00
Stanislav Laznicka
d7efd8a33a Fixes minor issues
Fixes issues discovered by Coverity

plugins/baseldap.py:      possible undefined value in return
certmonger.py:            possible dereference of None value
i18n.py:                  fixed always True bug (+ cosmetic change)

https://fedorahosted.org/freeipa/ticket/5661

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-24 09:21:30 +01:00
Stanislav Laznicka
9757384c7c Cosmetic changes to the code
Fixes some Coverity issues

ipadiscovery.py:          added assert should universe break
plugins/dns.py:           removed dead code
dnssec/ldapkeydb.py:      attribute assert in the proper object
test_automount_plugin.py: fixed possible close() on None
xmlrpc_test.py:           Coverity does not like accessing None.__class__

https://fedorahosted.org/freeipa/ticket/5661

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-24 09:21:30 +01:00
Martin Basti
c96822f3e5 Warn user if trust is broken
Detect missing ipaNTSecurityIdentifier and print message for a user,
that the trust is broken as result of trust-show and trust-find commands.

https://fedorahosted.org/freeipa/ticket/5665

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-23 17:35:20 +01:00
Martin Basti
70bd7c8802 trusts: use ipaNTTrustPartner attribute to detect trust entries
Trust entries were found by presence of ipaNTSecurityIdentifier
attribute. Unfortunately this attribute might not be there due the bug.
As replacement for this, attribute ipaNTTrustPartner can be used.

Note: other non trust entries located in cn=trusts subtree can be
cross-realm principals.

https://fedorahosted.org/freeipa/ticket/5665

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-23 17:35:20 +01:00
Petr Viktorin
d1252cfb8e cli: Don't encode/decode for stdin/stdout on Python 3
https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-17 10:41:29 +01:00
Michael Simacek
831856ea55 Fix bytes/string handling in rpc
https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-17 10:41:29 +01:00
Martin Basti
2ce8921fe6 make lint: use config file and plugin for pylint
Our custom implementation of pylint checker is often broken by
incompatible change on pylint side. Using supported solutions (config
file, pylint plugins) should avoid this issue.

The plugin adds missing (dynamic) member to classes in abstract syntax
tree generated for pylint, instead of just ignoring missing members and
all sub-members. This should improve pylint detection of typos and
missing members in api. env and test config.

make-lint python script has been removed, to run pylint execute 'make
lint'

https://fedorahosted.org/freeipa/ticket/5615

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-11 11:06:39 +01:00
Thorsten Scherf
d85d709473 Fixed typo in service-add
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-02-02 15:34:16 +01:00
Pavel Vomacka
d5674b1490 Add tool tips for Revert, Refresh, Undo, and Undo All
Add tool tips for buttons in detail view. New tooltips:
Reload - Reload current settings from the server.
Revert - Undo all unsaved changes.
Undo - Undo this change.
Undo all - Undo all changes in this field.

https://fedorahosted.org/freeipa/ticket/5428

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2016-01-27 14:14:56 +01:00
Martin Basti
9a945b201e Warn user when ipa *-find reach limit
Truncated entries were silently ignored, now a user receives warning.

https://fedorahosted.org/freeipa/ticket/4022

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2016-01-27 12:54:25 +01:00
Martin Babinsky
d726da3ba2 uninstallation: more robust check for master removal from topology
When uninstalling IPA master in domain level 1 topology, the code that checks
for correct removal from topology will now consider failures to lookup host
entry in local LDAP and to obtain host TGT as a sign that the master entry was
already removed.

https://fedorahosted.org/freeipa/ticket/5584

Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-21 18:12:42 +01:00
Petr Viktorin
06a678c159 Avoid builtins that were removed in Python 3
- `file` was removed in favor of `open`. Switch to the new spelling.
- `buffer` was removed in favor of a buffer protocol (and memoryview),
  and `reload` was moved to importlib.
  Both are used in py2-only blocks, so just placate PyLint.

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-20 11:59:21 +01:00
Petr Viktorin
465dd9829c Don't index exceptions directly
In Python 3, exceptions don't behave as tuples of their arguments;
instead of e[1] it's necessary to use e.args[1].

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-20 11:59:21 +01:00
Petr Viktorin
126d899321 Use explicit truncating division
In Python 3, the truncating division operator, //, is needed to
get C-style "int division".

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-20 11:59:21 +01:00
Tomas Babej
ddf2c813b4 Loggger: Use warning instead of warn - dns plugin
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-19 14:26:52 +01:00
Tomas Babej
78c5bf9f8e logger: Use warning instead of warn
Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-18 17:49:54 +01:00
Jan Cholasta
7e56b4bbd7 ipapython: remove default_encoding_utf8
Replace the "import default_encoding_utf8" in ipalib/cli.py with equivalent
Python code.

https://fedorahosted.org/freeipa/ticket/5596

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2016-01-15 13:39:52 +01:00
Jan Cholasta
6b2b173a4d ipalib: assume version 2.0 when skip_version_check is enabled
https://fedorahosted.org/freeipa/ticket/5601

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-12 16:37:29 +01:00
Petr Spacek
17a4a29c25 Fix dns_is_enabled() API command to throw exceptions as appropriate
Previously the command returned False whenever an exception occured
which caused installed to continue even when there was a problem with
LDAP connection.

https://fedorahosted.org/freeipa/ticket/5564

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-01-08 10:14:51 +01:00
Petr Vobornik
a291ca8780 webui: add examples to network address validator error message
https://fedorahosted.org/freeipa/ticket/5532

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Gabe Alford <redhatrises@gmail.com>
2016-01-08 09:57:42 +01:00
Martin Babinsky
2fad223dbe ipalib/x509.py: revert deletion of ipalib api import
This import statement has been removed in commit
e4075b1fe2. This caused requests for service
certs to fail, since the validation functions from x509 module crashed with
NameError.

https://fedorahosted.org/freeipa/ticket/5561

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-01-04 17:41:59 +01:00
Martin Basti
00fd28e026 Enable pylint unnecessary-pass check
Enables check and removes extra pass statement from code.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Basti
ded70b6c6e Enable pylint empty-docstring check
Enables check and fixes:
************* Module ipalib.session
ipalib/session.py:671: [C0112(empty-docstring), SessionAuthManager]
Empty class docstring)
ipalib/session.py:705: [C0112(empty-docstring),
SessionAuthManager.logout] Empty method docstring)
************* Module ipalib.cli
ipalib/cli.py:364: [C0112(empty-docstring), textui.print_entry] Empty
method docstring)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Basti
1f6b1c2de7 Enable pylint trailing-whitespace check
Enables check and fixes:
************* Module ipapython.log_manager
ipapython/log_manager.py:808: [C0303(trailing-whitespace), ] Trailing
whitespace)
************* Module ipachangeconf
contrib/RHEL4/ipachangeconf.py:28: [C0303(trailing-whitespace), ]
Trailing whitespace)
contrib/RHEL4/ipachangeconf.py:116: [C0303(trailing-whitespace), ]
Trailing whitespace)
************* Module ipalib.plugins.pwpolicy
ipalib/plugins/pwpolicy.py:174: [C0303(trailing-whitespace), ] Trailing
whitespace)
ipalib/plugins/pwpolicy.py:180: [C0303(trailing-whitespace), ] Trailing
whitespace)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Basti
e1192ebd97 Remove wildcard imports
Wildcard imports should not be used.

Check for wildcard imports has been enabled in pylint.
Pylint note: options 'wildcard-import' causes too much false positive
results, so instead it I used 'unused-wildcard-import' option which has almost
the same effect.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Basti
e4075b1fe2 Remove unused imports
This patch removes unused imports, alse pylint has been configured to
check unused imports.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Babinsky
cd5fa38945 raise more descriptive Backend connection-related exceptions
https://fedorahosted.org/freeipa/ticket/5473

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-21 12:05:23 +01:00
Petr Viktorin
53b60546e4 Package ipapython, ipalib, ipaplatform, ipatests for Python 3
Running make with PYTHON=/usr/bin/python3 will build/install the
bits for Python 3.

Executable scripts in ipatests have symlinks Python version suffixes
as per Fedora guidelines. Suffix-less names point to the Python 2 versions.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-17 10:52:57 +01:00
David Kupka
6c107d819c dns: do not add (forward)zone if it is already resolvable.
Check if the zone user wants to add is already resolvable and refuse to
create it if yes. --skip-overlap-check and --force options suppress this check.

https://fedorahosted.org/freeipa/ticket/5087

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-12-14 18:53:53 +01:00
Petr Viktorin
099cf98307 Refactor ipautil.run
The ipautil.run function now returns an object with returncode and
output are accessible as attributes.

The stdout and stderr of all commands are logged (unless skip_output is given).

The stdout/stderr contents must be explicitly requested with a keyword
argument, otherwise they are None.
This is because in Python 3, the output needs to be decoded, and that can
fail if it's not decodable (human-readable) text.

The raw (bytes) output is always available from the result object,
as is "leniently" decoded output suitable for logging.

All calls are changed to reflect this.

A use of Popen in cainstance is changed to ipautil.run.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-14 10:54:23 +01:00
Jan Cholasta
8d7f67e08c replica install: add remote connection check over API
Add server_conncheck command which calls ipa-replica-conncheck --replica
over oddjob.

https://fedorahosted.org/freeipa/ticket/5497

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-11 18:44:13 +01:00
Yuri Chornoivan
2180d5db8a Fix minor typos
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-12-07 12:07:47 +01:00
Jan Cholasta
a8d7ce5cf1 aci: add IPA servers host group 'ipaservers'
https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-12-07 08:13:23 +01:00
Petr Vobornik
81c06327b9 Extend topology help
`ipa help topology` is improved.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-12-04 19:51:55 +01:00
Petr Vobornik
517aa84569 rename topology suffixes to "domain" and "ca"
https://www.redhat.com/archives/freeipa-devel/2015-November/msg00485.html

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-04 12:59:21 +01:00
Petr Vobornik
581f5432bf topologysuffix: change iparepltopoconfroot API properties
Change CLI option, label and type to reflect that it is a only a DN
of the suffix.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-03 12:41:07 +01:00
Stanislav Laznicka
498471e4ae Removed duplicate domain name validating function
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-12-02 17:26:56 +01:00
Jan Cholasta
4d24d8b26c topology: replace "suffices" with "suffixes"
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-12-01 09:30:21 +01:00
Jan Cholasta
46ae52569a server: use topologysuffix name in iparepltopomanagedsuffix
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-12-01 09:30:21 +01:00
Martin Basti
2a1a3c498a Upgrade: increase time limit for upgrades
Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-01 08:51:44 +01:00
Petr Vobornik
c688954c27 topology: treat server suffix as multivalued attribute in API
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-27 15:56:59 +01:00
Petr Vobornik
68f6c2c7dc webui: topology graph facet
https://fedorahosted.org/freeipa/ticket/4286

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-27 15:50:56 +01:00
Martin Basti
6bbde3e0f7 Compare objectclasses as case insensitive in baseuser.py
Objectclasses must be handled as case insensitive.

https://fedorahosted.org/freeipa/ticket/5456

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-25 14:56:30 +01:00
Martin Basti
800c702324 Use absolute domain in detection of A/AAAA records
Python dns resolver append configured domain to queries which may lead
to false positive answer.

Exmaple: resolving "ipa.example.com" may return records for
"ipa.example.com.example.com" if domain is configured as "example.com"

https://fedorahosted.org/freeipa/ticket/5421

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-25 14:13:26 +01:00
Martin Basti
7acfaee8ab Call directly function is_host_resolvable instead do call via framework
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-25 14:11:13 +01:00
Martin Basti
749dfc3917 Make command dns-resolve deprecated.
To debug DNS issues other commands should be used like 'dig', 'host',
'nslookup' instead of command 'ipa dns-resolve'.

This command is executed on server side, what may not be helpful with
debugging clients.

'ipa dns-resolve' command is worse copy of host command, users should use
'host' command instead.

dns-resolve is removed from CLI

https://fedorahosted.org/freeipa/ticket/5466

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-25 14:09:02 +01:00
Martin Basti
6eeb4e4f2a Fix upgrade of forwardzones when zone is in realmdomains
https://fedorahosted.org/freeipa/ticket/5472

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-25 13:39:45 +01:00
Fraser Tweedale
620036d26e Add profiles and default CA ACL on migration
Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers.  Update ipa-replica-install to add
these if they are missing.

Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.

To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.

Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.

Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-24 10:12:24 +01:00
Martin Basti
bf654aee1c remove forgotten print in DNS plugin
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-23 12:38:33 +01:00
Martin Basti
72b03a5d79 upgrade: fix migration of old dns forward zones
Plugins should call self.api not the global one during upgrade

https://fedorahosted.org/freeipa/ticket/5472

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-11-20 16:44:27 +01:00
Martin Basti
457c974670 Allow multiple managers per user - CLI part
Added commands:
* user-add-manager
* user-remove-manager
* stageuser-add-manager
* stageuser-remove-manager

Commit contains override of convert_attribute_members method in baseuser
class that ensures the managers will be returned in 'manager' attribute
due to backward compatibility instead of 'manager_user' as would be
expected.

https://fedorahosted.org/freeipa/ticket/5344

This patch also fixes: https://fedorahosted.org/freeipa/ticket/5387

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-11-20 15:35:14 +01:00
Martin Basti
c56d45bc38 Move common code of user and stageuser to baseuser postcallback
usser-add and stageuser-add contains common code that can be exported to
baseuser common postcallback

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-11-20 15:32:34 +01:00
Martin Basti
c339abbad1 Use domain level constants in topology plugin
Reviewed-By: David Kupka <dkupka@redhat.com>
2015-11-10 13:49:50 +01:00
Petr Spacek
50b0471f01 DNS record-add warns when a suspicious DNS name is detected
Relative name "record.zone" is being added into zone "zone.",
which is probably a mistake. User probably wanted to either specify
relative name "record" or use FQDN "record.zone.".

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-11-10 13:47:27 +01:00
Martin Basti
6119dbb9a9 ipa-csreplica-manage: disable connect/disconnect/del with domain level > 0
* ipa-csreplica-manage {connect|disconnect} - a user should use 'ipa
topologysegment-*' commands
* ipa-csreplica-manage del - a user should use ipa-replica-manage del

https://fedorahosted.org/freeipa/ticket/5405

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-11-02 13:31:27 +01:00
Abhijeet Kasurde
c60cec4fa7 Added user friendly error message for dnszone enable and disable
Added try-except block in dns plugin in order to provide user
friendly message to end user.

https://fedorahosted.org/freeipa/ticket/4811

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-29 13:41:41 +01:00
Martin Babinsky
82fd4250b9 silence pylint in Python 3-specific portion of ipalib/rpc.py
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 18:27:19 +01:00
Petr Viktorin
c38516eab7 ipalib.rpc: Update for Python 3
The client XML-RPC implementation is tied to rpclib internals,
so with a change in Python it needs to be updated. And rpclib
changed in Python 3.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
6811b4be6a ipapython.nsslib: Remove NSSHTTPS
This workaround is unused in Python 2.7+.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Petr Viktorin
4ddd1821b6 ipapython.nsslib, ipalib.rpc: Remove code for Python 2.6 and below
IPA hasn't supported these pythons for a while now.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 17:23:25 +01:00
Martin Basti
beb6a3236d Domain levels: use constants rather than hardcoded values
Added constants for domain levels
DOMAIN_LEVEL_0 = 0
DOMAIN_LEVEL_1 = 1

This allows to search for domain level easier in code.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-27 10:29:41 +01:00
Tomas Babej
c6a558c30e trustdomain: Perform validation of the trust domain first
Makes sure that the first check that is performed when trustdomain-del
command is run is that the actual trusted domain exists. This is done to
prevent a subseqent error which might be misleading.

https://fedorahosted.org/freeipa/ticket/5389

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-26 14:10:53 +01:00
Tomas Babej
4d0d5913dd trusts: Make trust_show.get_dn raise properly formatted NotFound
The trust_show command does not raise a properly formatted NotFound
error if the trust is not found, only a generic EmptyResult error
is raised.

This patch makes the trust_show tell us what actually could not be
found.

https://fedorahosted.org/freeipa/ticket/5389

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-26 14:10:53 +01:00
Martin Babinsky
c43dce3a61 always ask the resolver for the reverse zone when manipulating PTR records
Instead of searching for all zones to identify the correct reverse zone, we
will first ask the resolver to return the name of zone that should contain the
desired record and then see if IPA manages this zone.

This patch also removes a duplicate function in bindinstance.py that is not
used anywhere.

https://fedorahosted.org/freeipa/ticket/5200

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-22 18:36:17 +02:00
Petr Viktorin
ab75964b9a Work around ipalib.text (i18n) str/unicode handling
Python 3 doesn't provide ugettext/ungettext, since gettext/ngettext
work with (unicode) strings.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
8a2b65a357 Fix more bytes/unicode issues
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
0a23afeab2 ipalib.messages: Add "message" property to PublicMessage
In Python 3, the "message" property was removed in favor of calling str().
Add it to PublicMessage, since IPA code depends on it.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
eab334dde8 Handle binascii.Error from base64.b64decode()
In Python 3, the base64.b64decode function raises binascii.Error (a ValueError
subclass) when it finds incorrect padding. In Python 2 it raises TypeError.

Callers should usually handle ValueError; unless they are specifically
concerned with handling base64 padding issues).

In some cases, callers should handle ValueError:
- ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should
  handle ValueError
- ipalib.x509 (load_certificate*, get_*): callers should handle ValueError

In other cases ValueError is handled:
- ipalib.parameters
- ipapython.ssh
- ipalib.rpc (json_decode_binary - callers already expect ValueError)
- ipaserver.install.ldapupdate

Elsewhere no error handling is done, because values come from trusted
sources, or are pre-validated:
- vault plugin
- ipaserver.install.cainstance
- ipaserver.install.certs
- ipaserver.install.ipa_otptoken_import

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Martin Basti
92a4b18fc2 DNSSEC: warn user if DNSSEC key master is not installed
Warning user that DNSSEC key master is not installed when commands
dnszone-add, dnszone-mod, dnszone-show when option dnssec=true

https://fedorahosted.org/freeipa/ticket/5290

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-22 18:29:44 +02:00
Martin Babinsky
6a401fbf31 execute user-del pre-callback also during user preservation
user preservation code was not using the pre-callback function which did check
whether a protected member is being deleted and facilitated the
orphaning/deletion of OTP tokens owner/managed by the user.

https://fedorahosted.org/freeipa/ticket/5362
https://fedorahosted.org/freeipa/ticket/5372

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-21 12:33:39 +02:00
Martin Babinsky
e0d9a1b47c do not ask for segment direction when running topology commands
https://fedorahosted.org/freeipa/ticket/5222

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-10-20 15:32:47 +02:00
Petr Vobornik
834b5fd513 enable topology plugin on upgrade
Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-15 14:24:33 +02:00
Tomas Babej
4c2276f7ec idoverride: Ignore ValidationErrors when converting the anchor
When converting the anchor to a human readable form, SID validation
may fail, i.e. if the domain is no longer trusted.

Ignore such cases and pass along the anchor in the raw format.

https://fedorahosted.org/freeipa/ticket/5322

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-10-14 16:11:25 +02:00
Martin Babinsky
5484ae014e remove ID overrides when deleting a user
patch fixes a regression introduced during user-del refactoring

https://fedorahosted.org/freeipa/ticket/5365

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-14 13:16:34 +02:00
Jan Cholasta
2f3450249d vault: fix private service vault creation
https://fedorahosted.org/freeipa/ticket/5361

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-10-13 14:34:00 +02:00
Petr Viktorin
5f7c206e74 rpc: Name argument to KerberosError
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
614b490402 ipalib.parameters: Require bytes for Bytes.pattern
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
e0eff8b834 ipalib.parameters: Handle 0-prefixed octal format of ints
In Python 2, numbers prfixed with '0' are parsed as octal,
e.g. '020' -> 16. In Python 3, the prefix is '0o'.

Handle the old syntax for IPA's parameter conversion to keep
backwards compatibility.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
b71fd2d3c9 Add message property to IPA's errors and warnings under Python 3
Python 3 removes the "message" attribute from exceptions, in favor
of just calling str().
Add it back for IPA's own exception types.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
905d81f500 ipalib.aci: Port to Python 3
- Don't encode under Python 3, where shlex would choke on bytes
- Sort the attrs dictionary in export_to_string, so the tests are
  deterministic. (The iteration order of dicts was always unspecified,
  but was always the same in practice under CPython 2.)

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
88ac1c1616 Rename caught exception for use outside the except: block.
In Python 3, the variable with the currently handled exception is unset
at the end of the except block. (This is done to break reference
cycles, since exception instances now carry tracebacks, which contain
all locals.)

Fix this in baseldap's error handler.

Use a simpler structure for the ipatests.raises utility that only uses the
exception inside the except block.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
929c3d1265 x509: Port to Python 3
In python 3 , `bytes` has the buffer interface, and `buffer` was removed.

Also, invalid padding in base64-encoded data raises a ValueError rather
than TypeError.

In tests, use pytest.assert_raises for more correct exception assertions.
Also, get rid of unused imports in the tests

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
59d87d53b1 Do not compare types that are not comparable in Python 3
In Python 3, different types are generally not comparable (except for equality),
and None can't be compared to None.
Fix cases of these comparisons.

In ipatest.util, give up on sorting lists if the sorting raises a TypeError.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Tomas Babej
dae9c6cbc1 realmdomains: Do not fail due the ValidationError when adding _kerberos TXT record
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
1e1d6d15c6 realmdomains: Issue a warning when automated management of realmdomains failed
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
6a2f47acbe realmdomains: Add validation that realmdomain being added is indeed from our realm
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
fc6e1f0bb5 realmdomains: Minor style and wording improvements
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
4ceae037f5 util: Add detect_dns_zone_realm_type helper
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Jan Cholasta
4b381b1503 vault: select a server with KRA for vault operations
This uses the same mechanism which is used for the CA.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Petr Viktorin
e3c05fcb73 Remove uses of the types module
In Python 3, the types module no longer provide alternate names for
built-in types, e.g. `types.StringType` can just be spelled `str`.

NoneType is also removed; it needs to be replaced with type(None)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
187efdfe42 Use six.moves.configparser instead of ConfigParser
The module name was lowercased in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ad2bc94725 Use six.moves.xmlrpc.client instead of xmlrpclib
The module is renamed to xmlrpc.client in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
70b37a956c Use six.moves.urllib instead of urllib/urllib2/urlparse
In Python 3, these modules are reorganized.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
c9ca8de7a2 rpc: Don't use undocumented urllib functions
The "splittype" and "splithost" functions in urllib.parse
are undocumented and reserved for internal use,
see http://bugs.python.org/issue11009

Use urlsplit instead.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Robert Kuska
01da4a8de3 Replace StandardError with Exception
StandardError was removed in Python3 and instead
Exception should be used.

Signed-off-by: Robert Kuska <rkuska@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-30 10:51:36 +02:00
Michael Simacek
bdccebbcdb Rewrap errors in get_principal to CCacheError
Causes nicer error message when kerberos credentials are not available.

https://fedorahosted.org/freeipa/ticket/5272

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-09-22 13:29:55 +02:00
Gabe
65e958fda4 Standardize minvalue for ipasearchrecordlimit and ipasesarchsizelimit for unlimited minvalue
https://fedorahosted.org/freeipa/ticket/4023

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-22 08:00:16 +02:00
Jan Cholasta
0dfcf1d9db vault: add permissions and administrator privilege
https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
5cf46b8936 vault: set owner to current user on container creation
This reverts commit 419754b1c1.

https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Petr Vobornik
d396913e9c vault: add vault container commands
adds commands:
* vaultcontainer-show [--service <service>|--user <user>|--shared ]
* vaultcontainer-del [--service <service>|--user <user>|--shared ]
* vaultcontainer-add-owner
     [--service <service>|--user <user>|--shared ]
     [--users <users>]  [--groups <groups>] [--services <services>]
* vaultcontainer-remove-owner
     [--service <service>|--user <user>|--shared ]
     [--users <users>]  [--groups <groups>] [--services <services>]

https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
2964b019d9 baseldap: make subtree deletion optional in LDAPDelete
https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-17 14:55:54 +02:00
Jan Cholasta
ba5201979d Use bytes instead of str where appropriate
Under Python 2, "str" and "bytes" are synonyms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
23507e6124 Alias "unicode" to "str" under Python 3
The six way of doing this is to replace all occurences of "unicode"
with "six.text_type". However, "unicode" is non-ambiguous and
(arguably) easier to read. Also, using it makes the patches smaller,
which should help with backporting.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
60dd90cf77 config: allow user/host attributes with tagging options
https://fedorahosted.org/freeipa/ticket/5295

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-09-16 15:01:34 +02:00
Jan Cholasta
cf9bf9dcaf Use six.python_2_unicode_compatible
Rename __unicode__ to __str__ in classes which define it and use the
six.python_2_unicode_compatible decorator on them to make them compatible with
both Python 2 and 3.

Additional changes were required for the ipapython.dnsutil.DNSName class,
because it defined both __str__ and __unicode__.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-07 08:00:11 +02:00
Fraser Tweedale
86cd47af02 certprofile: remove 'rename' option
The initial fix of ticket 5247 rejected renames, but left the option
behind for API compatibility.  Remove the option now, according to
the consensus that because it never worked, it is fine to remove it.

Fixes: https://fedorahosted.org/freeipa/ticket/5247
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-02 13:47:48 +02:00
Martin Basti
740f7fd817 DNSSEC: remove "DNSSEC is experimental" warnings
https://fedorahosted.org/freeipa/ticket/5265

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-02 10:26:14 +02:00
Petr Viktorin
5178e9a597 Modernize use of range()
In Python 3, range() behaves like the old xrange().
The difference between range() and xrange() is usually not significant,
especially if the whole result is iterated over.

Convert xrange() usage to range() for small ranges.
Use modern idioms in a few other uses of range().

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
d1187cbc6f Use new-style raise syntax
The form`raise Error, value` is deprecated in favor of `raise Error(value)`,
and will be removed in Python 3.
Use the new syntax.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
8de13bd7dd Use the print function
In Python 3, `print` is no longer a statement. Call it as a function
everywhere, and include the future import to remove the statement
in Python 2 code as well.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
fb7943dab4 Use next() function on iterators
In Python 3, next() for iterators is a function rather than method.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
ace63f4ea5 Replace uses of map()
In Python 2, map() returns a list; in Python 3 it returns an iterator.

Replace all uses by list comprehensions, generators, or for loops,
as required.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
fbacc26a6a Use six.integer_types instead of (long, int)
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
c27cb295a5 Use six.moves.input instead of raw_input
In Python 3, raw_input() was renamed to input().
Import the function from six.moves to get the right version.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
5a9141dc40 Replace filter() calls with list comprehensions
In Python 3, filter() returns an iterator.
Use list comprehensions instead.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
3bf91eab25 Use Python3-compatible dict method names
Python 2 has keys()/values()/items(), which return lists,
iterkeys()/itervalues()/iteritems(), which return iterators,
and viewkeys()/viewvalues()/viewitems() which return views.

Python 3 has only keys()/values()/items(), which return views.
To get iterators, one can use iter() or a for loop/comprehension;
for lists there's the list() constructor.

When iterating through the entire dict, without modifying the dict,
 the difference between Python 2's items() and iteritems() is
negligible, especially on small dicts (the main overhead is
extra memory, not CPU time). In the interest of simpler code,
this patch changes many instances of iteritems() to items(),
iterkeys() to keys() etc.

In other cases, helpers like six.itervalues are used.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
dd16cc98b0 Use six.string_types instead of "basestring"
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
David Kupka
02ab34c60b vault: Limit size of data stored in vault
https://fedorahosted.org/freeipa/ticket/5231

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-08-26 16:11:42 +02:00
Fraser Tweedale
5c7d6a6a31 certprofile: prevent rename (modrdn)
Fixes: https://fedorahosted.org/freeipa/ticket/5247
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-08-26 13:55:09 +02:00
Petr Vobornik
d01f18d441 fix missing information in object metadata
Missing 'required' values in takes_params causes Web UI to treat required
fields as optional.

Regression caused by ba0a1c6b33

https://fedorahosted.org/freeipa/ticket/5258

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-26 13:01:52 +02:00
Martin Basti
14a87632e5 Fix: Remove leftover krbV reference
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-08-26 12:53:12 +02:00
Petr Vobornik
19dd2ed758 vault: change default vault type to symmetric
https://fedorahosted.org/freeipa/ticket/5251

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-08-26 10:56:28 +02:00
Michael Simacek
aad73fad60 Port from python-krbV to python-gssapi
python-krbV library is deprecated and doesn't work with python 3. Replacing all
it's usages with python-gssapi.

- Removed Backend.krb and KRB5_CCache classes
  They were wrappers around krbV classes that cannot really work without them
- Added few utility functions for querying GSSAPI credentials
  in krb_utils module. They provide replacements for KRB5_CCache.
- Merged two kinit_keytab functions
- Changed ldap plugin connection defaults to match ipaldap
- Unified getting default realm
  Using api.env.realm instead of krbV call

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-08-26 09:41:36 +02:00