Commit Graph

5223 Commits

Author SHA1 Message Date
Petr Viktorin
a95eaeac8e Internationalization for public errors
Currently, we throw many public exceptions without proper i18n.
Wrap natural-language error messages in _() so they can be translated.

In the service plugin, raise NotFound errors using handle_not_found helper
so the error message contains the offending service.

Use ScriptError instead of NotFoundError in bindinstance install.

https://fedorahosted.org/freeipa/ticket/1953
2012-09-03 18:16:12 +02:00
John Dennis
4f03aed5e6 prevent last admin from being disabled
We prevent the last member of the admin group from being deleted. The
same check needs to be performed when disabling a user.

* Moved the code in del_user to the common subroutine
  check_protected_member() and call it from both user_del and
  user_disable. Note, unlike user_del user_disable does not have a
  'pre' callback therefore the check function is called in
  user_disable's execute routine.

* Make check_protected_member() aware of disabled members. It's not
  sufficient to check which members of the protected group are
  present, one must only consider those members which are enabled.

* Add tests to test_user_plugin.py.

  - verify you cannot delete nor disable the last member of the admin
    group

  - verify when the admin group contains disabled users in addition to
    enabled users only the enabled users are considered when
    determining if the last admin is about to be disabled or deleted.

* Replace duplicated hardcoded values in the tests with variables or
  subroutines, this makes the individual tests a bit more succinct and
  easier to copy/modify.

* Update error msg to reflect either deleting or disabling is an error.

https://fedorahosted.org/freeipa/ticket/2979
2012-09-03 18:11:49 +02:00
John Dennis
557b260550 ipa user-find --manager does not find matches
The manager LDAP attribute is a dn pointing inside the user
container. When passed on the command it is typically a bare user
uid. The search filter will only succeed if the bare uid is converted
to a full dn because that is what is stored in the value for the
manager attribute.

The search failure is solved by calling _normalize_manager() which
does the conversion to a dn (if not already a dn).

It feels like this type of conversion should be performed in the pre
callback which allows one to modify the filter. But when the pre
callback is invoked it's complex string with the manager attribute
already inserted. This is because the LDAPSearch.execute() method
processes the options dict and constructs a filter component for each
key/value in the options dict prior to invoking the pre callback. If
we wanted to modify the manager value in the filter in the pre
callback we would have to decompose the filter string, perform dn
checking and then reassemble the filter. It's much cleaner to perform
the dn operations on the manager value before it gets embedded into
what otherwise might be a very complex filter. This is the reason why
the normalization is perfored in the execute method as opposed to the
pre callback. Other classes do similar things in their execute methods
as opposed to their callbacks's, selinuxusermap_find is one example.

Patch also introduces new unit test to verify.

https://fedorahosted.org/freeipa/ticket/2264
2012-09-03 18:10:17 +02:00
Tomas Babej
7e9eb9caad Fixes different behaviour of permission-mod and show.
Both commands now produce the same output regarding
the attributelevelrights.

https://fedorahosted.org/freeipa/ticket/2875
2012-08-29 16:02:43 -04:00
Petr Vobornik
edbcd28f44 Password policy paging with proper sorting
This patch adds option to disable sorting when paging. It allowed to enable paging in password policy with order of items untouched (they are sorted on server side by priority).

Also fixing issue when paging is disabled and command summary = null. It displayed 'null' in facet footer.

https://fedorahosted.org/freeipa/ticket/2677
2012-08-29 12:00:15 +02:00
Petr Vobornik
81007ff385 Successful action notification
User was not notified about success of actions executed from action list, action panel or facet cotrol bar.

This patch adds IPA.notify_success(message) call. It creates a yellow notification area with supplied message in Web UI header in the middle of the green area (empty space of first level navigation).
This area is displayed for 3s and then it fades out (800ms). It also fades out when it is clicked.

This call is used(directly or indirectly) in:
 * search facets: delete, disable, enable actions
 * details facets: delete action
 * user details facet: reset password action
 * host details facet: unprovision, set OTP actions
 * service details facet: unprovision action
 * host and service details facet: request, revoke, restore certificates actions
 * group details facet: change to POSIX/external actions
 * dns zone details facet: add/remove permission actions

 https://fedorahosted.org/freeipa/ticket/2977
2012-08-29 12:00:06 +02:00
Petr Vobornik
7d3aa96103 Fix issue which broke setup of Web UI unit tests
Web UI itself wasn't negatively affected.

https://fedorahosted.org/freeipa/ticket/2897
2012-08-29 11:59:37 +02:00
Petr Vobornik
36c345dd1d Revert change causing failure in test automation
Move of click handler in patch for #2834 causes failure of automation tests.

This patch reverts the problematic part. It should not affect function of fix for #2824.

https://fedorahosted.org/freeipa/ticket/3014
2012-08-29 11:59:29 +02:00
Rob Crittenden
785e80c4fc Restrict the SELinux user map user MLS value to 0-1023
https://fedorahosted.org/freeipa/ticket/3001
2012-08-29 09:29:08 +02:00
Martin Kosek
5e277a97a6 Update Contributors.txt file
Update list of active developers working on IPA.
2012-08-28 16:59:42 +02:00
Tomas Babej
cb961066aa Improves deletion of PTR records in ipa host-del
Command ipa host-del with --updatedns now can deal both with hosts
which zones are in FQDN form with or without a trailing dot.

https://fedorahosted.org/freeipa/ticket/2809
2012-08-28 16:38:03 +02:00
Martin Kosek
a5c8dcd996 Fix managedBy label for DNS zone
Even though managedBy output parameter was only used for failed host
managedBy memberships, it was defined in global baseldap.py
classes. Incorrect label was then being displayed also for DNS zone
per-zone permission attribute with the same name.

Move managedBy output parameter to host plugin. Define proper managedBy
output parameter in DNS plugin to improve clarity of this attribute.

https://fedorahosted.org/freeipa/ticket/2946
2012-08-26 23:10:25 -04:00
John Dennis
2bf68115ce Ticket #2850 - Ipactl exception not handled well
Ticket #2850 - Ipactl exception not handled well

There were various places in ipactl which intialized IpactlError with
None as the msg. If you called str() on that exception all was well
because ScriptError.__str__() converted a msg with None to the empty
string (IpactlError is subclassed from ScriptError). But a few places
directly access e.msg which will be None if initialized that way. It's
hard to tell from the stack traces but I'm pretty sure it's those
places which use e.msg directly which will cause the problems seen in
the bug report.

I do not believe it is ever correct to initialize an exception message
to None, I don't even understand what that means. On the other hand
initializing to the empty string is sensible and for that matter is
the default for the class.

This patch makes two fixes:

1) The ScriptError initializer will now convert a msg parameter of
None to the empty string.

2) All places that initialized IpactlError's msg parameter to None
removed the None initializer allowing the msg parameter to default
to the empty string.

I don't know how to test the fix for Ticket #2850 because it's not
clear how it got into that state in the first place, but I do believe
initialing the msg value to None is clearly wrong and should fix the
problem.
2012-08-27 15:30:28 +02:00
Rob Crittenden
3eadcdf123 Don't generate password history error if history is set to 0.
https://fedorahosted.org/freeipa/ticket/2805
2012-08-27 15:21:03 +02:00
Alexander Bokovoy
191f514640 Ask for admin password in ipa-adtrust-install
The credentials of the admin user will be used to obtain Kerberos ticket before
configuring  cross-realm  trusts  support and afterwards, to ensure that the
ticket contains MS-PAC information required to actually add a trust with Active
Directory domain via 'ipa trust-add --type=ad' command.

https://fedorahosted.org/freeipa/ticket/2852
2012-08-24 16:16:58 +03:00
John Dennis
1328f984d0 Ticket #3008: DN objects hash differently depending on case
Because the attrs & values in DN's, RDN's and AVA's are comparison case-
insensitive the hash value between two objects which compare as equal but
differ in case must also yield the same hash value. This is critical when
these objects are used as a dict key or in a set because dicts and sets
use the object's __hash__ value in conjunction with the objects __eq__
method to lookup the object.

The defect is the DN, RDN & AVA objects computed their hash from the case-
preserving string representation thus two otherwise equal objects
incorrectly yielded different hash values.

The problem manifests itself when one of these objects is used as a key in
a dict, for example a dn.

dn1 = DN(('cn', 'Bob'))
dn2 = DN(('cn', 'bob'))

dn1 == dn2 --> True

hash(dn1) == hash(dn2) --> False

d = {}

d[dn1] = x
d[dn2] = y

len(d) --> 2

The patch fixes the above by lower casing the string representation of
the object prior to computing it's hash.

The patch also corrects a spelling mistake and a bogus return value in
ldapupdate.py which happened to be discovered while researching this
bug.
2012-08-22 17:23:12 +03:00
Tomas Babej
f397db79dd Adds dependency on samba4-winbind.
Dependency on samba4-winbind has been added to the package
freeipa-server-trust-ad.
2012-08-22 17:22:48 +03:00
Alexander Bokovoy
155d1efd48 Add ACI to allow regenerating ipaNTHash from ipasam
ACI was lacking to allow actually writing MagicRegen into ipaNTHash attribute,

Part 2 of https://fedorahosted.org/freeipa/ticket/3016
2012-08-22 17:21:27 +03:00
Alexander Bokovoy
6171d0a01b Fix ipasam ipaNThash magic regen to actually fetch updated password
With this change ipasam is able to ask for ipaNTHash generation and if
corresponding Kerberos key is available, will be able to retrieve generated ipaNTHash.

Part 1 of https://fedorahosted.org/freeipa/ticket/3016
2012-08-22 17:21:11 +03:00
Alexander Bokovoy
14c48ba6fb Recover from invalid cached kerberos credentials in ipasam
When developing and testing in the same environment, multiple re-installs
may be needed. This means previously issued and cached Kerberos credentials
will become invalid upon new install.

ipasam passdb module for Samba uses Kerberos authentication when talking to
IPA LDAP server. Obtained Kerberos credentials are cached during their lifetime.
However, the ccache is not removed automatically and if IPA setup is made
again, cached credentials are used, only to discover that they are invalid.

With this change invalid correctly obtained cached credentials are recognized
and, if LDAP SASL bind fails, new credentials are requested from the KDC.

https://fedorahosted.org/freeipa/ticket/3009
2012-08-22 17:20:56 +03:00
Sumit Bose
e8d4cc65f8 Use libsamba-security instead of libsecurity
In samba4-beta6 the name of a library was changed from libsecurity to
libsamba-security.
2012-08-22 17:18:07 +03:00
Petr Vobornik
2d63e28c78 Range Web UI
Range web UI was implemented.

It consist of:
 * new menu item - 'ranges' in 'IPA Server' tab
 * new search page
 * new details page

https://fedorahosted.org/freeipa/ticket/2894
2012-08-21 14:35:19 +02:00
Martin Kosek
af4d534428 Fix client-only build
Client-only build unconditionally touched some files from freeipa-server
package and thus the installation crashed. Fix spec file to enable
client-only builds like "make client-rpms".
2012-08-17 14:24:15 +02:00
Martin Kosek
489493e690 Read DM password from option in external CA install
ipa-server-install with external CA could not be run in
an unattended mode as DM password was required to decipher answer
cache.

https://fedorahosted.org/freeipa/ticket/2793
2012-08-17 12:07:46 +02:00
Martin Kosek
adc2f77a39 Bump bind-dyndb-ldap version in spec file
The updated version of the BIND LDAP plugin includes completed
support of DNS zone transfers. With the new version, users will be
able to configure slave DNS servers for IPA master DNS server.
2012-08-17 12:07:25 +02:00
Rob Crittenden
fb2a36d517 Become IPA v3 beta 2 (3.0.0.pre2) 2012-08-15 23:58:17 -04:00
Alexander Bokovoy
cea40170f5 Ignore lint errors if pysssd_murmur and samba4 support not installed when building client code.
Since ipalib.plugins.trust has both client-side and server-side code,
this is the only way to properly handle linting errors.
2012-08-15 23:41:19 -04:00
Sumit Bose
59df038f87 trust CLI: add ID range for new trusted domain 2012-08-15 23:41:17 -04:00
Sumit Bose
d815c3bc99 extdom: read ranges from LDAP 2012-08-15 23:41:06 -04:00
John Dennis
390d708e43 Ticket #2584 - Installation fails when CN is set in certificate subject base
It is illegal to have more than one CN attribute in a certificate
subject. The subject command line arg is actually inserting a dn
between a leading RDN with a CN attribute and a suffix. The final
subject must have only CN attribute therefore the subject command line
arg must not contain CN. The patch modifies the subject validation to
prohibit CN. It also improves the error messages to clearly indicate
which command line parameter caused the failure and why.

While fixing the above it discovered the logic used for subject
validation with an external CA was flawed. DN objects were not being
used when they should be (certificate subject and issuer fields are dn
syntax). That code was also fixed so that the comparisions between
subjects and issuers were performed with DN objects. While fixing this
it was noted the object type relationship between IPA DN objects and
x509 DN objects was awkward, ticket 3003 was opened to address this.
2012-08-16 12:53:57 +02:00
Rob Crittenden
b5d0a9fcb2 Validate default user in ordered list when using setattr, require MLS
The MLS was optional in the format, it should be required.

https://fedorahosted.org/freeipa/ticket/2984
2012-08-16 12:52:38 +02:00
Rob Crittenden
bb5788fc7e Raise proper exception when given a bad DN attribute. 2012-08-16 12:52:23 +02:00
Rob Crittenden
9ab599bcba Use DN object for Directory Manager in ipa-replica-manage connect command 2012-08-16 12:52:08 +02:00
Rob Crittenden
e1d34638ad Convert PKCS#11 subject to string before passing to ipapython.DN 2012-08-15 08:35:36 +02:00
Alexander Bokovoy
1baac3c29e Add internationalization to DCE RPC code
https://fedorahosted.org/freeipa/ticket/2964
2012-08-14 16:51:21 +02:00
Jan Cholasta
de63e95de3 Raise Base64DecodeError instead of ConversionError when base64 decoding fails in Bytes parameters.
ticket 2962
2012-08-14 15:55:44 +02:00
Tomas Babej
2e00a9f45c Improves exception handling in ipa-replica-prepare.
A backtrace is no longer displayed when trying to prepare a replica
file with the local LDAP server down. Also adds --debug option and
no longer displays info messages without it.

https://fedorahosted.org/freeipa/ticket/2939
2012-08-14 15:48:59 +02:00
Tomas Babej
da55aadf74 Corrects help description of selinuxusermap.
https://fedorahosted.org/freeipa/ticket/2959
2012-08-14 15:46:59 +02:00
Tomas Babej
53967f21bd Handle SSSD restart crash more gently.
In ipa-client-install, failure of restart of sssd service no longer
causes the crash of the install process. Adds a warning message to
the root logger instead.

https://fedorahosted.org/freeipa/ticket/2827
2012-08-14 15:45:32 +02:00
Petr Vobornik
690211adb5 Update other facets on delete from search page
When an object in search facet was deleted, other facets were not notified that they need to refresh. If one crated object with same pkey as deleted object and then navigated to it's details he could see old object's data.

This notification was added.

https://fedorahosted.org/freeipa/ticket/2618
2012-08-14 08:26:54 +02:00
Petr Vobornik
d227c70d15 Disable caching of Web UI login_kerberos request
IE caches login_kerberos request so SSO doesn't work after logout. This patch disables the caching.

https://fedorahosted.org/freeipa/ticket/2991
2012-08-14 08:22:48 +02:00
Petr Vobornik
be144da672 Handle case when trusted domain user access the Web UI
WebUI catches the fact that the user can't access LDAP server with a current ticket. It shows form-based auth login dialog. Previoustly an ugly error was returned on an almost empty page, and user had no recourse.

https://fedorahosted.org/freeipa/ticket/2897
2012-08-14 08:20:46 +02:00
Petr Vobornik
ade68ec94f Read-only external facet for non-external groups
Added evaluators to decide if attribute facet should be read-only based on attribute level rights.
Default values serves well for group's external member.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:50 +02:00
Petr Vobornik
994eeb55c9 Group external member facet
Added 'external' attribute facet to group entity. It serves for displaying group's externalmember attribute.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:47 +02:00
Petr Vobornik
5d2b0fecd5 Attribute facet
Created new type of facet: attribute facet. This facet is similar to association facet but it serves for displaying object's multivalued attributes which behaves like association attributes. It will serve as a basis for displaying group's externalmember attribute.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:43 +02:00
Petr Vobornik
7c99e2d661 Display group type
Created new value_map_widget which serves for displaying values based on a map.

It is added to group for displaying its type. The decision is based on group's objectclass.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:39 +02:00
Petr Vobornik
d536b3824e Make group posix
New option for creating plain user group posix group. External group can't be made posix.

https://fedorahosted.org/freeipa/ticket/2338
2012-08-14 08:09:35 +02:00
Petr Vobornik
271043ccf7 Make group external
New action for creating plain group external. Posix group can't be made external.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:31 +02:00
Petr Vobornik
44e86aa3bb Add external group
Group can be normal, posix and external. Posix checkbox was removed and was replaced by radio for selecting group type. This adds possibility of adding of external group.

https://fedorahosted.org/freeipa/ticket/2895
2012-08-14 08:09:23 +02:00
Martin Kosek
6341eff078 Fix winsync agreements creation
Due to recent addition of ID range support to DsInstance, the class
could no longer be instantiated when realm_name was passed but
ID range parameters were not. This condition broke winsync agreements
creation in ipa-replica-manage.

Make sure that ID range computation in DsInstance does not crash in
this cases so that winsync replica can be created. Also convert --binddn
option of ipa-replica-manage script to IPA native DN type so that
setup_agreement does not crash.

https://fedorahosted.org/freeipa/ticket/2987
2012-08-12 23:26:16 -04:00