IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
954 Commits 11 Branches 63 Tags
a9e8a72059ca5a6db13a9835d20f68dd16ce9a7a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Rob Crittenden 76bf420754 Display name as separate attributes instead of showing common name. 
We allow one to individually set first and last name but we do not
automatically update the common name so changes don't seem to happen.

451318
 2008-08-22 18:02:20 -04:00
Rob Crittenden c7ee747ee5 Add options to display a subset of delegations and return 2 if none are found. 
452027
 2008-08-22 17:57:09 -04:00
Rob Crittenden ff82c4c1e5 Limit the mod_rewrite rules to just /ipa 
459209
 2008-08-21 09:48:48 -04:00
Rob Crittenden e9bde984e0 Add tool to manage IPA Search and User policy 
448624, 448625
 2008-08-20 17:39:46 -04:00
Rob Crittenden 548c169c5a Create temporary files used in self-signed cert requests in a temporary directory and ensure that it gets cleaned up when we're done with it. 
458159
 2008-08-15 11:05:31 -04:00
Rob Crittenden 4be5d862a6 When installing with an IPA-created CA generate the Firefox autoconfiguration files. 
458871
 2008-08-14 18:07:52 -04:00
Rob Crittenden 8edc9aa8aa Make Proxy directive wildcard match more specific so we can play nicer with other apps. 
459061
 2008-08-14 14:55:39 -04:00
Rob Crittenden a013fe5cc2 Fix some copy/paste and other syntax errors from the validators commit. 
450613, 457124
 2008-08-14 14:55:35 -04:00
Rob Crittenden 110f60da8e Change user and group validators to match shadow-utils 
This sets the regex to [a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,30}[a-zA-Z0-9_.$-]?

Also change the validators to return True/False

450613, 457124
 2008-08-07 11:21:33 -04:00
Rob Crittenden df2b40303f Fix python syntax error: missing colon. 2008-08-06 11:27:30 -04:00
Rob Crittenden 6efb547987 Shift search base for users and groups to "cn=accounts, baseDN" 
450552
 2008-07-29 11:33:51 -04:00
Rob Crittenden bae3a2101f Fix encoding issue when manually loading templates for forms 
We used to manually load the template files for the edit pages using
turbogears.meta.load_kid_template(). Unfortunately this went through
the one code path where encoding was completely ignored. It ended up
defaulting to sys.getdefaultencoding() which is 'ascii'. So even though
most of the templates are loaded as 'utf-8' the few that really mattered
weren't.

The fix is to call kid.load_template() ourselves and set the encoding of
the class we just loaded to either the setting in the app.cfg file or
to the normal default value of 'utf-8'.

454076
 2008-07-29 11:32:02 -04:00
Rob Crittenden cdba310f02 Change Title label to Job Title for clarity 
453780
 2008-07-29 11:24:52 -04:00
Rob Crittenden f5f8e8d884 NSS 3.12 added a header to the certutil output we need to skip 
456694
 2008-07-28 09:55:49 -04:00
Rob Crittenden cf06dd9f84 Don't assume that the Firefox autoconfig files exist. 
These are created by an object-signing cert and needs to be done
after the fact if a server is created with user-supplied PKCS#12 files.

452402
 2008-07-28 09:54:16 -04:00
Rob Crittenden 9f2ee29218 Specify --mandir to configure to fix building on CentOS 5.2 
456672
 2008-07-28 09:53:38 -04:00
Rob Crittenden a19d27717a Move the self-signed CA serialno file to /var/lib/ipa to adhere to the FHS 
455064
 2008-07-25 09:05:14 -04:00
Rob Crittenden 23fab304e9 Catch correct exception when trying to find the default IPA users group and return a more detailed error message. 
455092
 2008-07-23 10:05:32 -04:00
Rob Crittenden 6980b07303 Rework the way SSL certificates are imported from PKCS#12 files. 
Add the ability to provide PKCS#12 files during initial installation
Add the ability to provide PKCS#12 files when preparing a replica
Correct some issues with ipa-server-certinstall

452402
 2008-07-14 09:06:52 -04:00
Rob Crittenden 3f85a011c6 Be more exacting when deleting a group. 
453222
 2008-07-07 10:23:38 -04:00
Rob Crittenden 469fc7663c Add documentation for -v/--verbose option 
451117
 2008-07-03 15:26:27 -04:00
Rob Crittenden fb9f92c9f3 Merge branch 'master' of ssh://rcritten@git.fedorahosted.org/git/freeipa 2008-07-03 15:20:36 -04:00
Rob Crittenden 1bd0a868a2 NSS_DIR is already fetched into a variable, use that instead. 
451098
 2008-07-03 15:20:19 -04:00
Rob Crittenden e9196e2d93 Properly convert the realm to a DS instance name 
451014
 2008-07-01 15:07:00 -04:00
Rob Crittenden ec597b0ef1 Ensure correct permissions and file ownership of Apache NSS database 
451098
 2008-07-01 15:06:59 -04:00
Rob Crittenden 4665700fef Index the memberof attribute 
450951
 2008-06-11 17:26:45 -04:00
Rob Crittenden 8752ebd185 Missed adding verbose to a couple of IPAClient invocations. 
443987
 2008-06-11 16:29:12 -04:00
Rob Crittenden d1322c6517 Ensure that the realm name is upper-case. 
449182
 2008-06-09 22:18:00 -04:00
Rob Crittenden ad3e4d4ed5 Ignore empty values when converting a multi-valued form field back to a list. This will prevent validation errors when validate.UniqueList() is executed. 
449785
 2008-06-09 22:15:22 -04:00
Rob Crittenden 42cada4594 When an LDAP connection fails, display the host one is trying to connect to. 
450111
 2008-06-09 22:13:54 -04:00
Rob Crittenden 48f2e3c3db Add our own SIGTERM handler so we can do clean shutdowns. 
Also fix foreground mode.

450211
 2008-06-09 22:11:08 -04:00
Rob Crittenden 77483ac808 Make it clear which packages are being configured and which aren't. 
450175
 2008-06-09 22:09:19 -04:00
Rob Crittenden 1f511d4b75 Add sbin_t directory read permissions 
449760
 2008-06-05 13:02:38 -04:00
Rob Crittenden d600f9bb09 Fix typo 
450077
 2008-06-05 09:00:20 -04:00
Rob Crittenden ec2eff9774 Under some conditions rl may not have been initialized so the config may error out with: 
UnboundLocalError: "local variable 'rl' referenced before assignment"

This is caught and ignored but the result is that the records in DNS may
not be used at all. Initializing rl to zero fixes this.

I also convert the server list into a set to make each entry unique (and
back to a list because that is what we are supposed to return)

433506
 2008-06-04 22:40:32 -04:00
Rob Crittenden b26fc32d9d Fix import for version 2008-06-04 17:32:51 -04:00
Rob Crittenden 68e14ed8ba Add -p/--password option so the DM password can be passed on the command-line. 
The import for version moved from ipaserver to ipa, fix that as well.

449858
 2008-06-04 17:32:47 -04:00
Rob Crittenden 12899d9053 Don't make the search criteria lower-case so one can do case-sensitive searches (such as looking for HTTP principals) 
449975
 2008-06-04 16:34:47 -04:00
Rob Crittenden 5c916a1cc8 Fix some minor man page issues. 
438771
 2008-06-04 12:50:13 -04:00
Rob Crittenden d6f7998fe7 Fix some formatting issues and correct the example. 
443009
 2008-06-04 11:14:33 -04:00
Rob Crittenden 28008a4bf2 Fix typo and reorder -q|--quiet so it displays nicer. popt isn't putting it on a separate line so moving it up front makes it easier to find. 
443014
 2008-06-04 11:05:47 -04:00
Rob Crittenden 9bcd31efc5 Fix issue of double logging in ipa_error.log. 
We open the log in ipa_webgui and this was being inherited by TurboGears
which uses the same log so everything was getting logged twice. Shut down
the log in ipa_webgui at the last possible moment. This will not catch
configuration errors.

Add a Not Found template.

Only print a traceback on 500 errors.
 2008-06-03 22:41:09 -04:00
Rob Crittenden c58b7a3d7c Move version.py to the common ipa directory instead of being server-based so it can be used by the client tool. 
Fix the client tool imports to fail more gracefully.
 2008-06-03 22:39:11 -04:00
Rob Crittenden 5a56b7c885 Fix some minor man page issues. 
438771
 2008-06-03 14:33:18 -04:00
Rob Crittenden f87dc9123b Don't prompt regarding previous DS installations in unattended mode. 
449150
 2008-05-30 16:14:51 -04:00
Rob Crittenden e935287f6e Try to clear up messages prompting for domain and IPA server when DNS discovery fails to find them. 2008-05-30 15:44:56 -04:00
Rob Crittenden 8f639ea924 Add two now options, --addattr and --setattr, to allow arbitrary attributes to be added and set when a new user or group is created. 
Make the user password not mandatory and add new option, -P, to prompt
for a password interactively.

449006
 2008-05-30 11:22:56 -04:00
Rob Crittenden 165d26ce2b Make check_inst() a standalone function in bindinstance. 
When an install instance is created that contains a pointer to a sysrestore
point it loads in the current configuration when instantiated. If an
instance is instantiated but not used then changes may occur to the
system state that it is unaware of. So one needs to take care in the order
that things are done to avoid losing information.

When bind was setup it was overwriting all data in sysrestore.state and
leaving just a [named] section. This caused problems at uninstall.

448173
 2008-05-30 11:21:11 -04:00
Rob Crittenden e3ba80e3d3 Actually pass along the verbose option to IPAClient. 
443987
 2008-05-29 16:04:28 -04:00
Rob Crittenden 8f6303adf0 Fix typo in log statement 
448948
 2008-05-29 13:23:43 -04:00
Rob Crittenden c5d6ad5c6e Set default logging level to INFO (still logs to Apache) 
Add function entry log for the core IPA XML-RPC functions.
 2008-05-28 14:13:19 -04:00
Rob Crittenden 0f9b944dde Add python-configobj as a Requires and do some other specfile cleanups. 
432814
 2008-05-28 14:09:08 -04:00
Rob Crittenden 927447b144 Fix up function return values so we can return 1 on an installation error. 
447973
 2008-05-22 16:37:33 -04:00
Rob Crittenden a087818197 Move non-user-configurable configuration elements to TurboGears app.cfg file. 
432908
 2008-05-22 16:31:08 -04:00
Rob Crittenden fcd3260955 Ensure hostnames are lower during installation and when adding service princs 
447381
 2008-05-20 15:07:24 -04:00
Rob Crittenden fe2f69718f Remove broken link for IE configuration and replace sample domain/realm. Also fix some HTML errors: missing DOCTYPE, title, head. 
The web page actually comes up as a link in a search on Microsoft's site
but the content is gone. It is possible it will come back at some point, who
knows.

447445
 2008-05-20 15:05:50 -04:00
Rob Crittenden d640eb17e5 Add validators.py to the list of files. 
445286
 2008-05-20 15:03:58 -04:00
Rob Crittenden d142b5376d Do uniqueness check on phone numbers and cn entered via the UI. 
445286
 2008-05-20 11:38:35 -04:00
Rob Crittenden 6c87f83180 Don't pass the Directory Manager password on the command-line to ldapmodify. 
446865
 2008-05-19 17:07:41 -04:00
Rob Crittenden 2b05d973a4 Fix typo in ipa-client-install manpage. 
446201
 2008-05-14 11:41:56 -04:00
Rob Crittenden 92d7f9c28a Make sure all services are stopped during uninstall. 
We were just shutting down the KDC if it had been started prior to IPA
installation. We need to stop it in all cases.

And we should restart nscd as it may have made an LDAP connection.

440322
 2008-05-14 09:57:09 -04:00
Rob Crittenden 99141e3a04 Enforce the maximum username length set by IPA Policy 
439891
 2008-05-14 09:48:21 -04:00
Rob Crittenden 319cb38e28 Do a more thorough job of removing an existing DS instance. 
Add /usr/lib/dirsrv/slapd-INSTANCE to the list of directories removed.

442753
 2008-05-13 22:53:01 -04:00
Rob Crittenden 3daa94ccc0 Catch name resolution errors coming from the socket module. 
442650
 2008-05-13 12:00:21 -04:00
Rob Crittenden b1cc4199fa The admin user doesn't have the inetorgperson objectclass so don't have a givenname attribute. The UI is currently hardcoded to require "first name" which renders the admin user uneditable via the UI. 
This is a hack that will allow admin to be edited, assuming that one doesn't
try to add a firstname field.

440548
 2008-05-13 11:59:46 -04:00
Rob Crittenden 41457f0e81 Display information on how to uninstall a partially installed server. 
This may have failed either because the user pressed ^C or something
failed during installation.

442454
 2008-05-09 14:05:47 -04:00
Rob Crittenden ae641ed31b Include information on where to look if a hostname resolves to localhost. 
442812
 2008-05-09 14:04:04 -04:00
Rob Crittenden 9fe649b804 Convert mercurial command to git equivalent for creating an archive. 
By default it will use the master branch of the repo this is run from.
To specify a different branch use the argument TARGET=<branch>

e.g. make dist TARGET=ipa-1-0

442419
 2008-05-09 11:09:49 -04:00
Rob Crittenden 6538c150b1 Detect existing DS instances and prompt for removal during replica install. 
442454
 2008-05-08 15:56:10 -04:00
Rob Crittenden 318c6adfae Add missing colon to function definition that broke the build 2008-05-08 15:17:59 -04:00
Rob Crittenden bd9dea888d Add a version API to the server so it knows what version it is. 
435019
 2008-05-08 13:01:27 -04:00
Rob Crittenden 24f43bc846 Don't allow the IPA server service principals to be removed. 
440282
 2008-05-08 12:57:31 -04:00
Rob Crittenden 2bb64e404c Don't prompt for confirmation of DM password when installing a replica. 
It implies that you are setting a new password and you really aren't.

Also added a catch for KeyboardInterrupt with instructions on how to
recover from a partial install.

441607
 2008-05-08 12:01:38 -04:00
Rob Crittenden 570b71372f Second half of the redoing how the version is managed. 2008-05-07 18:26:03 -04:00
Rob Crittenden 8e7561cff6 Refine our web space some more so that everything we reference is in /ipa 
UI: /ipa/ui
XML-RPC: /ipa/xml
errors: /ipa/errors
config: /ipa/config

I had to hardcode that URI into the CSS pages but TurboGears handles the
rest of the translations with tg.url().

Added a version to ipa.conf and ipa-rewrite.conf so we can update them
in the future if needed with ipa-upgradeconfig

440443
 2008-05-07 09:41:32 -04:00
Rob Crittenden 5ad2af3429 Redo the way versioning works in freeIPA. 
The file VERSION is now the sole-source of versioning.

The generated .spec files will been removed in the maintainer-clean targets
and have been removed from the repository.

By default a GIT build is done. To do a non-GIT build do:

 $ make TARGET IPA_VERSION_IS_GIT_SNAPSHOT=no

When updating the version you can run this to regenerate the version:

 $ make version-update

The version can be determined in Python by using ipaserver.version.VERSION
 2008-05-05 13:53:57 -04:00
Rob Crittenden 23fe67996c Remove duplicated "the" and add some formatting to the EXAMPLE for clarity. 
443012
 2008-05-05 11:10:40 -04:00
Rob Crittenden 274eb708c2 Fix ownership of the Apache NSS cert and key databases. 
The group "apache" needs to have read access to them so they will work in
Fedora 9+.
 2008-04-30 09:44:48 -04:00
Rob Crittenden 306d8241b3 Fix the client-side search size limit. 
I've changed the variable name searchlimit to sizelimit to match the
name in python-ldap (and hopefully therefore be more readable).

The big change was changing the default value from 0 to -1. As 0 we were
never using the value from cn=ipaconfig

python-ldap expects this to be an int type

In the UI sizelimit was hardcoded at 0 for users

439880
 2008-04-25 16:46:13 -04:00
Rob Crittenden 12ea8efc0b Add --verbose option so the HTTP headers and XML request/response can be seen. 
Also re-do the way modules are imported. I was attemping to have ^C handled
gracefully but the way I did it could mask other problems.

443987
 2008-04-25 10:35:22 -04:00
Rob Crittenden 47e6a75cff Add nfs as a service principal type. 
440242
 2008-04-23 15:42:41 -04:00
Rob Crittenden 03b3dbd2ab Don't let a user change their own uid. Fix some related errors if they try. 
440895
 2008-04-23 15:36:14 -04:00
Rob Crittenden 2427e7c130 Don't allow a replica to prepare a replica for itself. 
442756
 2008-04-23 15:36:13 -04:00
Rob Crittenden def28f3d5b Become version 1.0.0 2008-04-16 14:29:17 -07:00
Rob Crittenden dce8008167 Catch all errors when obtaining an LDAP connection. 
442582
 2008-04-15 21:08:55 -07:00
Rob Crittenden 78bdb75291 Move print statement to the correct scope so it displays both lock and unlock. 
442625
 2008-04-15 21:27:04 -04:00
Rob Crittenden 4eb7c51e59 Better detection of DS not starting. 
The dirsrv init script always returns 0 on status checks, even if an
instance is not started. So we have to look through the output instead.

442452
 2008-04-14 23:14:16 -04:00
Rob Crittenden b1f58e5441 Don't quit trying to lock a user if they aren't in the activated group. 
Users are considered activated by default so don't need to be in the
activated group explicitly. Ignore the "not in group" error when trying
to remove them.

442470
 2008-04-14 23:13:58 -04:00
Rob Crittenden ff3ca61f73 Handle exceptions more gracefully on systems with python-ldap 2.2.0 
442136
 2008-04-14 18:23:29 -04:00
Rob Crittenden ce3f79e51c Configure the ipa_pwd_extop plugin on replicas. 
If plugin isn't configured then the kerberos attributes don't get populated.
User's will get Preauthentication errors from the kerberos libraries
because there is no krbPrincipalKey to match against.

442134
 2008-04-14 17:55:25 -04:00
Rob Crittenden 27691b9e1c Use the same kpasswd.keytab on all replicas. 
If we generate a new keytab for each replica then effectively password
changes can only occur on the last replica created.

439905
 2008-04-09 16:57:41 -04:00
Rob Crittenden 3ec54383f9 Fix error where password was getting set wrong if passed in on command-line. 
439905
 2008-04-08 15:44:05 -04:00
Rob Crittenden 0f00ba24a2 SELinux fix from Dan Walsh 
440646
 2008-04-07 23:50:43 -04:00
Rob Crittenden f88f9f3cc0 Add (post) to Requires: ipa-server-spec 2008-04-07 23:45:00 -04:00
Rob Crittenden 039581d1ed Some SELinux policy changes provided by Dan Walsh. 
440651
 2008-04-07 23:38:51 -04:00
Rob Crittenden ac5a35086e Don't allow the admin user to be removed from the admins group. 
439281
 2008-04-04 17:41:32 -04:00
Rob Crittenden cb4648a8af Add missing normalizeDN() when removing members from a group. 
438387
 2008-04-04 16:30:36 -04:00
Rob Crittenden a761093a30 Create /etc/ipa/ipa.conf earlier in the installation process. 
Because the ipa.config() object raises an error if there is no configuration
file and auto-detection fails, ipa_webgui may fail to start at install time.

440475
 2008-04-03 15:49:07 -04:00
Rob Crittenden 8dafa9dc92 Add missing image 2008-04-03 15:40:11 -04:00
Rob Crittenden c30a533de6 Don't try to update ipauserobjectclasses or ipagroupobjectclasses 
since they aren't being displayed anymore. They will just get blanked.

Also add some error handling in ipahelper.fix_incoming_fields()

438256
 2008-04-02 21:15:49 -04:00