We verify user and group default objectclasses when changing them
to be sure that required objectclasses aren't being dropped. We need
to ignore virtual attributes or it will raise an error because they
aren't defined in schema.
https://fedorahosted.org/freeipa/ticket/2406
New version of bind-dyndb-ldap plugin have an ability to
automatically update machine reverse address when its forward
address is updated via GSS-TSIG update. The reverse zone must be
managed by FreeIPA as well in order of this feature to work.
As it would not be secure to enable this behaviour for all zones
there is a global attribute that can enable PTR sync for all zones
and also a per-zone attribute that can enable for chosen zones
only.
This patch adds an API for this control.
https://fedorahosted.org/freeipa/ticket/2176
Add ability configure per-zone forwarder for DNS zones. Any data
in such zone will then be considered as non-authoritative and all
queries will be sent to specified forwarder.
https://fedorahosted.org/freeipa/ticket/2108
Provide a way to specify BIND allow-query and allow-transfer ACLs
for DNS zones.
IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To
avoid zone information leaks to unintended places, allow-transfer
ACL for every zone is by default set to none and has to be
explicitly enabled by an Administrator. This is done both for new
DNS zones and old DNS zones during RPM update via new DNS upgrade
plugin.
https://fedorahosted.org/freeipa/ticket/1211
Implement API for DNS global options supported in bind-dyndb-ldap.
Currently, global DNS option overrides any relevant option in
named.conf. Thus they are not filled by default they are left as
a possibility for a user.
Bool encoding had to be fixed so that Bool LDAP attribute can also
be deleted and not just set to True or False.
https://fedorahosted.org/freeipa/ticket/2216
Deleting these would cause the IPA master to blow up.
For services I'm taking a conservative approach and only limiting the
deletion of known services we care about.
https://fedorahosted.org/freeipa/ticket/2425
Address column in A, AAAA DNS records was exented of redirection capabilities.
Redirection dialog is shown after a click on a value.
Dialog does following steps:
1) fetch all dns zones
2) find most accurate reverse zone for IP address
2 -fail) show error message, stop
3) checks if target record exists in the zone
3 -fail) show 'dns record create link', stop
4) redirects
Click on 'dns record create link':
1) creates record
1 -fail) show error, stop
2) redirects
https://fedorahosted.org/freeipa/ticket/1975
Fix wrong handling of strings in --setattr/--addattr/--delattr.
These changes make it possible to use Bytes in --setattr/--addattr/
--delattr without errors.
Fixes managing SSH keys on command-line
https://fedorahosted.org/freeipa/ticket/754
This patch adds a new multivalue param "sshpubkey" for specifying SSH public
keys to both user and host objects. The accepted value is base64-encoded
public key blob as specified in RFC4253, section 6.6.
Additionaly, host commands automatically update DNS SSHFP records when
requested by user.
https://fedorahosted.org/freeipa/ticket/754
* hbacrule: Internationalize HBAC rule "all" category exceptions
https://fedorahosted.org/freeipa/ticket/2267
* hbactest: Use internationalized names (doc) instead of names
for output items
Also don't convert result to bool, `not` does it implicitly
* ipalib.output: Internationalize descriptions of some standard entries
In user group adder dialog, the "Is this a POSIX group?" was replaced with "POSIX group".
In host search facet, the "Enrolled?" was replaced with "Enrolled".
https://fedorahosted.org/freeipa/ticket/2353
This patch switches to named ("%(name)s") instead of positional ("%s")
substitutions for internationalized strings, so translators can
reorder the words.
This fixes https://fedorahosted.org/freeipa/ticket/2179 (xgettext no
longer gives warnings).
Also, some i18n calls are rewritten to translate the template before
substitutions, not after.
The homedirectory argument had a default_from '/home/<name>', ignoring
the ipahomesrootdir config setting. This patch removes that default,
and adds a test case for ipahomesrootdir.
https://fedorahosted.org/freeipa/ticket/2332
The login shell had the same problem. Again this patch removes the
client-side default and adds a test.
Building the home directory from the default is changed to use
posixpath.join instead of string formatting and ad-hoc cleanup,
and to use '/home' instead of failing when the ipahomesrootdir
setting is not present for some reason.
Convert from a freeform string into a enumeration.
Only values currently allowed are AllowLMhash and AllowNThash.
To add more than one value on the command-line either specify
--ipaconfigstring multiple times or add the values comma-separated.
https://fedorahosted.org/freeipa/ticket/1433
External members (users and hosts) are assumed when doing member
management on certain attributes. If the member isn't in IPA it
is assumed to be external. When doing member management we need
to sift through the list of failures and pull out all those
that were simply not found in IPA.
https://fedorahosted.org/freeipa/ticket/1734
The example mistakenly showed how to allow "employees" to edit
addresses of "managers".
This fixes the example by switching the two options.
https://fedorahosted.org/freeipa/ticket/2317
Indirect automount nesting is achieved by adding a key that references
another map. This isn't heirarchical, in fact, you can have multiple
duplicate keys all pointing at the same map, which itself is mounted
in other places. It can be a real mess if you want.
In any case, a submount map has its information set to
"-fstype=autofs <type>:<map>"
The type can be any valid automount type: file, nis, yp, ldap, etc. We
are going to hardcode ldap in when we create these using
automountmap-add-indirect. If a user wants a different type they can
create the key themselves (or edit it later).
Here is an example of creating a submount:
$ ipa automountlocation-add baltimore
$ ipa automountmap-add-indirect baltimore auto.share --mount=/share
$ ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.sub
$ ipa automountkey-add baltimore auto.sub --key=share --info=attic:/share
$ ls /share/sub/share
builds lost+found
This looks like:
etc/auto.master:
/- /etc/auto.direct
/share /etc/auto.share
---------------------------
/etc/auto.direct:
---------------------------
/etc/auto.share:
sub -fstype=autofs ldap:auto.sub
maps not connected to /etc/auto.master:
---------------------------
/etc/auto.sub:
share attic:/share
I've also added a catch-all when using the tofiles function. We were
missing any maps that weren't attached to auto.master. They will now
be shown along with whatever keys they have.
https://fedorahosted.org/freeipa/ticket/1268
CLI command help contains a documentation for all options that can
be passed to commands. However, help strings for positional
arguments are not included.
This patch uses an OptionParser description field to list all
command arguments as OptionParser does not have a native support
to provide such information to user.
https://fedorahosted.org/freeipa/ticket/1974
Improve migration help topic so that it easier understandable:
- Add missing list of Topic commands
- Add one more example to demonstrate migration abilities
- Add breaks to too long lines to improve readibility
https://fedorahosted.org/freeipa/ticket/2174
When a new DNS record is being added to DNS zone via command
ipa dnsrecord-add ZONE @
and the target ZONE does not exist it returns ObjectclassViolation
which may confuse users. Make sure that standard DNS Zone NotFound
exception is returned.
https://fedorahosted.org/freeipa/ticket/2270
Since A6 is an obsolete RR type, no DNS part option was created.
This is, however, not consistent with the rest of per-type API
and may cause problems. This patch adds at least a DNS part for
raw A6 record data so that the record type is treated consistently.
This patch also fixes interactive mode for A6 records. Their data
were not detected correctly as dnsrecord_add didn't expect
a number in DNS part option name.
https://fedorahosted.org/freeipa/ticket/2309
NSEC record needs special treatment as it is not composed from
a fixed set of DNS parts divided by space, but it contains
a multivalued DNS part "types" containing a list of RR types
it covers.
There was already a special method for parsing raw NSEC record
to DNS parts, but the other direction was missing. This patch
adds special NSEC convertor to fix this issue.
https://fedorahosted.org/freeipa/ticket/2307
TXT record validation fails to parse the record if it contains
spaces. Standard DNS part parser uses a space to divide record
parts. A special parser thus need to be implemented for this RR
type.
https://fedorahosted.org/freeipa/ticket/2306
These two situations in netgroup-add need to be distinguished:
1) Netgroup cannot be added because a hostgroup with the same name
created a colliding managed netgroup
2) Another native netgroup with the same name exists
This patch checks the colliding netgroup and raise appropriate
error message based on this finding.
https://fedorahosted.org/freeipa/ticket/2069
The user details page was modified to show the password expiration
date next to the existing password field.
Fixed problem resetting password in self-service mode. The JSON
interface for the passwd command requires the username to be
specified although the equivalent CLI command doesn't require it.
Ticket #2064
Web UI is caching records. Currently only possible ways how to display updated record which was changed elsewhere - ie. in CLI are:
* refresh page in browser (takes really long on slow vpns)
* search facet: change filter, find, change filter back, find
* entity details: go to search, select other entry, go back to search, select original entry
* association facet: same as entity details
These are unconvenient methods.
This patch adds Refresh button to search, details and association facet. This button executes facets refresh method.
https://fedorahosted.org/freeipa/ticket/2051
Host object has a virtual attribute "managing" containing all hosts
it manages (governed by managedBy attribute). This patch also adds
standard membership filtering options:
--man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned
--not-man-hosts=HOSTS: Only hosts which do not manage _any_ host
in HOSTS are returned
https://fedorahosted.org/freeipa/ticket/1675
macaddress is a multi-valued attribute and we allow multiple entries.
This is from the objectclass ieee802device. This is added manually when
doing a mod or add and not as a default to support existing host entries
that do not have this objectclass. If this were added to the defaults
then existing hosts missing this objectclass would not be found by
host-find.
It is possible to get ethers data out of nss by configuring nsswitch.conf
to use ldap for ethers and running getent ethers <hostname>
I tested nslcd and it only returned one macaddress value.
https://fedorahosted.org/freeipa/ticket/1132
When deleting an HBAC rule we need to ensure that an SELinux user
map isn't pointing at it. We need to take what is the cn of the HBAC
rule and see if that rule exists, then return the dn to that rule.
The search was not being done properly and wasn't enforcing uniqueness.
It could have returned partial matches as well (so tests for the
search test).
https://fedorahosted.org/freeipa/ticket/2269
All DNS record part options in dnsrecord commands need to be
optional so that all of them are not required in every dnsrecord
command. However, FreeIPA API then does not include an information
which DNS record part options are optional in term of creating
a new DNS record. For example, LOC record option "latitude seconds"
is not needed to add a new LOC record.
This patch adds a flag "dnsrecord_optional" to all such options so
that this information is available for any other UI reading the
FreeIPA API.
https://fedorahosted.org/freeipa/ticket/2208
This patch modifies the status attributes in users, DNS zones,
HBAC/sudo rules, HBAC test, and SELinux User Map to use the same
label (i.e. Status) and values (i.e. Enabled/Disabled). The method
to change the status will be modified separately.
Ticket #2247
host-add command allows to add a host and its IP address via
--ip-address option. When the address is invalid, it throws
an error and refuses to operate. However, the invalid IP address
error message is always the same which is not right as it forces
a user to guess the reason of rejection (loopback address,
link-local address or invalid address at all was passed, etc.).
This patch changes host-add validator to print the error message.
https://fedorahosted.org/freeipa/ticket/2229
Having float type as a base type for floating point parameters in
ipalib introduces several issues, e.g. problem with representation
or value comparison. Python language provides a Decimal type which
help overcome these issues.
This patch replaces a float type and Float parameter with a
decimal.Decimal type in Decimal parameter. A precision attribute
was added to Decimal parameter that can be used to limit a number
of decimal places in parameter representation. This approach fixes
a problem with API.txt validation where comparison of float values
may fail on different architectures due to float representation error.
In order to safely transfer the parameter value over RPC it is
being converted to string which is then converted back to
decimal.Decimal number on a server side.
https://fedorahosted.org/freeipa/ticket/2260
This is what we already do in the HBAC plugin, this ports it to Sudo.
If a category (user, host, etc) is u'all' then we don't allow individual
members be added. Conversely if there are members we don't allow the
category be set to u'all'.
https://fedorahosted.org/freeipa/ticket/1440
pkey-only functionality has to be implemented separately for these
modules as they are based on crud.Search instead of standard
LDAPSearch.
Delegation moduled was also fixed to support new format of ACI's
memberof attribute introduced in patch "Display the value of
memberOf ACIs in permission plugin."
https://fedorahosted.org/freeipa/ticket/2092
The certificate request dialog box has been modified to show
the OpenSSL commands for generating a CSR.
The realm and entry names in the test data have been fixed to
be more consistent.
Ticket #1012
