Commit Graph

343 Commits

Author SHA1 Message Date
Martin Kosek
34f8ff4793 Add range-mod command
range plugin was missing range-mod command that could be used for
example to fix a size for a range generated during upgrades. The
range should be updated with a caution though, a misconfiguration
could break trusts.

iparangetype is now also handled better and filled in all commands
instead of just range-show. objectclass attribute is deleted only
when really needed now.
2012-07-13 16:18:29 +02:00
Rob Crittenden
50ebd1a339 Add missing option to range_add in API.txt
Fix build
2012-06-30 19:58:00 -04:00
Sumit Bose
fbebe82811 Add CLI for ID ranges
https://fedorahosted.org/freeipa/ticket/2185
2012-06-29 18:00:50 -04:00
Alexander Bokovoy
a6ff85f425 Add support for external group members
When using ipaExternalGroup/ipaExternalMember attributes it is
possible to add group members which don't exist in IPA database.
This is primarily is required for AD trusts support and therefore
validation is accepting only secure identifier (SID) format.

https://fedorahosted.org/freeipa/ticket/2664
2012-06-28 16:53:33 +02:00
Martin Kosek
52f69aaa8a Per-domain DNS record permissions
IPA implements read/write permissions for DNS record or zones.
Provided set of permissions and privileges can, however, only grant
access to the whole DNS tree, which may not be appropriate.
Administrators may miss more fine-grained permissions allowing
them to delegate access per-zone.

Create a new IPA auxiliary objectclass ipaDNSZone allowing
a managedBy attribute for a DNS zone. This attribute will hold
a group DN (in this case a permission) which allows its members
to read or write in a zone. Member permissions in given zone
will only have 2 limitations:
1) Members cannot delete the zone
2) Members cannot edit managedBy attribute

Current DNS deny ACI used to enforce read access is removed so that
DNS privileges are based on allow ACIs only, which is much more
flexible approach as deny ACIs have always precedence and limit
other extensions. Per-zone access is allowed in 3 generic ACIs
placed in cn=dns,$SUFFIX so that no special ACIs has to be added
to DNS zones itselves.

2 new commands have been added which allows an administrator to
create the system permission allowing the per-zone access and
fill a zone's managedBy attribute:
 * dnszone-add-permission: Add per-zone permission
 * dnszone-remove-permission: Remove per-zone permission

https://fedorahosted.org/freeipa/ticket/2511
2012-06-28 15:21:21 +02:00
Alexander Bokovoy
a5cb1961fe Rename 'ipa trust-add-ad' to 'ipa trust-add --type=ad' 2012-06-25 18:16:15 +02:00
Simo Sorce
f602ad270d Add support for disabling KDC writes
Add two global ipaConfig options to disable undesirable writes that have
performance impact.
The "KDC:Disable Last Success" will disable writing back to ldap the last
successful AS Request time (successful kinit)
The "KDC:Disable Lockout" will disable completely writing back lockout
related data. This means lockout policies will stop working.

https://fedorahosted.org/freeipa/ticket/2734
2012-06-06 22:12:22 -04:00
Alexander Bokovoy
a7420c1e83 Add trust management for Active Directory trusts 2012-06-07 09:39:09 +02:00
Martin Kosek
d31f0c2d33 Improve migration NotFound error
When no user/group was found, migration plugin reported an ambiguous
error about invalid container. But the root cause may be for example
in a wrong list of user/group objectclasses. Report both in the error
message to avoid user confusion.

User/group objectclass attribute is now also marked as required.
Without the list of objectclasses, an invalid LDAP search is
produced.

https://fedorahosted.org/freeipa/ticket/2206
2012-06-05 08:51:30 +02:00
Martin Kosek
c06cbb12ac Fill new DNS zone update policy by default
For security reasons, dynamic updates are not enabled for new DNS
zones. In order to enable the dynamic zone securely, user needs to
allow dynamic updates and create a zone update policy.

The policy is not easy to construct for regular users, we should
rather fill it by default and let users just switch the policy
on or off.

https://fedorahosted.org/freeipa/ticket/2441
2012-06-05 08:41:46 +02:00
Martin Kosek
5b465811ce Add rename option for DNS records
This option will make renaming DNS records much easier.
Add a unit test for this new functionality.

https://fedorahosted.org/freeipa/ticket/2600
2012-05-31 12:45:47 +02:00
Petr Viktorin
1af36da933 Disallow setattr on no_update/no_create params
Make --{set,add,del}attr fail on parameters with the no_update/no_create
flag for the respective command.

For attributes that can be modified, but we just don't want to display
in the CLI, use the 'no_option' flag. These are "locking" attributes
(ipaenabledflag, nsaccountlock) and externalhost.

Document the 'no_option' flag. Add some tests.

https://fedorahosted.org/freeipa/ticket/2580
2012-05-29 09:23:26 +02:00
Ondrej Hamada
677ea8cbfa permission-mod prompts for all parameters
ipa permission-mod was prompting for all parameters because they had
specified flag 'ask_update'. The flag was removed. Additionally the
exec_callback for permission-mod was updated to unify the behaviour with
other ipa commands (raise exception when no modification was specified).

https://fedorahosted.org/freeipa/ticket/2280
2012-05-17 10:12:10 +02:00
Ondrej Hamada
343aba2486 Allow one letter net/hostgroups names
Changed regex validating net/hostgroup names to allow single letter
names. Unit-tests added.

https://fedorahosted.org/freeipa/ticket/2671
2012-05-07 08:35:11 +02:00
John Dennis
d317c2a0d1 Validate DN & RDN parameters for migrate command
Ticket #2555

We were generating a traceback (server error) if a malformed RDN was
passed as a parameter to the migrate command.

* add parameter validation functions validate_dn_param() and
  validate_rdn_param() to ipalib.util. Those functions simply invoke
  the DN or RDN constructor from our dn module passing it the string
  representation. If the constructor does not throw an error it's
  valid.

* Add the parameter validation function pointers to the Param objects
  in the migrate command.

* Make the usercontainer and groupcontainer parameters required.
  passing --usercontainer= on the command line will produce

  ipa: ERROR: 'user_container' is required

* Fix _get_search_bases() so if a container dn is empty it it just
  uses the base dn alone instead of faulting (currently
  bullet-proofing because now the containers are required).

* Update the doc for usercontainer and groupcontainer to reflect the
  fact they are DN's not RDN's. A RDN can only be one level and it
  should be possible to have a container more than one RDN removed
  from the base.
2012-04-16 08:35:03 +02:00
Petr Viktorin
e1813976a5 Remove pattern_errmsg from API.txt
https://fedorahosted.org/freeipa/ticket/2619
2012-04-12 15:05:54 +02:00
Petr Viktorin
6e5c8b25bf Limit permission and selfservice names to alphanumerics, -, _, space
The DN and ACI code doesn't always escape special characters properly.
Rather than trying to fix it, this patch takes the easy way out and
enforces that the names are safe.

https://fedorahosted.org/freeipa/ticket/2585
2012-04-09 20:56:29 -04:00
Jan Cholasta
cdebb29fec Check whether the default user group is POSIX when adding new user with --noprivate.
ticket 2572
2012-04-05 15:04:45 +02:00
Rob Crittenden
51b34d5c42 Make revocation_reason required when revoking a certificate.
This will prevent errors if an empty reason is provided and it is
set by default one doesn't have to always set it on the command-line.

https://fedorahosted.org/freeipa/ticket/2597
2012-04-05 08:51:30 +02:00
Rob Crittenden
a5a4323946 Add updated Output format for batch to API.txt
This doesn't require bumping VERSION, it just makes list and tuple
both allowable
2012-04-03 17:17:41 -04:00
Ondrej Hamada
5cfee2338d Netgroup nisdomain and hosts validation
nisdomain validation:
Added pattern to the 'nisdomain' parameter to validate the specified
nisdomain name. According to most common use cases the same pattern as
for netgroup should fit. Unit-tests added.

https://fedorahosted.org/freeipa/ticket/2448

'add_external_pre_callback' function was created to allow validation of
all external members. Validation is based on usage of objects primary
key parameter. The 'add_external_pre_callback' fucntion has to be called
directly from in the 'pre_callback' function. This change affects
netgroup, hbacrule and sudorule commands.

For hostname, the validator allows non-fqdn and underscore characters.
validate_hostname function in ipalib.util was modified and contains
additional option that allows hostname to contain underscore characters.
This option is disabled by default.

Unit-tests added.

https://fedorahosted.org/freeipa/ticket/2447
2012-03-28 16:23:37 +02:00
Martin Kosek
9b562f7377 Add missing global options in dnsconfig
Add a support for new global options in bind-dyndb-ldap, that is:
 * idnsforwardpolicy: Default policy for conditional forwarding
 * idnsallowsyncptr: Allow globaly PTR synchronization for dynamic
   updates
 * idnszonerefresh: Default interval between regular polls of the
   name server for new DNS zones

https://fedorahosted.org/freeipa/ticket/2439
2012-03-20 15:40:08 +01:00
Rob Crittenden
763265f28e Fix API.txt and VERSION to reflect new sudoOrder option. 2012-03-01 22:24:26 -05:00
Rob Crittenden
d55d8bfa7e Add support for sudoOrder
Update ipaSudoRule objectClass on upgrades to add new attributes.
Ensure uniqueness of sudoOrder in rules.

The attributes sudoNotBefore and sudoNotAfter are being added to
schema but not as Params.

https://fedorahosted.org/freeipa/ticket/1314
2012-03-01 21:02:33 -05:00
Rob Crittenden
d5c9f7bcaa Add status command to retrieve user lockout status
This information is not replicated so pull from all IPA masters
and display the status across all servers.

https://fedorahosted.org/freeipa/ticket/2162
2012-03-02 16:28:54 +01:00
Ondrej Hamada
73249140fc Migration warning when compat enabled
Added check into migration plugin to warn user when compat is enabled.
If compat is enabled, the migration fails and user is warned that he
must turn the compat off or run the script with (the newly introduced)
option '--with-compat'.

'--with-compat' is new flag. If it is set, the compat status is ignored.

https://fedorahosted.org/freeipa/ticket/2274
2012-02-29 18:30:03 -05:00
Rob Crittenden
0099ccbea8 Only apply validation rules when adding and updating.
There may be cases, for whatever reason, that an otherwise illegal
entry gets created that doesn't match the criteria for a valid
user/host/group name. If this happens (i.e. migration) there is no way
to remove this using the IPA tools because we always applied the name
pattern. So you can't, for example, delete a user with an illegal name.

Primary keys are cloned with query=True in PKQuery which causes no
rules to be applied on mod/show/find. This reverts a change from commit
3a5e26a0 which applies class rules when query=True (for enforcing no
white space).

Replace rdnattr with rdn_is_primary_key. This was meant to tell us when
an RDN change was necessary to do a rename. There could be a disconnect
where the rdnattr wasn't the primary key and in that case we don't
need to do an RDN change, so use a boolean instead so that it is
clear that RDN == primary key.

Add a test to ensure that nowhitespace is actually enforced.

https://fedorahosted.org/freeipa/ticket/2115

Related: https://fedorahosted.org/freeipa/ticket/2089

Whitespace tickets:
https://fedorahosted.org/freeipa/ticket/1285
https://fedorahosted.org/freeipa/ticket/1286
https://fedorahosted.org/freeipa/ticket/1287
2012-02-29 18:00:45 -05:00
Martin Kosek
7db1da1d65 Improve hostname and domain name validation
DNS plugin did not check DNS zone and DNS record validity and
user was thus able to create domains like "foo bar" or other
invalid DNS labels which would really confuse both user and
bind-dyndb-ldap plugin.

This patch at first consolidates hostname/domain name validators
so that they use common functions and we don't have regular
expressions and other checks defined in several places. These
new cleaned validators are then used for zone/record name
validation.

https://fedorahosted.org/freeipa/ticket/2384
2012-02-29 18:52:58 +01:00
Rob Crittenden
e889b82599 Add support defaultNamingContext and add --basedn to migrate-ds
There are two sides to this, the server and client side.

On the server side we attempt to add a defaultNamingContext on already
installed servers. This will fail on older 389-ds instances but the
failure is not fatal. New installations on versions of 389-ds that
support this attribute will have it already defined.

On the client side we need to look for both defaultNamingContext and
namingContexts. We still need to check that the defaultNamingContext
is an IPA server (info=IPAV2).

The migration change also takes advantage of this and adds a new
option which allows one to provide a basedn to use instead of trying
to detect it.

https://fedorahosted.org/freeipa/ticket/1919
https://fedorahosted.org/freeipa/ticket/2314
2012-02-29 15:28:13 +01:00
Rob Crittenden
7d7322de2e Limit allowed characters in a netgroup name to alpha, digit, -, _ and .
Apply this to hostgroup names as well since they can be linked.

https://fedorahosted.org/freeipa/ticket/2221
2012-02-27 00:06:44 -05:00
Martin Kosek
cbb3bfae23 Add reverse DNS record when forward is created
Adding reverse DNS record may be a time consuming task, especially
for IPv6 addresses. Having a way to automatically create a reverse
record when a forward record is created could speed up the process.
host-add command already has this possibility.

This patch takes advantage of the new per-type API and adds new
options for A/AAAA record types: --a-create-reverse and
--aaaa-create-reverse. These commands can be used to automatically
create reverse records for new A/AAAA addresses (both forward
and reverse zones need to be managed by FreeIPA server):

ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse

This command would add a new A record to record foo in zone
example.com and a PTR record to appropriate reverse zone for
IP address 10.0.0.1 (for example PTR record 1 in zone
0.0.10.in-addr.arpa. pointing to foo.example.com.).

Few modification were done to new DNS API to support this feature:
 - Refactor --ip-address option handling from host-add and place it
   to dns.py to be used by both modules
 - Add support for "extra" per-type options
 - Hide DNS record part options in dnsrecord_find command as they
   have no effect for this command

https://fedorahosted.org/freeipa/ticket/2009
2012-02-27 16:50:08 +01:00
Martin Kosek
16d88d79ad Add gidnumber minvalue
Do not accept invalid GID values in IPA user/group plugins.

https://fedorahosted.org/freeipa/ticket/2335
2012-02-23 21:00:15 -05:00
Martin Kosek
1c898e388b Add API for PTR sync control
New version of bind-dyndb-ldap plugin have an ability to
automatically update machine reverse address when its forward
address is updated via GSS-TSIG update. The reverse zone must be
managed by FreeIPA as well in order of this feature to work.

As it would not be secure to enable this behaviour for all zones
there is a global attribute that can enable PTR sync for all zones
and also a per-zone attribute that can enable for chosen zones
only.

This patch adds an API for this control.

https://fedorahosted.org/freeipa/ticket/2176
2012-02-24 09:40:51 +01:00
Martin Kosek
210d913eb1 Add DNS conditional forwarding
Add ability configure per-zone forwarder for DNS zones. Any data
in such zone will then be considered as non-authoritative and all
queries will be sent to specified forwarder.

https://fedorahosted.org/freeipa/ticket/2108
2012-02-24 09:40:47 +01:00
Martin Kosek
8605790225 Query and transfer ACLs for DNS zones
Provide a way to specify BIND allow-query and allow-transfer ACLs
for DNS zones.

IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To
avoid zone information leaks to unintended places, allow-transfer
ACL for every zone is by default set to none and has to be
explicitly enabled by an Administrator. This is done both for new
DNS zones and old DNS zones during RPM update via new DNS upgrade
plugin.

https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 09:40:43 +01:00
Martin Kosek
2cf5893761 Global DNS options
Implement API for DNS global options supported in bind-dyndb-ldap.
Currently, global DNS option overrides any relevant option in
named.conf. Thus they are not filled by default they are left as
a possibility for a user.

Bool encoding had to be fixed so that Bool LDAP attribute can also
be deleted and not just set to True or False.

https://fedorahosted.org/freeipa/ticket/2216
2012-02-24 09:40:40 +01:00
Jan Cholasta
3c2b0fc28a Add support for SSH public keys to user and host objects.
This patch adds a new multivalue param "sshpubkey" for specifying SSH public
keys to both user and host objects. The accepted value is base64-encoded
public key blob as specified in RFC4253, section 6.6.

Additionaly, host commands automatically update DNS SSHFP records when
requested by user.

https://fedorahosted.org/freeipa/ticket/754
2012-02-13 22:21:27 -05:00
Petr Viktorin
d706c411ef Honor default home directory and login shell in user_add
The homedirectory argument had a default_from '/home/<name>', ignoring
the ipahomesrootdir config setting. This patch removes that default,
and adds a test case for ipahomesrootdir.

https://fedorahosted.org/freeipa/ticket/2332

The login shell had the same problem. Again this patch removes the
client-side default and adds a test.

Building the home directory from the default is changed to use
posixpath.join instead of string formatting and ad-hoc cleanup,
and to use '/home' instead of failing when the ipahomesrootdir
setting is not present for some reason.
2012-02-09 18:11:57 +01:00
Rob Crittenden
44c69ef33e Make ipaconfigstring modifiable by users.
Convert from a freeform string into a enumeration.

Only values currently allowed are AllowLMhash and AllowNThash.

To add more than one value on the command-line either specify
--ipaconfigstring multiple times or add the values comma-separated.

https://fedorahosted.org/freeipa/ticket/1433
2012-02-09 08:29:09 +01:00
Martin Kosek
f411ed1e47 Add data field for A6 record
Since A6 is an obsolete RR type, no DNS part option was created.
This is, however, not consistent with the rest of per-type API
and may cause problems. This patch adds at least a DNS part for
raw A6 record data so that the record type is treated consistently.

This patch also fixes interactive mode for A6 records. Their data
were not detected correctly as dnsrecord_add didn't expect
a number in DNS part option name.

https://fedorahosted.org/freeipa/ticket/2309
2012-02-03 16:26:20 +01:00
Martin Kosek
cb4b2e6fac Fix NSEC record conversion
NSEC record needs special treatment as it is not composed from
a fixed set of DNS parts divided by space, but it contains
a multivalued DNS part "types" containing a list of RR types
it covers.

There was already a special method for parsing raw NSEC record
to DNS parts, but the other direction was missing. This patch
adds special NSEC convertor to fix this issue.

https://fedorahosted.org/freeipa/ticket/2307
2012-02-03 16:25:26 +01:00
Martin Kosek
0b9279a30a Add missing managing hosts filtering options
Host object has a virtual attribute "managing" containing all hosts
it manages (governed by managedBy attribute). This patch also adds
standard membership filtering options:
  --man-hosts=HOSTS: Only hosts managing _all_ HOSTS are returned
  --not-man-hosts=HOSTS: Only hosts which do not manage _any_ host
    in HOSTS are returned

https://fedorahosted.org/freeipa/ticket/1675
2012-01-26 10:17:39 -06:00
Rob Crittenden
52e3488b75 Add support for storing MAC address in host entries.
macaddress is a multi-valued attribute and we allow multiple entries.
This is from the objectclass ieee802device. This is added manually when
doing a mod or add and not as a default to support existing host entries
that do not have this objectclass. If this were added to the defaults
then existing hosts missing this objectclass would not be found by
host-find.

It is possible to get ethers data out of nss by configuring nsswitch.conf
to use ldap for ethers and running getent ethers <hostname>

I tested nslcd and it only returned one macaddress value.

https://fedorahosted.org/freeipa/ticket/1132
2012-01-26 14:11:33 +01:00
Martin Kosek
092dd8db12 Replace float with Decimal
Having float type as a base type for floating point parameters in
ipalib introduces several issues, e.g. problem with representation
or value comparison. Python language provides a Decimal type which
help overcome these issues.

This patch replaces a float type and Float parameter with a
decimal.Decimal type in Decimal parameter. A precision attribute
was added to Decimal parameter that can be used to limit a number
of decimal places in parameter representation. This approach fixes
a problem with API.txt validation where comparison of float values
may fail on different architectures due to float representation error.

In order to safely transfer the parameter value over RPC it is
being converted to string which is then converted back to
decimal.Decimal number on a server side.

https://fedorahosted.org/freeipa/ticket/2260
2012-01-20 08:13:44 +01:00
Martin Kosek
7f6c9ac04c Add missing --pkey-only option for selfservice and delegation
pkey-only functionality has to be implemented separately for these
modules as they are based on crud.Search instead of standard
LDAPSearch.

Delegation moduled was also fixed to support new format of ACI's
memberof attribute introduced in patch "Display the value of
memberOf ACIs in permission plugin."

https://fedorahosted.org/freeipa/ticket/2092
2012-01-16 20:08:13 +01:00
Alexander Bokovoy
1e04e9f029 Allow hbactest to work with HBAC rules exceeding default IPA limits
When multiple HBAC rules are defined, IPA default limits to retrieve
objects may limit the scope of HBAC testing. To allow full range of rules
to be tested support for --sizelimit option is added.

In addition, when --rules option is specified, make sure only those rules
are retrieved regardless total number of rules defined. This should also
speed up HBAC test performance for real life scenarios when few new rules
are added to large collection of rules.

https://fedorahosted.org/freeipa/ticket/2230
2012-01-13 18:22:57 +02:00
Martin Kosek
485c3bb897 Fix maxvalue in DNS plugin
Having a Parameter maxvalue larger that 2G makes Python convert it
to "long" type instead of "int" type. Our framework than fails to
bootstrap the API when it detects long integer in Parameter
maxvalue.

Remove the clashing maxvalue out entirely as we can't transfer
values larger than 2G anyway (xmlrpc limitation).

https://fedorahosted.org/freeipa/ticket/2082
2012-01-12 17:15:00 +01:00
Martin Kosek
a22620c832 Create per-type DNS API
Use new structured DNSRecord parameters to generate per-type API
for all supported DNS RR types. This should help significantly
the end-user with manipulating complex DNS record type (MX, LOC,
etc.).

All enhancements are integrated to current DNS record commands:

1) dnsrecord-add
  - Records can be either entered as a raw value (e.g. --mx-rec=
    "1 srv1.example.com" for MX record) or per-part:
    --mx-preference=1 --mx-exchanger=srv1.example.com
  - CLI interactive help behavior was changed. It will ask for
    a record type and then ask for all DNS record part values
    (e.g. MX Preference value, MX Exchanger value).

2) dnsrecord-mod
  - This command can now operate in 2 modes. When only a raw DNS
    record is entered (e.g. --mx-rec="1 srv1.example.com") it
    operates in standard mode and replaces any previous mxrecord
    value with the --mx-rec value.

    When any structured parameter (e.g. --mx-preference) is passed
    it modifies just the specified parts of one mxrecord value
    referred by --mx-rec:
      --mx-rec="1 srv1.example.com" --mx-preference=2
  - New interactive help has been implemented. It will ask for a
    record to be modified (in the same manner as dnsrecord-del)
    and then let user change DNS record part(s) for chosen
    records.

3) All dnsrecord-* commands have now --structured option
  - When this option is passed, instead of displaying raw DNS values
    all DNS records are parsed and displayed per-part. Example:

$ ipa dnsrecord-show example.com @ --structured
  Record name: @
  Records:
    Record type: MX
    Record data: 0 server1.example.com.
    MX Preference: 0
    MX Exchanger: server1.example.com.

    Record type: NS
    Record data: ns1.example.com.
    NS Hostname: ns1.example.com.

All API changes are compatible with clients without this patch.

https://fedorahosted.org/freeipa/ticket/2082
2012-01-12 09:44:00 +01:00
Martin Kosek
52ea3a6b29 Refactor dnsrecord processing
Current DNS record processing architecture has many flaws,
including custom execute() methods which does not take advantage
of base LDAP commands or nonstandard and confusing DNS record
option processing.

This patch refactors DNS record processing with the following
improvements:
 * Every DNS record has now own Parameter type. Each DNS record
   consists from one or more "parts" which are also Parameters.
   This architecture will enable much easier implementation of
   future per-DNS-type API.
 * Validation is now not written as a separate function for
   every parameter but is delegated to DNS record parts.
 * Normalization is also delegated to DNS record parts.
 * Since standard LDAP base commands execute method is now used,
   dnsrecord-add and dnsrecord-mod correctly supports --setattr
   and --addattr options.
 * In order to prevent confusion unsupported DNS record types
   are now hidden. They are still present in the plugin so that
   old clients receive proper validation error.

The patch also contains several fixes:
 * Fix domain-name validation and normalization- allow domain
   names that are not fully qualified. For example --cname-rec=bar
   is a valid domain-name for bind which will translate it then
   as bar.<owning-domain>. This change implies, that fully qualified
   domain names must end with '.'.
 * Do not let user accidentally remove entire zone with command
   "ipa dnsrecord-del @ --del-all".
 * Fix --ttl and --class option processing in dnsrecord-add and
   dnsrecord-mod.

All API changes are compatible with clients without this patch.

https://fedorahosted.org/freeipa/ticket/2082
2012-01-12 09:43:05 +01:00
Ondrej Hamada
0e037f24ce HBAC test optional sourcehost option
New version of SSSD begins ignoring sourcehost value of HBAC rules by
default. In order to match this behaviour the sourcehost option in
hbactest is optional now, but the value of sourcehost is ignored in all
rules. Every rule's sourcehost value is set to 'ALL' what turns sourchost
value comparation off. If srchost option is used, warning is displayed to
inform the user about changes. Text of plugin help was also updated.

Also the unit tests for hbactest plugin were updated. Every test was
doubled. The second ones test the plugin without sourcehost option. They
are supposed to have the same result.

https://fedorahosted.org/freeipa/ticket/2085
2012-01-09 08:49:10 +02:00
Ondrej Hamada
da4b4fc4d9 User-add random password support
I've used code from ipalib/plugins/host.py to add support for random
password generation. The '--random' option is now available in user-add
and user-mod commands. If both the 'password' and 'random' options are
used the 'random' option will be ignored.

Two test cases were added to unit test's module test_user_plugin.py -
they test creating and modifying user with random password. Two fuzzy tests
were added: test for password(string that doesn't start or end with
whitespace and doesn't containt other whitespace than ' ') and for whatever
string(because of krbextradata).

I've slightly modified ipa_generate_password in order to make passwords for
users more user-friendly(reduce number of non-letters). It has two optional
parameters now - first one is string of characters that should be used for
generating the passwd and second one is length of password. If none
parameter is set default values will be used so there's no need to modify
other plugins that use random password generator.

https://fedorahosted.org/freeipa/ticket/1979
2011-12-12 00:17:07 -05:00
Rob Crittenden
55512dc938 Add SELinux user mapping framework.
This will allow one to define what SELinux context a given user gets
on a given machine. A rule can contain a set of users and hosts or it
can point to an existing HBAC rule that defines them.

https://fedorahosted.org/freeipa/ticket/755
2011-12-09 16:46:25 +02:00
Endi S. Dewata
8f642bbe08 Added commands into metadata.
The json_metadata command has been modified to accept some new
options and return the commands metadata. The API.txt has been
updated as well. The UI has been modified to use commands metadata
instead of methods metadata.

Ticket #388
2011-12-06 22:07:35 +00:00
Rob Crittenden
181e6da9d8 Mark some attributes required to match the schema.
This makes no changes to the functionality in the command-line or
GUI because these all have defaults anyway. This is mostly to show
them properly in the UI and prevent someone from trying to erase the
value (and getting a nasty schema error in response).

https://fedorahosted.org/freeipa/ticket/2015
2011-12-05 22:29:02 -05:00
Jan Cholasta
135ccf89de Parse comma-separated lists of values in all parameter types. This can be enabled for a specific parameter by setting the "csv" option to True.
Remove "List" parameter type and replace all occurences of it with appropriate
multi-valued parameter ("Str" in most cases) with csv enabled.

Add new parameter type "Any", capable of holding values of any type. This is
needed by the "batch" command, as "Str" is not suitable type for the "methods"
parameter.

ticket 2007
2011-11-30 17:08:35 +01:00
Martin Kosek
1b0b9645d1 Add --delattr option to complement --setattr/--addattr
Add a --delattr option to round out multi-valued attribute
manipulation. The new option is available for all LDAPUpdate based
commands. --delattr is evaluated last, it can remove any value
present either in --addattr/--setattr option or in current LDAP
object.

--*attr processing was completely refactored and placed to one
independent function available for all baseldap commands. For this
purpose a missing common base class for all baseldap commands has
been implemented. The new class should serve not only for --*attr
processing but also for other common baseldap methods and
attributes.

This approach will also benefit other custom commands based neither
on LDAPCreate nor LDAPUpdate. They can easily integrate --*attr
option processing when needed.

https://fedorahosted.org/freeipa/ticket/1929
2011-11-29 10:08:28 +01:00
Martin Kosek
16b18135d9 Remove redundant information from API.txt
Some Param or Output attributes do not cause API incompatibility
(e.g. doc, label or callables) and does not need to be included
in API.txt. When these attributes are modified, a lot of bogus
changes may get in API.txt - making the real API changes less
detectable.

https://fedorahosted.org/freeipa/ticket/2107
2011-11-15 18:35:28 +01:00
Martin Kosek
2a3a4ae64a Fix LDAP object parameter encoding
Parameters in LDAP objects missed an information if they are real
LDAP attributes or not. Real LDAP attributes are written to
entry_attrs dictionary in plugin callbacks and are being encoded.
This causes issues when plugin callbacks does not expect that
the parameters values are already encoded for submission to LDAP.

This patch introduces a new flag "noattribute" used to mark that
a parameter is not an LDAP attribute and thus should not be encoded
or added to entry_attrs. Param documentation is improved to describe
the meaning of this and other Param flags or attributes.

https://fedorahosted.org/freeipa/ticket/2097
2011-11-15 13:17:44 +01:00
Martin Kosek
0f34e0bf82 Fix API.txt
Fix a post-makeapi change in one option's label in commit
62c110a3b8

https://fedorahosted.org/freeipa/ticket/1906
2011-11-14 10:26:23 +01:00
Martin Kosek
62c110a3b8 Polish ipa config help
Remove config-mod options help from config module help to keep the
option doc on one place and without unnecessary redundancy. The new
format is more consistent with the rest of the plugins. Also fix
several inconsistencies in the labels/doc, including:
- using abbreviation when not needed
- using '.' at the end of options help

https://fedorahosted.org/freeipa/ticket/1906
2011-11-10 20:18:40 -05:00
Martin Kosek
efc3e2c1f7 Improve DNS record data validation
Implement missing validators for DNS RR types so that we can capture
at least basic user errors. Additionally, a normalizer creating
a fully-qualified domain name has been implemented for several RRs
where name server may mis-interpret the domain name otherwise.

Unit tests exercising these new validators for the most common
RR types have been added. This patch also consolidates hard-coded
values in DNS test to one place.

https://fedorahosted.org/freeipa/ticket/1106
2011-11-10 18:48:41 -05:00
Martin Kosek
843c0787b7 Fix DNS zone --allow-dynupdate option behavior
--allow-dynupdate was implemented as a Flag parameter type, which
is not convenient for LDAP attributes. When a DNS zone with
permitted dynamic updates was modified and the --allow-dynupdate
flag was not set, dynamic updates were turned off.

This patch changes the option type to Bool parameter type which
behaves according to user expectations when modifying the zone.

https://fedorahosted.org/freeipa/ticket/2039
2011-11-09 15:31:50 +01:00
Martin Kosek
a486f49a37 Create pkey-only option for find commands
New option --pkey-only is available for all LDAPSearch based classes
with primary key visible in the output. This option makes LDAPSearch
commands search for primary attribute only.

This may be useful when manipulating large data sets. User can at
first retrieve all primary keys in a relatively small data package
and then run further commands with retrieved primary keys.

https://fedorahosted.org/freeipa/ticket/1262
2011-10-27 14:17:51 +00:00
Martin Kosek
b26d0dcc04 Add --zonemgr/--admin-mail validator
Do at least a basic validation of DNS zone manager mail address.

Do not require '@' to be in the mail address as the SOA record
stores this value without it and people may be used to configure
it that way. '@' is always removed by the installer/dns plugin before
the DNS zone is created.

https://fedorahosted.org/freeipa/ticket/1966
2011-10-26 08:52:50 +02:00
Martin Kosek
2aa63fe4a9 Improve handling of GIDs when migrating groups
Since IPA v2 server already contain predefined groups that may collide
with groups in migrated (IPA v1) server (for example admins, ipausers),
users having colliding group as their primary group may happen to belong
to an unknown group on new IPA v2 server.

Implement --group-overwrite-gid option to overwrite GID of already
existing groups to prevent this issue.

https://fedorahosted.org/freeipa/ticket/1866
2011-10-11 23:24:00 -04:00
Rob Crittenden
bd227b3562 Require current password when using passwd to change your own password.
Add a new required parameter, current_password. In order to ask this
first I added a new parameter option, sortorder. The lower the value the
earlier it will be prompted for.

I also changed the way autofill works. It will attempt to get the default
and if it doesn't get anything will continue prompting interactively.

Since current_password is required I'm passing a magic value that
means changing someone else's password. We need to pass something
since current_password is required.

The python-ldap passwd command doesn't seem to use the old password at
all so I do a simple bind to validate it.

https://fedorahosted.org/freeipa/ticket/1808
2011-10-04 15:16:15 +02:00
Rob Crittenden
8cf8870d3d Add regular expression pattern to host names.
Limit hostnames to letters, digits and - with a maximum length of 255

https://fedorahosted.org/freeipa/ticket/1780
2011-09-27 16:08:26 +02:00
Rob Crittenden
a1430dcb2c Normalize uid in user principal to lower-case and do validation
Use same normalization and validation in passwd plugin and add some
tests for invalid principals

https://fedorahosted.org/freeipa/ticket/1778
2011-09-22 15:41:19 +02:00
Rob Crittenden
29ec63c381 Skip the cert validator if the csr we are passed in is a valid filename
The validator will still fire, just after the load_files() call. Basically
it will hit the validator twice. The first time it will exit because the
value of csr is a filename. The second time it will run the validator against
the contents of the file.

ticket https://fedorahosted.org/freeipa/ticket/1777
2011-09-14 18:27:05 +02:00
Rob Crittenden
5ddc027d7f Remove normalizer that made role, privilege and permission names lower-case
https://fedorahosted.org/freeipa/ticket/1747
2011-09-12 16:51:25 -04:00
Jr Aquino
d05ace8fba 34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin
Added new container in etc to hold the automembership configs.
Modified constants to point to the new container
Modified dsinstance to create the container
Created automember.py to add the new commands
Added xmlrpc test to verify functionality
Added minor fix to user.py for constant behavior between memberof
and automember

https://fedorahosted.org/freeipa/ticket/1272
2011-08-31 09:49:43 +02:00
Rob Crittenden
e52f652873 Add netgroup as possible memberOf for hostgroups
https://fedorahosted.org/freeipa/ticket/1563
2011-08-29 21:29:16 -04:00
Rob Crittenden
1936b8050e Add option to only prompt once for passwords, use in entitle_register
A Password param always prompted to confirm the entered password.
This doesn't make sense if you want to prompt for a password to another
system like we do with entitlements. This adds a new boolean option to
control the Password prompt parameter.

https://fedorahosted.org/freeipa/ticket/1695
2011-08-24 15:25:53 -04:00
Martin Kosek
d28f1c3b7c Fix automountkey-mod
Fix automountkey-mod so that automountkey attribute is correctly
updated. Add this test case to the unit tests.

Make automountkey required for automountkey-mod, otherwise it would
cause internal server error.

Make --newinfo optional so that automountkey may be just renamed
without changing its info attribute.

https://fedorahosted.org/freeipa/ticket/1528
2011-08-18 20:35:12 -04:00
Martin Kosek
07837082f4 Hide continue option from automountkey-del
This option makes no sense for automount keys. This should be
removed in future versions.

https://fedorahosted.org/freeipa/ticket/1529
2011-08-02 02:16:54 -04:00
Rob Crittenden
d8c479731e Deprecated managing users and runas user/group in sudorule add/mod
We have helpers to manage these values so they shouldn't be available
via add/mod. There is no logic behind them to do the right thing.

https://fedorahosted.org/freeipa/ticket/1307
https://fedorahosted.org/freeipa/ticket/1320
2011-07-29 15:40:01 +02:00
Alexander Bokovoy
dd296eec13 Add hbactest command. https://fedorahosted.org/freeipa/ticket/386
HBAC rules control who can access what services on what hosts and from where.
You can use HBAC to control which users or groups on a source host can
access a service, or group of services, on a target host.

Since applying HBAC rules implies use of a production environment,
this plugin aims to provide simulation of HBAC rules evaluation without
having access to the production environment.

 Test user coming from source host to a service on a named host against
 existing enabled rules.

 ipa hbactest --user= --srchost= --host= --service=
              [--rules=rules-list] [--nodetail] [--enabled] [--disabled]

 --user, --srchost, --host, and --service are mandatory, others are optional.

 If --rules is specified simulate enabling of the specified rules and test
 the login of the user using only these rules.

 If --enabled is specified, all enabled HBAC rules will be added to simulation

 If --disabled is specified, all disabled HBAC rules will be added to simulation

 If --nodetail is specified, do not return information about rules matched/not matched.

 If both --rules and --enabled are specified, apply simulation to --rules _and_
 all IPA enabled rules.

 If no --rules specified, simulation is run against all IPA enabled rules.

EXAMPLES:

    1. Use all enabled HBAC rules in IPA database to simulate:
    $ ipa  hbactest --user=a1a --srchost=foo --host=bar --service=ssh
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      matched: allow_all

    2. Disable detailed summary of how rules were applied:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail
    --------------------
    Access granted: True
    --------------------

    3. Test explicitly specified HBAC rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule
    ---------------------
    Access granted: False
    ---------------------
      notmatched: my-second-rule
      notmatched: myrule

    4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      matched: allow_all

    5. Test all disabled HBAC rules in IPA database:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled
    ---------------------
    Access granted: False
    ---------------------
      notmatched: new-rule

    6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled
    ---------------------
    Access granted: False
    ---------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule

    7. Test all (enabled and disabled) HBAC rules in IPA database:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      notmatched: new-rule
      matched: allow_all

Only rules existing in IPA database are tested. They may be in enabled or
disabled disabled state.

Specifying them through --rules option explicitly enables them only in
simulation run.

Specifying non-existing rules will not grant access and report non-existing
rules in output.
2011-07-28 18:01:44 -04:00
Rob Crittenden
abb5ee22d2 Autofill the default revocation reason
https://fedorahosted.org/freeipa/ticket/1514
2011-07-22 08:57:31 +02:00
Rob Crittenden
506cbaa1fb Hide the HBAC access type attribute now that deny is deprecated.
It won't appear in the UI/CLI but is still available via XML-RPC.
allow is the default and deny will be rejected.

https://fedorahosted.org/freeipa/ticket/1495
2011-07-21 01:11:45 -04:00
Jan Cholasta
b203756a88 Add ability to specify DNS reverse zone name by IP network address.
In order for this to work, chaining of parameters through
default_from is made possible.

ticket 1474
2011-07-15 02:21:23 -04:00
Rob Crittenden
bea7818add Remove the ability to create new HBAC deny rules.
New rules will all be allow type. Existing rules cannot be changed to
deny.

The type attribute now defaults to allow with autofill so it won't be
prompted in interactive mode in the cli.

https://fedorahosted.org/freeipa/ticket/1432
2011-07-14 19:23:17 -04:00
Rob Crittenden
9dfdf55034 In sudo labels we should use RunAs and not Run As.
https://fedorahosted.org/freeipa/ticket/1328
2011-07-14 19:18:02 -04:00
Martin Kosek
0cb65fd9f6 Filter reverse zones in dnszone-find
Implements a new option to filter out reverse zones.

This patch also do some clean up in dns plugin - debug prints were
accidentally left here in the last dns patch.

https://fedorahosted.org/freeipa/ticket/1471
2011-07-13 15:06:13 +02:00
Endi S. Dewata
b2c5b2b4b5 Fixed object_name and object_name_plural internationalization
The object_name, object_name_plural and messages that use these
attributes have been converted to support translation. The label
attribute in the Param class has been modified to accept unicode
string.

Ticket #1435
2011-07-12 16:33:08 -04:00
Martin Kosek
e6c68e9993 Add DNS record modification command
The DNS record plugin does not support modification of a record. One
can only add A type addresses to a DNS record or remove the current
ones. To actually change a DNS record value it has to be removed and
then added with a desired value.

This patch adds a new DNS plugin command "dnsrecord-mod" which enables
user to:
 - modify a DNS record value (note than DNS record can hold multiple values
   and those will be overwritten)
 - remove a DNS record when an empty value is passed

New tests for this new command have been added to the CLI test suite.

https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 14:20:16 -04:00
Rob Crittenden
3a5e26a01c Enforce class rules when query=True, continue to not run validators.
This started as a problem in allowing leading/trailing whitespaces
on primary keys. In nearly every command other than add query is True
so all rules were ignored on the primary key. This meant that to
enforce whitespace we would need to define a validator for each one.

I decided instead to set self.all_rules to just the class rules if
query == True. So the minimum set of validators will be executed
against each type but param-specific validators will only run on add.

https://fedorahosted.org/freeipa/ticket/1285
https://fedorahosted.org/freeipa/ticket/1286
https://fedorahosted.org/freeipa/ticket/1287
2011-07-11 18:43:32 -04:00
Adam Young
a38ad1d433 password expiration label 2011-07-05 18:00:05 -04:00
Endi S. Dewata
6083df1b02 Fixed object_name usage.
The object_name attribute was used as both an identifier and a
label which sometimes require different values (e.g. hbacrule
vs. HBAC rule). The code that uses object_name as an identifier
has been changed to use the 'name' attribute instead. The values
of the object_name attribute have been fixed to become proper
labels.

Ticket #1217
2011-07-05 16:19:10 -04:00
Adam Young
9d8ddb5d46 config widgets entity select default group checkbox for migration 2011-06-30 22:26:19 -04:00
Jan Cholasta
67b807d640 Replace the 'private' option in netgroup-find with 'managed'.
The 'private' option is kept in to maintain API compatibility, but
is hidden from the user.

ticket 1120
2011-06-28 01:57:11 -04:00
Adam Young
eeed975bc6 ipaddress for host add
updated label triggered an API change
2011-06-20 20:53:15 -04:00
Jr Aquino
44cdf8ef54 Raise DuplicateEntry Error when adding a duplicate sudo option
https://fedorahosted.org/freeipa/ticket/1276
https://fedorahosted.org/freeipa/ticket/1277
https://fedorahosted.org/freeipa/ticket/1308

Added new Exception: AttrValueNotFound
Fixed XML Test for Sudorule remove_option
1276 (Raise AttrValueNotFound when trying to remove a non-existent option from Sudo rule)
1277 (Raise DuplicateEntry Error when adding a duplicate sudo option)
1308 (Make sudooption a required option for sudorule_remove_option)
2011-06-16 19:21:07 -04:00
Martin Kosek
058e3d0306 Add ignore lists to migrate-ds command
When user migrates users/groups from an old DS instance, the
migration may fail on unsupported object classes and/or
relevant LDAP object attributes.

This patch implements a support for object class and attribute
ignore lists that can be used to suppress these migration issues.

Additionally, a redundant "dev/null" file is removed from git repo
(originally added in 26b0e8fc98).

https://fedorahosted.org/freeipa/ticket/1266
2011-06-15 08:36:32 +02:00
Rob Crittenden
bee4e6a85a Remove automountinformation as part of the DN for automount.
To support multiple direct maps we added description to the DN of
automount key entries. The downside of this is that to display a key
you had to know the information as well, which was rather pointless if
that is what you were trying to get.

So now both modes are supported. It will first look for just a key
in the description and fall back to including automountinformation
if it needs to.

Multiple direct maps are still supported and for those the info is
always required.

ticket 1229
2011-06-13 22:59:27 -04:00
Jr Aquino
d7c60205a6 Add sudorule and hbacrule to memberof and indirectmemberof attributes
Add Add tests for users, groups, hosts and hostgroups to verify membership

Update API to version 2.3

https://fedorahosted.org/freeipa/ticket/1170
2011-06-06 13:14:38 -04:00
Rob Crittenden
e91aa64d4a Include the word 'member' with autogenerated optional member labels.
There were reports of confusion over what was being prompted for, hopefully
adding member will make things clearer.

ticket 1062
2011-05-27 13:54:31 -04:00
Martin Kosek
dea578a357 A new flag to disable creation of UPG
Automatic creation may of User Private Groups (UPG) may not be
wanted at all times. This patch adds a new flag --noprivate to
ipa user-add command to disable it.

https://fedorahosted.org/freeipa/ticket/1131
2011-05-25 08:39:47 +02:00
Martin Kosek
72b56e4630 Remove doc from API.txt
Doc parts are not removed from the API completely. This leads to
unnecessary updates to API.txt when the option/argument documentation
is changed.

This patch replaces unreliable doc stripping function with a regular
expression. It works for all current doc strings (simple string or
GetText). The only limitation is that the RE supports only up to
2 levels of nested parentheses in doc string.

https://fedorahosted.org/freeipa/ticket/1057
2011-05-13 13:06:37 +02:00
Martin Kosek
bc6f9accd9 Need force option in DNS zone adder dialog
When adding a new DNS zone in the WebUI, IPA server will verify
whether the nameserver is in DNS. Sometimes it is necessary to
skip the verification.

This patch adds a --force option already available in CLI which
can skip this the verification.

https://fedorahosted.org/freeipa/ticket/1105
2011-04-21 19:03:38 +00:00
Rob Crittenden
740416c8fb Always ask members in LDAP*ReverseMember commands.
This changes the API but alwaysask is enforced on the client only
so doesn't change the wire API so I'm not updating the API version.

ticket 1081
2011-04-15 13:12:16 +02:00
Martin Kosek
c2350e756a Revert "Remove doc from API.txt"
This commit accidentaly slipped in (it was not ready for the
upstream).

This reverts commit 9915b93737.
2011-04-08 15:54:59 +02:00
Martin Kosek
9915b93737 Remove doc from API.txt
Doc parts are not removed from the API completely. This leads to
unnecessary updates to API.txt when the option/argument documentation
is changed.

This patch replaces unreliable doc stripping function with a regular
expression. It works for all current doc strings (simple string or
GetText). The only limitation is that the RE supports only up to
2 levels of nested parentheses in doc string.

https://fedorahosted.org/freeipa/ticket/1057
2011-04-08 09:27:00 +02:00
Rob Crittenden
316efbc32f postalCode should be a string not an integer.
postalCode is defined as an Int. This means you can't define one that has
a leading zero nor can you have dashes, letters, etc.

This changes the data type on the server. It will still accept an int
value if provided and convert it into a string.

Bump the API version to 2.1.

ticket 1150
2011-04-05 21:51:34 -04:00
Rob Crittenden
deaf029023 Change default gecos from uid to first and last name.
ticket 1146
2011-04-05 14:18:55 -04:00
Rob Crittenden
c6ee105ec1 Update API to reflect doc change in force parameter in dnszone_add 2011-03-04 13:23:07 -05:00
Rob Crittenden
4d0e739345 Fix style and grammatical issues in built-in command help.
There is a rather large API.txt change but it is only due to changes
in the doc string in parameters.

ticket 729
2011-03-04 11:09:43 -05:00
Adam Young
cd61ef61ad update API.txt 2011-03-02 12:39:31 -05:00
Rob Crittenden
d57dfc4e98 Sudo command groups are not supposed to allow nesting.
It was a design decision to not allow nesting sudo command groups,
remove it.

ticket 1004
2011-02-23 18:44:28 -05:00
Jakub Hrozek
6e7815a30e Validate NAPTR records
https://fedorahosted.org/freeipa/ticket/840
2011-02-22 09:08:11 -05:00
Jakub Hrozek
18be4ebec3 Better doc for idnssoaminimum 2011-02-18 15:36:07 -05:00
Endi S. Dewata
e245b6da9b Updated json_metadata and i18n_messages.
The json_metadata() has been updated to return ipa.Objects and
ipa.Methods. The i18n_messages() has been updated to include other
messages that are not available from the metadata.
2011-02-18 10:10:35 -05:00
Endi S. Dewata
fa75959486 Fixed parameter for user city.
Previously the user's city parameter is defined to use the 'locality'
attribute. This was a problem because the attribute would be returned
as 'l' by the directory server causing a mismatch. Now the parameter
has been changed to use the 'l' attribute.
2011-02-18 10:10:35 -05:00
Jakub Hrozek
36070555d1 Validate and convert certificate SN
The cert plugin only worked OK with decimal certificate serial numbers.
This patch allows specifying the serial number in hexadecimal, too. The
conversion now works such that:
 * with no explicit radix, a best-effort conversion is done using int(str,
   0) in python. If the format is ambiguous, decimal takes precedence.
 * a hexadecimal radix can be specified explicitly with the traditional
   0x prefix

https://fedorahosted.org/freeipa/ticket/958
https://fedorahosted.org/freeipa/ticket/953
2011-02-16 22:04:44 -05:00
Jr Aquino
d781dbd045 17-2 Managed netgroups should be invisible https://fedorahosted.org/freeipa/ticket/963 2011-02-16 17:52:21 -05:00
Martin Kosek
e5d57d237b HBAC plugin inconsistent output
This patch adds a proper summary text to HBAC command which is
then printed out in CLI. Now, HBAC plugin output is consistent
with other plugins.

https://fedorahosted.org/freeipa/ticket/596
2011-02-16 10:39:16 -05:00
Jakub Hrozek
a9dc175bc5 Validate MX records
https://fedorahosted.org/freeipa/ticket/967
2011-02-16 09:56:29 -05:00
Endi S. Dewata
eb8f091c9b Fixed association facets.
The association config has been removed because it incorrectly assumes there is only one association between two entities. Now each association is defined separately using association facets.

The service.py has been modified to specify the correct relationships. The API.txt has been updated.

https://fedorahosted.org/freeipa/ticket/960
2011-02-15 17:45:46 -05:00
Rob Crittenden
edcdd87bc8 A privilege cannot be a member of a permission, remove it from metadata
ticket 970
2011-02-15 13:39:49 -05:00
Rob Crittenden
dab452442d The --out option wasn't working at all with cert-show.
Also fix some related problems in write_certificate(), handle
either a DER or base64-formatted incoming certificate and don't
explode if the filename is None.

ticket 954
2011-02-14 16:43:48 -05:00
Jakub Hrozek
04597f4e36 Remove obsolete record types from DNS
https://fedorahosted.org/freeipa/ticket/923
2011-02-14 14:50:57 -05:00
Rob Crittenden
779f8da2f0 API fix for dns -> dnsrecord change in permission plugin 2011-02-14 11:48:12 -05:00
Rob Crittenden
456101bd29 Update API.txt with updated usercertificate in service-find 2011-02-10 14:51:39 -05:00
Rob Crittenden
121da04579 Add the entitlement API to API.txt
It was missed because the whole module was skipped if python-rhsm wasn't
loaded.

ticket 919
2011-02-10 11:16:58 -05:00
Pavel Zuna
ab7e702487 Set minimum for Kerberos policy max life and max renew.
Fix #847
2011-02-10 11:16:57 -05:00
Rob Crittenden
0188158a76 Use correct LDAP attributes for city and state.
Also add a unit test for address.

Ticket 889
2011-02-02 16:53:32 -05:00
Martin Kosek
0353a2be67 Typos in freeIPA messages
This patch fixes several reported typos in IPA messages and
in comments.

Contributors file has been updated + the original author of the
patch reporting the typos was added.

https://fedorahosted.org/freeipa/ticket/848
2011-02-02 15:38:50 -05:00
Jakub Hrozek
0dce1bc9e1 Add an address for a nameserver when a new zone is created during install
https://fedorahosted.org/freeipa/ticket/881
2011-01-31 22:15:45 -05:00
Rob Crittenden
bf4f77d985 Rename permissions and privileges to be more readable.
This also drops description from permissions since it seems redundant and
fixes up the help text a little.

ticket 792
2011-01-31 13:17:38 -05:00
Jakub Hrozek
92c57946e1 Fix API.txt 2011-01-28 11:44:38 -05:00
Jakub Hrozek
0a6b1c4bce Enforce that all NS records are resolvable
Bind cannot load a zone if any of its name server records is not
resolvable.

https://fedorahosted.org/freeipa/ticket/838
2011-01-28 11:44:38 -05:00
Jakub Hrozek
682ca8658a Add example of DNS SRV record and a simple validator
https://fedorahosted.org/freeipa/ticket/846
2011-01-28 11:44:38 -05:00
Jakub Hrozek
a641f1f23d Delete the whole DNS record with no parameters
Error out when deleting a nonexistent DNS record

Also fixes the DNS unit tests.

https://fedorahosted.org/freeipa/ticket/816
https://fedorahosted.org/freeipa/ticket/829
2011-01-28 11:44:38 -05:00
Jan Zeleny
884f43f0db Add support for account unlocking
This patch adds command ipa user-unlock and some LDAP modifications
which are required by Kerberos for unlocking to work.

Ticket:
https://fedorahosted.org/freeipa/ticket/344
2011-01-28 10:23:02 -05:00
Adam Young
b871b90ef0 api version update 2011-01-26 10:12:04 -05:00
Jakub Hrozek
70a9e04f04 Enforce uniqueness on (key,info) pairs in automount keys
https://fedorahosted.org/freeipa/ticket/293
2011-01-25 11:13:10 -05:00
Endi S. Dewata
9319385c7e Removed 'name' from 'Sudo Command Group name'. 2011-01-24 13:33:00 -05:00
Rob Crittenden
8cc46af050 Remove del-all from dnsrecord_del from API.txt
This was from an unpushed patch I had in my tree.
2011-01-21 16:03:22 -05:00
Rob Crittenden
5f0c52ab97 Add new option to dns_del and always ask permission options to API.txt 2011-01-21 15:13:58 -05:00
Simo Sorce
835436df15 Provide API to check if IPA DNS is enabled on some server
Fixes: https://fedorahosted.org/freeipa/ticket/600
2011-01-19 20:23:42 -05:00
Adam Young
cbd121333a update API removal of idnssoamaximum from dns APIs broke the build. THis fixes it. 2011-01-18 14:43:19 -05:00
Simo Sorce
f8c7afd15c Remove old DNS plugin commands from API validation 2011-01-14 17:26:48 -05:00
Simo Sorce
81311a9f4e Fix API validation 2011-01-14 15:42:40 -05:00
Rob Crittenden
c69d8084c1 Add API version and have server reject incompatible clients.
This patch contains 2 parts.

The first part is a small utility to create and validate the current
API. To do this it needs to load ipalib which on a fresh system
introduces a few problems, namely that it relies on a python plugin
to set the default encoding to utf8. For our purposes we can skip that.
It is also important that any optional plugins be loadable so the
API can be examined.

The second part is a version exchange between the client and server.
The version has a major and a minor version. The major verion is
updated whenever existing API changes. The minor version is updated when
new API is added. A request will be rejected if either the major versions
don't match or if the client major version is higher than then server
major version (though by implication new API would return a command not
found if allowed to proceed).

To determine the API version of the server from a client use the ping
command.

ticket 584
2011-01-14 14:26:22 -05:00