Commit Graph

1991 Commits

Author SHA1 Message Date
Petr Vobornik
b4fc6f4ba8 Load updated Web UI files after server upgrade
Issue:
* There was no caching policy specified.
* -> Browsers use their own default policy.
* -> After upgrade, some Web UI files might have been actualized some not.
* -> With schema change may result into weird bugs in Web UI

Solution considerations:

1. Detect server version change and hard-reload at runtime
Detection is easy. Problem is the reload. Obvious candidate 'window.location.reload(true)' works in Firefox but not in Chrome because expected behavior when parameter is used is not in standard and therefore Chromium/WebKit authors did not implement it.

2. Application Cache
HTML 5 technology which lets web apps to run offline. Besides weird issues with event handlers which I encountered, this would be an ideal candidate. Simple change of manifest file would lead to reload of all files (requires reload of page to used the new files).

Showstopper was usage with untrusted certificate. If user did not add exception for the cert or its CA and would visit the page for a second time, all AJAX calls would fail.

3. Set Expires to now() for everything
Web UI rarely changes so this is an overkill. Setting it to different value is not a solution either. We can't predict when the upgrade will happen and when new Web UI will be needed.

Solution:
* Implemented a mini loader which loads basic resources. Dojo loader takes action after Dojo is loaded.
* The loader adds a version parameter (?v=__NUM_VERSION__) to all requests.
* Version is defined in the loader. It's set to current in `make version-update`.
* All static pages use this loader to fetch their resources.
* Version is also passed to dojo loader as cache-bust for the same effect.
* Expire header was set to 'access time plus 1 year' for /ui folder. Exceptions are HTML files and loader (set to immediate expiration).

Possible issues:
* Images are cached but not requested with version param.
  * Images with version and without are considered different
  * -> We would have to attach version to all URIs - in CSS and in JS. But we should avoid changing jQuery UI CSS.
  * Proposed solution is to change image name when changing image. Image change is done rarely.
* Version is set by build and therefore updated just on server update. It might cause trouble with different update schedule of plugins.
  * No action taken to address this issue yet.
  * We might leave it on plugin devs (own .conf in /etc/httpd/conf.d/)
  * or set expires to now for all plugins
* running `make version-update` is required in order to use static version of UI for testing

https://fedorahosted.org/freeipa/ticket/3798
2013-10-16 18:06:30 +02:00
Tomas Babej
d769b124b0 adtrustinstance: Properly handle uninstall of AD trust instance
The uninstall method of the AD trust instance was not called upon
at all in the ipa-server-install --uninstall phase.

This patch makes sure that AD trust instance is unconfigured when
the server is uninstalled.

The following steps are undertaken:
  * Remove /var/run/samba/krb5cc_samba
  * Remove our keys from /etc/samba/samba.keytab using ipa-rmkeytab
  * Remove /var/lib/samba/*.tdb files

Additionally, we make sure winbind service is stopped from within the
stop() method.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Tomas Babej
45e310ecc4 ipa-adtrust-install: Add warning that we will break existing samba configuration
In case /etc/samba/smb.conf exists and it was not created by ipa-adtrust-install,
print a warning that we will break existing samba configuration and ask for
a confirmation in the interactive mode.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Tomas Babej
4a95a50596 ipa-upgradeconfig: Remove backed up smb.conf
Since we are not able to properly restore the Samba server to the
working state after running ipa-adtrust-install, we should not keep
the smb.conf in the fstore.

This patch makes sure that any backed up smb.conf is removed from
the backup and that this file is not backed up anymore.

Part of: https://fedorahosted.org/freeipa/ticket/3479
2013-10-14 11:11:17 +02:00
Martin Kosek
dfa135e606 Winsync re-initialize should not run memberOf fixup task
Change re-initialize command to consider memberOf fixup task only
for non-winsync replication agreements.

https://fedorahosted.org/freeipa/ticket/3854
2013-10-11 10:08:21 +02:00
Martin Kosek
cb9331ebfc Remove --no-serial-autoincrement
Deprecate this option and do not offer it in installation tools.
Without this option enabled, advanced DNS features like DNSSEC
would not work.

https://fedorahosted.org/freeipa/ticket/3962
2013-10-11 09:47:59 +02:00
Martin Kosek
1480cf1603 Do not allow '%' in DM password
Having '%' in DM password causes pkispawn to crash. Do not allow
users to enter it until pkispawn is fixed.

https://bugzilla.redhat.com/show_bug.cgi?id=953488
2013-10-04 17:41:20 +02:00
Petr Viktorin
321e8635ae Update translations from Transifex 2013-10-04 14:51:19 +02:00
Martin Kosek
b1451373c4 Remove faulty DNS memberOf Task
This task was added with a DN colliding with privilege update memberOf
task being run later and caused this task to be ineffective and thus
miss some privilege membership, like "SELinux User Map Administrators"

DNS update plugin do not need to run any task at all as privileges
will be updated later in scope of 55-pbacmemberof.update

https://fedorahosted.org/freeipa/ticket/3877
2013-10-04 14:30:13 +02:00
Jan Cholasta
194556beb0 Allow PKCS#12 files with empty password in install tools.
https://fedorahosted.org/freeipa/ticket/3897
2013-10-04 10:27:23 +02:00
Jan Cholasta
c123264ac7 Read passwords from stdin when importing PKCS#12 files with pk12util.
This works around pk12util refusing to use empty password files, which prevents
the use of PKCS#12 files with empty password.

https://fedorahosted.org/freeipa/ticket/3897
2013-10-04 10:27:23 +02:00
Tomas Babej
bae291def7 Warn user about realm-domain mismatch in install scripts
If the IPA server is setup with non-matching domain and realm
names, it will not be able to estabilish trust with the Active
Directory.

Adds warnings to the ipa-server-install and warning to the
ipa-adtrust-install (which has to be confirmed).

Man pages for the ipa-server-install and ipa-adtrust-install were
updated with the relevant notes.

https://fedorahosted.org/freeipa/ticket/3924
2013-10-03 12:02:44 +02:00
Petr Vobornik
6a124160a5 Fix enablement of automount map type selector
Map type radio used old way of defining that its value should not be used in add command.  Recent patch related to 'enable' attribute hardened/fixed the behavior of radio widgets so they are disabled in UI as well when enabled==false. Automount did not reflect this change.

https://fedorahosted.org/freeipa/ticket/3954
2013-10-03 09:13:45 +02:00
Petr Vobornik
edf0719409 Allow edit of ipakrbokasdelegate in Web UI when attrlevelrights are unknown
Old host entries are missing object class with krbticketflags attribute. Therefore UI does not receive attrlevelrights for it. This OC is added when ipakrbokasdelegate is set.

This patch adds the usual hack for such cases.

https://fedorahosted.org/freeipa/ticket/3940
2013-09-26 10:24:14 +02:00
Alexander Bokovoy
9cf8ec79c9 ipa-sam: do not modify objectclass when trust object already created
When trust is established, last step done by IPA framework is to set
encryption types associated with the trust. This operation fails due
to ipa-sam attempting to modify object classes in trust object entry
which is not allowed by ACI.

Additionally, wrong handle was used by dcerpc.py code when executing
SetInformationTrustedDomain() against IPA smbd which prevented even to
reach the point where ipa-sam would be asked to modify the trust object.
2013-09-20 09:59:02 +02:00
Petr Vobornik
5c4a72de59 Fix redirection on deletion of last dns record entry
https://fedorahosted.org/freeipa/ticket/3907
2013-09-16 13:56:25 +02:00
Jan Cholasta
e380acdc1c Fix nsslapdPlugin object class after initial replication.
This is a workaround for <https://fedorahosted.org/389/ticket/47490>.

https://fedorahosted.org/freeipa/ticket/3915
2013-09-10 09:49:43 +02:00
Ana Krivokapic
a70b08e9ae Do not crash if DS is down during server uninstall
DS is contacted during server uninstallation, in order to obtain information
about replication agreements. If DS is unavailable, warn and continue with
uninstallation.

https://fedorahosted.org/freeipa/ticket/3867
2013-09-09 17:24:04 +02:00
Petr Spacek
0924177ab0 Add timestamps to named debug logs in /var/named/data/named.run 2013-09-06 15:39:36 +02:00
Petr Vobornik
f312d72510 Fix RUV search scope in ipa-replica-manage
The search had an incorrect scope and therefore it didn't find any RUV.

This issue prevented removing of replica.

https://fedorahosted.org/freeipa/ticket/3876
2013-09-04 12:46:29 +02:00
Ana Krivokapic
7959f3ee1e Add warning when uninstalling active replica
Add a warning when trying to uninstall a replica that has active replication
agreements.

https://fedorahosted.org/freeipa/ticket/3867
2013-09-04 11:07:32 +02:00
Ana Krivokapic
de7b1f86dc Create DS user and group during ipa-restore
ipa-restore would fail if DS user did not exist. Check for presence of DS
user and group and create them if needed.

https://fedorahosted.org/freeipa/ticket/3856
2013-09-02 16:28:37 +02:00
Petr Vobornik
92569b712c Update idrange search facet after trust creation
Adding a trust creates a range -> range search facet should be marked as expired.

https://fedorahosted.org/freeipa/ticket/3874
2013-08-28 14:23:42 +02:00
Jan Cholasta
fc8f0ae3ad Add --dirman-password option to ipa-server-certinstall.
https://fedorahosted.org/freeipa/ticket/3869
2013-08-28 10:20:41 +02:00
Tomas Babej
ab6a6e27d8 Make CS.cfg edits with CA instance stopped
This patch makes sure that all edits to CS.cfg configuration file
are performed while pki-tomcatd service is stopped.

Introduces a new contextmanager stopped_service for handling
a general problem of performing a task that needs certain service
being stopped.

https://fedorahosted.org/freeipa/ticket/3804
2013-08-26 16:21:36 +02:00
Petr Vobornik
34342b9a97 Show human-readable error name in error dialog title
Fixes RPC server's JSON encoding of exception's name.

It allows to show the name in Web UI's error dialog title.
2013-08-26 13:05:36 +02:00
Petr Vobornik
e61c2e3441 Hide 'New Certificate' action on CA-less install
This action calls cert-request command which is not available on CA-less installs. Thus this action won't be enabled and therefore there is no reason to keep it visible.

https://fedorahosted.org/freeipa/ticket/3363
2013-08-22 15:23:56 +02:00
Petr Vobornik
ca0d959df8 Add base-id, range-size and range-type options to trust-add dialog
https://fedorahosted.org/freeipa/ticket/3049
2013-08-22 15:23:56 +02:00
Ana Krivokapic
c318213250 Fix broken replica installation
Make sure the subject base parameter is correctly passed and used during the
creation of the DS instance on a replica.

https://fedorahosted.org/freeipa/ticket/3868
2013-08-20 16:36:13 +02:00
Jan Cholasta
02be7acd15 Add --pin option to ipa-server-certinstall.
Hide the unnecessary --dirsrv_pin and --http_pin options.

https://fedorahosted.org/freeipa/ticket/3869
2013-08-20 16:18:59 +02:00
Jan Cholasta
2b08168df4 Port ipa-server-certinstall to the admintool framework.
Change the log file path from /var/log/ipa/default.log to admintool's default
path.

https://fedorahosted.org/freeipa/ticket/3641
2013-08-20 16:18:59 +02:00
Jan Cholasta
ce711ddad8 Make PKCS#12 handling in ipa-server-certinstall closer to what other tools do.
In particular, PKCS#12 validation and server certificate selection is now done
the same way as in ipa-server-install and ipa-replica-prepare.

https://fedorahosted.org/freeipa/ticket/3641
2013-08-20 16:18:59 +02:00
Nathaniel McCallum
fb95f379f0 Bypass ipa-replica-conncheck ssh tests when ssh is not installed
https://fedorahosted.org/freeipa/ticket/3777
2013-08-15 20:06:18 +02:00
Petr Vobornik
ed3791d2f3 Removal of deprecated selenium tests
Tests were deprecated by new FreeIPA 3.3 Web UI integration tests (ticket #3744).

https://fedorahosted.org/freeipa/ticket/3857
2013-08-15 13:17:40 +02:00
Alexander Bokovoy
1fa0f77878 Remove systemd upgrader as it is not used anymore 2013-08-15 08:49:15 +02:00
Martin Kosek
b1474a53c0 Fix selected minor issues in the spec file and license
This patch fixes:
- too long description for server-trust-ad subpackage
- adds (noreplace) flag %{_sysconfdir}/tmpfiles.d/ipa.conf to avoid
  overwriting potential user changes
- changes permissions on default_encoding_utf8.so to prevent it
  pollute python subpackage Provides.
- wrong address in GPL v2 license preamble in 2 distributed files

https://fedorahosted.org/freeipa/ticket/3855
2013-08-13 15:31:46 +02:00
Martin Kosek
b9ec4d1a67 Prevent *.pyo and *.pyc multilib problems
Differences in the python byte code fails in a build validation
(rpmdiff) done on difference architecture of the same package.

This patch:
 1) Ensures that timestamps of generated *.pyo and *.pyc files match
 2) Python integer literals greater or equal 2^32 and lower than 2^64
    are converted to long right away to prevent different type of
    the integer on architectures with different size of int

https://fedorahosted.org/freeipa/ticket/3858
2013-08-13 15:31:46 +02:00
Ana Krivokapic
b561e85e4a Fix handling of CSS files in sync.sh script 2013-08-13 12:44:17 +02:00
Petr Vobornik
006c4eabd9 Hide delete button in multivalued widget if attr is not writable
https://fedorahosted.org/freeipa/ticket/3799
2013-08-13 12:42:09 +02:00
Petr Vobornik
ff6f958d96 Make ssh_widget not-editable if attr is readonly
https://fedorahosted.org/freeipa/ticket/3800
2013-08-13 12:41:48 +02:00
Tomas Babej
69394bab5a Remove support for IPA deployments with no persistent search
Drops the code from ipa-server-install, ipa-dns-install and the
BindInstance itself. Also changed ipa-upgradeconfig script so
that it does not set zone_refresh to 0 on upgrades, as the option
is deprecated.

https://fedorahosted.org/freeipa/ticket/3632
2013-08-09 12:14:42 +02:00
Ana Krivokapic
da2605c942 Handle --subject option in ipa-server-install
Properly handle --subject option of ipa-server-install, making sure this
value gets passed to certmap.conf. Introduce a new template variable
$SUBJECT_BASE for this purpose.

Also make sure that this value is preserved on upgrades.

https://fedorahosted.org/freeipa/ticket/3783
2013-08-08 16:52:48 +02:00
Martin Kosek
f5ef2fb146 Increase default SASL buffer size
Default SASL buffer size was too small and could lead for example to
migration errors.

https://fedorahosted.org/freeipa/ticket/3826
2013-08-07 14:13:56 +02:00
Ana Krivokapic
fc3f3c90b9 Add ipa-advise plugins for legacy clients
Old versions of SSSD do not directly support cross-realm trusts between IPA
and AD. This patch introduces plugins for the ipa-advise tool, which should
help with configuring an old version of SSSD (1.5-1.8) to gain access to
resources in trusted domain.

Since the configuration steps differ depending on whether the platform includes
the authconfig tool, two plugins are needed:

* config-redhat-sssd-before-1-9 - provides configuration for Red Hat based
  systems, as these system include the autconfig utility
* config-generic-sssd-before-1-9 - provides configuration for other platforms

https://fedorahosted.org/freeipa/ticket/3671
https://fedorahosted.org/freeipa/ticket/3672
2013-08-07 09:18:42 +02:00
Petr Viktorin
5d141bd39c Update translations
Regenerate the POT file and pull new translations from Transifex.

Also, update the Transifex URL in the configuration file:
transifex.net has redirected to transifex.com for some time,
and now its certificate has expired.
2013-08-02 16:54:25 +02:00
Ana Krivokapic
69bcfa49d4 Expose ipaRangeType in Web UI
https://fedorahosted.org/freeipa/ticket/3759
2013-07-29 10:38:03 +02:00
Ana Krivokapic
2ca280c56d Honor 'enabled' option for widgets.
https://fedorahosted.org/freeipa/ticket/3793
2013-07-26 16:32:47 +02:00
Martin Kosek
6a0aabede5 Free NSS objects in --external-ca scenario
In external CA installation, ipa-server-install leaked NSS objects
which caused an installation crash later when a subsequent call of
NSSConnection tried to free them.

Properly freeing the NSS objects avoid this crash.

https://fedorahosted.org/freeipa/ticket/3773
2013-07-26 12:51:10 +02:00
Jan Cholasta
693710784b Print newline after receiving EOF in installutils.read_password. 2013-07-24 10:00:03 +02:00
Jan Cholasta
ea544bee4c Ask for PKCS#12 password interactively in ipa-server-install.
https://fedorahosted.org/freeipa/ticket/3717
2013-07-24 10:00:02 +02:00