Commit Graph

215 Commits

Author SHA1 Message Date
Petr Viktorin
d28d37ebdb test_integration.host: Export the hostname to dict as string
Our tests do strict type-checking, using unicode string causes failures.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-22 12:55:35 +02:00
Jan Cholasta
9814b272af Keep original name when setting attribute in LDAPEntry.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:21 +02:00
Jan Cholasta
a8dd7aa337 Use raw attribute values in command result when --raw is specified.
For backward compatibility, the values are converted to unicode, unless the
attribute is binary or the conversion fails.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
8b6dc819d5 Support API version-specific RPC marshalling.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
4314d02fbf Allow primary keys to use different type than unicode.
Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Tomas Babej
f74ab3cba2 ipatests: Fix incorrect UID/GID reference for subdomain users and groups
In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
49a59d1292 ipatests: Allow using FQDN with trailing dot as final hostname
When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
24aa0a91e5 ipatests: tasks: Accept extra arguments when installing client
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
ceca0b5591 ipatests: Fix apache semaphores prior to installing IPA server
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Adam Misnyovszki
f85fe1e851 CI - test_forced_client_reenrollment stability fix
fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19

https://fedorahosted.org/freeipa/ticket/4298

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Petr Viktorin
b53f2d28fd Add managed read permissions to krbtpolicy
Unlike other objects, the ticket policy is stored in different
subtrees: global policy in cn=kerberos and per-user policy in
cn=users,cn=accounts.
Add two permissions, one for each location.

Also, modify tests so that adding new permissions in cn=users
doesn't cause failures.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
2014-04-16 16:10:43 +02:00
Petr Vobornik
466e32f9ec webui-ci: adapt to new login screen
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Viktorin
3deb76cf17 Fix expected output in permission tests
There is now a second permission affecting krbMinPwdLife.
Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-15 09:45:40 +02:00
Petr Viktorin
db85ea32c1 test_realmdomains_plugin: Add default ACI to expected output
Since realmdomains is only one entry, _show with --all will return
the ACI on it. Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-11 12:45:14 +02:00
Petr Viktorin
85b8d8d5ae CA-less tests: Use sequential certificate serial numbers
When serial numbers were generated with $RANDOM, there
could be collisions.
Use sequential numbers instead.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-10 12:05:26 +02:00
Adam Misnyovszki
8b91d9a6e8 automember rebuild nowait feature added
automember-rebuild uses asynchronous 389 task, and returned
success even if the task didn't run. this patch fixes this
issue adding a --nowait parameter to 'ipa automember-rebuild',
defaulting to False, thus when the script runs without it,
it waits for the 'nstaskexitcode' attribute, which means
the task has finished. Old usage can be enabled using --nowait,
and returns the DN of the task for further polling.
New tests added also.

https://fedorahosted.org/freeipa/ticket/4239

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-09 13:45:32 +02:00
Adam Misnyovszki
2b171d273f CA-less tests generate failure
CA-less test suite always generate failures when installing
revoked certificates. This is a known issue, described in
https://fedorahosted.org/freeipa/ticket/4270 , this fix skips
these tests, outputting a warning for the later ticket.

https://fedorahosted.org/freeipa/ticket/4271

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-08 14:10:28 +02:00
Tomas Babej
50a6316d16 ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cache
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
6dcf2400be ipatests: legacy_clients: Relax regex checks
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
517ac41524 ipatests: legacy_clients: Use hostname instead of external hostname for AD subdomain
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
81b5adee80 ipatests: Make sure that remnants of PKI are removed
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Adam Misnyovszki
0f626a9cc8 Extending user plugin with inetOrgPerson fields
According to http://tools.ietf.org/html/rfc2798 ipa client
and web ui extended with inetOrgPerson fields:
- employeenumber
- employeetype
- preferredlanguage
- departmentnumber

carlicenseplate is now multivalued

https://fedorahosted.org/freeipa/ticket/4165

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-03-28 12:38:50 +01:00
Petr Vobornik
06a7a1b3cb webui: replace IPA.command usage with rpc.command
Replace all IPA.command, IPA.batch_command and IPA.concurrent_command usages
by equivalents from rpc module.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-03-27 14:54:08 +01:00
Tomas Babej
f9ebd47f93 ipatests: Do not depend on the case of the attributes when testing ID ranges
In test_trust.py, several tests did case sensitive search on the output of
the ipa idrange-show command. This could cause false negatives.

Part of: https://fedorahosted.org/freeipa/ticket/4267

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-26 12:57:29 +01:00
Jan Cholasta
d5e35f92a5 Update pkcs10 module functions to always load CSRs and allow selecting format.
This change makes the pkcs10 module more consistent with the x509 module.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-25 16:54:55 +01:00
Petr Viktorin
1df9b5836a Allow modifying permissions with ":" in the name
The ":" character will be reserved for default permissions, so that
users cannot create a permission with a name that will later be
added as a default.

Allow the ":" character modifying/deleting permissions*, but not
when creating them. Also do not allow the new name to contain ":"
when renaming.

(* modify/delete have unrelated restrictions on managed permissions)

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
d0e83dbccf test_permission_plugin: Fix tests that make too broad assumptions
The test that searches with a limit of 1 assumes a specific order
LDAP returns entries in. Future patches will change this order.
Do not check the specific entry returned.

The test that searched for --bindtype assumed that no anonymous
permissions exist in a clean install. Again, this will be changed
in future patches.
Add a name to the bindtype test, and add a negatitive test to
verify the filtering works.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
4f302f6500 Allow indexing API object types by class
This allows code like:
    from ipalib.plugins.dns import dnszone_mod

    api.Command[dnszone_mod]

This form should be preferred when getting specific objects
because it ensures that the appropriate plugin is imported.

https://fedorahosted.org/freeipa/ticket/4185

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
3dcad00b94 permission plugin: Do not add the ipapermissionv2 for output
As with the flags, the objectclass should be returned as it is
on the entry.

https://fedorahosted.org/freeipa/ticket/4257

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-24 15:44:23 +01:00
Petr Vobornik
7872b92050 webui-ci: fix test_rebuild_membership_hosts on server without DNS
Host adder dialog differs on installations with and without DNS.
Previous test used values for adding hosts which were suitable only for IPA servers installed with DNS.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-24 15:04:46 +01:00
Tomas Babej
8c8cc8b614 ipatests: test_trust: Change expected home directories for posix users
Information from the AD about the home directories is not leveraged at
all, but is generated from the username and domain. Fix the assumptions
in the tests.

Also changes 'Subdomain Test User' to 'Subdomaintest User' to be more
consistent.

https://fedorahosted.org/freeipa/ticket/4184

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-24 09:51:52 +01:00
Petr Viktorin
44b065a277 test_integration.tasks: Do not fail cleanup if backup directory does not exist
If the test backup directory was never created (for example if
there was an early failure, or install was never run),
we don't want the test to fail.
Do not restore if the backup dir is not there.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-20 15:38:16 +01:00
Petr Vobornik
5efcb240ce webui: change permissions UI to v2
reflect ipalib permission changes in Web UI.

- http://www.freeipa.org/page/V4/Permissions_V2
- http://www.freeipa.org/page/V4/Anonymous_and_All_permissions
- http://www.freeipa.org/page/V4/Managed_Read_permissions
- http://www.freeipa.org/page/V4/Multivalued_target_filters_in_permissions

https://fedorahosted.org/freeipa/ticket/4079

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-20 10:02:31 +01:00
Petr Vobornik
fddb2212bc webui-css: improve radio,checkbox keyboard support and color
checkboxes and radio buttons:
- do not change color on hover when disabled
- are focusable and checkable be keyboard again. This uses a little
  trick where the real checkbox is hidden under the artificial
  checkbox. That way it has the same position and therefore it
  works even in containers with overflow set.

https://fedorahosted.org/freeipa/ticket/4217

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-03-20 08:57:42 +01:00
Petr Viktorin
64cc4d81cc permission plugin: Do not change extra target filters by "views"
Previously, setting/deleting the "--type" virtual attribute removed
all (objectclass=...) target filters.
Change so that only the filter associated with --type is removed.

The same change applies to --memberof: only filters associated
with the option are removed when --memberof is (un-)set.

Follow-up to https://fedorahosted.org/freeipa/ticket/4216

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-14 10:14:05 +01:00
Petr Viktorin
29eef98c76 permission plugin: Support searching by extratargetfilter
The extratargetfilter behaves exactly like targetfilter, so that e.g.
  ipa permission-find --filter=(objectclass=ipausergroup)
finds all permissions with that filter in the ACI.

Part of the work for https://fedorahosted.org/freeipa/ticket/4216

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-14 10:14:05 +01:00
Petr Viktorin
fe2a41e8a3 permission plugin: Add tests for extratargetfilter
Part of the work for: https://fedorahosted.org/freeipa/ticket/4216

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-14 10:14:05 +01:00
Petr Viktorin
254c82727f permission CLI: Rename filter to rawfilter, extratargetfilter to filter
Since extratargetfilter is shown by default, change it to also have
the "default" (i.e. shorter) option name.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-14 10:14:05 +01:00
Petr Viktorin
3120a6833e permission plugin: Output the extratargetfilter virtual attribute
The --filter, --type, and --memberof options interact in a way that's
difficult to recreate in the UI: type and memberof are "views" on the
filter, they affect it and are affected by it

Add a "extratagretfilter" view that only contains the filters
not linked to type or memberof.

Show extra target filter, and not the full target filter, by default;
show both with --all, and full filter only with --raw.

Write support will be added in a subsequent patch.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4216

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-14 10:14:05 +01:00
Martin Kosek
6fb53bb08c Fix idrange unit test failure
This is a follow up to patch for ticket 4247 - the raised
errors.DependentEntry changed, test needs to be change as well.

https://fedorahosted.org/freeipa/ticket/4247
2014-03-14 10:07:20 +01:00
Petr Viktorin
7c9fa8fad9 ipaserver.install.service: Fix estimated time display
Use basic math rather than timezone conversion to get
minutes and seconds.
Break out the message generation into a small tested function.

https://fedorahosted.org/freeipa/ticket/4242

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-03-13 18:15:43 +01:00
Petr Vobornik
870a5daf24 webui: Datetime parsing and formatting
this patch implements:
- output_formatter in field. It should be used in par with formatter. Formatter serves for datasource->widget conversion, output_formatter for widget->datasource format conversion.
- datetime module which parses/format strings in subset of ISO 8601 and LDAP generalized time format to Date.
- utc formatter replaced with new datetime formatter
- datetime_validator introduced
- new datetime field, extension of text field, which by default uses datetime formatter and validator

Dojo was regenerated to include dojo/string module

https://fedorahosted.org/freeipa/ticket/4194

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-03-13 15:59:44 +01:00
Petr Viktorin
05f612e58a Do not hardcode path to ipa-getkeytab in tests
Using the in-tree binary makes testing outside the source tree
impossible.
Use ipa-getkeytab from $PATH, and add the directory to $PATH when
running the in-tree tests.

Part of the work for https://fedorahosted.org/freeipa/ticket/3654

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-13 15:52:18 +01:00
Petr Viktorin
d3a34591a8 permission_add: Remove permission entry if adding the ACI fails
https://fedorahosted.org/freeipa/ticket/4187

Reviewed-By: Jan Pazdziora <jpazdziora@redhat.com>
2014-03-12 12:17:08 +01:00
Petr Viktorin
d727599aa8 permissions plugin: Don't crash with empty targetfilter
https://fedorahosted.org/freeipa/ticket/4206

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-07 20:06:52 +01:00
Petr Viktorin
0c2aec1be5 permission plugin: Allow multiple values for memberof
Design: http://www.freeipa.org/page/V3/Multivalued_target_filters_in_permissions
Additional fix for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-07 20:05:28 +01:00
Petr Viktorin
02e61961da permission-mod: Remove attributelevelrights before reverting entry
LDAPUpdate adds the display-only 'attributelevelrights' attribute,
which doesn't exist in LDAP. Remove it before reverting entry.

https://fedorahosted.org/freeipa/ticket/4212

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-07 16:52:40 +01:00
Petr Viktorin
68f4af3122 tests: Create the testing service certificate on demand
Replace the make-testcert command with a module that creates
the certificate when it is first needed.
As a result the tests are more self-contained, and can be run from
a read-only location (such as installed from a system package).

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-06 10:33:21 +01:00
Petr Viktorin
561e57d121 Add tests for integration test configuration
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-05 10:00:58 +01:00
Petr Viktorin
e6dbb2aa68 test_integration.config: Convert some text values to str
When loading from file, some strings are loaded as unicode,
which would throw off assert_deepequal.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-05 10:00:58 +01:00