When a translation file does not contain any translation, the
build is broken. Remove the zh_Hant file as it is still empty.
Fix es.po
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 62.5% (3055 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.4% (3047 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.3% (3045 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 59.1% (2886 of 4881 strings)
Co-authored-by: Fco. Javier F. Serrador <fserrador@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/es/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 36.6% (1788 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.9% (1755 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.8% (1751 of 4881 strings)
Co-authored-by: Temuri Doghonadze <temuri.doghonadze@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
A previous commit overwrote the version of freeipa-webui and
went back before the patch that was fixing the copr build.
Refresh to the tip of freeipa-webui to include the copr fix.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Introduce support for LDAP-based system accounts by adding a dedicated
sysaccount plugin with full CLI commands, extending role membership to
include system accounts, and providing warnings for passsync
configuration updates across servers, along with corresponding
documentation and tests.
New Features:
Implement system accounts LDAP object with CLI commands for add,
delete, modify, find, show, enable, and disable.
Enhancements:
Extend role and baseldap plugins to support sysaccount membership
and manage passsync managers with a ServerSysacctMgrUpdateRequired
warning.
Documentation:
Add a design document for system accounts and regenerate API docs
for sysaccount commands and role membership.
Tests:
Update existing role and service plugin tests to cover sysaccount
membership.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Add new attribute, SysAcctManagersDNs, to store list of DNs allowed to
reset user passwords without forcing the users to change them
afterwards.
This list will differ from the use of PassSyncManagersDNs by the fact
that password policy checks will still apply to those password changes.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
- Test scenarios :
- AD users running commands as root via external groups
- AD users switching to other AD user accounts
- IPA users running commands as AD users
- Sudo rule disable/enable functionality
- Command allow/deny restrictions
- Access denial for users not in sudo rules
- Automated with Cursor+Claude
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Instead of modifying /etc/krb5.conf with all IPA realm configuration, follow
the practice of creating a separate config snippet file owned by IPA.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Instead of using chromium from the distribution, use the
browser provided with Pupeteer and disbale the sandbox
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The command launching autogen.sh ends with \ and on fedora 43
this causes a build failure
checking build system type... Invalid configuration '\': machine '\-unknown' not recognized
configure: error: /bin/sh ./config.sub \ failed
Remove the trailing \
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Fedora 43 is now available, switch azure CI to this version.
Fixes: IDM-3231
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The Modrdn plugin doesn't check whether the operation it processes is replicated.
This results in duplicate operations on each replica, for example, when deleting a saved user.
To fix this behavior, a check was added to the Modrdn plugin that the operation is not replicated.
Fixes: https://pagure.io/freeipa/issue/9867
Signed-off-by: vectinx <vectinx@yandex.ru>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Collation should be the same for API files or we will end up with
differences between development environments.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
There seem to be a difference between API notes in different files: some
contain CRLF, some LF only, and also some empty lines are present while
they should not be there.
Normalize the remaining API docs.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
In order to generate the private key for a a LWCA (subca)
on an HSM the name of the subca needs to be the HSM token
name : name_of_subca, e.g. ipa_token:test.
This works fine now without any code changes but it requires
that admins always remember to include the prefix which is
unlikely (everyone makes mistakes). So do it for them if
an HSM is present and a token is not provided. We only support
one token at a time in IPA so for now this is sufficient.
One can also mix-and-match including the token and not.
For example you can run:
$ ipa ca-add test --subject cn=test
$ ipa ca-show ipa_token:test
It shouldn't be an issue if a lwca name contains a colon.
Fixes: https://pagure.io/freeipa/issue/9865
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The test moves the date in the future, performs checks and in the
teardown method uninstalls and moves the date back to the current time.
It often fails in the teardown part because certmonger is in the process
of renewing the expired certificates.
Apply the same strategy as other tests fiddling with the date:
stop certmonger and remove the tracking requests before uninstallation.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The error message returned by ipa ca-show has changed with PKI 11.7.
Adapt the test to succeed with old and new versions.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Fedora 42 now ships PKI 11.7.0-5 and certmonger 0.79.21-1.
Update the vagrant image to 0.0.9 in order to pull the new versions.
Related: IDM-3437
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
It's required to install git for copr, so we can fetch the
webui submodule. Updates webui to use clean-install, updates
dependencies and replaces SWC with Babel for build due to
being architecture agnostic.
Signed-off-by: David Hanina <dhanina@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This repalces the straight string parsing from IPAv3.0.0.
It should be much more robust and result in a valid
configuration file when complete. aug.save() will
assure that as it will raise an error otherwise.
This will handle the following cases:
* db_library = ipadb.so : do nothing
* db_library is missing, set to ipadb.so
* db_library is something else, replace wih ipadb.so
Fixes: https://pagure.io/freeipa/issue/9862
Related: https://pagure.io/freeipa/issue/5913
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
- Tests to cover both root domain and subdomain users:
- Test that adding AD users/groups without the external group to
HBAC rules fails.
- Test HBAC rule denies SSH access for AD users.
- Test HBAC rule allows SSH access for AD users in external group.
- Test HBAC rule denies sudo access for AD users when rule doesn't
include them.
- Test HBAC rule allows sudo access for AD users in external group.
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
We already have libpwquality plumbed in. The ask here was
to support the quality credits as well.
There are four credits: digits, uppers, lowers and others
These either count complexity towards satisfying the minimum
length or set the minimum number of a type allowed.
If any of the four credits is configured then it will cause
the password policy plugin to go through the libpwquality.
Reminder that libpwquality sets its own min password length
floor that should be overridden already.
If min_classes is set as well then that is still enforced.
Fixes: https://pagure.io/freeipa/issue/9835
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
When executed in IDM-CI the test fails because the file
/etc/resolv.conf is overwritten by Networkmanager.
Use the methods provided by the tasks module to modify
resolver configuration.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
IPA relies on the patch for https://github.com/389ds/389-ds-base/issues/6857
Allow Uniqueness plugin to search uniqueness attributes using custom
matching rules
Provided in 389-ds 3.1.3-2 on fedora 41, 42
3.1.3-7 on fedora 43+
2.7.0-7 on RHEL 9.7
3.1.3-5 on RHEL 10.1
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
With PKI 11.7, requesting a cert with a subca fails.
Mark the tests as xfail for now.
Related: RHEL-108293
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Add a test ensuring that root@REALM cannot be added as
krbcanonicalname
Add a test for PAC enforcement:
try to access a service using a TGT obtained without PAC.
Should fail as PAC is now enforced.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
MS-KILE's PA-PAC-REQUEST sequence allows the Kerberos client to request
a TGT without a PAC. At the moment, there is no way to configure the MIT
KDC to reject such request.
This commit enforces the presence of the PAC when processing TGTs
provided by TGS-REQ. It ensures the server principal of the TGT is the
same as the one in PAC_CLIENT_INFO (i.e. enforces client principal
canonicalization) with integrity check.
Only one exception is applied: this check is skipped for local TGTs on
domain where the MS-PAC generator is not initialized (i.e. domains where
SID generation was not executed yet).
Signed-off-by: Julien Rische <jrische@redhat.com>
This relies on a fix in 389-ds that extends the uniqueness plugin
to be able to compare attributes with different matching syntax.
This will prevent privilege escalation attacks if one of the
attributes is not set on an entry if it is set elsewhere.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Alexander Bokovoy
Florence Blanc-Renaud
Arif Budiman
Andi Chandler
Christian Rohr
Pejman Rezaei
Fco. Javier F. Serrador
Weblate Translation Memory
Temuri Doghonadze
Piotr Drąg
Weblate
Rafael Fontenelle
hsu zangmen
Anuja More
vectinx
Rob Crittenden
Aleksandr Sharov
David Hanina
PRANAV THUBE
Julien Rische