Commit Graph

6450 Commits

Author SHA1 Message Date
Petr Viktorin
f2ee8a7403 test_webui: Allow False values in configuration for no_ca, no_dns, has_trusts
The driver only checked if the corresponding value was in the config, so
    no_dns: False
had the same effect as
    no_dns: True

Change the check to take the value into consideration.

This makes false-y values like False (from YAML) and empty string
(from environment) work as if the value was not specified.
2013-12-10 15:42:33 +01:00
Petr Viktorin
b656398415 Regression test for user_status crash
https://fedorahosted.org/freeipa/ticket/4066
2013-12-10 15:34:45 +01:00
Jan Cholasta
36502a6367 Fix internal error in the user-status command.
https://fedorahosted.org/freeipa/ticket/4066
2013-12-10 15:34:45 +01:00
Martin Kosek
1e0405880f Consolidate .gitignore entries
Clean up the .gitignore file:
- Remove no longer used .gitignore entries, like .bzr files
- Do not repeat autotools generated files over and over again
- Whitelist existent Makefiles in the repository
- Better separate the .gitignore entries
2013-12-10 10:28:38 +01:00
Tomas Babej
89ab877c5c ipa-client-install: Always pass hostname to the ipa-join
The ipa-client-install script and ipa-join use different methods
of resolving the hostname, the former uses gethostbyaddr() call,
while the latter reads the "uinfo.nodename".

This can result ipa-client-install failures in case of broken PTR
records.

https://fedorahosted.org/freeipa/ticket/4027
2013-12-09 13:34:39 +01:00
Martin Kosek
9677308caa Allow kernel keyring CCACHE when supported
Server and client installer should allow kernel keyring ccache when
supported.

https://fedorahosted.org/freeipa/ticket/4013
2013-12-09 12:21:22 +01:00
Petr Vobornik
b6540e88d8 Fix license in some Web UI files
Modified web ui files had incorrect GPLv2 headers instead of GPLv3 ones.

All of the affected code is of FreeIPA origin.
2013-12-09 10:18:38 +01:00
Jan Cholasta
5e2f7b68f0 Remove CFLAGS duplication.
https://fedorahosted.org/freeipa/ticket/3896
2013-12-06 14:44:41 +01:00
Jan Cholasta
07ddfdd127 Fix compilation error in ipa-cldap.
https://fedorahosted.org/freeipa/ticket/3896
2013-12-06 14:44:40 +01:00
Jan Cholasta
8bfa79289a Add stricter default CFLAGS to Makefile.
https://fedorahosted.org/freeipa/ticket/3896
2013-12-06 14:44:40 +01:00
Jan Cholasta
75dadc1d8f Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file.
Remove explicitly specified hardening flags from LDFLAGS in ipa-otpd.

https://fedorahosted.org/freeipa/ticket/3896
2013-12-06 14:44:40 +01:00
Jan Cholasta
f618e35a1a Prefer user CFLAGS/CPPFLAGS over those provided by rpmbuild in the spec file.
https://fedorahosted.org/freeipa/ticket/3896
2013-12-06 14:44:40 +01:00
Petr Viktorin
a9a7976ca8 test_integration: Log external hostname in Host.ldap_connect
This may make debugging easier if the address is set incorrectly.
2013-12-06 12:58:50 +01:00
Petr Viktorin
98f4c22267 test_integration: Support external names for hosts
The framework had a concept of external hostnames,
which the controller uses to contact the test machines,
but they were not loaded from configuration.

Load external names from configuration.

This makes tests pass in setups where internal and external
hostnames are different, and the internal hostnames are not
initially resolvable from the controller.
2013-12-06 12:58:50 +01:00
Simo Sorce
af26e6da46 Fix license tag in python setup files
Apparently when we relicensed to GPLv3 we missed these two spots.
The actual boilerplate was changed in these files but not the
license tag passed to python setup.
2013-12-05 14:07:40 +01:00
Petr Spacek
2348e0fab7 Clarify error message about IPv6 socket creation in ipa-cldap plugin
https://fedorahosted.org/freeipa/ticket/4056
2013-12-03 16:27:12 +01:00
Petr Viktorin
a1f32fa936 Add tests for the radiusproxy plugin 2013-12-03 14:49:10 +01:00
Nathaniel McCallum
4cb2c2813d Add RADIUS proxy support to ipalib CLI
https://fedorahosted.org/freeipa/ticket/3368
2013-12-03 14:49:10 +01:00
Martin Basti
efffcfdbc2 migrate-ds added --ca-cert-file=FILE option
FILE is used to specify CA certificate for DS connection when TLS is
required (ldaps://...).

Ticket: https://fedorahosted.org/freeipa/ticket/3243
2013-12-02 13:30:12 +01:00
Martin Basti
db7dbbb141 Changed CLI to allow to use FILE as optional param 2013-12-02 13:30:11 +01:00
Jan Cholasta
db3e450732 Own /usr/share/ipa/ui/js/ in the spec file.
https://fedorahosted.org/freeipa/ticket/4010
2013-12-02 12:37:44 +01:00
Jan Cholasta
652c4e6ace Use hardening flags for ipa-optd.
https://fedorahosted.org/freeipa/ticket/4010
2013-12-02 12:37:41 +01:00
Alexander Bokovoy
32df84f04b subdomains: Use AD admin credentials when trust is being established
When AD administrator credentials passed, they stored in realm_passwd,
not realm_password in the options.

When passing credentials to ipaserver.dcerpc.fetch_domains(), make sure
to normalize them.

Additionally, force Samba auth module to use NTLMSSP in case we have
credentials because at the point when trust is established, KDC is not
yet ready to issue tickets to a service in the other realm due to
MS-PAC information caching effects. The logic is a bit fuzzy because
credentials code makes decisions on what to use based on the smb.conf
parameters and Python bindings to set parameters to smb.conf make it so
that auth module believes these parameters were overidden by the user
through the command line and ignore some of options. We have to do calls
in the right order to force NTLMSSP use instead of Kerberos.

Fixes https://fedorahosted.org/freeipa/ticket/4046
2013-11-29 13:13:55 +01:00
Ana Krivokapic
2d86d7d85a Make Expression field required when adding automember condition
https://fedorahosted.org/freeipa/ticket/4053
2013-11-27 16:56:59 +01:00
Jan Cholasta
4050e553c3 Remove unused method get_api of the ldap2 plugin.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:42 +01:00
Jan Cholasta
97445b2df3 Refactor indirect membership processing.
A single LDAP search is now used instead of one search per member.

https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:42 +01:00
Jan Cholasta
a9bf18ab95 Support searches with paged results control in LDAPClient.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Jan Cholasta
8013056194 Add wrapper for result3 to IPASimpleLDAPObject.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Jan Cholasta
73df6150e5 Move IPA specific code from LDAPClient to the ldap2 plugin.
https://fedorahosted.org/freeipa/ticket/3971
2013-11-27 13:46:41 +01:00
Petr Viktorin
73b8047b22 Add server/protocol type to rpcserver logs
Add the server class name, such as [xmlserver] or [jsonserver_kerb] to
the server logs. This will allow easier debugging of problems specific
to a protocol or server class.
2013-11-26 16:59:59 +01:00
Petr Viktorin
6839d8334e Make jsonserver_kerb start a cookie-based session
Part of the work for: https://fedorahosted.org/freeipa/ticket/3299
2013-11-26 16:59:59 +01:00
Petr Viktorin
1e836d2d0c Switch client to JSON-RPC
Modify ipalib.rpc to support JSON-RPC in addition to XML-RPC.
This is done by subclassing and extending xmlrpclib, because
our existing code relies on xmlrpclib internals.

The URI to use is given in the new jsonrpc_uri env variable. When
it is not given, it is generated from xmlrpc_uri by replacing
/xml with /json.

The rpc_json_uri env variable existed before, but was unused,
undocumented and not set the install scripts.
This patch removes it in favor of jsonrpc_uri (for consistency
with xmlrpc_uri).

Add the rpc_protocol env variable to control the protocol
IPA uses. rpc_protocol defaults to 'jsonrpc', but may be changed
to 'xmlrpc'.
Make backend.Executioner and tests use the backend specified by
rpc_protocol.

For compatibility with unwrap_xml, decoding JSON now gives tuples
instead of lists.

Design: http://freeipa.org/page/V3/JSON-RPC
Ticket: https://fedorahosted.org/freeipa/ticket/3299
2013-11-26 16:59:59 +01:00
Simo Sorce
a1165ffbb8 Add krbticketPolicyAux objectclass if needed
When modifying ticket flags add the objectclass to the object if it is missing.

https://fedorahosted.org/freeipa/ticket/3901
2013-11-26 16:44:37 +01:00
Petr Viktorin
ba0da01c1d Remove changelog from the spec
The project's history is kept in Git. We used the spec changelog
for changes to the spec itself, which doesn't make much sense.
Downstreams like Fedora use their own changelog anyway.

A single entry is left for tools that expect a changelog.
2013-11-26 15:37:18 +01:00
Tomas Babej
d361e12ae5 trusts: Always stop and disable smb service on uninstall
https://fedorahosted.org/freeipa/ticket/4042
2013-11-26 15:23:42 +01:00
Petr Viktorin
76c7f24919 Improve LDAPEntry.__repr__ for freshly created entries
Creating a LDAPEntry from dict does not set the raw entries,
to display everything we need to combine the underlying data.

https://fedorahosted.org/freeipa/ticket/4015
2013-11-26 13:19:37 +01:00
Jan Cholasta
f20577ddc4 Remove mod_ssl port workaround.
https://fedorahosted.org/freeipa/ticket/4021
2013-11-26 12:58:17 +01:00
Tomas Babej
63d4f30686 trusts: Do not pass base-id to the subdomain ranges
For trusted domains base id is calculated using a murmur3 hash of the
domain Security Identifier (SID). During trust-add we create ranges for
forest root domain and other forest domains. Since --base-id explicitly
overrides generated base id for forest root domain, its value should not
be passed to other forest domains' ranges -- their base ids must be
calculated based on their SIDs.

In case base id change for non-root forest domains is required, it can
be done manually through idrange-mod command after the trust is
established.

https://fedorahosted.org/freeipa/ticket/4041
2013-11-22 08:47:49 +01:00
Petr Viktorin
56e3e12f12 Break long doc string in the Host plugin
Also split the translations in French and Ukraininan

Part of https://fedorahosted.org/freeipa/ticket/3587
2013-11-21 10:34:25 +01:00
Petr Viktorin
8f57f25e82 Add ConcatenatedLazyText object
This object will allow splitting large translatable strings into more
pieces, so translators don't have to re-translate the entire text
when a small part changes.

https://fedorahosted.org/freeipa/ticket/3587
2013-11-21 10:34:25 +01:00
Petr Viktorin
35c3a5f161 Update translations from Transifex 2013-11-21 10:34:25 +01:00
Tomas Babej
4a0e91449e ipa-client-install: Publish CA certificate to systemwide store
During the installation, copy the CA certificate to the systemwide
store (/etc/pki/ca-trust/source/anchors/ipa-ca.crt) and update the
systemwide CA database.

This allows browsers to access IPA WebUI without warning out of the
box.

https://fedorahosted.org/freeipa/ticket/3504
2013-11-20 13:15:38 +01:00
Tomas Babej
60b472479d platform: Add Fedora 19 platform file
Part of: https://fedorahosted.org/freeipa/ticket/3504
2013-11-20 13:13:38 +01:00
Ana Krivokapic
afbf528a83 WebUI: Add userClass attribute to user and host pages
Add userClass attribute to:
- user and host adder dialogs
- user and host detail facets

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3590
2013-11-19 14:27:50 +01:00
Ana Krivokapic
b216a7b610 Add userClass attribute for users
This new freeform user attribute will allow provisioning systems
to add custom tags for user objects which can be later used for
automember rules or for additional local interpretation.

Design page: http://www.freeipa.org/page/V3/Integration_with_a_provisioning_systems
https://fedorahosted.org/freeipa/ticket/3588
2013-11-19 14:27:50 +01:00
Petr Viktorin
2bc7803b69 Unify capitalization of attribute names in schema files
Due to a bug[0], python-ldap doesn't parse schema LDIF files correctly
if they use inconsistent capitalization.

This patch works around the bug in IPA schema files.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1007820

Note: git's --word-diff option is recommended for viewing these changes
2013-11-18 16:54:22 +01:00
Petr Viktorin
ec1585f831 Add formerly update-only schema
Some schema was only delivered in updates. Add it back as ldif files.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Petr Viktorin
a1eb71768c Make schema files conform to new updater
The new schema updater only compares textual representations of schema
elements, as formatted by python-ldap.
This works well, but it is too strict for the current schema files in two ways:
- For attribute names in MAY and MUST, the correct letter case must be used
- AttributeTypes must specify explicit EQUALITY and SYNTAX fields even if
    they are the same as its supertype's.
When these restrictions are not followed, the updater will always overwrite
the schema element. This is harmless but it fills up the log unnecessarily.

Modify the schema files to conform to these restrictions.

Part of the work for https://fedorahosted.org/freeipa/ticket/3454

Note: git's --word-diff option is recommended for viewing these changes
2013-11-18 16:54:21 +01:00
Petr Viktorin
6381d766ce Remove schema special-casing from the LDAP updater
Now that there's a dedicated schema updater, we do not need the code
in ldapupdate.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00
Petr Viktorin
d9a1c09e7c Remove schema modifications from update files
As schema is now handled by the schema updater, these entries
are superfluous.

https://fedorahosted.org/freeipa/ticket/3454
2013-11-18 16:54:21 +01:00