Commit Graph

171 Commits

Author SHA1 Message Date
Karl MacMillan
3b4f0db73e Convert the setup of ssl from a shell script to a
python module. This is in preparation for user
supplied certs.
0001-01-01 00:00:00 +00:00
Karl MacMillan
ad3fcc200c Merge. 0001-01-01 00:00:00 +00:00
Simo Sorce
c0b809efd5 Move dnsclient into ipa-python so that I will be able to use it in ipaconfig 2007-12-10 16:31:21 -05:00
Rob Crittenden
00489597d8 Rework input validation to more closely match what we require in the UI 2007-12-07 17:07:03 -05:00
Karl MacMillan
d2378f13d0 Merge. 0001-01-01 00:00:00 +00:00
John Dennis
d53915954e merge 2007-12-04 10:08:08 -05:00
John Dennis
4e1d291d15 change location of radius data in ldap from
cn=radius,cn=services,cn=etc
to
cn=radius
2007-11-30 20:29:12 -05:00
John Dennis
d7a7ba4f45 add user profile command line arg to all radius
profile command line tools to select between shared
and per user profiles

modify AttributeValueCompleter so default values prefer
previously entered values in editing session
2007-11-28 12:06:06 -05:00
John Dennis
904b76059c merged radius work with latest mainline tip 2007-11-28 07:49:07 -05:00
John Dennis
c939c5d289 fix regular expression used in parse_key_value_pairs() 2007-11-27 22:52:11 -05:00
John Dennis
5d1ca46ea7 do a better job of handling attribute deletion 2007-11-27 16:16:10 -05:00
John Dennis
78b5987101 add parse_items(), read_items_file()
move read_pairs_file() to ipautil
2007-11-26 23:11:49 -05:00
John Dennis
c5a43a0168 add ItemCompleter class 2007-11-26 20:59:53 -05:00
John Dennis
09238510ff add command line utilites for radius profiles 2007-11-26 19:30:33 -05:00
John Dennis
4f33d67418 remove radius_client.py, move contents to radius_util.py 2007-11-26 11:12:58 -05:00
jdennis@VAIO
9a9a7e4058 clean up attribute names
clean up command line args in ipa-delradiusclient
2007-11-24 11:20:28 -05:00
John Dennis
d98686e967 Add radius profile implementations:
get_radius_profile_by_uid
  add_radius_profile
  update_radius_profile
  delete_radius_profile
  find_radius_profiles

Rewrite command line arg handling, now support pair entry, interactive
mode with auto completion, reading pairs from a file, better handling
of mandatory values, better help, long arg names now match attribute
name in pairs

Establish mappings for all attributes and names used in clients and
profiles

Add notion of containers to radius clients and profiles in LDAP

Move common code, variables, constants, and strings into the files
radius_client.py, radius_util.py, ipautil.py to eliminate redundant
elements which could get out of sync if modified and to provide access
to other code which might benefit from using these items in the
future.

Add utility functions:
  format_list()
  parse_key_value_pairs()

Add utility class:
  AttributeValueCompleter

Unify attribute usage in radius ldap schema
2007-11-21 13:11:10 -05:00
John Dennis
c4dbe6433d add ipa-findradiusclient search 2007-11-14 15:32:08 -05:00
John Dennis
c24da12fe1 radius client modify and delete work 2007-11-14 00:04:19 -05:00
John Dennis
c4bf859bfb move radius client utility code to common radius_client.py so it can be shared 2007-11-13 20:22:18 -05:00
John Dennis
eab5a89d4a ipa-addradiusclient now working 2007-11-13 20:05:02 -05:00
John Dennis
152f8e3392 checkpoint radius client work 2007-11-13 13:06:18 -05:00
John Dennis
80c4ed7af2 remove offensive use of rpm
add the radiusprofile to the list of objectclasses used when creating a user
2007-11-06 16:26:10 -05:00
John Dennis
22493d9b9f remove offensive use of rpm
add the radiusprofile to the list of objectclasses used when creating a user
2007-11-06 16:26:10 -05:00
rcritten@redhat.com
c32a960cae Compatibility changes to work on RHEL 5 with python 2.4 2007-11-30 15:53:02 -05:00
Rob Crittenden
bac556557d Don't allow the admins or editors groups to be removed.
Don't allow the default group for users to be removed.
2007-11-30 12:49:08 -05:00
Rob Crittenden
0b1650e7ad Add ipa-python to maintainer-clean and clean up .pyc files 2007-11-28 12:33:14 -05:00
Rob Crittenden
eb141b02ff Move dn removal to the XML-RPC side and remove empty attributes 2007-12-05 17:26:39 -05:00
Rob Crittenden
15b7dc6ff9 Add UI for service principal creation and keytab retrieval 2007-12-05 15:17:11 -05:00
Karl MacMillan
edc7af1446 Add xml-rpc interface for getting keytabs.
Warning: this lacks any sort of authorization.
0001-01-01 00:00:00 +00:00
John Dennis
8cfd270f34 merge initial radius work 2007-11-03 12:22:20 -04:00
Karl MacMillan
c397041bfa Merge. 0001-01-01 00:00:00 +00:00
Rob Crittenden
2fbe5cbf49 Phase 1 of allowing admins to set the default object classes for users & groups
This adds the UI and does error checking of the selected object classes but
it doesn't actually use the values yet.

It also generalizes some functions for doing multi-valued fields.
2007-12-04 13:18:37 -05:00
Karl MacMillan
9038bf71dd Move packages to ipa from freeipa. 0001-01-01 00:00:00 +00:00
Karl MacMillan
90d6fefe32 Fix errors with ipautil.CalledProcessError and cleanup some imports. 0001-01-01 00:00:00 +00:00
Karl MacMillan
b202b6cc31 Bump the version numbers for release. Also remove
specific version check on freeradius. Packages aren't
available and the freeradius support isn't ready
anyway.
0001-01-01 00:00:00 +00:00
Rob Crittenden
d9f809746b Completely remove an attribute 2007-10-31 17:11:55 -04:00
Karl MacMillan
67cddce4d4 Generate master password from Simo. 0001-01-01 00:00:00 +00:00
Rob Crittenden
23ffab533f Make the old entry option in update_*, check for empty parameters and
fix some problems reported by pychecker.
2007-12-11 17:34:15 -05:00
Karl MacMillan
c373ed5c5c Initial replication setup.
This add replication setup through two new commands: ipa-replica-prepare
and ipa-replica-install. The procedure is to run ipa-replica-prepare
on an existing master. This will collect information about the realm
and the current master and create a file storing all of the information.
After copying that file to the new replica, ipa-replica-install is
run (with -r to create a read-only replica).

This version of the patch also includes fixes for the sasl mappings
on the replicas.

Remaining features:
- ssl for replication.
- automatic configuration of mesh topology for
  master (or a simpler way to replicate multiple
  masters.
- tool for view / configuring current replication.
0001-01-01 00:00:00 +00:00
Rob Crittenden
bf743087d2 Fix indentation error that occured in merge 2007-11-21 00:29:03 -05:00
Rob Crittenden
f42f1f44c8 Enable group inactivation by using the Class of Service plugin.
This adds 2 new groups: activated and inactivated.

If you, or a group you are a member of, is in inactivated then you are too.

If you, or a group you are a member of, is in the activated group, then you
are too.

In a fight between activated and inactivated, activated wins.

The DNs for doing this matching is case and white space sensitive.

The goal is to never have to actually set nsAccountLock in a user directly
but move them between these groups.

We need to decide where in the CLI this will happen. Right it is split
between ipa-deluser and ipa-usermod. To inactivate groups for now just
add the group to inactivate or active.
2007-11-20 22:45:29 -05:00
Karl MacMillan
29c0668e98 Bump versions for release. 0001-01-01 00:00:00 +00:00
Rob Crittenden
1967aafa39 Implement the password policy UI and finish IPA policy UI
This includes a default password policy
Custom fields are now read from LDAP. The format is a list of
  dicts with keys: label, field, required.
The LDAP-based configuration now specifies:
    ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title
    ipaGroupSearchFields: cn,description
    ipaSearchTimeLimit: 2
    ipaSearchRecordsLimit: 0
    ipaCustomFields:
    ipaHomesRootDir: /home
    ipaDefaultLoginShell: /bin/sh
    ipaDefaultPrimaryGroup: ipausers
    ipaMaxUsernameLength: 8
    ipaPwdExpAdvNotify: 4
This could use some optimization.
2007-11-16 12:59:32 -05:00
Karl MacMillan
27f0aab667 Rename memberOf to group_members in xml-rpc interface. 0001-01-01 00:00:00 +00:00
Rob Crittenden
303d5ebad9 Have the GUI use memberOf() instead of looping through the member DNs
Fix a bug in the local transport version of memberOf()
2007-10-31 10:08:16 -04:00
Rob Crittenden
1d6e88565c Add memberOf API call to the XML-RPC interface
Make find-groups use memberOf to have a prettier dispaly of members
2007-10-30 15:07:02 -04:00
Rob Crittenden
99b84bfd01 Handle ldap.UNWILLING_TO_PERFORM more gracefully 2007-11-09 16:34:52 -05:00
Rob Crittenden
705d68ddcb Require uniqueness in the name/comment field of delegations
Fix error reporting in the UI to include the detailed message
Sort delegations by name when displaying them
Update the name field from "Name" to "Delegation Name"
2007-11-09 13:58:36 -05:00
Rob Crittenden
e9dfbfa773 Enable multi-value field support for some attributes on the edit pages
Better error reporting in the GUI
Include a document describing how multi-valued fields work
2007-11-08 22:12:42 -05:00
Kevin McCarthy
859291a706 Add delete user and group to webgui.
NOTE: this doesn't handle referential integrity.
2007-10-23 16:46:50 -07:00
Mark McLoughlin
5ec9a55278 Cleanup freeipa-python requires
We don't need the elaborate python requires, since a requires
for e.g. "python-abi = 2.5" is automatically added.

We also don't need the elaborate build requires, since all
it does is query the currently installed version of python
and require that you have it's appropriate python-devel
installed. But if python-devel is installed at all, this
should hold true.

(Also, IMHO the .spec files should be removed from mercurial
since they are automatically generated)

Signed-off-by: Mark McLouglin <markmc@redhat.com>
2008-02-21 15:23:29 +00:00
Rob Crittenden
04636b8ae7 Add an LDAP attribute -> label mapping function to XML-RPC layer
Move some ACI functions around in preparation for cli delegation
2007-10-22 17:06:52 -04:00
Karl MacMillan
1685751b1c Remove dependency between ipa-pyton and ipa-server
Current ipa-python imports and calls code from ipaserver (which is in
the ipa-server package). This makes it impossible to use the admin
tools or the ipa-python package on a system without the server bits
installed. This fixes that in a fairly minimal way.
0001-01-01 00:00:00 +00:00
Kevin McCarthy
5e651a6496 Finish the email autosuggest.
For now I've added a new API call.  The field-specific searching is
a ways off.
2007-10-18 14:33:55 -07:00
Rob Crittenden
ba0adcffb1 Require SSL for the XML-RPC interface 2007-10-19 10:14:30 -04:00
Rob Crittenden
53166669e7 Make distclean work again 2007-10-19 09:53:27 -04:00
Rob Crittenden
bc52446074 Fix build issues by combining patches submitted by Michael Gregg and
Karl MacMillan
Remove #!/usr/bin/python from many files to quiet rpmlint
2007-10-17 11:28:37 -04:00
Karl MacMillan
bd3b07b448 Use setup.py for ipa-python from William Jon McCann <mccann@jhu.edu>. 0001-01-01 00:00:00 +00:00
Kevin McCarthy
233915b780 Add basic delegation editing. 2007-10-15 13:07:39 -07:00
Kevin McCarthy
fbbdd27b53 Creates an update_entry api call, aliases update_user and update_group to it. 2007-10-15 09:04:13 -07:00
Kevin McCarthy
63f7cdf7f7 Adds delegation listing and creation to the GUI. 2007-10-12 15:11:55 -07:00
Kevin McCarthy
52a57a9639 This is a really simple (and dumb) ACI parser for the ACI's we
will need in the delegation UI.
2007-10-11 11:21:27 -07:00
Kevin McCarthy
2b38769b50 Combine get_user/group by dn/cn into get_entry_by_cn/dn.
Also a couple double-escaping fixes I missed in the last patch.
2007-10-09 09:26:16 -07:00
Kevin McCarthy
99c793e2ad Fixes none values in first/last name to display properly. 2007-10-04 12:20:00 -07:00
Kevin McCarthy
2ac1b39f42 Trickle the group_cn to group_dn down the layers. Fix controller calls. 2007-10-03 18:21:41 -07:00
rcritten@redhat.com
53e872fb72 Try to catch more error conditions during installation
Modify the way we detect SELinux to use selinuxenabled instead of using
  a try/except.
Handle SASL/GSSAPI authentication failures when getting a connection
2007-10-03 17:37:13 -04:00
mccann@jhu.edu
3ef4a374f7 Patch to fix the installer crashing if selinux is disabled. Also changes
the exception to contain the complete command.
Add a check to make sure installer is running as root.
Add signal handler to detect a user-cancelled installation.
Detect existing DS instances and prompt to remove them.
2007-10-02 16:56:51 -04:00
rcritten@redhat.com
6aa72b44e4 Do group operations based on the group DN, not the CN
Add new class of errors for connections
Raise an exception if a connection cannot be made due to missing ccache
2007-10-02 16:56:51 -04:00
Simo Sorce
cfac4acf9f Rely more on kerberos.
Don't read ipa.conf to get the realm, the kerberos libs do that for you.
Use the krbPrincipalName to change passwords
Make it possible to specify the principal at user creation.
Mail is not a required attribute so far, don't require it.
2007-10-01 17:33:16 -04:00
Kevin McCarthy
dbf8c1aeb9 Add group management to the user edit page.
Added a couple more API calls to make the inverse operations easier.
2007-09-28 16:01:42 -07:00
Kevin McCarthy
572b3e9fdd Make timelimit a parameter to the find methods. 2007-09-27 15:51:26 -07:00
Karl MacMillan
679343594d Install the web gui
Install the turbogears web gui including an init script. This
patch includes a few related changes:

* create a production configuration
* rename the web gui startup scrip to ipa-webgui
* add an init script
* chkconfig on the ipa-webgui init script
* make the start script properly daemonize the app when not
  in a development directory.
* Install everything to the correct places (/usr/sbin/ipa-webgui
  and /usr/share/ipa/ipagui mainly).

There are some things still left to do:

* Sort out the logging - the config needs to be adjusted so
  that logging messages end up in /var/log.
0001-01-01 00:00:00 +00:00
Karl MacMillan
50d12d6d2e Misc small fixes
* Remove the rpmbuild tree with the dist-clean target.
* Move ipa-server-setupssl from /usr/sbin to /usr/share/ipa
* Check in requirement change for generated freeipa-python.spec
* Fix interactive hostname in ipa-server-install.
0001-01-01 00:00:00 +00:00
Kevin McCarthy
1725397a53 Adds methods to manipulate groups by dns.
Renamed some of the user_group parameters to be self-evident.
Binary wrapping isn't necessary on strings, so removed from xmlrpc calls.
2007-09-26 15:47:34 -07:00
Kevin McCarthy
fa7759684f Adds manager and direct reports to usershow page.
Fixes a bug with the group by member where is wasn't trapping not found errors.
2007-09-25 15:44:49 -07:00
Kevin McCarthy
765279d82b Show the list of groups a user belongs to. 2007-09-25 13:35:43 -07:00
rcritten@redhat.com
7b96973711 Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
Add ipa-passwd tool
Add simple field validation package
This patch adds a package requirement, python-krbV. This is needed to
 determine the current user based on their kerberos ticket.
2007-09-21 10:24:36 -04:00
Simo Sorce
fbfefe6b0e Merge conflicts between rob and kevin patches 2007-09-20 16:58:54 -04:00
Kevin McCarthy
f17071533a Implement asynchronous search for groups.
Use the filter generation code to search on multiple fields.
2007-09-19 08:42:34 -07:00
Kevin McCarthy
6b3d1e85da Add client-side search limit parameter for user search.
Limit editgroup user ajax search.
Minor UI cleanup for editgroup.
2007-09-18 14:58:30 -07:00
rcritten@redhat.com
b85668579e Use ticket forwarding with TurboGears. mod_proxy forwards the principal
name and location of the keytab. In order for this keytab to be usable
 TurboGears and Apache will need to run as the same user. We will also need
 to listen only on localhost in TG.
2007-09-14 17:19:02 -04:00
Simo Sorce
5898ae527a In the TCP case there is an extra (redundant) lenght
field before the packet data, address the problem.
2007-09-12 11:51:16 -04:00
rcritten@redhat.com
ed6ab17c9c Add function to allow user's to set/reset their kerberos password
Remove some unused calls to retrieve the current realm
2007-09-11 02:48:53 -04:00
Karl MacMillan
d0c856d547 Reset version numbers for next milestone. 0001-01-01 00:00:00 +00:00
Karl MacMillan
d15ad0f26a Update version numbers for release. 0001-01-01 00:00:00 +00:00
Kevin McCarthy
3afd023c3a Generalized Time parser and tests, for use in krbPasswordExpiration 2007-09-04 13:44:59 -07:00
Simo Sorce
584baa7ee2 merge ipa-server/ipaserver/util.py into ipa-python/ipautil.py
this way freeipa-client does not depend on freeipa-server
2007-09-04 16:13:15 -04:00
Kevin McCarthy
c85c8eede3 Add 'test' target to makefiles. Hook up ipautil tests to run. 2007-09-04 10:22:45 -07:00
Kevin McCarthy
a57fe697a7 Fix python-ldap attribution for cidict. 2007-08-27 09:49:35 -07:00
Kevin McCarthy
e9bd8dee3b Change user search to be asynchronous.
This way it returns results even if the search times out.
The find_users() search now returns a counter as the first result, which
is set to -1 if the results are partial.
2007-08-28 16:01:07 -07:00
rcritten@redhat.com
eebaa73d3d Implement delete users and groups
Implement adding a group to a group
Some other small fixups
Add new cmd-line tool ipa-delgroup
2007-08-28 13:52:08 -04:00
Karl MacMillan
6eea6664e0 This patch wraps binary data in an xmlrpclib Binary object. This
removes the need for LDIF conversion.  It will make TurboGears direct
code faster, but should keep xmlrpc about the same speed.

The patch also swaps out ldap.cidict for the IPA CIDict class.  IPA code
should only use the CIDict class now.
0001-01-01 00:00:00 +00:00
Karl MacMillan
f437ecfad1 Fix minor error in previous patch. 0001-01-01 00:00:00 +00:00
Kevin McCarthy
c7c8aa0926 Add ipautil, which contains CIDict - a case insensitive dict.
This version of the cidict extends the dict class, which allows it to
play nicely with turbogears.
Also includes extensive tests.
2007-08-24 10:31:45 -07:00
rcritten@redhat.com
861cda3cb5 Initial support for Groups
Create separate object for Users and Groups (using same base class)
Check for uniqueness before adding new users and groups
Remove user_container from everything but add operations
Abstract out a number of functions that are common across users and groups
Make sure all strings passed in to be in a filter are checked
Add new error message: No modifications specified
2007-08-24 15:42:56 -04:00
rcritten@redhat.com
240a99b6f3 Move add user logic to the server side 2007-08-23 11:57:25 -04:00
rcritten@redhat.com
8879ee173e Handle optional arguments by using the value __NONE__ over XML-RPC.
rpcclient.py must call XML-RPC functions with all arguments.
Removed encode_args and decode_args. They were the source of most of the
  argument pain. Now opts is alwyas appended to the end of the arguments
  so MUST be the last argument in any server-side function (can be None)
Allow the User object to handle unicode data
Small fixes to command-line tools to be friendlier
Broke out get_user() into get_user_by_dn() and get_user_by_uid()
Need to request more than just 'nsAccountLock' attribute when trying to
  see if a user is already marked deleted. If it is blank the record
  coming back is empty. Add 'uid' to the list to guarantee something coming
  back (dn is handled specially)
Added user_container attribute to get_user_* and add_user so the caller
  can specify where in the tree the user will be searched for/added.
Added global default value for user_container
2007-08-23 09:44:00 -04:00
Kevin McCarthy
7691653c0a Create ipaerror module.
Move LDAPError trapping/conversion into the ipaldap module.
Fix xmlrpc layer to encode/decode ipaerrors properly.
Also, implement mid-air collision exception for updates.
2007-08-22 10:30:51 -07:00
Kevin McCarthy
cb03961ff1 Convert add_user to take a user instead of a dict. 2007-08-20 12:10:50 -07:00