Alexander Bokovoy 08d7209828 baseldap: allow rejecting unknown objects instead of adding to an external attr ...

IPA traditionally allowed to add names not found in IPA LDAP to external
attributes. This is used to allow, for example, a local system user or
group be present in a SUDO rule.

With membership validator, we can actually check validity of the names
against both IPA users/groups and users/groups from trusted domains.
If in future we decide to reject a local system's objects, then all it
would take is to switch reject_failures to True.

Fixes: https://pagure.io/freeipa/issue/3226
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

2021-01-26 13:05:27 -05:00

..

__init__.py

Change FreeIPA license to GPLv3+

2010-12-20 17:19:53 -05:00

aci.py

Use ACI class set_permissions() method to set permissions

2020-09-14 09:15:59 +03:00

automember.py

Fixes pylint errors introduced by version 2.4.0.

2019-09-27 09:38:32 +02:00

automount.py

Reworked the renaming mechanism

2017-03-27 19:08:26 +02:00

baseldap.py

baseldap: allow rejecting unknown objects instead of adding to an external attr

2021-01-26 13:05:27 -05:00

baseuser.py

baseuser: fix ipanthomedirectorydrive option name

2020-06-16 19:06:02 -04:00

batch.py

CVE-2019-10195: Don't log passwords embedded in commands in calls using batch

2019-11-26 15:24:20 +02:00

ca.py

ca plugin: improve doc

2020-07-07 10:07:48 -04:00

caacl.py

LGTM: raise handle_not_found()

2018-01-09 07:53:28 +01:00

cert.py

dnspython: Add compatibility shim

2020-08-31 09:46:03 +03:00

certmap.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

certprofile.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

config.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

delegation.py

Fix errors found by Pylint-2.4.3

2019-10-21 18:01:32 +11:00

dns.py

dns: allow PTR records in arbitrary zones

2020-11-11 10:24:38 +02:00

dnsserver.py

dnsserver.py: dnsserver-find no longer returns internal server error

2017-06-15 13:51:06 +02:00

dogtag.py

Let dogtag.py be imported if the api is not initialized

2020-11-02 10:43:57 -05:00

domainlevel.py

Use api.env.container_masters

2019-03-28 00:21:00 +01:00

group.py

Prevent local account takeover

2020-06-15 22:44:42 +03:00

hbac.py

ipalib: move server-side plugins to ipaserver

2016-06-03 09:00:34 +02:00

hbacrule.py

ipaserver/plugins/hbacrule: Add HBAC to memberservice_hbacsvc* labels

2020-02-24 15:02:24 +01:00

hbacsvc.py

remove trailing newlines form python modules

2016-10-12 10:38:52 +02:00

hbacsvcgroup.py

remove trailing newlines form python modules

2016-10-12 10:38:52 +02:00

hbactest.py

support using trust-related operations in the server console

2020-06-08 12:39:34 -04:00

host.py

Allow leading/trailing whitespaces in passwords

2020-12-18 16:47:59 +02:00

hostgroup.py

Allow rename of a host group

2020-03-31 09:21:37 +03:00

idrange.py

support using trust-related operations in the server console

2020-06-08 12:39:34 -04:00

idviews.py

idviews: add extended validator for users from trusted domains

2021-01-26 13:05:27 -05:00

internal.py

Unify spelling of "One-Time Password" (take 2)

2020-06-24 14:55:27 +02:00

join.py

Delay import of psutil to avoid AVC

2020-09-23 14:49:15 +02:00

krbtpolicy.py

Reset per-indicator Kerberos policy

2019-12-18 14:16:33 +01:00

ldap2.py

Optimize user-add by caching ldap2.has_upg()

2019-12-05 15:07:57 +01:00

location.py

Fix div-by-zero when svc weight is 0 for all masters in location

2020-02-26 13:42:10 -05:00

migration.py

Terminology improvements: use block list

2020-06-23 10:16:29 +02:00

misc.py

Make env and plugins commands local again

2016-12-02 13:00:06 +01:00

netgroup.py

LGTM: raise handle_not_found()

2018-01-09 07:53:28 +01:00

otp.py

ipalib: move server-side plugins to ipaserver

2016-06-03 09:00:34 +02:00

otpconfig.py

ipalib: move server-side plugins to ipaserver

2016-06-03 09:00:34 +02:00

otptoken.py

Change FreeIPA references to IPA and Identity Management

2021-01-21 13:51:45 +01:00

passwd.py

logging: remove object-specific loggers

2017-07-14 15:55:59 +02:00

permission.py

Remove virtual attributes before rolling back a permission

2021-01-13 13:50:45 +01:00

ping.py

ipalib: move server-side plugins to ipaserver

2016-06-03 09:00:34 +02:00

pkinit.py

Don't fail if config-show does not return servers

2019-03-28 17:57:58 +01:00

privilege.py

Privilege: add a helper checking if a principal has a given privilege

2020-03-05 14:40:58 +01:00

pwpolicy.py

Extend IPA pwquality plugin to include libpwquality support

2020-10-23 09:32:52 -04:00

rabase.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

radiusproxy.py

radiusproxy: add permission for reading radius proxy servers

2018-11-13 12:40:44 +01:00

realmdomains.py

Fix pylint 2.0 return-related violations

2018-07-11 10:11:38 +02:00

role.py

Support adding user ID overrides as group and role members

2020-06-08 12:39:34 -04:00

schema.py

Fix E713 test for membership should be 'not in'

2020-05-05 10:42:46 +02:00

selfservice.py

Fix errors found by Pylint-2.4.3

2019-10-21 18:01:32 +11:00

selinuxusermap.py

Fix E711 comparison to None

2020-05-05 10:42:46 +02:00

server.py

Privilege: add a helper checking if a principal has a given privilege

2020-03-05 14:40:58 +01:00

serverrole.py

servrole: takes_params must be a tuple

2020-04-27 10:15:58 +02:00

serverroles.py

Improve config-show to show hidden servers

2019-03-28 17:57:58 +01:00

service.py

Terminology improvements: use allow list

2020-06-23 10:16:29 +02:00

servicedelegation.py

service delegation: allow to add and remove host principals

2020-05-14 21:47:17 +03:00

session.py

Fix some untranslatable commands in Web UI API Browser

2018-06-21 18:42:05 +02:00

stageuser.py

Fix E722 do not use bare 'except'

2020-05-05 10:42:46 +02:00

sudo.py

ipalib: move server-side plugins to ipaserver

2016-06-03 09:00:34 +02:00

sudocmd.py

sudocmd: fix unsupported assignment

2017-09-08 15:42:07 +02:00

sudocmdgroup.py

remove trailing newlines form python modules

2016-10-12 10:38:52 +02:00

sudorule.py

sudorule runAs: allow to add users and groups from trusted domains directly

2021-01-26 13:05:27 -05:00

topology.py

domainlevel-get: fix various issues when running as non-admin

2019-03-25 09:48:31 +01:00

trust.py

ipaserver/dcerpc: store forest topology as a blob in ipasam

2021-01-22 12:21:33 -05:00

user.py

Prevent local account takeover

2020-06-15 22:44:42 +03:00

vault.py

Consolidate container_masters queries

2019-03-28 00:21:00 +01:00

virtual.py

extract virtual operation access check subroutine

2020-06-30 11:47:29 +02:00

whoami.py

whoami.py: Type error when running tests

2017-07-07 14:44:42 +02:00

xmlserver.py

Add endpoint for serving i18n requests

2018-07-17 15:32:28 -04:00