From ssorce at redhat.com Mon Oct 1 03:42:25 2007 From: ssorce at redhat.com (Simo Sorce) Date: Sun, 30 Sep 2007 23:42:25 -0400 Subject: [Freeipa-devel] Milestone 4 almost done In-Reply-To: <1191190549.28109.4.camel@laptop.local> References: <1191013043.12112.60.camel@laptop.local> <1191173302.3284.3.camel@localhost.localdomain> <1191190549.28109.4.camel@laptop.local> Message-ID: <1191210145.3155.11.camel@localhost.localdomain> On Sun, 2007-09-30 at 18:15 -0400, Karl MacMillan wrote: > On Sun, 2007-09-30 at 13:28 -0400, Simo Sorce wrote: > > On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote: > > > I'm planning on pushing out a milestone 4 release on Monday after doing > > > some testing. Other than some pending patches from Kevin, anything else > > > need to be merged for this release? > > > > I am still having problems with apache and kerberos > > > > My debugging on the plane turns out to show that a call to the kerberos > > library tells back that I have no delegated credentials (but klist shows > > the ticket is forwardable). > > > > It would be nice to understand if it is something in my environment that > > is wrong or if there is a more general problem and what causes it. > > > > On Monday I hope to have the time to install an F-7 from scratch and see > > if I can install and make it working. > > > > Have you upgraded your mod_auth_kerb and installed the new PyKerberos > that Rob posted Fri? That (and setting my hostname correctly) fixed all > of my problems. I have the mod_auth_kerb (recompiled multiple times and with added debug options to understand what was wrong as well :-) Didn't see any new PyKerberos package, will try that eventually. > It would be great if you could test everything on Mon. and let me know > if it works. If it does that would mean that at least 3 of us have > everything working - which would count as well tested at this point :) Crossing fingers :) > The only thing I have to do to reinstall is: > > a) stop all of the ipa components > b) delete the dirsrv instance > > Does that match your experience? IIRC yes, but we need to test more. > We could automate that, but I hesitate > to delete data. Maybe offer to move aside the dirsrv instance data? Dunno, maybe tar it up. > Also > - do we _really_ need the guid naming for the dirsrv instance. It is > really a pain and I'm not convinced that we need uniqueness like that. Maybe use the REALM name for that? Would it make more sense? > Also - do we need a convenient way to start/stop all of the IPA related > daemons? Not sure, do we really need that as a convenience? > Regardless, let's put some solution on the list of things to do, but not > delay milestone 4. ACK Simo. From ssorce at redhat.com Mon Oct 1 03:44:57 2007 From: ssorce at redhat.com (Simo Sorce) Date: Sun, 30 Sep 2007 23:44:57 -0400 Subject: [Freeipa-devel] new PyKerberos with delegation In-Reply-To: <46FD664F.5080701@redhat.com> References: <46FD664F.5080701@redhat.com> Message-ID: <1191210297.3155.14.camel@localhost.localdomain> On Fri, 2007-09-28 at 16:38 -0400, Rob Crittenden wrote: > I fixed this way back at the end of August and never sent it out... > > The first PyKerberos I built didn't set the GSS_C_DELEG_FLAG flag so > wouldn't do ticket forwarding. This one adds a patch that sets it. I bet it was this one, I debugged mod_auth_kerb exactly to the point I found I had no delegation accordingly to the libkrb call that finds it out. > If you're having problems with the IPA command-line tools try this out. I'll do tomorrow, it is great if this is all is needed to fix my issues. Simo. From rcritten at redhat.com Mon Oct 1 13:12:08 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 09:12:08 -0400 Subject: [Freeipa-devel] Milestone 4 almost done In-Reply-To: <1191173302.3284.3.camel@localhost.localdomain> References: <1191013043.12112.60.camel@laptop.local> <1191173302.3284.3.camel@localhost.localdomain> Message-ID: <4700F228.4050301@redhat.com> Simo Sorce wrote: > On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote: >> I'm planning on pushing out a milestone 4 release on Monday after doing >> some testing. Other than some pending patches from Kevin, anything else >> need to be merged for this release? > > I am still having problems with apache and kerberos > > My debugging on the plane turns out to show that a call to the kerberos > library tells back that I have no delegated credentials (but klist shows > the ticket is forwardable). You need an updated PyKerberos rpm, PyKerberos-0.1735-2. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From rcritten at redhat.com Mon Oct 1 13:15:00 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 09:15:00 -0400 Subject: [Freeipa-devel] Milestone 4 almost done In-Reply-To: <1191190549.28109.4.camel@laptop.local> References: <1191013043.12112.60.camel@laptop.local> <1191173302.3284.3.camel@localhost.localdomain> <1191190549.28109.4.camel@laptop.local> Message-ID: <4700F2D4.3070705@redhat.com> Karl MacMillan wrote: > On Sun, 2007-09-30 at 13:28 -0400, Simo Sorce wrote: >> On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote: >>> I'm planning on pushing out a milestone 4 release on Monday after doing >>> some testing. Other than some pending patches from Kevin, anything else >>> need to be merged for this release? >> I am still having problems with apache and kerberos >> >> My debugging on the plane turns out to show that a call to the kerberos >> library tells back that I have no delegated credentials (but klist shows >> the ticket is forwardable). >> >> It would be nice to understand if it is something in my environment that >> is wrong or if there is a more general problem and what causes it. >> >> On Monday I hope to have the time to install an F-7 from scratch and see >> if I can install and make it working. >> > > Have you upgraded your mod_auth_kerb and installed the new PyKerberos > that Rob posted Fri? That (and setting my hostname correctly) fixed all > of my problems. > > It would be great if you could test everything on Mon. and let me know > if it works. If it does that would mean that at least 3 of us have > everything working - which would count as well tested at this point :) > >> Another problem we have and that we ditched so far is installing on >> dirty systems. So far we thought we should not support it because we >> install on clean systems. Yesterday (always on the plane) I found out >> why we are wrong: I hit ctrl-c in the middle of the installation. >> Rerunning ipa-server-install didn't work. This is not acceptable IMO. >> Not sure if this should impact at all Milestone 4, comments are welcome. >> > > The only thing I have to do to reinstall is: > > a) stop all of the ipa components > b) delete the dirsrv instance > > Does that match your experience? We could automate that, but I hesitate > to delete data. Maybe offer to move aside the dirsrv instance data? Also > - do we _really_ need the guid naming for the dirsrv instance. It is > really a pain and I'm not convinced that we need uniqueness like that. What we can do is detect another DS instance and simply refuse to do anything until it is gone. Let the user delete the data. > Also - do we need a convenient way to start/stop all of the IPA related > daemons? I'm not sure why one would need to do this. > Regardless, let's put some solution on the list of things to do, but not > delay milestone 4. > I agree. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From ssorce at redhat.com Mon Oct 1 13:47:28 2007 From: ssorce at redhat.com (Simo Sorce) Date: Mon, 01 Oct 2007 09:47:28 -0400 Subject: [Freeipa-devel] Milestone 4 almost done In-Reply-To: <4700F228.4050301@redhat.com> References: <1191013043.12112.60.camel@laptop.local> <1191173302.3284.3.camel@localhost.localdomain> <4700F228.4050301@redhat.com> Message-ID: <1191246448.3155.34.camel@localhost.localdomain> On Mon, 2007-10-01 at 09:12 -0400, Rob Crittenden wrote: > Simo Sorce wrote: > > On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote: > >> I'm planning on pushing out a milestone 4 release on Monday after doing > >> some testing. Other than some pending patches from Kevin, anything else > >> need to be merged for this release? > > > > I am still having problems with apache and kerberos > > > > My debugging on the plane turns out to show that a call to the kerberos > > library tells back that I have no delegated credentials (but klist shows > > the ticket is forwardable). > > You need an updated PyKerberos rpm, PyKerberos-0.1735-2. Yeah that was it, as soon as I installed this new one, all worked perfectly. Too bad I lost hours on this, but I am glad it is solved. Simo. From ssorce at redhat.com Mon Oct 1 15:53:38 2007 From: ssorce at redhat.com (Simo Sorce) Date: Mon, 01 Oct 2007 11:53:38 -0400 Subject: [Freeipa-devel] [PATCH] Use more krb Message-ID: <1191254018.10954.3.camel@hopeson> This patch changes a bit of code to rely more on kerberos. It also changes ipa-adduser to something I think is a more useful workflow, it does not require an email for example as we don't need it. Instead it allows passing a principal name in case you need to create specific one or want to avoid conflicts with an exiting one. This patch also removes some classes we don't want to use by default for users. Note: this patch may not apply cleanly as a pull from upstream after the commit required me a merge. I have the merge patch in my tree so just ack/nack it and I will push both the patch and the merge patch at the same time. Simo. -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-223-more-krb.patch Type: text/x-patch Size: 15976 bytes Desc: not available URL: From rcritten at redhat.com Mon Oct 1 16:19:37 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 12:19:37 -0400 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <1191254018.10954.3.camel@hopeson> References: <1191254018.10954.3.camel@hopeson> Message-ID: <47011E19.4090007@redhat.com> Simo Sorce wrote: > This patch changes a bit of code to rely more on kerberos. > > It also changes ipa-adduser to something I think is a more useful > workflow, it does not require an email for example as we don't need it. > Instead it allows passing a principal name in case you need to create > specific one or want to avoid conflicts with an exiting one. What about the other tools? > This patch also removes some classes we don't want to use by default for > users. > > Note: this patch may not apply cleanly as a pull from upstream after the > commit required me a merge. I have the merge patch in my tree so just > ack/nack it and I will push both the patch and the merge patch at the > same time. I'd rather ack the actual patch that is going to be committed. Other comments in-line in the code, marked by [] # HG changeset patch # User Simo Sorce # Date 1191252940 14400 # Node ID fbee5ea59a1f622aadcbf14c545c877920fd1458 # Parent e950c62a04f9d472d287bcf91012a2a1294cb014 Rely more on kerberos. Don't read ipa.conf to get the realm, the kerberos libs do that for you. Use the krbPrincipalName to change passwords Make it possible to specify the principal at user creation. Mail is not a required attribute so far, don't require it. [ E-mail is required in the GUI so I made it required here for consistency. ] diff -r e950c62a04f9 -r fbee5ea59a1f ipa-admintools/ipa-adduser --- a/ipa-admintools/ipa-adduser Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-admintools/ipa-adduser Mon Oct 01 11:35:40 2007 -0400 @@ -28,6 +28,7 @@ import ipa.config import xmlrpclib import kerberos +import krbV import ldap import getpass @@ -51,8 +52,10 @@ def parse_options(): help="Set user's login shell to shell") parser.add_option("-G", "--groups", dest="groups", help="Add account to one or more groups (comma-separated)") + parser.add_option("-k", "--krb-principal", dest="principal", + help="Set user's Kerberos Principal Name") parser.add_option("-M", "--mailAddress", dest="mail", - help="Set uesr's e-mail address") + help="Set user's e-mail address") parser.add_option("--usage", action="store_true", help="Program usage") @@ -66,8 +69,9 @@ def main(): givenname = "" lastname = "" username = "" + principal = "" password = "" - mail = "" + mail = "" gecos = "" directory = "" shell = "" @@ -100,7 +104,7 @@ def main(): cont = False if not options.sn: while (cont != True): - lastname = raw_input(" Last name: ") + lastname = raw_input("Last name: ") if (ipavalidate.plain(lastname, notEmpty=True)): print "Field is required and must be letters or '" else: @@ -140,18 +144,10 @@ def main(): else: password = options.sn - cont = False - if not options.mail: - while (cont != True): - mail = raw_input("E-mail addr: ") - if (ipavalidate.email(mail)): - print "Field is required and must include a user and domain name" - else: - cont = True - else: + if options.mail: mail = options.mail if (ipavalidate.email(mail)): - print "E-mail is required and must include a user and domain name" + print "The email provided seem not a valid email." return 1 # Ask the questions we don't normally force. We don't require answers @@ -168,8 +164,10 @@ def main(): cont = False if not options.directory: while (cont != True): - directory = raw_input("home directory []: ") - if (ipavalidate.path(gecos, notEmpty=False)): + directory = raw_input("home directory [/home/"+username+"]: ") + if directory == "": + directory = "/home/"+username [ /home should not be hardcoded here. It is currently hardcoded on the server side. This needs not be hardcoded anywhere but should be stored in LDAP somewhere. I'd rather not have to fix both places in the future though. ] + if (ipavalidate.path(directory, notEmpty=False)): print "Must be letters, numbers, spaces or '" else: cont = True @@ -180,29 +178,26 @@ def main(): if len(shell) < 1: shell = None - cont = True - cont = False - if not options.groups: - while (cont != True): - g = raw_input("Add to group [blank to exit]: ") - - if len(g) < 1: - cont = True - else: - if (ipavalidate.path(g, notEmpty=False)): - print "Must be letters, numbers, spaces or '" - else: - groups = groups + "," + g [ Why not add groups at the same time? ] + cont = True + else: gecos = options.gecos directory = options.directory shell = options.shell groups = options.groups + if options.principal: + principal = options.principal + else: + ctx = krbV.default_context() + principal = username + "@" + ctx.default_realm + user.setValue('givenname', givenname) user.setValue('sn', lastname) user.setValue('uid', username) - user.setValue('mail', mail) + user.setValue('krbprincipalname', principal) + if mail: + user.setValue('mail', mail) if gecos: user.setValue('gecos', gecos) if directory: @@ -231,7 +226,7 @@ def main(): # Set the User's password if password is not None: try: - client.modifyPassword(username, None, password) + client.modifyPassword(principal, None, password) except ipa.ipaerror.IPAError, e: print "User added but setting the password failed." print "%s" % (e.message) diff -r e950c62a04f9 -r fbee5ea59a1f ipa-admintools/ipa-passwd --- a/ipa-admintools/ipa-passwd Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-admintools/ipa-passwd Mon Oct 01 11:35:40 2007 -0400 @@ -44,12 +44,12 @@ def parse_options(): return options, args -def get_principal(): +def get_principal(krbctx): try: - ctx = krbV.default_context() - ccache = ctx.default_ccache() + ccache = krbctx.default_ccache() cprinc = ccache.principal() except krbV.Krb5Error, e: + #TODO: do a kinit print "Unable to get kerberos principal: %s" % e[1] return None @@ -57,39 +57,47 @@ def get_principal(): def main(): match = False + username = None + principal = None + krbctx = krbV.default_context() options, args = parse_options() if len(args) == 2: username = args[1] else: - username = get_principal() - if username is None: + principal = get_principal(krbctx) + if principal is None: return 1 - u = username.split('@') - if len(u) > 1: - username = u[0] + if not principal: + u = username.split('@') + if len(u) > 2 or len(u) == 0: + print "Invalid user name (%s)" % username + if len(u) == 1: + principal = username+"@"+krbctx.default_realm + else: + principal = username - print "Changing password for %s" % username + print "Changing password for %s" % principal while (match != True): # No syntax checking of the password is required because that is done # on the server side password = getpass.getpass(" New Password: ") - confirm = getpass.getpass(" New Password (again): ") + confirm = getpass.getpass(" Confirm Password: ") if (password != confirm): print "Passwords do not match" match = False + elif (len(password) < 1): + print "Password cannot be empty" + match = False else: match = True - if (len(password) < 1): - print "Password cannot be empty" - match = False try: client = ipaclient.IPAClient() - client.modifyPassword(username, None, password) + client.modifyPassword(principal, None, password) except ipa.ipaerror.IPAError, e: print "%s" % (e.message) return 1 diff -r e950c62a04f9 -r fbee5ea59a1f ipa-python/freeipa-python.spec --- a/ipa-python/freeipa-python.spec Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-python/freeipa-python.spec Mon Oct 01 11:35:40 2007 -0400 @@ -10,7 +10,7 @@ BuildRoot: %{_tmppath}/%{name}-%{ve BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildArch: noarch -Requires: python PyKerberos python-krbV +Requires: python PyKerberos [ This looks like a mis-merge. python-krbV is required now ] %{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")} diff -r e950c62a04f9 -r fbee5ea59a1f ipa-python/ipaclient.py --- a/ipa-python/ipaclient.py Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-python/ipaclient.py Mon Oct 01 11:35:40 2007 -0400 @@ -34,7 +34,6 @@ class IPAClient: def __init__(self,local=None): self.local = local - ipa.config.init_config() if local: self.transport = funcs.IPAServer() # client needs to call set_principal(user at REALM) @@ -80,8 +79,6 @@ class IPAClient: def add_user(self,user,user_container=None): """Add a user. user is a ipa.user.User object""" - realm = config.config.get_realm() - user_dict = user.toDict() # dn is set on the server-side @@ -125,30 +122,24 @@ class IPAClient: def update_user(self,user): """Update a user entry.""" - realm = config.config.get_realm() - result = self.transport.update_user(user.origDataDict(), user.toDict()) return result def delete_user(self,uid): """Delete a user entry.""" - realm = config.config.get_realm() - result = self.transport.delete_user(uid) return result - def modifyPassword(self,uid,oldpass,newpass): + def modifyPassword(self,principal,oldpass,newpass): """Modify a user's password""" - result = self.transport.modifyPassword(uid,oldpass,newpass) + result = self.transport.modifyPassword(principal,oldpass,newpass) return result def mark_user_deleted(self,uid): """Set a user as inactive by uid.""" - - realm = config.config.get_realm() result = self.transport.mark_user_deleted(uid) return result @@ -181,8 +172,6 @@ class IPAClient: def add_group(self,group,group_container=None): """Add a group. group is a ipa.group.Group object""" - realm = config.config.get_realm() - group_dict = group.toDict() # dn is set on the server-side @@ -237,6 +226,8 @@ class IPAClient: def add_user_to_group(self, user_uid, group_cn): """Add a user to an existing group. + user is a uid of the user to add + group is the cn of the group to be added to """ return self.transport.add_user_to_group(user_uid, group_cn) @@ -252,6 +243,8 @@ class IPAClient: def remove_user_from_group(self, user_uid, group_cn): """Remove a user from an existing group. + user is a uid of the user to remove + group is the cn of the group to be removed from """ return self.transport.remove_user_from_group(user_uid, group_cn) diff -r e950c62a04f9 -r fbee5ea59a1f ipa-python/rpcclient.py --- a/ipa-python/rpcclient.py Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-python/rpcclient.py Mon Oct 01 11:35:40 2007 -0400 @@ -212,7 +212,7 @@ class RPCClient: return result - def modifyPassword(self,uid,oldpass,newpass): + def modifyPassword(self,principal,oldpass,newpass): """Modify a user's password""" server = self.setup_server() @@ -220,7 +220,7 @@ class RPCClient: oldpass = "__NONE__" try: - result = server.modifyPassword(uid,oldpass,newpass) + result = server.modifyPassword(principal,oldpass,newpass) except xmlrpclib.Fault, fault: raise ipaerror.gen_exception(fault.faultCode, fault.faultString) except socket.error, (value, msg): diff -r e950c62a04f9 -r fbee5ea59a1f ipa-server/ipa-gui/ipagui/controllers.py --- a/ipa-server/ipa-gui/ipagui/controllers.py Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-server/ipa-gui/ipagui/controllers.py Mon Oct 01 11:35:40 2007 -0400 @@ -191,7 +191,7 @@ class Root(controllers.RootController): try: if password_change: - rv = client.modifyPassword(kw['uid'], "", kw.get('userpassword')) + rv = client.modifyPassword(kw['krbprincipalname'], "", kw.get('userpassword')) except ipaerror.IPAError, e: turbogears.flash("User password change failed: " + str(e)) return dict(form=user_edit_form, user=kw, diff -r e950c62a04f9 -r fbee5ea59a1f ipa-server/xmlrpc-server/funcs.py --- a/ipa-server/xmlrpc-server/funcs.py Fri Sep 28 14:55:28 2007 -0400 +++ b/ipa-server/xmlrpc-server/funcs.py Mon Oct 01 11:35:40 2007 -0400 @@ -20,12 +20,12 @@ import sys import sys sys.path.append("/usr/share/ipa") +import krbV import ldap import ipaserver.dsinstance import ipaserver.ipaldap import ipa.ipautil import xmlrpclib -import ipa.config import copy from ipa import ipaerror @@ -86,11 +86,12 @@ class IPAServer: self.bindcert = "/usr/share/ipa/cert.pem" self.bindkey = "/usr/share/ipa/key.pem" self.bindca = "/usr/share/ipa/cacert.asc" - + self.krbctx = krbV.default_context() + self.realm = self.krbctx.default_realm + if _LDAPPool is None: _LDAPPool = IPAConnPool() - ipa.config.init_config() - self.basedn = ipa.ipautil.realm_to_suffix(ipa.config.config.get_realm()) + self.basedn = ipa.ipautil.realm_to_suffix(self.realm) self.scope = ldap.SCOPE_SUBTREE self.princ = None self.krbccache = None @@ -311,6 +312,15 @@ class IPAServer: filter = "(objectClass=*)" return self.__get_entry(dn, filter, sattrs, opts) + def get_user_by_principal(self, principal, sattrs=None, opts=None): + """Get a user entry searching by Kerberos Principal Name. + Return as a dict of values. Multi-valued fields are + represented as lists. + """ + + filter = "(krbPrincipalName="+self.__safe_filter(principal)+")" + return self.__get_entry(self.basedn, filter, sattrs, opts) + def get_users_by_manager (self, manager_dn, sattrs=None, opts=None): """Gets the users that report to a particular manager. """ @@ -350,8 +360,7 @@ class IPAServer: # FIXME: What is the default group for users? user['gidnumber'] = '501' - realm = ipa.config.config.get_realm() - user['krbprincipalname'] = "%s@%s" % (user.get('uid'), realm) + user['krbprincipalname'] = "%s@%s" % (user.get('uid'), self.realm) [ You need to check to see if krbprincipalname is already set ] # FIXME. This is a hack so we can request separate First and Last # name in the GUI. @@ -562,31 +571,31 @@ class IPAServer: The memberOf plugin handles removing the user from any other groups. """ - user_dn = self.get_user_by_uid(uid, ['dn', 'uid', 'objectclass'], opts) - if user_dn is None: + user = self.get_user_by_uid(uid, ['dn', 'uid', 'objectclass'], opts) + if user is None: raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND) conn = self.getConnection(opts) try: - res = conn.deleteEntry(user_dn['dn']) + res = conn.deleteEntry(user['dn']) finally: self.releaseConnection(conn) return res - def modifyPassword (self, uid, oldpass, newpass, opts=None): + def modifyPassword (self, principal, oldpass, newpass, opts=None): """Set/Reset a user's password uid tells us who's password to change oldpass is the old password (if available) newpass is the new password """ - user_dn = self.get_user_by_uid(uid, ['dn', 'uid', 'objectclass'], opts) - if user_dn is None: + user = self.get_user_by_principal(principal, ['krbprincipalname'], opts) + if user is None or user['krbprincipalname'] != principal: raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND) [ If you do a search on principal how could user['principalname] ever != principal? ] conn = self.getConnection(opts) try: - res = conn.modifyPassword(user_dn['dn'], oldpass, newpass) + res = conn.modifyPassword(user['dn'], oldpass, newpass) finally: self.releaseConnection(conn) return res -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From kmccarth at redhat.com Mon Oct 1 16:40:01 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Mon, 1 Oct 2007 09:40:01 -0700 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <1191254018.10954.3.camel@hopeson> References: <1191254018.10954.3.camel@hopeson> Message-ID: <20071001164000.GC3697@moon.usersys.redhat.com> Simo Sorce wrote: > This patch changes a bit of code to rely more on kerberos. > > It also changes ipa-adduser to something I think is a more useful > workflow, it does not require an email for example as we don't need it. > Instead it allows passing a principal name in case you need to create > specific one or want to avoid conflicts with an exiting one. > > This patch also removes some classes we don't want to use by default for > users. > > Note: this patch may not apply cleanly as a pull from upstream after the > commit required me a merge. I have the merge patch in my tree so just > ack/nack it and I will push both the patch and the merge patch at the > same time. I hadn't put the password setting code into Add User yet. Should I be prompting them for the principal? If not, how shall I call modifyPassword after creating the user? I suppose I can query the user back after creating it to get the principal. -Kevin -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From ssorce at redhat.com Mon Oct 1 16:41:24 2007 From: ssorce at redhat.com (Simo Sorce) Date: Mon, 01 Oct 2007 12:41:24 -0400 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <47011E19.4090007@redhat.com> References: <1191254018.10954.3.camel@hopeson> <47011E19.4090007@redhat.com> Message-ID: <1191256884.3155.85.camel@localhost.localdomain> On Mon, 2007-10-01 at 12:19 -0400, Rob Crittenden wrote: > Simo Sorce wrote: > > This patch changes a bit of code to rely more on kerberos. > > > > It also changes ipa-adduser to something I think is a more useful > > workflow, it does not require an email for example as we don't need it. > > Instead it allows passing a principal name in case you need to create > > specific one or want to avoid conflicts with an exiting one. > > What about the other tools? Working on it while I explore the code. Any "must do" pointers are very welcome. > > This patch also removes some classes we don't want to use by default for > > users. > > > > Note: this patch may not apply cleanly as a pull from upstream after the > > commit required me a merge. I have the merge patch in my tree so just > > ack/nack it and I will push both the patch and the merge patch at the > > same time. > > I'd rather ack the actual patch that is going to be committed. > > Other comments in-line in the code, marked by [] > > [ E-mail is required in the GUI so I made it required here for > consistency. ] Ah I see, then I guess we should remove the requirement in the GUI. Service accounts may very well not have an email anyway. > [ /home should not be hardcoded here. It is currently hardcoded on the > server side. This needs not be hardcoded anywhere but should be stored > in LDAP somewhere. I'd rather not have to fix both places in the future > though. ] Uhmmm ... make sense, I will think how to best fix this in a following patch. > [ Why not add groups at the same time? ] I think it is a bit too much to list groups in interactive mode. Unattended is different. > diff -r e950c62a04f9 -r fbee5ea59a1f ipa-python/freeipa-python.spec > --- a/ipa-python/freeipa-python.spec Fri Sep 28 14:55:28 2007 -0400 > +++ b/ipa-python/freeipa-python.spec Mon Oct 01 11:35:40 2007 -0400 > @@ -10,7 +10,7 @@ BuildRoot: %{_tmppath}/%{name}-%{ve > BuildRoot: > %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) > BuildArch: noarch > > -Requires: python PyKerberos python-krbV > +Requires: python PyKerberos > > [ This looks like a mis-merge. python-krbV is required now ] Seem it is not in the current pushed code. Have you added this in some patches not yet pushed? > @@ -350,8 +360,7 @@ class IPAServer: > # FIXME: What is the default group for users? > user['gidnumber'] = '501' > > - realm = ipa.config.config.get_realm() > - user['krbprincipalname'] = "%s@%s" % (user.get('uid'), realm) > + user['krbprincipalname'] = "%s@%s" % (user.get('uid'), > self.realm) > > [ You need to check to see if krbprincipalname is already set ] Good catch thanks. > - user_dn = self.get_user_by_uid(uid, ['dn', 'uid', > 'objectclass'], opts) > - if user_dn is None: > + user = self.get_user_by_principal(principal, > ['krbprincipalname'], opts) > + if user is None or user['krbprincipalname'] != principal: > raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND) > > [ If you do a search on principal how could user['principalname] ever != > principal? ] Just paranoia checking :-) Simo. From ssorce at redhat.com Mon Oct 1 17:57:21 2007 From: ssorce at redhat.com (Simo Sorce) Date: Mon, 01 Oct 2007 13:57:21 -0400 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <20071001164000.GC3697@moon.usersys.redhat.com> References: <1191254018.10954.3.camel@hopeson> <20071001164000.GC3697@moon.usersys.redhat.com> Message-ID: <1191261441.3155.97.camel@localhost.localdomain> On Mon, 2007-10-01 at 09:40 -0700, Kevin McCarthy wrote: > Simo Sorce wrote: > > This patch changes a bit of code to rely more on kerberos. > > > > It also changes ipa-adduser to something I think is a more useful > > workflow, it does not require an email for example as we don't need it. > > Instead it allows passing a principal name in case you need to create > > specific one or want to avoid conflicts with an exiting one. > > > > This patch also removes some classes we don't want to use by default for > > users. > > > > Note: this patch may not apply cleanly as a pull from upstream after the > > commit required me a merge. I have the merge patch in my tree so just > > ack/nack it and I will push both the patch and the merge patch at the > > same time. > > I hadn't put the password setting code into Add User yet. Should I be > prompting them for the principal? I don't think you need to prompt, but there should be an option to change it from the default at user creation if necessary. > If not, how shall I call modifyPassword after creating the user? I > suppose I can query the user back after creating it to get the > principal. If you can't keep around the principal name you generated, yes. Simo. From rcritten at redhat.com Mon Oct 1 18:12:58 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 14:12:58 -0400 Subject: [Freeipa-devel] [PATCH] don't include opts in public API Message-ID: <470138AA.6010904@redhat.com> We use the argument 'opts' to pass stuff internally. We don't want that published, so remove it from any XML-RPC functions that can display the API. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-219-noopts.patch Type: text/x-patch Size: 1097 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From kmccarth at redhat.com Mon Oct 1 18:24:49 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Mon, 1 Oct 2007 11:24:49 -0700 Subject: [Freeipa-devel] [PATCH] new user group management Message-ID: <20071001182449.GE3697@moon.usersys.redhat.com> This patch adds the group management code to the new user screen. -Kevin -------------- next part -------------- # HG changeset patch # User Kevin McCarthy # Date 1191263182 25200 # Node ID 23d9775392a14cb7dc860675deaec6889431b28d # Parent 0a3bb27f723b0d70253613460b0d266aa1acb36a Allow group selection on the create user page. diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/controllers.py --- a/ipa-server/ipa-gui/ipagui/controllers.py Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/controllers.py Mon Oct 01 11:26:22 2007 -0700 @@ -116,7 +116,7 @@ class Root(controllers.RootController): if tg_errors: turbogears.flash("There was a problem with the form!") - return dict(form=user_new_form) + return dict(form=user_new_form, user={}) @expose() @identity.require(identity.not_anonymous()) @@ -130,8 +130,12 @@ class Root(controllers.RootController): tg_errors, kw = self.usercreatevalidate(**kw) if tg_errors: - return dict(form=user_new_form, tg_template='ipagui.templates.usernew') - + return dict(form=user_new_form, user=kw, + tg_template='ipagui.templates.usernew') + + # + # Update the user itself + # try: new_user = ipa.user.User() new_user.setValue('uid', kw.get('uid')) @@ -143,15 +147,67 @@ class Root(controllers.RootController): new_user.setValue('nsAccountLock', 'true') rv = client.add_user(new_user) - turbogears.flash("%s added!" % kw['uid']) - raise turbogears.redirect('/usershow', uid=kw['uid']) except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE): turbogears.flash("Person with login '%s' already exists" % kw.get('uid')) - return dict(form=user_new_form, tg_template='ipagui.templates.usernew') + return dict(form=user_new_form, user=kw, + tg_template='ipagui.templates.usernew') except ipaerror.IPAError, e: turbogears.flash("User add failed: " + str(e)) - return dict(form=user_new_form, tg_template='ipagui.templates.usernew') + return dict(form=user_new_form, user=kw, + tg_template='ipagui.templates.usernew') + + # + # NOTE: from here on, the user account now exists. + # on any error, we redirect to the _edit_ user page. + # this code does data setup, similar to useredit() + # + user = client.get_user_by_uid(kw['uid'], user_fields) + user_dict = user.toDict() + + user_groups_dicts = [] + user_groups_data = b64encode(dumps(user_groups_dicts)) + + # store a copy of the original user for the update later + user_data = b64encode(dumps(user_dict)) + user_dict['user_orig'] = user_data + user_dict['user_groups_data'] = user_groups_data + + # preserve group add info in case of errors + user_dict['dnadd'] = kw.get('dnadd') + user_dict['dn_to_info_json'] = kw.get('dn_to_info_json') + + # + # Password change + # TODO + # + + # + # Add groups + # + failed_adds = [] + try: + dnadds = kw.get('dnadd') + if dnadds != None: + if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)): + dnadds = [dnadds] + failed_adds = client.add_groups_to_user( + utf8_encode_values(dnadds), user.dn) + kw['dnadd'] = failed_adds + except ipaerror.IPAError, e: + failed_adds = dnadds + + if len(failed_adds) > 0: + message = "Person successfully updated.
" + message += "There was an error adding groups.
" + message += "Failures have been preserved in the add/remove lists." + turbogears.flash(message) + return dict(form=user_edit_form, user=user_dict, + user_groups=user_groups_dicts, + tg_template='ipagui.templates.useredit') + + turbogears.flash("%s added!" % kw['uid']) + raise turbogears.redirect('/usershow', uid=kw['uid']) @expose("ipagui.templates.dynamiceditsearch") @identity.require(identity.not_anonymous()) @@ -227,6 +283,7 @@ class Root(controllers.RootController): tg_template='ipagui.templates.useredit') password_change = False + user_modified = False # # Update the user itself @@ -262,6 +319,7 @@ class Root(controllers.RootController): # need to make sure a subsequent submit doesn't try to update # the user again. # + user_modified = True kw['user_orig'] = b64encode(dumps(new_user.toDict())) except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST), e: # could be a password change @@ -299,10 +357,7 @@ class Root(controllers.RootController): utf8_encode_values(dnadds), new_user.dn) kw['dnadd'] = failed_adds except ipaerror.IPAError, e: - turbogears.flash("Group update failed: " + str(e)) - return dict(form=user_edit_form, user=kw, - user_groups=user_groups_dicts, - tg_template='ipagui.templates.useredit') + failed_adds = dnadds # # Remove groups @@ -317,14 +372,15 @@ class Root(controllers.RootController): utf8_encode_values(dndels), new_user.dn) kw['dndel'] = failed_dels except ipaerror.IPAError, e: - turbogears.flash("Group update failed: " + str(e)) - return dict(form=user_edit_form, user=kw, - user_groups=user_groups_dicts, - tg_template='ipagui.templates.useredit') + failed_dels = dndels if (len(failed_adds) > 0) or (len(failed_dels) > 0): message = "There was an error updating groups.
" message += "Failures have been preserved in the add/remove lists." + if user_modified: + message = "User Details successfully updated.
" + message + if password_change: + message = "User password successfully updated.
" + message turbogears.flash(message) return dict(form=user_edit_form, user=kw, user_groups=user_groups_dicts, diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/forms/user.py --- a/ipa-server/ipa-gui/ipagui/forms/user.py Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/forms/user.py Mon Oct 01 11:26:22 2007 -0700 @@ -46,7 +46,9 @@ class UserNewForm(widgets.Form): params = ['user'] fields = [UserFields.uid, UserFields.givenname, - UserFields.sn, UserFields.mail] + UserFields.sn, UserFields.mail, + UserFields.dn_to_info_json, + ] validator = UserNewValidator() diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js --- a/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js Mon Oct 01 11:26:22 2007 -0700 @@ -169,3 +169,18 @@ function preSubmit() { $('form_dn_to_info_json').value = json; return true; } + +function enterDoSearch(e) { + var keyPressed; + if (window.event) { + keyPressed = window.event.keyCode; + } else { + keyPressed = e.which; + } + + if (keyPressed == 13) { + return doSearch(); + } else { + return true; + } +} diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid --- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid Mon Oct 01 11:26:22 2007 -0700 @@ -21,21 +21,6 @@ from ipagui.helpers import ipahelper } else { gidnumberField.disabled = true; $('form_editprotected').value = ''; - } - } - - function enterDoSearch(e) { - var keyPressed; - if (window.event) { - keyPressed = window.event.keyCode; - } else { - keyPressed = e.which; - } - - if (keyPressed == 13) { - return doSearch(); - } else { - return true; } } diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/templates/usereditform.kid --- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Mon Oct 01 11:26:22 2007 -0700 @@ -33,21 +33,6 @@ from ipagui.helpers import ipahelper } } - function enterDoSearch(e) { - var keyPressed; - if (window.event) { - keyPressed = window.event.keyCode; - } else { - keyPressed = e.which; - } - - if (keyPressed == 13) { - return doSearch(); - } else { - return true; - } - } - function doSearch() { $('searchresults').update("Searching..."); new Ajax.Updater('searchresults', diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/templates/usernew.kid --- a/ipa-server/ipa-gui/ipagui/templates/usernew.kid Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usernew.kid Mon Oct 01 11:26:22 2007 -0700 @@ -8,6 +8,6 @@

Add Person

- ${form.display(action="usercreate")} + ${form.display(action="usercreate", value=user)} diff -r 0a3bb27f723b -r 23d9775392a1 ipa-server/ipa-gui/ipagui/templates/usernewform.kid --- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid Fri Sep 28 16:01:42 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid Mon Oct 01 11:26:22 2007 -0700 @@ -1,6 +1,41 @@
-
+ + + + + + + + + + +
Identity Details
@@ -181,6 +216,28 @@
+
+
Add Groups
+ +
+
To Add:
+
+
+
+ +
+ +
+
+
+
+ @@ -192,4 +249,33 @@
+ + + + + + +
-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From rcritten at redhat.com Mon Oct 1 18:45:25 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 14:45:25 -0400 Subject: [Freeipa-devel] [PATCH] new user group management In-Reply-To: <20071001182449.GE3697@moon.usersys.redhat.com> References: <20071001182449.GE3697@moon.usersys.redhat.com> Message-ID: <47014045.9060208@redhat.com> Kevin McCarthy wrote: > This patch adds the group management code to the new user screen. > > -Kevin Looks ok. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From rcritten at redhat.com Mon Oct 1 20:44:12 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Mon, 01 Oct 2007 16:44:12 -0400 Subject: [Freeipa-devel] Kerberos ticket forwarding Message-ID: <47015C1C.40403@redhat.com> I started from scratch on the Kerberos ticket forwarding problem and mod_auth_kerb again. I have a 2-line patch that fixes it now and doesn't require the massive changes I currently used. In my rush I included the F7 patch in the RHEL-5 bug :-( I also made a patch for that. The patch for both can be found at: https://bugzilla.redhat.com/show_bug.cgi?id=301061 Note that I had RHEL-5 enforcing on my RHEL-5 box and had lots of problems with the tickets. The CGI I wrote to test this called klist to show that the ticket was forwarded properly. I got this denial: Oct 1 16:38:18 thor setroubleshoot: SELinux is preventing the /usr/kerberos/bin/klist from using potentially mislabeled files (/tmp/krb5cc_apache_TxNr3M). For complete SELinux messages. run sealert -l 40a72116-ed45-420d-914a-ce9d56486d94 rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From kmccarth at redhat.com Mon Oct 1 20:50:33 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Mon, 1 Oct 2007 13:50:33 -0700 Subject: [Freeipa-devel] [PATCH] add group management to 'add group' page Message-ID: <20071001205032.GA3878@moon.usersys.redhat.com> These should be looking pretty familiar by now. The patch adds the group member section to the 'add group' page. This should be the last page for this type of patch. -Kevin -------------- next part -------------- # HG changeset patch # User Kevin McCarthy # Date 1191270460 25200 # Node ID 32edac7bca41673fbf399f73ddae55c08afbbf22 # Parent 23d9775392a14cb7dc860675deaec6889431b28d Add group management to the newgroup page. diff -r 23d9775392a1 -r 32edac7bca41 ipa-server/ipa-gui/ipagui/controllers.py --- a/ipa-server/ipa-gui/ipagui/controllers.py Mon Oct 01 11:26:22 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/controllers.py Mon Oct 01 13:27:40 2007 -0700 @@ -134,7 +134,7 @@ class Root(controllers.RootController): tg_template='ipagui.templates.usernew') # - # Update the user itself + # Create the user itself # try: new_user = ipa.user.User() @@ -198,7 +198,7 @@ class Root(controllers.RootController): failed_adds = dnadds if len(failed_adds) > 0: - message = "Person successfully updated.
" + message = "Person successfully created.
" message += "There was an error adding groups.
" message += "Failures have been preserved in the add/remove lists." turbogears.flash(message) @@ -569,7 +569,7 @@ class Root(controllers.RootController): client.set_krbccache(os.environ["KRB5CCNAME"]) - return dict(form=group_new_form) + return dict(form=group_new_form, group={}) @expose() @identity.require(identity.not_anonymous()) @@ -584,23 +584,73 @@ class Root(controllers.RootController): tg_errors, kw = self.groupcreatevalidate(**kw) if tg_errors: - return dict(form=group_new_form, tg_template='ipagui.templates.groupnew') - + return dict(form=group_new_form, group=kw, + tg_template='ipagui.templates.groupnew') + + # + # Create the group itself + # try: new_group = ipa.group.Group() new_group.setValue('cn', kw.get('cn')) new_group.setValue('description', kw.get('description')) rv = client.add_group(new_group) - turbogears.flash("%s added!" % kw.get('cn')) - raise turbogears.redirect('/groupshow', cn=kw.get('cn')) except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE): turbogears.flash("Group with name '%s' already exists" % kw.get('cn')) - return dict(form=group_new_form, tg_template='ipagui.templates.groupnew') + return dict(form=group_new_form, group=kw, + tg_template='ipagui.templates.groupnew') except ipaerror.IPAError, e: turbogears.flash("Group add failed: " + str(e) + "
" + str(e.detail)) - return dict(form=group_new_form, tg_template='ipagui.templates.groupnew') + return dict(form=group_new_form, group=kw, + tg_template='ipagui.templates.groupnew') + + # + # NOTE: from here on, the group now exists. + # on any error, we redirect to the _edit_ group page. + # this code does data setup, similar to groupedit() + # + group = client.get_group_by_cn(kw['cn'], group_fields) + group_dict = group.toDict() + member_dicts = [] + + # store a copy of the original group for the update later + group_data = b64encode(dumps(group_dict)) + member_data = b64encode(dumps(member_dicts)) + group_dict['group_orig'] = group_data + group_dict['member_data'] = member_data + + # preserve group add info in case of errors + group_dict['dnadd'] = kw.get('dnadd') + group_dict['dn_to_info_json'] = kw.get('dn_to_info_json') + + # + # Add members + # + failed_adds = [] + try: + dnadds = kw.get('dnadd') + if dnadds != None: + if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)): + dnadds = [dnadds] + failed_adds = client.add_members_to_group( + utf8_encode_values(dnadds), kw.get('cn')) + kw['dnadd'] = failed_adds + except ipaerror.IPAError, e: + failed_adds = dnadds + + if len(failed_adds) > 0: + message = "Group successfully created.
" + message += "There was an error adding group members.
" + message += "Failures have been preserved in the add/remove lists." + turbogears.flash(message) + return dict(form=group_edit_form, group=group_dict, + members=member_dicts, + tg_template='ipagui.templates.groupedit') + + turbogears.flash("%s added!" % kw.get('cn')) + raise turbogears.redirect('/groupshow', cn=kw.get('cn')) @expose("ipagui.templates.dynamiceditsearch") @identity.require(identity.not_anonymous()) diff -r 23d9775392a1 -r 32edac7bca41 ipa-server/ipa-gui/ipagui/forms/group.py --- a/ipa-server/ipa-gui/ipagui/forms/group.py Mon Oct 01 11:26:22 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/forms/group.py Mon Oct 01 13:27:40 2007 -0700 @@ -21,7 +21,8 @@ class GroupNewForm(widgets.Form): class GroupNewForm(widgets.Form): params = ['group'] - fields = [GroupFields.cn, GroupFields.description] + fields = [GroupFields.cn, GroupFields.description, + GroupFields.dn_to_info_json] validator = GroupNewValidator() diff -r 23d9775392a1 -r 32edac7bca41 ipa-server/ipa-gui/ipagui/templates/groupnew.kid --- a/ipa-server/ipa-gui/ipagui/templates/groupnew.kid Mon Oct 01 11:26:22 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/groupnew.kid Mon Oct 01 13:27:40 2007 -0700 @@ -8,6 +8,6 @@

Add Group

- ${form.display(action="groupcreate")} + ${form.display(action="groupcreate", value=group)} diff -r 23d9775392a1 -r 32edac7bca41 ipa-server/ipa-gui/ipagui/templates/groupnewform.kid --- a/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid Mon Oct 01 11:26:22 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid Mon Oct 01 13:27:40 2007 -0700 @@ -1,6 +1,32 @@
-
+ + + + + + + + + + +
Group Details
@@ -41,6 +67,28 @@
+
+
Add Members
+ +
+
To Add:
+
+
+
+ +
+ +
+
+
+
+ @@ -52,4 +100,33 @@
+ + + + + + +
-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From ssorce at redhat.com Mon Oct 1 21:36:27 2007 From: ssorce at redhat.com (Simo Sorce) Date: Mon, 01 Oct 2007 17:36:27 -0400 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <1191254018.10954.3.camel@hopeson> References: <1191254018.10954.3.camel@hopeson> Message-ID: <1191274587.14034.0.camel@hopeson> On Mon, 2007-10-01 at 11:53 -0400, Simo Sorce wrote: > This patch changes a bit of code to rely more on kerberos. > > It also changes ipa-adduser to something I think is a more useful > workflow, it does not require an email for example as we don't need it. > Instead it allows passing a principal name in case you need to create > specific one or want to avoid conflicts with an exiting one. > > This patch also removes some classes we don't want to use by default for > users. > > Note: this patch may not apply cleanly as a pull from upstream after the > commit required me a merge. I have the merge patch in my tree so just > ack/nack it and I will push both the patch and the merge patch at the > same time. New patch, includes fixes from some of Rob's comments, and provides get_user_by_principal for all interfaces. -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-231-more-krb.patch Type: text/x-patch Size: 20089 bytes Desc: not available URL: From kmacmill at redhat.com Tue Oct 2 16:43:22 2007 From: kmacmill at redhat.com (Karl MacMillan) Date: Tue, 02 Oct 2007 12:43:22 -0400 Subject: [Freeipa-devel] Milestone 4 released Message-ID: <1191343402.2120.4.camel@laptop.local> The next milestone release of FreeIPA is available for download at http://freeipa.com/page/Downloads. Like the Milestone 3 release this release is aimed primarily at developers. This release has significant improvements in all areas and should be stable enough for initial testing by non-developers. It is not feature complete or stable, but most of the components are present in some form and should work. I will work to get some installation instructions posted soon. Karl From kmccarth at redhat.com Tue Oct 2 17:47:00 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 10:47:00 -0700 Subject: [Freeipa-devel] [PATCH] assorted small fixes Message-ID: <20071002174700.GG24968@moon.usersys.redhat.com> This is a collection of tiny fixes that started to pile up. -Kevin -------------- next part -------------- # HG changeset patch # User Kevin McCarthy # Date 1191347384 25200 # Node ID f06570e74fc46c4758dc42ca6af6bc33c5d65d61 # Parent 32edac7bca41673fbf399f73ddae55c08afbbf22 Assorted UI fixes: - Change sort functions to be on entities, so can use on the view pages too - Fix bug: empty ajax search on useredit blows up - Filter illegal characters from suggest uid/email methods - Rename first/last name fields - Make default font family sans-serif - Speed up effect appear/fade rendering - Add buttons to top and bottom of pages - Make grouplist sortable - Add noscript warning to welcome page diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/controllers.py --- a/ipa-server/ipa-gui/ipagui/controllers.py Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/controllers.py Tue Oct 02 10:49:44 2007 -0700 @@ -1,6 +1,7 @@ import random import random from pickle import dumps, loads from base64 import b64encode, b64decode +import re import os import cherrypy @@ -50,40 +51,40 @@ def utf8_encode(value): def sort_group_member(a, b): """Comparator function used for sorting group members.""" - if a.get('uid') and b.get('uid'): - if a.get('givenname', '') == b.get('givenname', ''): - if a.get('sn', '') == b.get('sn', ''): - if a.get('uid') == b.get('uid'): + if a.getValue('uid') and b.getValue('uid'): + if a.getValue('givenname') == b.getValue('givenname'): + if a.getValue('sn') == b.getValue('sn'): + if a.getValue('uid') == b.getValue('uid'): return 0 - elif a.get('uid') < b.get('uid'): + elif a.getValue('uid') < b.getValue('uid'): return -1 else: return 1 - elif a.get('sn', '') < b.get('sn', ''): + elif a.getValue('sn') < b.getValue('sn'): return -1 else: return 1 - elif a.get('givenname') < b.get('givenname'): + elif a.getValue('givenname') < b.getValue('givenname'): return -1 else: return 1 - elif a.get('uid'): + elif a.getValue('uid'): return -1 - elif b.get('uid'): + elif b.getValue('uid'): return 1 else: - if a.get('cn', '') == b.get('cn', ''): + if a.getValue('cn') == b.getValue('cn'): return 0 - elif a.get('cn', '') < b.get('cn', ''): + elif a.getValue('cn') < b.getValue('cn'): return -1 else: return 1 def sort_by_cn(a, b): """Comparator function used for sorting groups.""" - if a.get('cn', '') == b.get('cn', ''): + if a.getValue('cn') == b.getValue('cn'): return 0 - elif a.get('cn', '') < b.get('cn', ''): + elif a.getValue('cn') < b.getValue('cn'): return -1 else: return 1 @@ -216,7 +217,7 @@ class Root(controllers.RootController): This method is used for the ajax search on the user edit page.""" client.set_krbccache(os.environ["KRB5CCNAME"]) groups = [] - counter = 0 + groups_counter = 0 searchlimit = 100 criteria = kw.get('criteria') if criteria != None and len(criteria) > 0: @@ -248,8 +249,8 @@ class Root(controllers.RootController): del(user_dict['userpassword']) user_groups = client.get_groups_by_member(user.dn, ['dn', 'cn']) + user_groups.sort(sort_by_cn) user_groups_dicts = map(lambda group: group.toDict(), user_groups) - user_groups_dicts.sort(sort_by_cn) user_groups_data = b64encode(dumps(user_groups_dicts)) # store a copy of the original user for the update later @@ -421,8 +422,10 @@ class Root(controllers.RootController): try: user = client.get_user_by_uid(uid, user_fields) user_groups = client.get_groups_by_member(user.dn, ['cn']) + user_groups.sort(sort_by_cn) user_reports = client.get_users_by_manager(user.dn, ['givenname', 'sn', 'uid']) + user_reports.sort(sort_group_member) user_manager = None try: @@ -466,6 +469,10 @@ class Root(controllers.RootController): @expose() @identity.require(identity.not_anonymous()) def suggest_uid(self, givenname, sn): + # filter illegal uid characters out + givenname = re.sub(r'[^a-zA-Z_\-0-9]', "", givenname) + sn = re.sub(r'[^a-zA-Z_\-0-9]', "", sn) + if (len(givenname) == 0) or (len(sn) == 0): return "" @@ -512,6 +519,10 @@ class Root(controllers.RootController): @expose() @identity.require(identity.not_anonymous()) def suggest_email(self, givenname, sn): + # remove illegal email characters + givenname = re.sub(r'[^a-zA-Z0-9!#\$%\*/?\|\^\{\}`~&\'\+\-=_]', "", givenname) + sn = re.sub(r'[^a-zA-Z0-9!#\$%\*/?\|\^\{\}`~&\'\+\-=_]', "", sn) + if (len(givenname) == 0) or (len(sn) == 0): return "" @@ -716,11 +727,11 @@ class Root(controllers.RootController): lambda dn: client.get_user_by_dn(dn, ['dn', 'givenname', 'sn', 'uid', 'cn']), member_dns) + members.sort(sort_group_member) # Map users into an array of dicts, which can be serialized # (so we don't have to do this on each round trip) member_dicts = map(lambda member: member.toDict(), members) - member_dicts.sort(sort_group_member) # store a copy of the original group for the update later group_data = b64encode(dumps(group_dict)) @@ -885,8 +896,8 @@ class Root(controllers.RootController): lambda dn: client.get_user_by_dn(dn, ['dn', 'givenname', 'sn', 'uid', 'cn']), member_dns) + members.sort(sort_group_member) member_dicts = map(lambda member: member.toDict(), members) - member_dicts.sort(sort_group_member) return dict(group=group_dict, fields=forms.group.GroupFields(), members = member_dicts) diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/forms/user.py --- a/ipa-server/ipa-gui/ipagui/forms/user.py Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/forms/user.py Tue Oct 02 10:49:44 2007 -0700 @@ -8,9 +8,9 @@ class UserFields(): label="Confirm Password") uidnumber = widgets.TextField(name="uidnumber", label="UID") gidnumber = widgets.TextField(name="gidnumber", label="GID") - givenname = widgets.TextField(name="givenname", label="First name") - sn = widgets.TextField(name="sn", label="Last name") - mail = widgets.TextField(name="mail", label="E-mail address") + givenname = widgets.TextField(name="givenname", label="Given Name") + sn = widgets.TextField(name="sn", label="Family Name") + mail = widgets.TextField(name="mail", label="E-mail Address") telephonenumber = widgets.TextField(name="telephonenumber", label="Phone") # nsAccountLock = widgets.CheckBox(name="nsAccountLock", label="Account Deactivated") nsAccountLock = widgets.SingleSelectField(name="nsAccountLock", diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/static/css/style.css --- a/ipa-server/ipa-gui/ipagui/static/css/style.css Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/static/css/style.css Tue Oct 02 10:49:44 2007 -0700 @@ -7,6 +7,7 @@ html, body { background:#fff; margin: 0; padding: 0; + font-family: sans-serif; } body { diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js --- a/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js Tue Oct 02 10:49:44 2007 -0700 @@ -102,7 +102,7 @@ function addmember(dn, info) { var undolink = document.createElement('a'); undolink.setAttribute('href', ''); undolink.setAttribute('onclick', - 'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' + + 'new Effect.Fade(Element.up(this), {afterFinish: removeElement, duration: 0.75});' + 'added_hash.remove("' + jsStringEscape(dn) + '");' + 'return false;'); undolink.appendChild(document.createTextNode("undo")); @@ -123,8 +123,8 @@ function addmemberHandler(element, dn, i function addmemberHandler(element, dn, info) { var newdiv = addmember(dn, info) if (newdiv != null) { - new Effect.Fade(Element.up(element)); - new Effect.Appear(newdiv); + new Effect.Fade(Element.up(element), {duration: 0.75}); + new Effect.Appear(newdiv, {duration: 0.75}); /* Element.up(element).remove(); */ } } @@ -139,8 +139,8 @@ function removemember(dn, info) { var undolink = document.createElement('a'); undolink.setAttribute('href', ''); undolink.setAttribute('onclick', - 'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' + - "new Effect.Appear($('" + orig_div_id + "'));" + + 'new Effect.Fade(Element.up(this), {afterFinish: removeElement, duration: 0.75});' + + "new Effect.Appear($('" + orig_div_id + "'), {duration: 0.75});" + 'return false;'); undolink.appendChild(document.createTextNode("undo")); newdiv.appendChild(undolink); @@ -159,8 +159,8 @@ function removemember(dn, info) { function removememberHandler(element, dn, info) { var newdiv = removemember(dn, info); - new Effect.Fade(Element.up(element)); - new Effect.Appear(newdiv); + new Effect.Fade(Element.up(element), {duration: 0.75}); + new Effect.Appear(newdiv, {duration: 0.75}); /* Element.up(element).remove(); */ } diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js --- a/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js Tue Oct 02 10:49:44 2007 -0700 @@ -291,7 +291,9 @@ TableKit.Sortable = { if(cell.hasClassName(op.noSortClass)) {return;} - order = order ? order : (cell.hasClassName(op.descendingClass) ? 1 : -1); + // order = order ? order : (cell.hasClassName(op.descendingClass) ? 1 : -1); + // kmccarth - change default sort order to ascending + order = order ? order : (cell.hasClassName(op.ascendingClass) ? -1 : 1); var rows = TableKit.getBodyRows(table); if(cell.hasClassName(op.ascendingClass) || cell.hasClassName(op.descendingClass)) { @@ -843,4 +845,4 @@ if(window.FastInit) { FastInit.addOnLoad(TableKit.load); } else { Event.observe(window, 'load', TableKit.load); -} \ No newline at end of file +} diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/dynamiceditsearch.kid --- a/ipa-server/ipa-gui/ipagui/templates/dynamiceditsearch.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/dynamiceditsearch.kid Tue Oct 02 10:49:44 2007 -0700 @@ -66,7 +66,7 @@ from ipagui.helpers import ipahelper

${len(groups)} results returned:

- +
+ + + +
- -
${group.cn} @@ -34,6 +38,7 @@ ${group.description}
diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/groupnewform.kid --- a/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid Tue Oct 02 10:49:44 2007 -0700 @@ -2,6 +2,14 @@ class="simpleroster"> + + + + + +
+ +
-
diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/groupshow.kid --- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid Tue Oct 02 10:49:44 2007 -0700 @@ -6,7 +6,14 @@ View Group +

View Group

+ +
Group Details
@@ -61,9 +68,10 @@
-
- edit + diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/usereditform.kid --- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Tue Oct 02 10:49:44 2007 -0700 @@ -2,6 +2,20 @@ class="simpleroster"> + +
+ + + + + +
+ + + +
- - - - + -
diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/usernewform.kid --- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid Tue Oct 02 10:49:44 2007 -0700 @@ -2,6 +2,14 @@ class="simpleroster"> + + + + + +
+ +

diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/usershow.kid --- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid Tue Oct 02 10:49:44 2007 -0700 @@ -6,7 +6,14 @@ View Person +

View Person

+ +
-
- edit + diff -r 32edac7bca41 -r f06570e74fc4 ipa-server/ipa-gui/ipagui/templates/welcome.kid --- a/ipa-server/ipa-gui/ipagui/templates/welcome.kid Mon Oct 01 13:27:40 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/welcome.kid Tue Oct 02 10:49:44 2007 -0700 @@ -10,6 +10,13 @@

Welcome to Free IPA

+ +

IPA is used to manage Identity, Policy, and Auditing for your -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From rcritten at redhat.com Tue Oct 2 17:54:20 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Tue, 02 Oct 2007 13:54:20 -0400 Subject: [Freeipa-devel] [PATCH] assorted small fixes In-Reply-To: <20071002174700.GG24968@moon.usersys.redhat.com> References: <20071002174700.GG24968@moon.usersys.redhat.com> Message-ID: <470285CC.40101@redhat.com> Kevin McCarthy wrote: > This is a collection of tiny fixes that started to pile up. > > -Kevin I think it looks ok. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From kmccarth at redhat.com Tue Oct 2 18:04:58 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:04:58 -0700 Subject: [Freeipa-devel] [PATCH] do not allow empty passwords In-Reply-To: <1191185407.4736.0.camel@hopeson> References: <1191185407.4736.0.camel@hopeson> Message-ID: <20071002180458.GH24968@moon.usersys.redhat.com> Simo Sorce wrote: > see $SUBJECT :) Looks good. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:06:33 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:06:33 -0700 Subject: [Freeipa-devel] [PATCH] IPv6 support for ipa-kpasswd In-Reply-To: <1191020724.3476.44.camel@hopeson> References: <1191020724.3476.44.camel@hopeson> Message-ID: <20071002180632.GI24968@moon.usersys.redhat.com> Simo Sorce wrote: > After listen to a talk yesterday I thought it was going to be easy (and > necessary) to convert ipa-kpasswd to IPV6. > It was indeed easy, this night I coded up this patch which I just tested > and seem to work fine. I don't know IPv6, but the changes look reasonable. -Kevin -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:08:23 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:08:23 -0700 Subject: [Freeipa-devel] [PATCH] IPv6 support for ipa-kpasswd In-Reply-To: <20071002180632.GI24968@moon.usersys.redhat.com> References: <1191020724.3476.44.camel@hopeson> <20071002180632.GI24968@moon.usersys.redhat.com> Message-ID: <20071002180822.GJ24968@moon.usersys.redhat.com> Kevin McCarthy wrote: > Simo Sorce wrote: > > After listen to a talk yesterday I thought it was going to be easy (and > > necessary) to convert ipa-kpasswd to IPV6. > > It was indeed easy, this night I coded up this patch which I just tested > > and seem to work fine. > > I don't know IPv6, but the changes look reasonable. pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:16:12 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:16:12 -0700 Subject: [Freeipa-devel] [PATCH] do not allow empty passwords In-Reply-To: <20071002180458.GH24968@moon.usersys.redhat.com> References: <1191185407.4736.0.camel@hopeson> <20071002180458.GH24968@moon.usersys.redhat.com> Message-ID: <20071002181612.GK24968@moon.usersys.redhat.com> Kevin McCarthy wrote: > Simo Sorce wrote: > > see $SUBJECT :) > > Looks good. Pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:19:14 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:19:14 -0700 Subject: [Freeipa-devel] [PATCH] don't include opts in public API In-Reply-To: <470138AA.6010904@redhat.com> References: <470138AA.6010904@redhat.com> Message-ID: <20071002181914.GL24968@moon.usersys.redhat.com> Rob Crittenden wrote: > We use the argument 'opts' to pass stuff internally. We don't want that > published, so remove it from any XML-RPC functions that can display the > API. Looks good. -Kevin -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:19:52 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:19:52 -0700 Subject: [Freeipa-devel] [PATCH] don't include opts in public API In-Reply-To: <470138AA.6010904@redhat.com> References: <470138AA.6010904@redhat.com> Message-ID: <20071002181952.GM24968@moon.usersys.redhat.com> Rob Crittenden wrote: > We use the argument 'opts' to pass stuff internally. We don't want that > published, so remove it from any XML-RPC functions that can display the > API. Pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From ssorce at redhat.com Tue Oct 2 18:27:53 2007 From: ssorce at redhat.com (Simo Sorce) Date: Tue, 02 Oct 2007 14:27:53 -0400 Subject: [Freeipa-devel] [PATCH] add group management to 'add group' page In-Reply-To: <20071001205032.GA3878@moon.usersys.redhat.com> References: <20071001205032.GA3878@moon.usersys.redhat.com> Message-ID: <1191349673.8632.27.camel@localhost.localdomain> On Mon, 2007-10-01 at 13:50 -0700, Kevin McCarthy wrote: > These should be looking pretty familiar by now. The patch adds the > group member section to the 'add group' page. This should be the last > page for this type of patch. Looks ok. From kmccarth at redhat.com Tue Oct 2 18:43:35 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:43:35 -0700 Subject: [Freeipa-devel] [PATCH] add group mgmt to useredit page In-Reply-To: <20070928234632.GD10276@moon.usersys.redhat.com> References: <20070928234632.GD10276@moon.usersys.redhat.com> Message-ID: <20071002184335.GN24968@moon.usersys.redhat.com> Kevin McCarthy wrote: > This patch adds group management to the user edit page. This allows you > to manage "the groups a user is in" in the same way as you manage "the > users/groups in a group". > > It's pushed to demo, so feel free to take a peek. > > Still need to add this to the usernew page. pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:44:32 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:44:32 -0700 Subject: [Freeipa-devel] [PATCH] new user group management In-Reply-To: <47014045.9060208@redhat.com> References: <20071001182449.GE3697@moon.usersys.redhat.com> <47014045.9060208@redhat.com> Message-ID: <20071002184432.GO24968@moon.usersys.redhat.com> Rob Crittenden wrote: > Kevin McCarthy wrote: >> This patch adds the group management code to the new user screen. >> -Kevin > > Looks ok. pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:45:49 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:45:49 -0700 Subject: [Freeipa-devel] [PATCH] add group management to 'add group' page In-Reply-To: <1191349673.8632.27.camel@localhost.localdomain> References: <20071001205032.GA3878@moon.usersys.redhat.com> <1191349673.8632.27.camel@localhost.localdomain> Message-ID: <20071002184548.GP24968@moon.usersys.redhat.com> Simo Sorce wrote: > On Mon, 2007-10-01 at 13:50 -0700, Kevin McCarthy wrote: > > These should be looking pretty familiar by now. The patch adds the > > group member section to the 'add group' page. This should be the last > > page for this type of patch. > > Looks ok. pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 18:46:47 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 11:46:47 -0700 Subject: [Freeipa-devel] [PATCH] assorted small fixes In-Reply-To: <470285CC.40101@redhat.com> References: <20071002174700.GG24968@moon.usersys.redhat.com> <470285CC.40101@redhat.com> Message-ID: <20071002184647.GQ24968@moon.usersys.redhat.com> Rob Crittenden wrote: > Kevin McCarthy wrote: >> This is a collection of tiny fixes that started to pile up. >> -Kevin > > I think it looks ok. Pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From kmccarth at redhat.com Tue Oct 2 20:08:21 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 13:08:21 -0700 Subject: [Freeipa-devel] [PATCH] Use more krb In-Reply-To: <1191274587.14034.0.camel@hopeson> References: <1191254018.10954.3.camel@hopeson> <1191274587.14034.0.camel@hopeson> Message-ID: <20071002200821.GR24968@moon.usersys.redhat.com> Simo Sorce wrote: > On Mon, 2007-10-01 at 11:53 -0400, Simo Sorce wrote: > > This patch changes a bit of code to rely more on kerberos. > > > > It also changes ipa-adduser to something I think is a more useful > > workflow, it does not require an email for example as we don't need it. > > Instead it allows passing a principal name in case you need to create > > specific one or want to avoid conflicts with an exiting one. > > > > This patch also removes some classes we don't want to use by default for > > users. > > > > Note: this patch may not apply cleanly as a pull from upstream after the > > commit required me a merge. I have the merge patch in my tree so just > > ack/nack it and I will push both the patch and the merge patch at the > > same time. > > New patch, includes fixes from some of Rob's comments, and provides > get_user_by_principal for all interfaces. pushed. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From rcritten at redhat.com Tue Oct 2 21:05:08 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Tue, 02 Oct 2007 17:05:08 -0400 Subject: [Freeipa-devel] [PATCH] Use group DN instead of CN for operations Message-ID: <4702B284.5060801@redhat.com> This patch does a couple of things: 1. Use the group DN instead of CN for operations (silly me) 2. Add a new class of errors, connection errors 3. Rather than letting a failed connection fall through, raise an error. This should catch missing kerberos ccaches and other connection problems in a more useful way. I also updated one of the LDAP error messages. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-239-groupdn.patch Type: text/x-patch Size: 11157 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From ssorce at redhat.com Tue Oct 2 21:10:29 2007 From: ssorce at redhat.com (Simo Sorce) Date: Tue, 02 Oct 2007 17:10:29 -0400 Subject: [Freeipa-devel] [PATCH] Use group DN instead of CN for operations In-Reply-To: <4702B284.5060801@redhat.com> References: <4702B284.5060801@redhat.com> Message-ID: <1191359429.8632.33.camel@localhost.localdomain> On Tue, 2007-10-02 at 17:05 -0400, Rob Crittenden wrote: > This patch does a couple of things: > > 1. Use the group DN instead of CN for operations (silly me) > 2. Add a new class of errors, connection errors > 3. Rather than letting a failed connection fall through, raise an > error. > This should catch missing kerberos ccaches and other connection > problems > in a more useful way. > > I also updated one of the LDAP error messages. > > rob Looks good. From rcritten at redhat.com Tue Oct 2 21:38:08 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Tue, 02 Oct 2007 17:38:08 -0400 Subject: [Freeipa-devel] [PATCH] fix some groups Message-ID: <4702BA40.7040607@redhat.com> I broke 2 groups functions with my last patch. This addresses that. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-240-fixgroup.patch Type: text/x-patch Size: 1679 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From kmccarth at redhat.com Tue Oct 2 21:41:46 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Tue, 2 Oct 2007 14:41:46 -0700 Subject: [Freeipa-devel] [PATCH] fix some groups In-Reply-To: <4702BA40.7040607@redhat.com> References: <4702BA40.7040607@redhat.com> Message-ID: <20071002214145.GS24968@moon.usersys.redhat.com> Rob Crittenden wrote: > I broke 2 groups functions with my last patch. This addresses that. Looks great. Thanks, Rob! -Kevin -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 4054 bytes Desc: not available URL: From pasik at iki.fi Wed Oct 3 10:27:50 2007 From: pasik at iki.fi (Pasi =?iso-8859-1?Q?K=E4rkk=E4inen?=) Date: Wed, 3 Oct 2007 13:27:50 +0300 Subject: [Freeipa-devel] Milestone 4 released In-Reply-To: <1191343402.2120.4.camel@laptop.local> References: <1191343402.2120.4.camel@laptop.local> Message-ID: <20071003102750.GA5028@edu.joroinen.fi> On Tue, Oct 02, 2007 at 12:43:22PM -0400, Karl MacMillan wrote: > The next milestone release of FreeIPA is available for download at > http://freeipa.com/page/Downloads. Like the Milestone 3 release this > release is aimed primarily at developers. > > This release has significant improvements in all areas and should be > stable enough for initial testing by non-developers. It is not feature > complete or stable, but most of the components are present in some form > and should work. I will work to get some installation instructions > posted soon. > http://freeipa.com/page/Roadmap Roadmap page is missing Milestone 4.. Just to let you know :) -- Pasi From ssorce at redhat.com Wed Oct 3 12:50:06 2007 From: ssorce at redhat.com (Simo Sorce) Date: Wed, 03 Oct 2007 08:50:06 -0400 Subject: [Freeipa-devel] Milestone 4 released In-Reply-To: <20071003102750.GA5028@edu.joroinen.fi> References: <1191343402.2120.4.camel@laptop.local> <20071003102750.GA5028@edu.joroinen.fi> Message-ID: <1191415806.8632.48.camel@localhost.localdomain> On Wed, 2007-10-03 at 13:27 +0300, Pasi K?rkk?inen wrote: > On Tue, Oct 02, 2007 at 12:43:22PM -0400, Karl MacMillan wrote: > > The next milestone release of FreeIPA is available for download at > > http://freeipa.com/page/Downloads. Like the Milestone 3 release this > > release is aimed primarily at developers. > > > > This release has significant improvements in all areas and should be > > stable enough for initial testing by non-developers. It is not feature > > complete or stable, but most of the components are present in some form > > and should work. I will work to get some installation instructions > > posted soon. > > > > http://freeipa.com/page/Roadmap > > Roadmap page is missing Milestone 4.. > > Just to let you know :) We will fix asap. Kiitos Pasi. Simo. From rcritten at redhat.com Wed Oct 3 14:27:46 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Wed, 03 Oct 2007 10:27:46 -0400 Subject: [Freeipa-devel] [PATCH] Use group DN instead of CN for operations In-Reply-To: <1191359429.8632.33.camel@localhost.localdomain> References: <4702B284.5060801@redhat.com> <1191359429.8632.33.camel@localhost.localdomain> Message-ID: <4703A6E2.1060701@redhat.com> Simo Sorce wrote: > On Tue, 2007-10-02 at 17:05 -0400, Rob Crittenden wrote: >> This patch does a couple of things: >> >> 1. Use the group DN instead of CN for operations (silly me) >> 2. Add a new class of errors, connection errors >> 3. Rather than letting a failed connection fall through, raise an >> error. >> This should catch missing kerberos ccaches and other connection >> problems >> in a more useful way. >> >> I also updated one of the LDAP error messages. >> >> rob > > > Looks good. Pushed, thanks. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From rcritten at redhat.com Wed Oct 3 14:28:43 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Wed, 03 Oct 2007 10:28:43 -0400 Subject: [Freeipa-devel] [PATCH] fix some groups In-Reply-To: <20071002214145.GS24968@moon.usersys.redhat.com> References: <4702BA40.7040607@redhat.com> <20071002214145.GS24968@moon.usersys.redhat.com> Message-ID: <4703A71B.9030908@redhat.com> Kevin McCarthy wrote: > Rob Crittenden wrote: >> I broke 2 groups functions with my last patch. This addresses that. > > Looks great. Thanks, Rob! > > -Kevin > Pushed. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From rcritten at redhat.com Wed Oct 3 15:36:54 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Wed, 03 Oct 2007 11:36:54 -0400 Subject: [Freeipa-devel] Kerberos ticket forwarding In-Reply-To: <47015C1C.40403@redhat.com> References: <47015C1C.40403@redhat.com> Message-ID: <4703B716.3050503@redhat.com> Rob Crittenden wrote: > I started from scratch on the Kerberos ticket forwarding problem and > mod_auth_kerb again. I have a 2-line patch that fixes it now and doesn't > require the massive changes I currently used. > > In my rush I included the F7 patch in the RHEL-5 bug :-( I also made a > patch for that. > > The patch for both can be found at: > https://bugzilla.redhat.com/show_bug.cgi?id=301061 > > Note that I had RHEL-5 enforcing on my RHEL-5 box and had lots of > problems with the tickets. > > The CGI I wrote to test this called klist to show that the ticket was > forwarded properly. I got this denial: > > Oct 1 16:38:18 thor setroubleshoot: SELinux is preventing the > /usr/kerberos/bin/klist from using potentially mislabeled files > (/tmp/krb5cc_apache_TxNr3M). For complete SELinux messages. run > sealert -l 40a72116-ed45-420d-914a-ce9d56486d94 > > rob > Attached is the new SRPM if anyone wants to give it a go. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: mod_auth_kerb-5.3-5.ipa.src.rpm Type: application/x-redhat-package-manager Size: 84823 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From mccann at jhu.edu Wed Oct 3 17:00:49 2007 From: mccann at jhu.edu (William Jon McCann) Date: Wed, 3 Oct 2007 13:00:49 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled Message-ID: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> Hi, Tiny patch to fix the installer crashing if selinux is disabled. Also changes the exception to contain the complete command. FYI: the installer goes kinda wonky if you have run it multiple times and you don't apply this: https://bugzilla.redhat.com/show_bug.cgi?id=317071 Perhaps we can make it more robust to dirsrv failing to start. Jon -------------- next part -------------- A non-text attachment was scrubbed... Name: ipa-noselinux.diff Type: text/x-diff Size: 1084 bytes Desc: not available URL: From rcritten at redhat.com Wed Oct 3 17:26:42 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Wed, 03 Oct 2007 13:26:42 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> Message-ID: <4703D0D2.9070208@redhat.com> William Jon McCann wrote: > Hi, > > Tiny patch to fix the installer crashing if selinux is disabled. Also > changes the exception to contain the complete command. > > FYI: the installer goes kinda wonky if you have run it multiple times > and you don't apply this: > https://bugzilla.redhat.com/show_bug.cgi?id=317071 > > Perhaps we can make it more robust to dirsrv failing to start. > > Jon Yeah, we've been working under the assumption that we're working on a virginal machine which probably isn't the safest thing to do. I think what we should do is look for any existing dirsrv instances and punt if any are already installed. We aren't quite ready to support importing the necessary configuration into an existing directory server yet AFAIK. The idea is that one would install IPA, and then migrate to it, rather than integrating IPA into an existing DS server. There are some other appending issues too, such as the location of the FDS keytab in /etc/sysconfig/dirsrv. Mine currently has 3 exports :-) Rather than using a try/except I wonder if we should check the return value of selinuxenabled and use that to determine whether we need to run setsebool. Still, we should probably have a try/except around every single call to run since it can throw an error. Karl. Will this boolean get reset if someone does a relabels? Most of my experience with SELinux is quite dated (back to RHEL-4). rob -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From ssorce at redhat.com Wed Oct 3 17:59:46 2007 From: ssorce at redhat.com (Simo Sorce) Date: Wed, 03 Oct 2007 13:59:46 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> Message-ID: <1191434386.26778.3.camel@localhost.localdomain> On Wed, 2007-10-03 at 13:00 -0400, William Jon McCann wrote: > Hi, > > Tiny patch to fix the installer crashing if selinux is disabled. Also > changes the exception to contain the complete command. > > FYI: the installer goes kinda wonky if you have run it multiple times > and you don't apply this: > https://bugzilla.redhat.com/show_bug.cgi?id=317071 > > Perhaps we can make it more robust to dirsrv failing to start. Thanks, yeah at this stage we still don't support interrupting the install script. We are still thinking on which is the best way to handle it. I think we will probably prompt a very alarming message about deleting your existing directory configuration and data and then wipe it out if you really want to. We are also considering using the realm name instead of a UUID in the file names so that it will make it possible to better detect the intentions (create a new server vs replacing an existing one). Simo. From mccann at jhu.edu Wed Oct 3 18:07:20 2007 From: mccann at jhu.edu (William Jon McCann) Date: Wed, 3 Oct 2007 14:07:20 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <1191434386.26778.3.camel@localhost.localdomain> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> <1191434386.26778.3.camel@localhost.localdomain> Message-ID: <939dd5750710031107n7f946fc3g896fc927e1f19f89@mail.gmail.com> On 10/3/07, Simo Sorce wrote: > On Wed, 2007-10-03 at 13:00 -0400, William Jon McCann wrote: > > Hi, > > > > Tiny patch to fix the installer crashing if selinux is disabled. Also > > changes the exception to contain the complete command. > > > > FYI: the installer goes kinda wonky if you have run it multiple times > > and you don't apply this: > > https://bugzilla.redhat.com/show_bug.cgi?id=317071 > > > > Perhaps we can make it more robust to dirsrv failing to start. > > Thanks, yeah at this stage we still don't support interrupting the > install script. > We are still thinking on which is the best way to handle it. I think we > will probably prompt a very alarming message about deleting your > existing directory configuration and data and then wipe it out if you > really want to. > We are also considering using the realm name instead of a UUID in the > file names so that it will make it possible to better detect the > intentions (create a new server vs replacing an existing one). Yeah, that would work for me. I figured out that I need to do the following before running the install script: sudo rm -rf /var/lib/dirsrv/slapd-* /var/lock/dirsrv/* /etc/dirsrv/slapd-* sudo pkill -U dirsrv The only part that was missing was the chown of /var/run/dirsrv. I guess we should also try to clean up the configurations when the script doesn't run to completion... Thanks, Jon From ssorce at redhat.com Wed Oct 3 18:20:31 2007 From: ssorce at redhat.com (Simo Sorce) Date: Wed, 03 Oct 2007 14:20:31 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <939dd5750710031107n7f946fc3g896fc927e1f19f89@mail.gmail.com> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> <1191434386.26778.3.camel@localhost.localdomain> <939dd5750710031107n7f946fc3g896fc927e1f19f89@mail.gmail.com> Message-ID: <1191435631.26778.9.camel@localhost.localdomain> On Wed, 2007-10-03 at 14:07 -0400, William Jon McCann wrote: > On 10/3/07, Simo Sorce wrote: > > On Wed, 2007-10-03 at 13:00 -0400, William Jon McCann wrote: > > > Hi, > > > > > > Tiny patch to fix the installer crashing if selinux is disabled. Also > > > changes the exception to contain the complete command. > > > > > > FYI: the installer goes kinda wonky if you have run it multiple times > > > and you don't apply this: > > > https://bugzilla.redhat.com/show_bug.cgi?id=317071 > > > > > > Perhaps we can make it more robust to dirsrv failing to start. > > > > Thanks, yeah at this stage we still don't support interrupting the > > install script. > > We are still thinking on which is the best way to handle it. I think we > > will probably prompt a very alarming message about deleting your > > existing directory configuration and data and then wipe it out if you > > really want to. > > We are also considering using the realm name instead of a UUID in the > > file names so that it will make it possible to better detect the > > intentions (create a new server vs replacing an existing one). > > Yeah, that would work for me. I figured out that I need to do the > following before running the install script: > sudo rm -rf /var/lib/dirsrv/slapd-* /var/lock/dirsrv/* /etc/dirsrv/slapd-* > sudo pkill -U dirsrv > > The only part that was missing was the chown of /var/run/dirsrv. > > I guess we should also try to clean up the configurations when the > script doesn't run to completion... Uhmm that would mean catching ctrl+c and signals, not sure how it works with python, may be it is just simpler to clean up on each start-up, it will also catch legitimate existing cruft :) Simo. > > Thanks, > Jon From mccann at jhu.edu Wed Oct 3 20:11:42 2007 From: mccann at jhu.edu (William Jon McCann) Date: Wed, 3 Oct 2007 16:11:42 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <1191435631.26778.9.camel@localhost.localdomain> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> <1191434386.26778.3.camel@localhost.localdomain> <939dd5750710031107n7f946fc3g896fc927e1f19f89@mail.gmail.com> <1191435631.26778.9.camel@localhost.localdomain> Message-ID: <939dd5750710031311qc9c5588meda2c916dee43481@mail.gmail.com> Hey, On 10/3/07, Simo Sorce wrote: > On Wed, 2007-10-03 at 14:07 -0400, William Jon McCann wrote: > > On 10/3/07, Simo Sorce wrote: > > > On Wed, 2007-10-03 at 13:00 -0400, William Jon McCann wrote: > > > > Hi, > > > > > > > > Tiny patch to fix the installer crashing if selinux is disabled. Also > > > > changes the exception to contain the complete command. > > > > > > > > FYI: the installer goes kinda wonky if you have run it multiple times > > > > and you don't apply this: > > > > https://bugzilla.redhat.com/show_bug.cgi?id=317071 > > > > > > > > Perhaps we can make it more robust to dirsrv failing to start. > > > > > > Thanks, yeah at this stage we still don't support interrupting the > > > install script. > > > We are still thinking on which is the best way to handle it. I think we > > > will probably prompt a very alarming message about deleting your > > > existing directory configuration and data and then wipe it out if you > > > really want to. > > > We are also considering using the realm name instead of a UUID in the > > > file names so that it will make it possible to better detect the > > > intentions (create a new server vs replacing an existing one). > > > > Yeah, that would work for me. I figured out that I need to do the > > following before running the install script: > > sudo rm -rf /var/lib/dirsrv/slapd-* /var/lock/dirsrv/* /etc/dirsrv/slapd-* > > sudo pkill -U dirsrv > > > > The only part that was missing was the chown of /var/run/dirsrv. > > > > I guess we should also try to clean up the configurations when the > > script doesn't run to completion... > > Uhmm that would mean catching ctrl+c and signals, not sure how it works > with python, may be it is just simpler to clean up on each start-up, it > will also catch legitimate existing cruft :) Here's an updated patch that does both. And adds a check to make sure it is running as root. Jon -------------- next part -------------- A non-text attachment was scrubbed... Name: ipa-install-fixes.diff Type: text/x-diff Size: 2909 bytes Desc: not available URL: From rcritten at redhat.com Wed Oct 3 20:13:29 2007 From: rcritten at redhat.com (Rob Crittenden) Date: Wed, 03 Oct 2007 16:13:29 -0400 Subject: [Freeipa-devel] [PATCH] more robust installation error handling Message-ID: <4703F7E9.8090002@redhat.com> This needs more work but it is a first crack at trying to catch more error conditions during installation. What it currently lacks is completely bailing out, offering the user a choice to continue and/or doing a rollback. I also didn't add any code to exit out if an existing DS is found. Not sure if we want to do that or not. I also incorporated most of the patch to handle when SELinux is disabled from Jon McCann. I just do the selinux check slightly differently. I also noticed an error when I had old service keytabs and included something to handle SASL/GSSAPI authentication failures when getting a connection. rob -------------- next part -------------- A non-text attachment was scrubbed... Name: freeipa-242-install.patch Type: text/x-patch Size: 14211 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature URL: From ssorce at redhat.com Wed Oct 3 20:39:33 2007 From: ssorce at redhat.com (Simo Sorce) Date: Wed, 03 Oct 2007 16:39:33 -0400 Subject: [Freeipa-devel] [PATCH] install dies if selinux is disabled In-Reply-To: <939dd5750710031311qc9c5588meda2c916dee43481@mail.gmail.com> References: <939dd5750710031000i4fe658f2kf94720915dc74b9d@mail.gmail.com> <1191434386.26778.3.camel@localhost.localdomain> <939dd5750710031107n7f946fc3g896fc927e1f19f89@mail.gmail.com> <1191435631.26778.9.camel@localhost.localdomain> <939dd5750710031311qc9c5588meda2c916dee43481@mail.gmail.com> Message-ID: <1191443973.26778.50.camel@localhost.localdomain> On Wed, 2007-10-03 at 16:11 -0400, William Jon McCann wrote: > > Here's an updated patch that does both. And adds a check to make sure > it is running as root. Looks good as a first step to me. Simo. From kmccarth at redhat.com Wed Oct 3 20:45:49 2007 From: kmccarth at redhat.com (Kevin McCarthy) Date: Wed, 3 Oct 2007 13:45:49 -0700 Subject: [Freeipa-devel] [PATCH] add the rest of the user fields Message-ID: <20071003204549.GA23064@moon.usersys.redhat.com> Pete and I took a crack at picking out the fields that should go on the user forms. I've added them here. Some of these need to be multi-value, but I'm not handling that yet (first need to get rebuilding the demo server). -Kevin -------------- next part -------------- # HG changeset patch # User Kevin McCarthy # Date 1191444794 25200 # Node ID ee2e41c50353e74f94b049f70178a4f31b4d236e # Parent 0ab2c326750088d0011ebc41ecf7572abc0ba510 Add the rest of the user fields to the user pages. diff -r 0ab2c3267500 -r ee2e41c50353 ipa-server/ipa-gui/ipagui/controllers.py --- a/ipa-server/ipa-gui/ipagui/controllers.py Wed Oct 03 10:23:47 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/controllers.py Wed Oct 03 13:53:14 2007 -0700 @@ -139,11 +139,41 @@ class Root(controllers.RootController): # try: new_user = ipa.user.User() - new_user.setValue('uid', kw.get('uid')) + new_user.setValue('title', kw.get('title')) new_user.setValue('givenname', kw.get('givenname')) new_user.setValue('sn', kw.get('sn')) + new_user.setValue('cn', kw.get('cn')) + new_user.setValue('displayname', kw.get('displayname')) + new_user.setValue('initials', kw.get('initials')) + + new_user.setValue('uid', kw.get('uid')) + new_user.setValue('loginshell', kw.get('loginshell')) + new_user.setValue('gecos', kw.get('gecos')) + new_user.setValue('mail', kw.get('mail')) new_user.setValue('telephonenumber', kw.get('telephonenumber')) + new_user.setValue('facsimiletelephonenumber', + kw.get('facsimiletelephonenumber')) + new_user.setValue('mobile', kw.get('mobile')) + new_user.setValue('pager', kw.get('pager')) + new_user.setValue('homephone', kw.get('homephone')) + + new_user.setValue('street', kw.get('street')) + new_user.setValue('l', kw.get('l')) + new_user.setValue('st', kw.get('st')) + new_user.setValue('postalcode', kw.get('postalcode')) + + new_user.setValue('ou', kw.get('ou')) + new_user.setValue('businesscategory', kw.get('businesscategory')) + new_user.setValue('description', kw.get('description')) + new_user.setValue('employeetype', kw.get('employeetype')) + # new_user.setValue('manager', kw.get('manager')) + new_user.setValue('roomnumber', kw.get('roomnumber')) + # new_user.setValue('secretary', kw.get('secretary')) + + new_user.setValue('carlicense', kw.get('carlicense')) + new_user.setValue('labeleduri', kw.get('labeleduri')) + if kw.get('nsAccountLock'): new_user.setValue('nsAccountLock', 'true') @@ -293,10 +323,41 @@ class Root(controllers.RootController): orig_user_dict = loads(b64decode(kw.get('user_orig'))) new_user = ipa.user.User(orig_user_dict) + new_user.setValue('title', kw.get('title')) new_user.setValue('givenname', kw.get('givenname')) new_user.setValue('sn', kw.get('sn')) + new_user.setValue('cn', kw.get('cn')) + new_user.setValue('displayname', kw.get('displayname')) + new_user.setValue('initials', kw.get('initials')) + + new_user.setValue('loginshell', kw.get('loginshell')) + new_user.setValue('gecos', kw.get('gecos')) + new_user.setValue('mail', kw.get('mail')) new_user.setValue('telephonenumber', kw.get('telephonenumber')) + new_user.setValue('facsimiletelephonenumber', + kw.get('facsimiletelephonenumber')) + new_user.setValue('mobile', kw.get('mobile')) + new_user.setValue('pager', kw.get('pager')) + new_user.setValue('homephone', kw.get('homephone')) + + new_user.setValue('street', kw.get('street')) + new_user.setValue('l', kw.get('l')) + new_user.setValue('st', kw.get('st')) + new_user.setValue('postalcode', kw.get('postalcode')) + + new_user.setValue('ou', kw.get('ou')) + new_user.setValue('businesscategory', kw.get('businesscategory')) + new_user.setValue('description', kw.get('description')) + new_user.setValue('employeetype', kw.get('employeetype')) + # new_user.setValue('manager', kw.get('manager')) + new_user.setValue('roomnumber', kw.get('roomnumber')) + # new_user.setValue('secretary', kw.get('secretary')) + + new_user.setValue('carlicense', kw.get('carlicense')) + new_user.setValue('labeleduri', kw.get('labeleduri')) + + if kw.get('nsAccountLock'): new_user.setValue('nsAccountLock', 'true') else: @@ -306,13 +367,7 @@ class Root(controllers.RootController): password_change = True new_user.setValue('uidnumber', str(kw.get('uidnumber'))) new_user.setValue('gidnumber', str(kw.get('gidnumber'))) - - # - # this is a hack until we decide on the policy for names/cn/sn/givenName - # - new_user.setValue('cn', - "%s %s" % (new_user.getValue('givenname'), - new_user.getValue('sn'))) + new_user.setValue('homedirectory', str(kw.get('homedirectory'))) rv = client.update_user(new_user) # diff -r 0ab2c3267500 -r ee2e41c50353 ipa-server/ipa-gui/ipagui/forms/user.py --- a/ipa-server/ipa-gui/ipagui/forms/user.py Wed Oct 03 10:23:47 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/forms/user.py Wed Oct 03 13:53:14 2007 -0700 @@ -2,17 +2,47 @@ from turbogears import validators, widge from turbogears import validators, widgets class UserFields(): + givenname = widgets.TextField(name="givenname", label="Given Name") + sn = widgets.TextField(name="sn", label="Family Name") + cn = widgets.TextField(name="cn", label="Common Names") + title = widgets.TextField(name="title", label="Title") + displayname = widgets.TextField(name="displayname", label="Display Name") + initials = widgets.TextField(name="initials", label="Initials") + uid = widgets.TextField(name="uid", label="Login") userpassword = widgets.PasswordField(name="userpassword", label="Password") userpassword_confirm = widgets.PasswordField(name="userpassword_confirm", label="Confirm Password") uidnumber = widgets.TextField(name="uidnumber", label="UID") gidnumber = widgets.TextField(name="gidnumber", label="GID") - givenname = widgets.TextField(name="givenname", label="Given Name") - sn = widgets.TextField(name="sn", label="Family Name") + homedirectory = widgets.TextField(name="homedirectory", label="Home Directory") + loginshell = widgets.TextField(name="loginshell", label="Login Shell") + gecos = widgets.TextField(name="gecos", label="GECOS") + mail = widgets.TextField(name="mail", label="E-mail Address") - telephonenumber = widgets.TextField(name="telephonenumber", label="Phone") - # nsAccountLock = widgets.CheckBox(name="nsAccountLock", label="Account Deactivated") + telephonenumber = widgets.TextField(name="telephonenumber", label="Work Number") + facsimiletelephonenumber = widgets.TextField(name="facsimiletelephonenumber", + label="Fax Number") + mobile = widgets.TextField(name="mobile", label="Cell Number") + pager = widgets.TextField(name="pager", label="Pager Number") + homephone = widgets.TextField(name="homephone", label="Home Number") + + street = widgets.TextField(name="street", label="Street Address") + l = widgets.TextField(name="l", label="City") + st = widgets.TextField(name="st", label="State") + postalcode = widgets.TextField(name="postalcode", label="ZIP") + + ou = widgets.TextField(name="ou", label="Org Unit") + businesscategory = widgets.TextField(name="businesscategory", label="Tags") + description = widgets.TextField(name="description", label="Description") + employeetype = widgets.TextField(name="employeetype", label="Employee Type") + manager = widgets.TextField(name="manager", label="Manager") + roomnumber = widgets.TextField(name="roomnumber", label="Room Number") + secretary = widgets.TextField(name="secretary", label="Secretary") + + carlicense = widgets.TextField(name="carlicense", label="Car License") + labeleduri = widgets.TextField(name="labeleduri", label="Home Page") + nsAccountLock = widgets.SingleSelectField(name="nsAccountLock", label="Account Status", options = [("", "active"), ("true", "inactive")]) @@ -34,8 +64,6 @@ class UserNewValidator(validators.Schema givenname = validators.String(not_empty=True) sn = validators.String(not_empty=True) mail = validators.Email(not_empty=True) - # validators.PhoneNumber may be a bit too picky, requiring an area code - # telephonenumber = validators.PlainText(not_empty=False) chained_validators = [ validators.FieldsMatch('userpassword', 'userpassword_confirm') @@ -45,10 +73,9 @@ class UserNewForm(widgets.Form): class UserNewForm(widgets.Form): params = ['user'] - fields = [UserFields.uid, UserFields.givenname, - UserFields.sn, UserFields.mail, - UserFields.dn_to_info_json, - ] + hidden_fields = [ + UserFields.dn_to_info_json, + ] validator = UserNewValidator() @@ -59,10 +86,6 @@ class UserNewForm(widgets.Form): def update_params(self, params): super(UserNewForm,self).update_params(params) - params['has_foo'] = self.has_foo - - def has_foo(self): - return False class UserEditValidator(validators.Schema): userpassword = validators.String(not_empty=False) @@ -72,8 +95,6 @@ class UserEditValidator(validators.Schem mail = validators.Email(not_empty=True) uidnumber = validators.Int(not_empty=False) gidnumber = validators.Int(not_empty=False) - # validators.PhoneNumber may be a bit too picky, requiring an area code - # telephonenumber = validators.PlainText(not_empty=False) pre_validators = [ validators.RequireIfPresent(required='uidnumber', present='editprotected'), @@ -87,14 +108,13 @@ class UserEditForm(widgets.Form): class UserEditForm(widgets.Form): params = ['user'] - fields = [UserFields.givenname, UserFields.sn, UserFields.mail, - UserFields.uid_hidden, UserFields.user_orig, - UserFields.uidnumber, UserFields.gidnumber, - UserFields.krbPasswordExpiration_hidden, - UserFields.editprotected_hidden, - UserFields.user_groups_data, - UserFields.dn_to_info_json, - ] + hidden_fields = [ + UserFields.uid_hidden, UserFields.user_orig, + UserFields.krbPasswordExpiration_hidden, + UserFields.editprotected_hidden, + UserFields.user_groups_data, + UserFields.dn_to_info_json, + ] validator = UserEditValidator() diff -r 0ab2c3267500 -r ee2e41c50353 ipa-server/ipa-gui/ipagui/templates/usereditform.kid --- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Wed Oct 03 10:23:47 2007 -0700 +++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid Wed Oct 03 13:53:14 2007 -0700 @@ -32,17 +32,20 @@ from ipagui.helpers import ipahelper passwordConfirmField = document.getElementById('form_userpassword_confirm'); uidnumberField = document.getElementById('form_uidnumber'); gidnumberField = document.getElementById('form_gidnumber'); + homedirectoryField = document.getElementById('form_homedirectory'); if (checkbox.checked) { passwordField.disabled = false; passwordConfirmField.disabled = false; uidnumberField.disabled = false; gidnumberField.disabled = false; + homedirectoryField.disabled = false; $('form_editprotected').value = 'true'; } else { passwordField.disabled = true; passwordConfirmField.disabled = true; uidnumberField.disabled = true; gidnumberField.disabled = true; + homedirectoryField.disabled = true; $('form_editprotected').value = ''; } } @@ -76,6 +79,19 @@ from ipagui.helpers import ipahelper + + + + + @@ -98,10 +114,60 @@ from ipagui.helpers import ipahelper py:content="tg.errors.get('sn')" /> + + + + + + + + + + + + + + +
+ + + + +
+ + + + +
+ + + + +
+ + + + +

Account Details
+ + + + + + + + + + + + + + + + + + +
+ + + +
+ + + + + +
+ + + +
+ + + +
Contact Details
@@ -228,6 +337,7 @@ from ipagui.helpers import ipahelper py:content="tg.errors.get('mail')" />
- -
Account Status
- - - - - -
- - - -
+ + + +