On 09/18/2012 05:33 PM, Alexander Bokovoy wrote:
On Tue, 18 Sep 2012, Petr Vobornik wrote:
On 09/18/2012 03:22 PM, Alexander Bokovoy wrote:
On Tue, 18 Sep 2012, Petr Vobornik wrote:
On 09/18/2012 02:15 PM, Sumit Bose wrote:
On Tue, Sep 18, 2012 at 12:42:49PM +0200, Sumit Bose wrote:
On Mon, Sep 17, 2012 at 06:44:36PM +0300, Alexander Bokovoy wrote:
Hi,
Following patch adds trust verification sequence to the case when we
establish trust with knowledge of AD administrative credentials.
As we found out, in order to validate/verify trust, one has to have
administrative credentials for the trusted domain, since there are
few RPCs that should be performed against trusted domain's DC's LSA
and NetLogon pipes and these are protected by administrative
credentials.
Thus, when we know admin credentials for the remote domain, we can
perform the trust validation.
https://fedorahosted.org/freeipa/ticket/2763
Just a short feedback. The patch is working as expected, for a newly
created trust Windows will send a TGS request to the IPA KDC without
explicit validation on the windows side. Currently I have some issues
in my test setup so that I can not give a full ACK atm.
ok, ACK.
Nevertheless it would be nice if Petr can check for any
implications to
the web UI with respect to the status of the trust.
It shouldn't break Web UI but Web UI won't use it. In add command Web
UI uses only the command state (success/error). If the truststatus
text would be a part of command summary text, it can be displayed in
notification message (which fades after 3s) when comment 8 of
https://fedorahosted.org/freeipa/ticket/2977#comment:8 is implemented.
It is displayed as part of the output, truststatus property:
# ipa trust-add --type=ad --admin Administrator@ad.local --password
ad.local
Active directory domain adminstrator's password:
-------------------------------------------------
Added Active Directory trust for realm "ad.local"
-------------------------------------------------
Realm name: ad.local
Domain NetBIOS name: AD
Domain Security Identifier: S-1-5-21-16904141-148189700-2149043814
Trust direction: Two-way trust
Trust type: Active Directory domain
Trust status: Established and verified
Would be good if you could take it in use.
I created a patch which uses it. See attached screenshots. It may be
useful but, as I wrote, the message is displayed only for 3s, so some
users might not have time to read it whole - message is too long.
Well, as we don't have other means to show this information right now,
that's good too. Maybe notification message timer could be possible to
tune per instance? Then we could have, say, 5 seconds timeout here and
keep 3 seconds as default one...
I tuned it. Updated patch attached.
--
Petr Vobornik
From 4ec95483604c22119f3fa1405103558176e07784 Mon Sep 17 00:00:00 2001
From: Petr Vobornik <pvobo...@redhat.com>
Date: Tue, 18 Sep 2012 17:12:59 +0200
Subject: [PATCH] Show trust status in add success notification
Web UI notification of 'Add verification step after trust creation'
https://fedorahosted.org/freeipa/ticket/2763
---
install/ui/add.js | 13 +++++++++----
install/ui/ipa.js | 4 ++--
install/ui/trust.js | 18 ++++++++++++++++++
3 files changed, 29 insertions(+), 6 deletions(-)
diff --git a/install/ui/add.js b/install/ui/add.js
index d855879452e5812c8c7fbae7bc9d1ff9035f1a6e..a5e30092f10495266351674b37fc8fa912af0fbe 100644
--- a/install/ui/add.js
+++ b/install/ui/add.js
@@ -52,7 +52,7 @@ IPA.entity_adder_dialog = function(spec) {
var facet = IPA.current_entity.get_facet();
facet.refresh();
that.close();
- IPA.notify_success(that.get_success_message());
+ that.notify_success(data);
},
that.on_error);
}
@@ -66,7 +66,7 @@ IPA.entity_adder_dialog = function(spec) {
that.add(
function(data, text_status, xhr) {
that.added.notify();
- that.show_message(that.get_success_message());
+ that.show_message(that.get_success_message(data));
var facet = IPA.current_entity.get_facet();
facet.refresh();
that.reset();
@@ -86,7 +86,7 @@ IPA.entity_adder_dialog = function(spec) {
that.close();
var result = data.result.result;
that.show_edit_page(that.entity, result);
- IPA.notify_success(that.get_success_message());
+ that.notify_success(data);
},
that.on_error);
}
@@ -102,11 +102,15 @@ IPA.entity_adder_dialog = function(spec) {
});
};
- that.get_success_message = function() {
+ that.get_success_message = function(data) {
var message = IPA.messages.dialogs.add_confirmation;
return message.replace('${entity}', that.subject);
};
+ that.notify_success = function(data) {
+ IPA.notify_success(that.get_success_message(data));
+ };
+
function show_edit_page(entity,result) {
var pkey_name = entity.metadata.primary_key;
var pkey = result[pkey_name];
@@ -183,6 +187,7 @@ IPA.entity_adder_dialog = function(spec) {
// methods that should be invoked by subclasses
that.entity_adder_dialog_create = that.create;
that.entity_adder_dialog_create_add_command = that.create_add_command;
+ that.entity_adder_dialog_get_success_message = that.get_success_message;
init();
diff --git a/install/ui/ipa.js b/install/ui/ipa.js
index 23c9933dfb97cb39a932f78d235fdaf844e42b7c..a2c4c08d6f6cb8fc1ec86a315486fa333c67c020 100644
--- a/install/ui/ipa.js
+++ b/install/ui/ipa.js
@@ -2040,7 +2040,7 @@ IPA.confirm = function(msg) {
return window.confirm(msg);
};
-IPA.notify_success = function(message) {
+IPA.notify_success = function(message, timeout) {
if (!message) return; // don't show undefined, null and such
@@ -2069,7 +2069,7 @@ IPA.notify_success = function(message) {
IPA.notify_success.timeout = window.setTimeout(function() {
notification_area.fadeOut(IPA.config.message_fadeout_time);
- }, IPA.config.message_timeout);
+ }, timeout || IPA.config.message_timeout);
};
IPA.config = {
diff --git a/install/ui/trust.js b/install/ui/trust.js
index 77e7cb38101773f787ae1cbedab5a4efe9edf82b..939bb59a33e5f2b61eb11141a949094dd1394acb 100644
--- a/install/ui/trust.js
+++ b/install/ui/trust.js
@@ -71,6 +71,7 @@ IPA.trust.entity = function(spec) {
]
}).
adder_dialog({
+ factory: IPA.trust.adder_dialog,
fields: [
{
name: 'cn',
@@ -162,4 +163,21 @@ IPA.trust.entity = function(spec) {
return that;
};
+IPA.trust.adder_dialog = function(spec) {
+
+ spec = spec || {};
+
+ var that = IPA.entity_adder_dialog(spec);
+
+ that.get_success_message = function(data) {
+ return that.entity_adder_dialog_get_success_message(data) + '. ' + data.result.result.truststatus[0];
+ };
+
+ that.notify_success = function(data) {
+ IPA.notify_success(that.get_success_message(data), 5000);
+ };
+
+ return that;
+};
+
IPA.register('trust', IPA.trust.entity);
--
1.7.11.4
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
