Re: [Freeipa-devel] [PATCH] 861 roll back client changes on failed install
On 29.8.2011 23:49, Rob Crittenden wrote: There are still places where the client installation can fail that can cause /etc/sysconfig/network to be restored. I went through a number of iterations on restoring this and finally decided that we should just call uninstall() and undo everything. When we do automatic uninstallation I made it to be quiet since the user probably doesn't care what the individual steps are. We had a lot of sys.exit() interspersed in the installer that I replaced with print and return to make the code paths easier. I also replaced a bunch of magic integer values with constants. If --force is passed we leave things as they are. rob ipa-client/ipa-install/ipa-client-install:276: [E0602, uninstall] Undefined variable 'emit_erro' Besides that, ACK. Honza -- Jan Cholasta ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 257 Fixed host adder dialog to show default DNS zone.
On 08/29/2011 04:09 PM, Endi Sukma Dewata wrote: The DNS zone widget for host adder dialog has been modified not to provide an empty option, so it will show the first available zone. Ticket #1685 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel ACK -- Petr Vobornik ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 860 make uninstall logging more robust
On Mon, 2011-08-29 at 11:26 -0400, Rob Crittenden wrote: > The uninstaller would not often report problems, may exceptions were > ignored with pass. This beefs up the debug logging a bit more and will > attempt to find anything left over that may prevent a re-install. > > This also unifies the installed-status functions. ipa-server-install > looked at the install state and ipactl looked to see if files were > tracked. Now both are considered. > > rob Generally, it looks good. I just missed "kadmin" and "named" modules in IPA_MODULES. Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 111 Let Bind track data changes
On 08/15/2011 04:36 PM, Simo Sorce wrote: > On Mon, 2011-08-15 at 14:20 +0200, Martin Kosek wrote: >> A new version of bind-dyndb-ldap has been released. Thanks to the new >> persistent search feature, the name server can immediately pull new DNS >> zones when they are created in IPA. >> >> Since the bind-dyndb-ldap plugin has not been released in F-15 yet, one >> has to use the provided src.rpm: >> >> http://mkosek.fedorapeople.org/bind-dyndb-ldap/srpm/bind-dyndb-ldap-0.2.0-5.fc17.src.rpm >> >> or rpms I built for x86_64 F-15: >> >> http://mkosek.fedorapeople.org/bind-dyndb-ldap/x86_64/ >> >> There is one setback though. When I investigated DNS persistent search >> behavior I still miss the ability to detect changes to the DNS zone >> itself. Adding a record (for example MX record) to the zone does not >> trigger an update of the zone in nameserver cache. We still have to wait >> for cache timeout (argument "cache_ttl"). We cannot therefore use this >> feature as a solution of: >> >> https://fedorahosted.org/freeipa/ticket/1114 >> https://fedorahosted.org/freeipa/ticket/1125 >> https://fedorahosted.org/freeipa/ticket/1126 > Is this a bug/deficiency of the plugin ? Or is it something that depends > on named internals somehow ? > > Simo. > Sorry for late response, I'm finally back from vacation. There are two separate issues. The first one is that the plugin didn't purge outdated (i.e. persistent-search modified) zone data from cache. Patch for this issue is attached. The second issue is that the plugin doesn't recognize newly added records which have same FQDN as zone, which are KX/MX/LOC records for example. I haven't found why this happens, yet. Regards, Adam >From f4ab6f161d29bab81e566b739730b104a8f34545 Mon Sep 17 00:00:00 2001 From: Adam Tkac Date: Wed, 10 Aug 2011 16:06:39 +0200 Subject: [PATCH] Expire SOA record in cache when we modify the zone. Signed-off-by: Adam Tkac --- src/cache.h |6 ++ src/ldap_helper.c |4 2 files changed, 10 insertions(+), 0 deletions(-) diff --git a/src/cache.h b/src/cache.h index f5956cf..ade5aa5 100644 --- a/src/cache.h +++ b/src/cache.h @@ -59,6 +59,12 @@ ldap_cache_addrdatalist(ldap_cache_t *cache, dns_name_t *name, ldapdb_rdatalist_t *rdatalist); /* + * Delete matching "name" from the cache. + */ +isc_result_t +ldap_cache_deletename(ldap_cache_t *cache, dns_name_t *name); + +/* * Returns ISC_TRUE when cache is enabled. */ isc_boolean_t diff --git a/src/ldap_helper.c b/src/ldap_helper.c index 96c7349..7214dc1 100644 --- a/src/ldap_helper.c +++ b/src/ldap_helper.c @@ -695,6 +695,8 @@ ldap_delete_zone(ldap_instance_t *inst, const char *dn, isc_boolean_t lock) result == ISC_R_LOCKBUSY); if (result == ISC_R_SUCCESS) unlock = ISC_TRUE; + + CHECK(discard_from_cache(inst->cache, &name)); } result = zr_get_zone_ptr(inst->zone_register, &name, &zone); @@ -758,6 +760,8 @@ ldap_parse_zoneentry(ldap_entry_t *entry, ldap_instance_t *inst, if (result == ISC_R_SUCCESS) unlock = ISC_TRUE; + CHECK(discard_from_cache(inst->cache, &name)); + create: /* * Check if we are already serving given zone. -- 1.7.6 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 010 Enable update and reset buttons only if dirty
https://fedorahosted.org/freeipa/ticket/1697
Original problem:
Update name of the automount location (Policy -> Automount ->
custom_location -> Settings -> Update) in the WEBUI refer to an unknown
command.
Solution:
Tracking dirty state in field -> section -> details facet.
'Reset' and 'Updates' buttons in details facet are enabled only if facet
is dirty.
Removes the problem above and 'no modification to be performed' annoyance.
--
Petr Vobornik
From 6b373a80c7c9741c36e1151ca9f89dcd79dd52dd Mon Sep 17 00:00:00 2001
From: Petr Vobornik
Date: Tue, 30 Aug 2011 13:39:53 +0200
Subject: [PATCH] Enable update and reset button only if dirty
https://fedorahosted.org/freeipa/ticket/1697
Original problem:
WEBUI: Update automount location refer to unknown command
Update name of the automount location (Policy -> Automount ->
custom_location -> Settings -> Update) in the WEBUI refer to an unknown command.
Solution:
Tracking dirty state in field -> section -> details facet.
'Reset' and 'Updates' in details facet are enabled only if facet is dirty.
Removes the problem above and 'no modification to be performed' annoyance.
---
install/ui/details.js| 54 ++---
install/ui/test/ipa_tests.js | 32
install/ui/widget.js | 42
3 files changed, 124 insertions(+), 4 deletions(-)
diff --git a/install/ui/details.js b/install/ui/details.js
index a0a44e7b2e9c038afb5f11be1ae7aded82d2894d..4f7e4a29a432f225dc2b652a0e94f98529b84d35 100644
--- a/install/ui/details.js
+++ b/install/ui/details.js
@@ -40,6 +40,9 @@ IPA.details_section = function(spec) {
that.entity = spec.entity;
that.fields = $.ordered_map();
+that.dirty = false;
+that.dirty_changed = IPA.observer();
+
that.get_field = function(name) {
return that.fields.get(name);
};
@@ -47,6 +50,7 @@ IPA.details_section = function(spec) {
that.add_field = function(field) {
field.entity = that.entity;
that.fields.put(field.name, field);
+field.dirty_changed.attach(that.field_dirty_changed);
return field;
};
@@ -117,6 +121,20 @@ IPA.details_section = function(spec) {
}
};
+that.field_dirty_changed = function(dirty) {
+var old = that.dirty;
+
+if(dirty) {
+that.dirty = true;
+} else {
+that.dirty = that.is_dirty();
+}
+
+if(old !== that.dirty) {
+that.dirty_changed.notify([that.dirty], that);
+}
+};
+
that.is_dirty = function() {
var fields = that.fields.values;
for (var i=0; i___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 860 make uninstall logging more robust
Martin Kosek wrote: On Mon, 2011-08-29 at 11:26 -0400, Rob Crittenden wrote: The uninstaller would not often report problems, may exceptions were ignored with pass. This beefs up the debug logging a bit more and will attempt to find anything left over that may prevent a re-install. This also unifies the installed-status functions. ipa-server-install looked at the install state and ipactl looked to see if files were tracked. Now both are considered. rob Generally, it looks good. I just missed "kadmin" and "named" modules in IPA_MODULES. Martin As Martin points out, I needed to add named to both the master and ipa-2-1 branches. We dropped ipa_kpasswd in master, replacing it with kadmin. I fixed up both of these and pushed to master and ipa-2-1. rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 0283-enable-proxy-for-dogtag
Simo Sorce wrote:
On Fri, 2011-08-26 at 22:28 -0400, Adam Young wrote:
On 08/26/2011 08:57 PM, Adam Young wrote:
On 08/26/2011 06:30 PM, Simo Sorce wrote:
On Fri, 2011-08-26 at 17:41 -0400, Adam Young wrote:
On 08/26/2011 02:34 PM, Simo Sorce wrote:
On Fri, 2011-08-26 at 14:03 -0400, Simo Sorce wrote:
On Fri, 2011-08-26 at 12:45 -0400, Adam Young wrote:
On 08/25/2011 05:24 PM, Adam Young wrote:
Uses the updated version of pkicreate which makes an ipa specific
proxy config file.
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
The test for the proxy file in /etc/httpd/conf.d was "isfile' but
since the file is actually a symlink, it needs to be "islink".
This
one checks for either.
Nack, install fails after configuring the http service.
Restart bails out
using export SYSTEMCL_SKIP_REDIRECT=1 to get systemd out of the
way (it
was suppressing the error output) I get an permission denied error
trying to open /etc/httpd/conf.d/proxy-ipa.conf
That's a symlink into /etc/pki-ca/proxy-ipa.conf which is a file
owned
by pkiuser:pkiuser with permission 660 (therefore not readable by the
apache user).
Ok it turns out permissions are not the real issue as the file is read
while apache is till root, it's a selinux issue.
Apache starts if I setenforce 0
Still a NAck of course, it needs to work with selinux in enforcing
mode
Simo.
This version owns the proxy config file. It works with setenforce 0,
but does not work with SELinux, so, preemptive-nack. But I will be gone
for a week, so if someone wants to pick this up and run with it, start
from here.
The previous patch with the corrected isfile vs islink issue works fine
as long as the SELinux policy is fixed to allow access
to /etc/pki-ca/proxy-ipa.conf
I have tested a mastyer and then replica install with no issues after I
loaded a custom SeLinux policy that allow that.
So tentative ACK to the former patch.
I will discuss with Ade how to resolve the SELinux issue and willpush to
master once that is solved.
Simo.
Previous patch is based on a change for PKI-CA that we are not going
to push, so we can't go with that. The file
/etc/pki-ca/proxy-ipa.conf will not be available for IPA to use.
Whatever the issue is with this patch it has to be fairly minor. The
difference in approach is that this one includes the conf file and
places it in /etc/httpd/conf.d. The problem is possibly the fact that
this one uses localhost instead of the FQDN, although I did test it
both ways prior to adding it to the RPM, and it worked with localhost
and SELinux in enforcing mode.
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
Failure seems to be from this step in the install log:
After configuration, the server can be operated by the command:
/sbin/service pki-cad restart pki-ca
2011-08-26 21:51:47,114 DEBUG stderr=[error] FAILED
run_command("/sbin/service p
ki-cad restart pki-ca"), exit status=126 output="Stopping pki-ca: [ OK ]
/usr/bin/runcon: /var/lib/pki-ca/pki-ca: Permission denied"
And in the Audit log:
type=AVC msg=audit(1314409907.089:2397): avc: denied { transition }
for pid=21040 comm="runcon" path="/etc/rc.d/init.d/tomcat6" dev=dm-0
ino=35449 scontext=system_u:system_r:kernel_t:s0
tcontext=system_u:system_r:pki_ca_script_t:s0 tclass=process
type=AVC msg=audit(1314410048.272:2398): avc: denied { transition }
for pid=21124 comm="runcon" path="/etc/rc.d/init.d/tomcat6" dev=dm-0
ino=35449 scontext=system_u:system_r:kernel_t:s0
tcontext=system_u:system_r:pki_ca_script_t:s0 tclass=process
I guess these AVCs were due to mislabeling of your development system.
I tried multiple times w/o any issues.
I added a few minor corrections.
a) actually copying the file to /etc/httpd/conf.d was missing, I do that
as an additional final configuration step in cainstance.py
b) renamed the file to ipa-pki-proxy.conf, the orginal name was fine as
a dogtag file, but as an ipa file it lacked context
c) I added an httpd server restart in ipa-ca-install as that script does
not otherwise restart apache and we need it to read the new conf file
that was just dropped down.
This was tested and pushed to master.
Simo.
I pushed it to ipa-2-1.
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 845 add external source hosts to HBAC
Martin Kosek wrote: On Wed, 2011-08-17 at 11:56 -0400, Rob Crittenden wrote: You should be able to specify hosts that aren't in IPA in HBAC source host rules. This adds support for it. ticket https://fedorahosted.org/freeipa/ticket/1574 rob ACK. Works fine. Although, I am thinking that we now have the same algorithm (add user/host as external when not found in LDAP) for both hbac and sudorule. We may think about consolidating it so that we don't have duplicates. Martin I filed https://fedorahosted.org/freeipa/ticket/1734 for the code consolidation. pushed to master and ipa-2-1 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 861 roll back client changes on failed install
Jan Cholasta wrote: On 29.8.2011 23:49, Rob Crittenden wrote: There are still places where the client installation can fail that can cause /etc/sysconfig/network to be restored. I went through a number of iterations on restoring this and finally decided that we should just call uninstall() and undo everything. When we do automatic uninstallation I made it to be quiet since the user probably doesn't care what the individual steps are. We had a lot of sys.exit() interspersed in the installer that I replaced with print and return to make the code paths easier. I also replaced a bunch of magic integer values with constants. If --force is passed we leave things as they are. rob ipa-client/ipa-install/ipa-client-install:276: [E0602, uninstall] Undefined variable 'emit_erro' Besides that, ACK. Honza Fixed and pushed to master and ipa-2-1 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 0283-enable-proxy-for-dogtag
On Tue, 2011-08-30 at 10:14 -0400, Rob Crittenden wrote: > > This was tested and pushed to master. > > > > Simo. > > > > I pushed it to ipa-2-1. Thanks. I think we really need to start marking what branch patches should go into clearly. Simo. -- Simo Sorce * Red Hat, Inc * New York ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 1 Add ipa-adtrust-install utility
On Fri, Aug 26, 2011 at 09:14:27AM -0400, Simo Sorce wrote:
> More comments.
>
> On Fri, 2011-08-26 at 11:39 +0200, Sumit Bose wrote:
>
> [..]
>
> > +if not options.unattended:
> > +print ""
> > +print "The following operations may take some minutes to
> > complete."
> > +print "Please wait until the prompt is returned."
> > +print ""
> > +
> > +# Create a BIND instance
>
> comment seem to be wrong here :)
fixed
>
> > +if options.unattended and not options.dm_password:
> > +sys.exit("\nIn unattended mode you need to provide at least
> > the -p option")
> > +
> > +dm_password = options.dm_password or read_password("Directory
> > Manager",
> > + confirm=False,
> > validate=False)
> > +smb = smbinstance.SMBInstance(fstore, dm_password)
>
> [..]
>
> > diff --git a/ipaserver/install/service.py
> > b/ipaserver/install/service.py
> > index
> > a7f6ff4eea1b67f714e18f882a082d4ad7d83026..7e0d2bd314f00ccf0b0ee37a9d572bdd5ee89414
> > 100644
> > --- a/ipaserver/install/service.py
> > +++ b/ipaserver/install/service.py
> > @@ -37,7 +37,8 @@ SERVICE_LIST = {
> > 'KPASSWD':('kadmin', 20),
> > 'DNS':('named', 30),
> > 'HTTP':('httpd', 40),
> > -'CA':('pki-cad', 50)
> > +'CA':('pki-cad', 50),
> > +'SMB':('smb', 60)
>
> Please do not use SMB (in general I do not think SMB is the right
> prefix). Use something like ADTRUST or MSRPC or WINCOMPAT.
>
changed to ADTRUST
> > }
> >
> > def stop(service_name, instance_name="", capture_output=True):
> > diff --git a/ipaserver/install/smbinstance.py
> > b/ipaserver/install/smbinstance.py
> > new file mode 100644
> > index
> > ..5988f1e056d29af6686d53237b82d460cdc719da
> > --- /dev/null
> > +++ b/ipaserver/install/smbinstance.py
> > @@ -0,0 +1,261 @@
> > +# Authors: Sumit Bose
> > +#
> > +# Copyright (C) 2011 Red Hat
> > +# see file 'COPYING' for use and warranty information
> > +#
> > +# This program is free software; you can redistribute it and/or
> > modify
> > +# it under the terms of the GNU General Public License as published
> > by
> > +# the Free Software Foundation, either version 3 of the License, or
> > +# (at your option) any later version.
> > +#
> > +# This program is distributed in the hope that it will be useful,
> > +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> > +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> > +# GNU General Public License for more details.
> > +#
> > +# You should have received a copy of the GNU General Public License
> > +# along with this program. If not, see
> >
Re: [Freeipa-devel] [PATCH] 257 Fixed host adder dialog to show default DNS zone.
On 8/30/2011 3:21 AM, Petr Vobornik wrote: On 08/29/2011 04:09 PM, Endi Sukma Dewata wrote: The DNS zone widget for host adder dialog has been modified not to provide an empty option, so it will show the first available zone. Ticket #1685 ACK Pushed to master and ipa-2-1. -- Endi S. Dewata ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 114 Fix sudo help and summaries
On Fri, 2011-08-26 at 09:31 +0200, Martin Kosek wrote:
> On Thu, 2011-08-25 at 09:28 -0400, Rob Crittenden wrote:
> > Martin Kosek wrote:
> > > 1) Add sudorule docstring headline
> > >
> > > 2) Fix naming inconsistency in Sudo plugins help and summaries,
> > > especially capitalization of Sudo objects - Sudo Rule, Sudo
> > > Command and Sudo Command Group
> > >
> > > 3) Add missing summaries for sudorule-add-option and
> > > sudorule-remove-option
> > >
> > > https://fedorahosted.org/freeipa/ticket/1595
> > > https://fedorahosted.org/freeipa/ticket/1596
> >
> > This breaks compatibility with old clients:
> >
> > $ ipa sudorule-add-option test2
> > Sudo Option: foo
> > ipa: ERROR: non-public: ValueError:
> > sudorule_add_option.validate_output(): unexpected keys ['summary'] in
> > {'result': {'ipasudoopt': (u'foo',), 'cn': (u'test2',),
> > 'ipaenabledflag': (u'TRUE',)}, 'summary': u'Added option "foo" to Sudo
> > Rule "test2"'}
> > Traceback (most recent call last):
> >File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 125,
> > in execute
> > result = self.Command[_name](*args, **options)
> >File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 443,
> > in __call__
> > self.validate_output(ret)
> >File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 895,
> > in validate_output
> > nice, extra, output)
> > ValueError: sudorule_add_option.validate_output(): unexpected keys
> > ['summary'] in {'result': {'ipasudoopt': (u'foo',), 'cn': (u'test2',),
> > 'ipaenabledflag': (u'TRUE',)}, 'summary': u'Added option "foo" to Sudo
> > Rule "test2"'}
> > ipa: ERROR: an internal error has occurred
> >
>
> Thanks for catching this. I wonder if we should let output param
> validation skip unexpected keys in order to be able to do the change in
> Output + keep backwards compatibility in cases like this one.
>
> I reworked the patch so that the summaries are printed via
> output_for_cli() - this solves this problem.
>
> Martin
I had to rework the whole patch because of latest i18n patches. Here it
is, it can be applied to current master.
Martin
>From 6e54673829f464be4e0a10663f59bbac77833876 Mon Sep 17 00:00:00 2001
From: Martin Kosek
Date: Tue, 30 Aug 2011 17:10:27 +0200
Subject: [PATCH] Fix sudo help and summaries
1) Add sudorule docstring headline
2) Fix naming inconsistency in Sudo plugins help and summaries,
especially capitalization of Sudo objects - Sudo Rule, Sudo
Command and Sudo Command Group
3) Add missing summaries for sudorule-add-option and
sudorule-remove-option. To keep backward compatibility with
older clients, just print the missing summary with
output_for_cli(), don't expand Output.
https://fedorahosted.org/freeipa/ticket/1595
https://fedorahosted.org/freeipa/ticket/1596
---
ipalib/plugins/sudocmd.py | 18 +-
ipalib/plugins/sudocmdgroup.py| 40
ipalib/plugins/sudorule.py| 40 -
tests/test_xmlrpc/test_sudocmd_plugin.py |8 ++--
tests/test_xmlrpc/test_sudocmdgroup_plugin.py | 22 +++---
5 files changed, 70 insertions(+), 58 deletions(-)
diff --git a/ipalib/plugins/sudocmd.py b/ipalib/plugins/sudocmd.py
index 18190f9d95361d15ab59d748dabcc13624a27e8e..42068edea3c51804be9ee5919934462afbee578f 100644
--- a/ipalib/plugins/sudocmd.py
+++ b/ipalib/plugins/sudocmd.py
@@ -97,36 +97,36 @@ class sudocmd(LDAPObject):
api.register(sudocmd)
class sudocmd_add(LDAPCreate):
-__doc__ = _('Create new sudo command.')
+__doc__ = _('Create new Sudo Command.')
-msg_summary = _('Added sudo command "%(value)s"')
+msg_summary = _('Added Sudo Command "%(value)s"')
api.register(sudocmd_add)
class sudocmd_del(LDAPDelete):
-__doc__ = _('Delete sudo command.')
+__doc__ = _('Delete Sudo Command.')
-msg_summary = _('Deleted sudo command "%(value)s"')
+msg_summary = _('Deleted Sudo Command "%(value)s"')
api.register(sudocmd_del)
class sudocmd_mod(LDAPUpdate):
-__doc__ = _('Modify command.')
+__doc__ = _('Modify Sudo Command.')
-msg_summary = _('Modified sudo command "%(value)s"')
+msg_summary = _('Modified Sudo Command "%(value)s"')
api.register(sudocmd_mod)
class sudocmd_find(LDAPSearch):
-__doc__ = _('Search for commands.')
+__doc__ = _('Search for Sudo Commands.')
msg_summary = ngettext(
-'%(count)d sudo command matched', '%(count)d sudo command matched', 0
+'%(count)d Sudo Command matched', '%(count)d Sudo Commands matched', 0
)
api.register(sudocmd_find)
class sudocmd_show(LDAPRetrieve):
-__doc__ = _('Display sudo command.')
+__doc__ = _('Display Sudo Command.')
api.register(sudocmd_show)
diff --git a/ipalib/plugins/sudocmdgroup.py b/ipalib/plugins/sudocmdgroup.py
index e7f1fd3be56c301de84d6d0389ebe7d1bc4d5d38..2124b84a530cdaa2f8cb9754de88bd04d9961dd0 100644
--- a
Re: [Freeipa-devel] [PATCH] 844 add netgroup to memberof association of hostgroups
On Wed, 2011-08-17 at 14:23 -0400, Rob Crittenden wrote: > Rob Crittenden wrote: > > Let hostgroups show that they are members of netgroups. > > > > rob > > Updated patch It works fine with CLI. Still, I have 2 remarks: 1) Although the new "netgroup" tab in the WebUI screen for Host Group was displayed, Delete/Enroll actions in this new tab did not work. I did not find any problem in CLI, maybe Endi or Petr can provide a hint what is wrong. 2) This patch's needs to be rebased, there were conflicts in updated tests. So its ACK from me if the tests are fixed + WebUI guys don't object to the patch. Martin ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 844 add netgroup to memberof association of hostgroups
Martin Kosek wrote:
On Wed, 2011-08-17 at 14:23 -0400, Rob Crittenden wrote:
Rob Crittenden wrote:
Let hostgroups show that they are members of netgroups.
rob
Updated patch
It works fine with CLI. Still, I have 2 remarks:
1) Although the new "netgroup" tab in the WebUI screen for Host Group
was displayed, Delete/Enroll actions in this new tab did not work. I did
not find any problem in CLI, maybe Endi or Petr can provide a hint what
is wrong.
2) This patch's needs to be rebased, there were conflicts in updated
tests.
So its ACK from me if the tests are fixed + WebUI guys don't object to
the patch.
Martin
Updated patch so Endi can give it a quick looksee
rob
>From 1deac2e5f6dcc21b7f128930ad5ccd32a7bfbd83 Mon Sep 17 00:00:00 2001
From: Rob Crittenden
Date: Tue, 30 Aug 2011 14:08:34 -0400
Subject: [PATCH] Add netgroup as possible memberOf for hostgroups
https://fedorahosted.org/freeipa/ticket/1563
---
API.txt|4 +++-
ipalib/plugins/hostgroup.py|2 +-
tests/test_xmlrpc/test_hostgroup_plugin.py |7 +++
tests/test_xmlrpc/test_nesting.py |5 +
tests/test_xmlrpc/test_netgroup_plugin.py |1 +
5 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/API.txt b/API.txt
index 2929b9819b8533bf099eeddcadfc2741d1f2bb63..b7578b66f32b9abcdf74ad73b9d828f25202 100644
--- a/API.txt
+++ b/API.txt
@@ -1486,7 +1486,7 @@ output: Output('summary', (, ), 'User-friendly
output: Output('result', , 'list of deletions that failed')
output: Output('value', , "The primary_key value of the entry, e.g. 'jdoe' for a user")
command: hostgroup_find
-args: 1,17,4
+args: 1,19,4
arg: Str('criteria?', noextrawhitespace=False)
option: Str('cn', attribute=True, autofill=False, cli_name='hostgroup_name', label=Gettext('Host-group', domain='ipa', localedir=None), multivalue=False, normalizer=, primary_key=True, query=True, required=False)
option: Str('description', attribute=True, autofill=False, cli_name='desc', label=Gettext('Description', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
@@ -1501,6 +1501,8 @@ option: List('hostgroup?', cli_name='hostgroups', label=Gettext('host group', do
option: List('no_hostgroup?', cli_name='no_hostgroups', label=Gettext('host group', domain='ipa', localedir=None), multivalue=True)
option: List('in_hostgroup?', cli_name='in_hostgroups', label=Gettext('host group', domain='ipa', localedir=None), multivalue=True)
option: List('not_in_hostgroup?', cli_name='not_in_hostgroups', label=Gettext('host group', domain='ipa', localedir=None), multivalue=True)
+option: List('in_netgroup?', cli_name='in_netgroups', label=Gettext('netgroup', domain='ipa', localedir=None), multivalue=True)
+option: List('not_in_netgroup?', cli_name='not_in_netgroups', label=Gettext('netgroup', domain='ipa', localedir=None), multivalue=True)
option: List('in_hbacrule?', cli_name='in_hbacrules', label=Gettext('HBAC rule', domain='ipa', localedir=None), multivalue=True)
option: List('not_in_hbacrule?', cli_name='not_in_hbacrules', label=Gettext('HBAC rule', domain='ipa', localedir=None), multivalue=True)
option: List('in_sudorule?', cli_name='in_sudorules', label=Gettext('sudo rule', domain='ipa', localedir=None), multivalue=True)
diff --git a/ipalib/plugins/hostgroup.py b/ipalib/plugins/hostgroup.py
index a316270fa0a0ae5090554b110c08cad92dd07c83..d75f381e0250c1709d1497db8fe9bac501f4a0be 100644
--- a/ipalib/plugins/hostgroup.py
+++ b/ipalib/plugins/hostgroup.py
@@ -65,7 +65,7 @@ class hostgroup(LDAPObject):
uuid_attribute = 'ipauniqueid'
attribute_members = {
'member': ['host', 'hostgroup'],
-'memberof': ['hostgroup', 'hbacrule', 'sudorule'],
+'memberof': ['hostgroup', 'netgroup', 'hbacrule', 'sudorule'],
'memberindirect': ['host', 'hostgroup'],
'memberofindirect': ['hostgroup', 'hbacrule', 'sudorule'],
}
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index e0d115854e1f437da04cae797eb67e4b82230850..6c3b0a41e93eb97bf56edb687bacd626f0888db0 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -83,6 +83,7 @@ class test_hostgroup(Declarative):
objectclass=objectclasses.hostgroup,
description=[u'Test hostgroup 1'],
ipauniqueid=[fuzzy_uuid],
+memberof_netgroup=[hostgroup1],
mepmanagedentry=lambda x: [DN(i) for i in x] == \
[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
api.env.basedn)],
@@ -146,6 +147,7 @@ class test_hostgroup(Declarative):
'cn': [hostgroup1],
'description': [u'Test hostgroup 1'],
'member_host': [fqdn1],
+'memberof_netgroup': [hostgroup1],
},
),
Re: [Freeipa-devel] [PATCH] 114 Fix sudo help and summaries
Martin Kosek wrote:
On Fri, 2011-08-26 at 09:31 +0200, Martin Kosek wrote:
On Thu, 2011-08-25 at 09:28 -0400, Rob Crittenden wrote:
Martin Kosek wrote:
1) Add sudorule docstring headline
2) Fix naming inconsistency in Sudo plugins help and summaries,
especially capitalization of Sudo objects - Sudo Rule, Sudo
Command and Sudo Command Group
3) Add missing summaries for sudorule-add-option and
sudorule-remove-option
https://fedorahosted.org/freeipa/ticket/1595
https://fedorahosted.org/freeipa/ticket/1596
This breaks compatibility with old clients:
$ ipa sudorule-add-option test2
Sudo Option: foo
ipa: ERROR: non-public: ValueError:
sudorule_add_option.validate_output(): unexpected keys ['summary'] in
{'result': {'ipasudoopt': (u'foo',), 'cn': (u'test2',),
'ipaenabledflag': (u'TRUE',)}, 'summary': u'Added option "foo" to Sudo
Rule "test2"'}
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ipalib/backend.py", line 125,
in execute
result = self.Command[_name](*args, **options)
File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 443,
in __call__
self.validate_output(ret)
File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 895,
in validate_output
nice, extra, output)
ValueError: sudorule_add_option.validate_output(): unexpected keys
['summary'] in {'result': {'ipasudoopt': (u'foo',), 'cn': (u'test2',),
'ipaenabledflag': (u'TRUE',)}, 'summary': u'Added option "foo" to Sudo
Rule "test2"'}
ipa: ERROR: an internal error has occurred
Thanks for catching this. I wonder if we should let output param
validation skip unexpected keys in order to be able to do the change in
Output + keep backwards compatibility in cases like this one.
I reworked the patch so that the summaries are printed via
output_for_cli() - this solves this problem.
Martin
I had to rework the whole patch because of latest i18n patches. Here it
is, it can be applied to current master.
Martin
ACK
Fixed a couple of whitespace issues and pushed to master and ipa-2-1
rob
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
Re: [Freeipa-devel] [PATCH] 844 add netgroup to memberof association of hostgroups
Rob Crittenden wrote: Martin Kosek wrote: On Wed, 2011-08-17 at 14:23 -0400, Rob Crittenden wrote: Rob Crittenden wrote: Let hostgroups show that they are members of netgroups. rob Updated patch It works fine with CLI. Still, I have 2 remarks: 1) Although the new "netgroup" tab in the WebUI screen for Host Group was displayed, Delete/Enroll actions in this new tab did not work. I did not find any problem in CLI, maybe Endi or Petr can provide a hint what is wrong. 2) This patch's needs to be rebased, there were conflicts in updated tests. So its ACK from me if the tests are fixed + WebUI guys don't object to the patch. Martin Updated patch so Endi can give it a quick looksee rob ACK'd by endi in IRC, pushed to master and ipa-2-1. There is a problem in the UI, Endi is going to create a new ticket to fix it. rob ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 259 Fixed problem adding hostgroup into netgroup.
The memberof_netgroup association facet for hostgroup has been explicitly defined to use the serial associator so it will invoke the right methods. Ticket #1737 -- Endi S. Dewata freeipa-edewata-0259-Fixed-problem-adding-hostgroup-into-netgroup.patch Description: application/mbox ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 862 sort lists in tests
JR ran into an issue with his automember patch where the order of memberof wasn't predictable which caused tests to fail. To resolve this we just need to sort the lists and then compare. rob >From 4dddfe9d4166cba309ae213967f10f1d45d36b46 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 30 Aug 2011 23:40:17 -0400 Subject: [PATCH 1/2] Sort lists so order is predictable and tests pass as expected. Related to https://fedorahosted.org/freeipa/ticket/1272 --- tests/test_util.py |4 ++-- tests/util.py |8 +--- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/tests/test_util.py b/tests/test_util.py index 0a253adfa4ddd731a3f7b647a6d9f2bf7626635d..f87822a223f017f54f8b3bf5f6319b66e97482a7 100644 --- a/tests/test_util.py +++ b/tests/test_util.py @@ -180,7 +180,7 @@ def test_assert_deepequal(): ] e = raises(AssertionError, f, a, b, 'foo') assert str(e) == TYPE % ( -'foo', unicode, str, u'hello', 'hello', (0,) +'foo', unicode, str, u'hello', 'hello', (2,) ) b = [ @@ -200,7 +200,7 @@ def test_assert_deepequal(): ] e = raises(AssertionError, f, a, b, 'foo') assert str(e) == TYPE % ( -'foo', int, float, 18, 18.0, (2,) +'foo', int, float, 18, 18.0, (0,) ) # List length mismatch diff --git a/tests/util.py b/tests/util.py index 48260dd7cd06e9053a510cfec9ea592461c56da7..5a365fbcd0e065b2f645b379b554b973d511c791 100644 --- a/tests/util.py +++ b/tests/util.py @@ -286,7 +286,7 @@ def assert_deepequal(expected, got, doc='', stack=tuple()): type(got) = expected = u'how are you?' got = 'how are you?' - path = (1, 'world') + path = (0, 'world') """ if isinstance(expected, tuple): expected = list(expected) @@ -301,8 +301,10 @@ def assert_deepequal(expected, got, doc='', stack=tuple()): raise AssertionError( LEN % (doc, len(expected), len(got), expected, got, stack) ) -for (i, e_sub) in enumerate(expected): -g_sub = got[i] +s_got = sorted(got) +s_expected = sorted(expected) +for (i, e_sub) in enumerate(s_expected): +g_sub = s_got[i] assert_deepequal(e_sub, g_sub, doc, stack + (i,)) elif isinstance(expected, dict): missing = set(expected).difference(got) -- 1.7.4 ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 863 netgroups memberof
This was spawned by another recent patch I pushed that showed netgroups
that a hostgroup is a member of. We want to suppress the automatic
netgroup that is created with hostgroups.
rob
>From f4020dffa0f7ebd289063a2e519e21123456890a Mon Sep 17 00:00:00 2001
From: Rob Crittenden
Date: Tue, 30 Aug 2011 18:38:22 -0400
Subject: [PATCH 2/2] Suppress managed netgroups from showing as memberof hostgroups.
By design these managed netgroups are not supposed to show unless you
specifically want to see them.
https://fedorahosted.org/freeipa/ticket/1738
---
ipalib/plugins/hostgroup.py| 49 ++--
tests/test_xmlrpc/test_hostgroup_plugin.py |7
tests/test_xmlrpc/test_nesting.py |5 ---
tests/test_xmlrpc/test_netgroup_plugin.py |1 -
4 files changed, 46 insertions(+), 16 deletions(-)
diff --git a/ipalib/plugins/hostgroup.py b/ipalib/plugins/hostgroup.py
index d75f381e0250c1709d1497db8fe9bac501f4a0be..6a091e2d0d2490beeff041eb1eae282170370363 100644
--- a/ipalib/plugins/hostgroup.py
+++ b/ipalib/plugins/hostgroup.py
@@ -20,6 +20,7 @@
from ipalib.plugins.baseldap import *
from ipalib import api, Int, _, ngettext
+from ipalib.dn import DN
__doc__ = _("""
Groups of hosts.
@@ -88,6 +89,24 @@ class hostgroup(LDAPObject):
),
)
+def suppress_netgroup_memberof(self, dn, entry_attrs):
+"""
+We don't want to show managed netgroups so remove them from the
+memberOf list.
+"""
+if 'memberof' in entry_attrs:
+hgdn = DN(dn)
+for member in entry_attrs['memberof']:
+ngdn = DN(member)
+if ngdn['cn'] == hgdn['cn']:
+try:
+netgroup = api.Command['netgroup_show'](ngdn['cn'], all=True)['result']
+if self.has_objectclass(netgroup['objectclass'], 'mepmanagedentry'):
+entry_attrs['memberof'].remove(member)
+return
+except NotFound:
+pass
+
api.register(hostgroup)
@@ -97,9 +116,11 @@ class hostgroup_add(LDAPCreate):
msg_summary = _('Added hostgroup "%(value)s"')
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
-if self.api.env.wait_for_attr:
-newentry = wait_for_value(ldap, dn, 'objectclass', 'mepOriginEntry')
-entry_from_entry(entry_attrs, newentry)
+# Always wait for the associated netgroup to be created so we can
+# be sure to ignore it in memberOf
+newentry = wait_for_value(ldap, dn, 'objectclass', 'mepOriginEntry')
+entry_from_entry(entry_attrs, newentry)
+self.obj.suppress_netgroup_memberof(dn, entry_attrs)
return dn
@@ -120,6 +141,10 @@ class hostgroup_mod(LDAPUpdate):
msg_summary = _('Modified hostgroup "%(value)s"')
+def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+self.obj.suppress_netgroup_memberof(dn, entry_attrs)
+return dn
+
api.register(hostgroup_mod)
@@ -131,22 +156,40 @@ class hostgroup_find(LDAPSearch):
'%(count)d hostgroup matched', '%(count)d hostgroups matched', 0
)
+def post_callback(self, ldap, entries, truncated, *args, **options):
+for entry in entries:
+(dn, entry_attrs) = entry
+self.obj.suppress_netgroup_memberof(dn, entry_attrs)
+return dn
+
api.register(hostgroup_find)
class hostgroup_show(LDAPRetrieve):
__doc__ = _('Display information about a hostgroup.')
+def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+self.obj.suppress_netgroup_memberof( dn, entry_attrs)
+return dn
+
api.register(hostgroup_show)
class hostgroup_add_member(LDAPAddMember):
__doc__ = _('Add members to a hostgroup.')
+def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
+self.obj.suppress_netgroup_memberof(dn, entry_attrs)
+return (completed, dn)
+
api.register(hostgroup_add_member)
class hostgroup_remove_member(LDAPRemoveMember):
__doc__ = _('Remove members from a hostgroup.')
+def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
+self.obj.suppress_netgroup_memberof(dn, entry_attrs)
+return (completed, dn)
+
api.register(hostgroup_remove_member)
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index 6c3b0a41e93eb97bf56edb687bacd626f0888db0..e0d115854e1f437da04cae797eb67e4b82230850 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -83,7 +83,6 @@ class test_hostgroup(Declarative):
objectclass=objectclasses.hostgroup,
description=[u'Test hostgroup 1'],
ipauniqueid=[fuzzy_uuid],
-memberof_netgroup=[
Re: [Freeipa-devel] [PATCH] 010 Enable update and reset buttons only if dirty
On 8/30/2011 7:36 AM, Petr Vobornik wrote:
https://fedorahosted.org/freeipa/ticket/1697
Original problem:
Update name of the automount location (Policy -> Automount ->
custom_location -> Settings -> Update) in the WEBUI refer to an unknown
command.
Solution:
Tracking dirty state in field -> section -> details facet.
'Reset' and 'Updates' buttons in details facet are enabled only if facet
is dirty.
Removes the problem above and 'no modification to be performed' annoyance.
The patch works, so it's ACKed and pushed to master and ipa-2-1.
One minor thing, in details.js:322:
if(!that.update_button.hasClass('action-button-disabled')) {
that.reset();
}
It probably should have been a reset_button instead of update_button.
Right now it doesn't make any difference because both are enabled and
disabled together, but that might not be the case in the future.
--
Endi S. Dewata
___
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
[Freeipa-devel] [PATCH] 260 Fixed problem with combobox.
The entity select widget has been modified to handle timing issue in both dialog box and details page. Ticket #1736 -- Endi S. Dewata freeipa-edewata-0260-Fixed-problem-with-combobox.patch Description: application/mbox ___ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
