freeipa.git/API.txt, branch oneway-trust

trusts: add support for one-way trust and switch to it by default

2015-07-07T08:09:03+00:00

One-way trust is the default now, use 'trust add --two-way ' to
force bidirectional trust

https://fedorahosted.org/freeipa/ticket/4959

In case of one-way trust we cannot authenticate using cross-realm TGT
against an AD DC. We have to use trusted domain object from within AD
domain and access to this object is limited to avoid compromising the whole
trust configuration.

Instead, IPA framework can call out to oddjob daemon and ask it to
run the script which can have access to the TDO object. This script
(com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal
to retrieve TDO object credentials from IPA LDAP if needed and then
authenticate against AD DCs using the TDO object credentials.

The script pulls the trust topology out of AD DCs and updates IPA LDAP
store. Then IPA framework can pick the updated data from the IPA LDAP
under normal access conditions.

Part of https://fedorahosted.org/freeipa/ticket/4546

trusts: pass AD DC hostname if specified explicitly

2015-07-07T08:05:48+00:00

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1222047

new commands to manage user/host/service certificates

2015-07-02T14:43:44+00:00

A new group of commands is introduced that simplifies adding and removing
binary certificates to entries. A general form of the command is

ipa [user/host/service]-[add/remove]-cert [pkey] --certificate=[BASE64 BLOB]

Part of http://www.freeipa.org/page/V4/User_Certificates and
https://fedorahosted.org/freeipa/ticket/4238

Reviewed-By: Jan Cholasta

idviews: Fallback to AD DC LDAP only if specifically allowed

2015-07-02T11:23:21+00:00

https://fedorahosted.org/freeipa/ticket/4524

Reviewed-By: Martin Babinsky

Verify replication topology for a suffix

2015-06-29T15:11:53+00:00

Checks done:
  1. check if the topology is not disconnected. In other words if
     there are replication paths between all servers.
  2. check if servers don't have more than a recommended number of
     replication agreements(4)

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: David Kupka

User life cycle: change user-del flags to be CLI-specific

2015-06-18T13:48:53+00:00

Rename --permanently to --no-preserve.

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Petr Vobornik

User life cycle: provide preserved user virtual attribute

2015-06-15T14:13:22+00:00

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka 
Reviewed-By: Petr Vobornik

server: add "del" command

2015-06-15T14:06:48+00:00

this command is internal and is supposed to be used by ipa-replica-managed to
delete replica.

Reviewed-By: Martin Babinsky

topology: restrict direction changes

2015-06-15T07:38:46+00:00

topology plugin doesn't properly handle:
- creation of segment with direction 'none' and then upgrade to other
  direction
- downgrade of direction

These situations are now forbidden in API.

part of: https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky

disallow mod of topology segment nodes

2015-06-11T11:39:09+00:00

Mod of segment end will be disallowed in topology plugin.

Reasoning (by Ludwig):  if we want to properly allow mods to change
connectivity and endpoints, then we would need to check if the mod
disconnects the topology, delete existing agreements, check if the new
would be a duplicate and create new agmts. There could be some difficult
scenarios, like having
  A <--> B <--> C <--> D,
if you modify the segment B-C to A-D topology breaks and is then
reconnected.

part of: https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky