freeipa.git/daemons/ipa-sam, branch ad-work

ipasam: add enumeration of UPN suffixes based on the realm domains

2013-03-29T12:45:50+00:00

PASSDB API in Samba adds support for specifying UPN suffixes. The change
in ipasam will allow to pass through list of realm domains as UPN suffixes
so that Active Directory domain controller will be able to recognize
non-primary UPN suffixes as belonging to IPA and properly find our KDC
for cross-realm TGT.

Since Samba already returns primary DNS domain separately, filter it out
from list of UPN suffixes.

Also enclose provider of UPN suffixes into #ifdef to support both
Samba with and without pdb_enum_upn_suffixes().

Part of https://fedorahosted.org/freeipa/ticket/2848

Remove build warnings

2013-03-29T07:59:36+00:00

Fix rpm build warnings report in Fedora 19 build.

https://fedorahosted.org/freeipa/ticket/3500

Change DNA magic value to -1 to make UID 999 usable

2013-03-11T16:07:07+00:00

Change user-add's uid & gid parameters from autofill to optional.
Change the DNA magic value to -1.

For old clients, which will still send 999 when they want DNA
assignment, translate the 999 to -1. This is done via a new
capability, optional_uid_params.

Tests included

https://fedorahosted.org/freeipa/ticket/2886

ipa-sam: Array compared against 0 in ipasam_set_trusted_domain()

2013-02-28T11:27:51+00:00

ipa_mspac_well_known_sids is a globally defined array so the check was
always true.

Fixes https://fedorahosted.org/freeipa/ticket/3423

ipasam: use base scope when fetching domain information about own domain

2013-02-19T12:16:19+00:00

Since we use associatedDomain attribute to store information about UPN suffixes
and our own domain, searching subtree is going to return more than one entry.
Limit search for own domain by base scope as we only need to fetch our own
domain information here, not UPN suffixes.

Required for https://fedorahosted.org/freeipa/ticket/2945

ipa-sam: Fill SID blacklist when trust is added

2013-02-12T09:37:52+00:00

Fill incoming and outgoing trust LDAP entry with default SID
blacklist value.

https://fedorahosted.org/freeipa/ticket/3289

ipasam: better Kerberos error handling in ipasam

2012-11-21T12:18:26+00:00

If time is moved back on the IPA server, ipasam does not invalidate the
existing ticket.

https://fedorahosted.org/freeipa/ticket/3183

Fix various issues found by Coverity

2012-10-17T12:32:37+00:00

ipasam: generate proper SID for trusted domain object

2012-10-05T02:15:36+00:00

ipasam: add fallback primary group

2012-10-05T02:15:36+00:00

https://fedorahosted.org/freeipa/ticket/2955