freeipa.git/install/updates, branch adwork

Add objects for initial ID range

2012-06-26T07:04:08+00:00

Use exop instead of kadmin.local

2012-06-11T07:40:59+00:00

Add trust-related ACIs

2012-06-07T07:39:10+00:00

A high-level description of the design and ACIs for trusts is available at
https://www.redhat.com/archives/freeipa-devel/2011-December/msg00224.html
and
https://www.redhat.com/archives/freeipa-devel/2011-December/msg00248.html

Ticket #1731

Perform case-insensitive searches for principals on TGS requests

2012-06-07T07:39:10+00:00

We want to always resolve TGS requests even if the user mistakenly sends a
request for a service ticket where the fqdn part contain upper case letters.

The actual implementation follows hints set by KDC. When AP_REQ is done, KDC
sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests.

https://fedorahosted.org/freeipa/ticket/1577

Add separate attribute to store trusted domain SID

2012-06-07T07:39:09+00:00

We need two attributes in the ipaNTTrustedDomain objectclass to store different
kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID
of the trusted domain. A second attribute is needed to store the SID for the
trusted domain user. Since it cannot be derived safely from other values and
since it does not make sense to create a separate object for the user a new
attribute is needed.

https://fedorahosted.org/freeipa/ticket/2191

permission-find missed some results with --pkey-only option

2012-06-01T05:51:59+00:00

When permission-find post callback detected a --pkey-only option,
it just terminated. However, this way the results that could have
been added from aci_find matches were not included.

Fix the post callback to go through the entire matching process.
Also make sure that DNS permissions have a correct objectclass
(ipapermission), otherwise such objects are not matched by the
permission LDAP search.

https://fedorahosted.org/freeipa/ticket/2658

- add a pair of ethers maps for computers with hardware addresses on file

2012-04-26T07:00:22+00:00

- create a "cn=computers" compat area populated with ieee802Device entries corresponding to computers with fqdn and macAddress attributes

2012-04-26T07:00:17+00:00

- index the fqdn and macAddress attributes for the sake of the compat plugin

2012-04-26T07:00:11+00:00

Return consistent value when hostcat and usercat is all.

2012-04-08T20:54:32+00:00

We were returning '' for the first entry when hostcat and usercat were
set to all. All subsequent entries were padded with - which effectively
denied access.

This requires slapi-nis 0.40+

https://fedorahosted.org/freeipa/ticket/2192