freeipa.git/install/updates, branch oneway-trust

trusts: add ACIs to allow AD trust agents to fetch cross-realm keytabs

2015-07-07T08:09:03+00:00

Part of https://fedorahosted.org/freeipa/ticket/4959

Add ACI to allow hosts to add their own services

2015-06-29T11:41:52+00:00

Use wildcards and DN matching in an ACI to allow a host
that binds using GSSAPI to add a service for itself.

Set required version of 389-ds-base to 1.3.4.0 GA.

https://fedorahosted.org/freeipa/ticket/4567

Reviewed-By: Martin Basti

Fix indicies ntUserDomainId, ntUniqueId

2015-06-29T11:40:29+00:00

ntUserDomainId and ntUniqueId  contained "eq,pres" index value, which is
not valid.

Reviewed-By: Martin Babinsky

Server Upgrade: create default config for NIS Server plugin

2015-06-18T15:48:36+00:00

Plugin is disabled by default.

This commit prevents false positive upgrade errors.

Reviewed-By: Martin Basti

add DS index for userCertificate attribute

2015-06-18T13:42:03+00:00

'eq' and 'pres' indices for userCertificate attribute allow for more efficient
lookup and matching of binary certificates assigned to users, hosts, and
services.

Part of http://www.freeipa.org/page/V4/User_Certificates

Reviewed-By: Martin Basti

DNS: add UnknownRecord to schema

2015-06-18T12:37:28+00:00

defintion of UnknownRecord attributetype

https://fedorahosted.org/freeipa/ticket/4939

Reviewed-By: Petr Spacek

Add CA ACL plugin

2015-06-11T10:50:31+00:00

Implement the caacl commands, which are used to indicate which
principals may be issued certificates from which (sub-)CAs, using
which profiles.

At this commit, and until sub-CAs are implemented, all rules refer
to the top-level CA (represented as ".") and no ca-ref argument is
exposed.

Also, during install and upgrade add a default CA ACL that permits
certificate issuance for all hosts and services using the profile
'caIPAserviceCert' on the top-level CA.

Part of: https://fedorahosted.org/freeipa/ticket/57
Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Martin Basti

add entries required by topology plugin on update

2015-06-11T10:10:40+00:00

These entries were not added on upgrade from old IPA servers and on replica
creation.

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky

move replications managers group to cn=sysaccounts,cn=etc,$SUFFIX

2015-06-11T10:10:40+00:00

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky

vault: Move vaults to cn=vaults,cn=kra

2015-06-10T16:17:34+00:00

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: David Kupka