freeipa.git/install/updates, branch systemd-master

updates: Change default limits on ldap searches

2011-10-13T02:42:03+00:00

Fixes: https://fedorahosted.org/freeipa/ticket/1867
       https://fedorahosted.org/freeipa/ticket/1888

Fix DNS permissions and membership in privileges

2011-10-10T03:44:22+00:00

This resolves two issues:

1. The DNS acis lacked a prefix so weren't tied to permissions
2. The permissions were added before the privileges so the member
   values weren't calculated properly

For updates we need to add in the members and recalculate memberof via
a DS task.

https://fedorahosted.org/freeipa/ticket/1898

The precendence on the modrdn plugin was set in the wrong location.

2011-09-13T15:36:59+00:00

https://fedorahosted.org/freeipa/ticket/1370

Move Managed Entries into their own container in the replicated space.

2011-09-12T20:28:27+00:00

Repoint cn=Managed Entries,cn=plugins,cn=config in common_setup
Create: cn=Managed Entries,cn=etc,$SUFFIX
Create: cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX
Create: cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX
Create method for dynamically migrating any and all custom Managed Entries
from the cn=config space into the new container.
Separate the connection creation during update so that a restart can
be performed to initialize changes before performing a delete.
Add wait_for_open_socket() method in installutils

https://fedorahosted.org/freeipa/ticket/1708

Add additional pam ftp services to HBAC, and a ftp HBAC service group

2011-08-24T19:21:41+00:00

This adds proftpd, pure-ftpd, vsftpd and gssftp.

https://fedorahosted.org/freeipa/ticket/1703

Change the way has_keytab is determined, also check for password.

2011-08-24T12:12:01+00:00

We need an indicator to see if a keytab has been set on host and
service entries. We also need a way to know if a one-time password is
set on a host.

This adds an ACI that grants search on userPassword and
krbPrincipalKey so we can do an existence search on them. This way
we can tell if the attribute is set and create a fake attribute
accordingly.

When a userPassword is set on a host a keytab is generated against
that password so we always set has_keytab to False if a password
exists. This is fine because when keytab gets generated for the
host the password is removed (hence one-time).

This adds has_keytab/has_password to the user, host and service plugins.

ticket https://fedorahosted.org/freeipa/ticket/1538

Correct sudo runasuser and runasgroup attributes in schema

2011-07-19T12:06:41+00:00

https://fedorahosted.org/freeipa/ticket/1309

Correct behavior for sudorunasgroup vs sudorunasuser

2011-07-19T12:06:21+00:00

https://fedorahosted.org/freeipa/ticket/1309

Set the ipa-modrdn plugin precedence to 60 so it runs last

2011-07-18T02:24:30+00:00

The default precedence for plugins is 50 and the run in more or less
alphabetical order (but not guaranteed). This plugin needs to run after
the others have already done their work.

https://fedorahosted.org/freeipa/ticket/1370

Disallow direct modifications to enrolledBy.

2011-07-14T23:11:49+00:00

This fixes a regression.

We don't need to allow enrolledBy to be modified because it gets
written in the ipa_enrollment plugin which does internal operations
so bypasses acis.

https://fedorahosted.org/freeipa/ticket/302