freeipa.git/ipaserver, branch ad-work

Gain information from AD

2013-07-18T14:16:49+00:00

ipa-adtrust-install: configure compatibility tree to serve trusted domain users

2013-07-18T07:56:37+00:00

Enables  support  for  trusted  domains  users  for old clients through Schema
Compatibility plugin.  SSSD supports trusted domains natively starting with
version 1.9 platform. For platforms that lack SSSD or run older SSSD version
one needs  to  use  this  option.  When  enabled, slapi-nis  package  needs  to
be  installed  and schema-compat-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server. These users and
groups will be available under  cn=users,cn=compat,$SUFFIX  and
cn=groups,cn=compat,$SUFFIX trees.  SSSD will normalize names of users and
groups to lower case.

In  addition  to  providing  these users and groups through the compat tree,
this option enables authentication over LDAP for trusted domain users with DN
under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.

This authentication  is related to  PAM  stack  using  'system-auth' PAM
service. If you have disabled HBAC rule 'allow_all', then make sure there is
special service called 'system-auth' created and HBAC rule to allow access to
anyone to this rule on IPA masters is added. Please note that system-auth PAM
service is  not used directly by any other application, therefore it is safe to
create one specifically to support trusted domain users via compatibility path.

https://fedorahosted.org/freeipa/ticket/3567

Hide sensitive attributes in LDAP updater logging and output

2013-07-18T07:49:43+00:00

The LDAP updater prints the initial and final states of an entry, as well
as details on the changes made to attributes. This has the potential to
expose sensitive values so exclude those from logging.

https://fedorahosted.org/freeipa/ticket/3782

Provide ipa-advise tool

2013-07-17T11:49:59+00:00

Provides a pluggable framework for generating configuration
scriptlets and instructions for various machine setups and use
cases.

Creates a new ipa-advise command, available to root user
on the IPA server.

Also provides an example configuration plugin,
config-fedora-authconfig.

https://fedorahosted.org/freeipa/ticket/3670

Change group ownership of CRL publish directory

2013-07-16T10:17:40+00:00

Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no
longer owned by created with package installation. The directory
is rather created/removed with the CA instance itself.

This ensures proper creation/removeal, group ownership
and SELinux context.

https://fedorahosted.org/freeipa/ticket/3727

Return the correct Content-type on negotiated XML-RPC requests.

2013-07-15T13:36:46+00:00

https://fedorahosted.org/freeipa/ticket/3745

Make sure replication works after DM password is changed

2013-07-11T09:39:29+00:00

Replica information file contains the file `cacert.p12` which is protected by
the Directory Manager password of the initial IPA server installation. The DM
password of the initial installation is also used for the PKI admin user
password.

If the DM password is changed after the IPA server installation, the replication
fails.

To prevent this failure, add the following steps to ipa-replica-prepare:
1. Regenerate the `cacert.p12` file and protect it with the current DM password
2. Update the password of the PKI admin user with the current DM password

https://fedorahosted.org/freeipa/ticket/3594

Permit reads to ipatokenRadiusProxyUser objects

2013-07-11T09:39:27+00:00

This fixes an outstanding permissions issue from the OTP work.

https://fedorahosted.org/freeipa/ticket/3693

Use LDAP modify operation directly to add/remove group members.

2013-07-11T09:39:26+00:00

This prevents getting full member list from LDAP and putting it back later.

https://fedorahosted.org/freeipa/ticket/3706

Check trust chain length in CA-less install.

2013-07-11T09:39:25+00:00

https://fedorahosted.org/freeipa/ticket/3707