freeipa.git/ipaserver, branch trusts-master

Enhance ipa-adtrust-install for domains with multiple IPA server

2013-03-25T13:10:17+00:00

As described on http://www.freeipa.org/page/V3/MultipleTrustServers,
notice if FreeIPA server is a replica and adtrust agents contains members
corresponding to the cifs/ services from replication partners. If so, increase
priority field and add normal SRV records with increased priority.

https://fedorahosted.org/freeipa/ticket/2189

Add logging to join command

2013-03-25T09:58:23+00:00

The following is mentioned in the log now:
  - existence of host entry (if it already does exist)
  - missing krbprincipalname and its new value (if there was no
    principal name set)

https://fedorahosted.org/freeipa/ticket/3481

Configure ipa_dns DS plugin on install and upgrade

2013-03-22T13:31:22+00:00

The plugin is configured unconditionally (i.e. does not check if
IPA was configured with DNS) as the plugin is needed on all
replicas to prevent objectclass violations due to missing SOA
serial in idnsZone objectclass. The violation could happen if just
one replica configured DNS and added a new zone.

https://fedorahosted.org/freeipa/ticket/3347

Update named.conf parser

2013-03-14T14:50:24+00:00

Refactor the named.conf parsing and editing functions in bindinstance
so that both "dynamic-db" and "options" sections of named.conf can
be read and updated

https://fedorahosted.org/freeipa/ticket/3429

Enforce exact SID match when adding or modifying a ID range

2013-03-14T14:20:30+00:00

SID validation in idrange.py now enforces exact match on SIDs, thus
one can no longer use SID of an object in a trusted domain as a
trusted domain SID.

https://fedorahosted.org/freeipa/ticket/3432

Extend ipa-replica-manage to be able to manage DNA ranges.

2013-03-13T14:32:36+00:00

Attempt to automatically save DNA ranges when a master is removed.
This is done by trying to find a master that does not yet define
a DNA on-deck range. If one can be found then the range on the deleted
master is added.

If one cannot be found then it is reported as an error.

Some validation of the ranges are done to ensure that they do overlap
an IPA local range and do not overlap existing DNA ranges configured
on other masters.

http://freeipa.org/page/V3/Recover_DNA_Ranges

https://fedorahosted.org/freeipa/ticket/3321

Remove ipaserver/ipaldap.py

2013-03-13T11:36:33+00:00

In addition to removing the module, fix all places where it was imported.

Preparation for: https://fedorahosted.org/freeipa/ticket/3446

Move ipaldap to ipapython

2013-03-13T11:36:33+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/3446

Fix installing server with external CA

2013-03-08T14:42:20+00:00

Reorganize ipa-server-instal so that DS (and NTP server) installation
only happens in step one.

Change CAInstance to behave correctly in two-step install.

Add an `init_info` method to DSInstance that includes common
attribute/sub_dict initialization from create_instance and create_replica.
Use it in ipa-server-install to get a properly configured DSInstance
for later tasks.

https://fedorahosted.org/freeipa/ticket/3459

Disable schema retrieval and attribute decoding when talking to AD GC.

2013-03-08T13:47:52+00:00