| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
The NT Hash is the same thing as the RC4-HMAC key, so we add a function to
extract it from krb5 keys if they are available to avoid forcing a password
change when configuring trust relationships.
|
|
|
|
|
| |
Avoid the need to allocate/free a Slapi_Mod and avoid checking for attribute
equvalence after a match (use if/else)
|
|
|
|
|
|
|
| |
The DNA magic value can be arbitrarily changed by admins so we cannot use a
const value to check. And we relly do not need to check at all. If the DNA
plugin is broken and leaves magic values to reach the post-op stage we have
bigger problems. So just simply get rid of this check.
|
| |
|
|
|
|
|
|
|
| |
To make sure that ID ranges do not overlap this plugin checks new
additions and changes for conflicts with existing ranges.
https://fedorahosted.org/freeipa/ticket/2185
|
| |
|
|
|
|
|
|
| |
This extop can be used by clients of the IPA domain, e.g. sssd, to
retrieve data from trusted external domains. It can be used e.g. to map
Windows SIDs to user or groups names and back.
|
|
|
|
|
|
|
|
| |
A postop plugin is added to create the SID for new created users and
groups. A directory server task allows to set the SID for existing
users and groups.
Fixes https://fedorahosted.org/freeipa/ticket/2825
|
|
|
|
|
|
| |
This in effect fixes uid, krbPrincipalName and homeDir.
https://fedorahosted.org/freeipa/ticket/2756
|
|
|
|
|
|
|
|
| |
When we set a password we also need to make sure krbExtraData is set.
If not kadmin will later complain that the object is corrupted at password
change time.
Ticket: https://fedorahosted.org/freeipa/ticket/2764
|
|
|
|
|
|
|
|
|
| |
We currently return LDAP_REFERRAL which causes the mod to fail meaning
that referral entries cannot be changed.
All we really want to do is escape when we don't hvae an entry to modify.
https://fedorahosted.org/freeipa/ticket/2237
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
IPA winsync plugin failed to replicate users when default user group
was non-posix even though User Private Groups (UPG) were enabled
on the server. Both their uidNumber and gidNumber were empty and
they missed essential object classes. When the default user group
was made posix and UPG was disabled it did not set gidNumber to
the default group gidNumber.
This patch improves this behavior to set gidNumber correctly
according to UPG configuration and the default group status
(posix/non-posix). 4 situations can occur, the following list
specifies what value is assigned to user gidNumber:
1) Default group posix, UPG enabled: gidNumber = UPG gidNumber
2) Default group posix, UPG disabled: gidNumber = default
group gidNumber
3) Default group non-posix, UPG enabled: gidNumber = UPG gidNumber
4) Default group non-posix, UPG disabled: an error is printed to
the dirsrv log as the gidNumber cannot be retrieved. User
is replicated in the same way as before this patch, i.e.
without essential object classes.
https://fedorahosted.org/freeipa/ticket/2436
|
|
|
|
|
|
|
|
|
|
|
| |
User always receives the same error message if he changes his password
via "ipa passwd" command and the new password fails configured
password policy. He then has to investigate on his own the actual
reason why was the policy violated. This patch improves our SLAPI PWD
plugins to provide a better error message explaining the violation
reason.
https://fedorahosted.org/freeipa/ticket/2067
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/2036
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/2036
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/2036
|
|
|
|
|
|
|
| |
Instead of checking the individual SSFs for SASL, SSL/TLS and LDAPI connection
the global SSF is checked for password changes and enrollments.
https://fedorahosted.org/freeipa/ticket/1877
|
|
|
|
|
|
|
| |
If a user is changing his own password, then require the old password to be
sent for validation purposes.
https://fedorahosted.org/freeipa/ticket/1814
|
| |
|
|
|
|
|
| |
Do not pass an empty buffer to ber_init() as it will assert.
Check before hand and return an error.
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1370
|
|
|
|
|
|
| |
Fix "The the" and "classses" in FreeIPA code and messages.
https://fedorahosted.org/freeipa/ticket/1480
|
|
|
|
|
|
|
| |
Prevent the ipa-pwd-extop plugin from re-generating keys when kadimn is storing
a new set of keys. Only generate the userPassword and sambaXXPassword hashes.
Also avoid checking policies in this case and if history is provided avoid
regenerating the passwordHistory too.
|
| |
|
|
|
|
| |
It is going to be used by the ipa-kdb module too.
|
|
|
|
| |
Also to be used by ipa-kdb
|
|
|
|
| |
This way we can reuse the same code from ipa-kdb later
|
|
|
|
| |
This removes custom structures and allows easier sharing of code with ipa-kdb
|
| |
|
|
|
|
|
|
|
|
| |
Setting 0 will work as MIT KDCs assume the current master key when that is
found. But it is a legacy compatibility mode and we should instead set the
proper mkvno number on keys so changeing master key becomes possible w/o
having to do a dump reload and stopping the service. This is especially
important in replicated environments.
|
|
|
|
|
| |
mkvno is actually available as part of the key material.
There is no need to store it in the krbExtraData field as it is unused there.
|
| |
|
| |
|
|
|
|
| |
Some are actual bugs.
|
|
|
|
|
|
|
| |
The 389-ds team is in the process of exposing slapi_rwlock which we
will switch to when it is available.
https://fedorahosted.org/freeipa/ticket/1630
|
|
|
|
| |
This fixes a regression in the previous patch in ticket #1526.
|
|
|
|
|
|
|
| |
This can cause problems if a host is enrolled, unenrolled and a password
set. The password will be marked as expired like all new passwords are.
https://fedorahosted.org/freeipa/ticket/1526
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have no visibility into whether an entry has a keytab or not so
krbLastPwdChange is used as a rough guide.
If this value exists during enrollment then it fails because the host
is considered already joined. This was getting set when a OTP was
added to a host that had already been enrolled (e.g. you enroll a host,
unenroll it, set a OTP, then try to re-enroll). The second enrollment
was failing because the enrollment plugin thought it was still
enrolled becaused krbLastPwdChange was set.
https://fedorahosted.org/freeipa/ticket/1357
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1441
|
|
|
|
|
| |
The new_dn_string passed into this function is malloc'd. It
must be freed before we reassign the value.
|
|
|
|
|
|
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1382
crash in winsync if replaying a MOD and user does not exist in AD
If the AD entry is deleted before the deletion can be synced back to IPA,
and in the meantime an operation is performed on the corresponding
entry in IPA that should be synced to AD, winsync attempts to get the
AD entry and it is empty. This just means the operation will not go
through, and the entry will be deleted when the sync from AD happens.
The IPA winsync plugin needs to handle the case when the ad_entry
is NULL.
|
|
|
|
|
|
|
|
|
|
| |
https://fedorahosted.org/freeipa/ticket/1379
winsync enables disabled users in AD when the AD entry changes
This was likely broken when ipa switched from using CoS/groups for account
inactivation to using nsAccountLock directly. The code that handled the
account sync in the from AD direction was broken, but was never found before
now because it had not been used. The fix is to correctly set or remove
nsAccountLock.
|
|
|
|
| |
tickets 1166, 1167, 1168, 1169
|