freeipa.git - FreeIPA project

	Commit message (Collapse)	Author	Age	Files	Lines
*	ipa-kdb: read SID blacklist from LDAP	Martin Kosek	2013-02-12	1	-0/+32
\| \| \| \| \| \| \| \| \| \| \| \|	SIDs in incoming MS-PAC were checked and filtered with a fixed list of well-known SIDs. Allow reading the SID blacklist from LDAP (ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list to mspac adtrust structure. Use the hardcoded SID list only if the LDAP SID list is not configured. LIMITATION: SID blacklist list is not used yet. https://fedorahosted.org/freeipa/ticket/3289
*	Prevent integer overflow when setting krbPasswordExpiration	Tomas Babej	2013-02-08	1	-0/+3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Since in Kerberos V5 are used 32-bit unix timestamps, setting maxlife in pwpolicy to values such as 9999 days would cause integer overflow in krbPasswordExpiration attribute. This would result into unpredictable behaviour such as users not being able to log in after password expiration if password policy was changed (#3114) or new users not being able to log in at all (#3312). The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver. https://fedorahosted.org/freeipa/ticket/3312 https://fedorahosted.org/freeipa/ticket/3114
*	Make encode_ntlm_keys() public	Sumit Bose	2012-09-06	3	-0/+226
\|
*	Move code into common krb5 utils	Simo Sorce	2012-07-30	2	-0/+152
\| \| \| \| \| \| \| \|	This moves the decoding function that reads the keys from the ber format into a structure in the common krb5 util code right below the function that encodes the same data structure into a ber format. This way the 2 functions are in the same place and can be both used by all ia components.
*	Move some krb5 keys related functions from ipa-client to util	Sumit Bose	2012-06-11	2	-0/+398
\|
*	Dereference pointer when comparing password history in qsort compare.	Rob Crittenden	2012-04-10	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \|	The man page for qsort(3) says that the comparison function is called with pointers to pointers to char but memcmp(3) wants a pointer to void so we need to cast and dereference. Without this the qsort() call wasn't properly sorting the elements so a random password was being removed rather than the oldest when the list overflowed. https://fedorahosted.org/freeipa/ticket/2613
*	ipa-kdb: add AS auditing support	Simo Sorce	2012-02-14	1	-0/+3
\| \| \| \|	Fixes: https://fedorahosted.org/freeipa/ticket/2334
*	Improve password change error message	Martin Kosek	2012-02-03	2	-0/+26
\| \| \| \| \| \| \| \| \| \| \|	User always receives the same error message if he changes his password via "ipa passwd" command and the new password fails configured password policy. He then has to investigate on his own the actual reason why was the policy violated. This patch improves our SLAPI PWD plugins to provide a better error message explaining the violation reason. https://fedorahosted.org/freeipa/ticket/2067
*	Add missing copyright header	Simo Sorce	2011-11-17	1	-0/+22
\|
*	Fix CID 11021: Resource leak	Simo Sorce	2011-11-07	1	-1/+3
\| \| \| \|	https://fedorahosted.org/freeipa/ticket/2037
*	Amend #2038 fix	Simo Sorce	2011-11-05	1	-3/+5
\| \| \| \|	The math was unsafe, thanks to Nalin for spotting it.
*	Modify random salt creation for interoperability	Simo Sorce	2011-11-04	1	-8/+29
\| \| \| \| \|	See: https://fedorahosted.org/freeipa/ticket/2038
*	util: add password policy manipulation functions	Simo Sorce	2011-08-26	2	-0/+699
\|
*	ipa-kdb: implement change_pwd function	Simo Sorce	2011-08-26	2	-0/+37
\|
*	ipa-pwd-extop: make encsalt parsing function common	Simo Sorce	2011-08-26	2	-0/+79
\| \| \| \|	It is going to be used by the ipa-kdb module too.
*	ipa-pwd-extop: Move encoding in common too	Simo Sorce	2011-08-26	2	-0/+124
\| \| \| \|	Also to be used by ipa-kdb
*	ipa-pwd-extop: Move encryption of keys in common	Simo Sorce	2011-08-26	2	-5/+235
\| \| \| \|	This way we can reuse the same code from ipa-kdb later
*	Use internal implementation of internal Kerberos functions	Jakub Hrozek	2010-11-22	2	-0/+56
	Don't use KRB5_PRIVATE. The patch implements and uses the following krb5 functions that are otherwise private in recent MIT Kerberos releases: * krb5_principal2salt_norealm * krb5_free_ktypes Signed-off-by: Simo Sorce <ssorce@redhat.com>