freeipa.git/install/updates, branch master

Store list of non-master replicas in DIT and provide way to list them

2011-03-02T14:46:46+00:00

Fixes: https://fedorahosted.org/freeipa/ticket/1007

Use Sudo rather than SUDO as a label.

2011-03-01T21:48:35+00:00

ticket 1005

Add default roles and permissions for HBAC, SUDO and pw policy

2011-02-22T15:02:24+00:00

Created some default roles as examples. In doing so I realized that
we were completely missing default rules for HBAC, SUDO and password
policy so I added those as well.

I ran into a problem when the updater has a default record and an add
at the same time, it should handle it better now.

ticket 585

Add aci to make managed netgroups immutable.

2011-02-18T20:29:51+00:00

ticket 962

Updated default Kerberos password policy

2011-02-17T03:28:08+00:00

https://fedorahosted.org/freeipa/ticket/930

Add permission/privilege for updating IPA configuration.

2011-02-14T15:22:55+00:00

ticket 950

Move automount, default HBAC services, netgroup and hostgroup bootstrapping.

2010-12-17T22:31:19+00:00

There is no need for these to be done as updates, just add these entries
to the bootstrapping.

Re-implement access control using an updated model.

2010-12-02T01:42:31+00:00

The new model is based on permssions, privileges and roles.
Most importantly it corrects the reverse membership that caused problems
in the previous implementation. You add permission to privileges and
privileges to roles, not the other way around (even though it works that
way behind the scenes).

A permission object is a combination of a simple group and an aci.
The linkage between the aci and the permission is the description of
the permission. This shows as the name/description of the aci.

ldap:///self and groups granting groups (v1-style) are not supported by
this model (it will be provided separately).

This makes the aci plugin internal only.

ticket 445

Reduce the number of attributes a host is allowed to write.

2010-11-30T19:30:52+00:00

The list of attributes that a host bound as itself could write was
overly broad.

A host can now only update its description, information about itself
such as OS release, etc, its certificate, password and keytab.

ticket 416

Add additional default HBAC login services

2010-11-08T19:23:03+00:00

ticket 307