freeipa.git, branch master

Do not start the service in stopped_service if it was not running before.

2014-01-15T16:44:10+00:00

This fixes a possible NSS database corruption in renew_ca_cert.

ipaserver/install/installutils: clean up properly after yield

2014-01-15T16:44:10+00:00

When a context to which we yield generates exception, the code in
private_ccache() and stopped_service() didn't get called for cleanup.

CLDAP: do not prepend \\

2014-01-15T15:26:09+00:00

For NETLOGON_NT_VERSION_5EX requests the prepended \\ is not expected in
the PDC NetBIOS name. In general AD seems to be smart enough to handle
the two \ signs. But if the NetBIOS name reaches the maximum of 15
character AD does not accept the responses anymore.

Fixes https://fedorahosted.org/freeipa/ticket/4028

trustdomain-find: report status of the (sub)domain

2014-01-15T15:19:26+00:00

Show status of each enumerated domain

trustdomain-find shows list of domains associated with the trust.
Each domain except the trust forest root can be enabled or disabled
with the help of trustdomain-enable and trustdomain-disable commands.

https://fedorahosted.org/freeipa/ticket/4096

trust-fetch-domains: create ranges for new child domains

2014-01-15T14:43:40+00:00

When trust is added, we do create ranges for discovered child domains.
However, this functionality was not available through
'trust-fetch-domains' command.

Additionally, make sure non-existing trust will report proper error in
trust-fetch-domains.

https://fedorahosted.org/freeipa/ticket/4111
https://fedorahosted.org/freeipa/ticket/4104

Fix ipa-client-automount uninstall when fstore is empty.

2014-01-15T11:10:05+00:00

https://fedorahosted.org/freeipa/ticket/4091

Add missing example to sudorule

2014-01-15T10:01:36+00:00

https://fedorahosted.org/freeipa/ticket/4090

sudoOrder missing in sudoers

2014-01-15T10:00:35+00:00

sudoers compat plugin configuration missed the sudoOrder attribute
and it thus did not show up in ou=sudoers. Add the definion to update
file.

https://fedorahosted.org/freeipa/ticket/4107

Change the way we determine if the host has a password set.

2014-01-15T09:02:49+00:00

When creating a host with a password we don't set a Kerberos
principal or add the Kerberos objectclasses. Those get added when the
host is enrolled. If one passed in --password= (so no password) then
we incorrectly thought the user was in fact setting a password, so the
principal and objectclasses weren't updated.

https://fedorahosted.org/freeipa/ticket/4102

Enable Retro Changelog and Content Synchronization DS plugins

2014-01-14T15:37:56+00:00

Enable Retro Changelog and Content Synchronization DS plugins which are required
for SyncRepl support.

Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+.

https://fedorahosted.org/freeipa/ticket/3967