sssd2.git/src/config, branch master

dyndns: new option dyndns_auth

2013-05-03T18:25:46+00:00

This options is mostly provided for future expansion. Currently it is
undocumented and both IPA and AD dynamic DNS updates default to
GSS-TSIG. Allowed values are GSS-TSIG and none.

dyndns: new option dyndns_force_tcp

2013-05-03T18:25:46+00:00

https://fedorahosted.org/sssd/ticket/1831

Adds a new option that can be used to force nsupdate to only use TCP to
communicate with the DNS server.

dyndns: New option dyndns_update_ptr

2013-05-03T18:25:46+00:00

https://fedorahosted.org/sssd/ticket/1832

While some servers, such as FreeIPA allow the PTR record to be
synchronized when the forward record is updated, other servers,
including Active Directory, require that the PTR record is synchronized
manually.

This patch adds a new option, dyndns_update_ptr that automatically
generates appropriate DNS update message for updating the reverse zone.

This option is off by default in the IPA provider.

Also renames be_nsupdate_create_msg to be_nsupdate_create_fwd_msg

dyndns: new option dyndns_refresh_interval

2013-05-03T18:25:46+00:00

This new options adds the possibility of updating the DNS entries
periodically regardless if they have changed or not. This feature
will be useful mainly in AD environments where the Windows clients
periodically update their DNS records.

Convert IPA-specific options to be back-end agnostic

2013-05-03T18:22:37+00:00

This patch introduces new options for dynamic DNS updates that are not
specific to any back end. The current ipa dyndns options are still
usable, just with a deprecation warning.

SUDO: IPA provider

2013-05-03T17:59:40+00:00

This patch added auto configuration SUDO with ipa provider and compat tree.

https://fedorahosted.org/sssd/ticket/1733

DNS sites support - add AD SRV plugin

2013-05-02T14:48:12+00:00

https://fedorahosted.org/sssd/ticket/1032

Allow usage of enterprise principals

2013-04-22T13:33:40+00:00

Enterprise principals are currently most useful for the AD provider and
hence enabled here by default while for the other Kerberos based
authentication providers they are disabled by default.

If additional UPN suffixes are configured for the AD domain the user
principal stored in the AD LDAP server might not contain the real
Kerberos realm of the AD domain but one of the additional suffixes which
might be completely randomly chooses, e.g. are not related to any
existing DNS domain. This make it hard for a client to figure out the
right KDC to send requests to.

To get around this enterprise principals (see
http://tools.ietf.org/html/rfc6806 for details) were introduced.
Basically a default realm is added to the principal so that the Kerberos
client libraries at least know where to send the request to. It is not
in the responsibility of the KDC to either handle the request itself,
return a client referral if he thinks a different KDC can handle the
request or return and error. This feature is also use to allow
authentication in AD environments with cross forest trusts.

Fixes https://fedorahosted.org/sssd/ticket/1842

DNS sites support - add IPA SRV plugin

2013-04-10T13:37:00+00:00

https://fedorahosted.org/sssd/ticket/1032

Allow setting krb5_renew_interval with a delimiter

2013-04-03T11:33:21+00:00

https://fedorahosted.org/sssd/ticket/902

changed the data type the krb5_renew_interval to string.
function krb5_string_to_deltat is used to convert and allow delimiters