freeipa.git, branch master

Add TOTP watermark support

2014-07-25T08:41:17+00:00

This prevents the reuse of TOTP tokens by recording the last token
interval that was used. This will be replicated as normal. However,
this patch does not increase the number of writes to the database
in the standard authentication case. This is because it also
eliminates an unnecessary write during authentication. Hence, this
patch should be write-load neutral with the existing code.

Further performance enhancement is desired, but is outside the
scope of this patch.

https://fedorahosted.org/freeipa/ticket/4410

Reviewed-By: Alexander Bokovoy

Allow hashed passwords in DS

2014-07-25T08:36:47+00:00

Without nsslapd-allow-hashed-passwords being turned on, user password
migration fails.

https://fedorahosted.org/freeipa/ticket/4450

Reviewed-By: Alexander Bokovoy

Fix ipa-getkeytab for pre-4.0 servers

2014-07-25T06:22:46+00:00

Also, make the error messages for this fallback case less scary and
clean up some indentation issues in the nearby code which made this
code difficult to read.

https://fedorahosted.org/freeipa/ticket/4446

Reviewed-By: Alexander Bokovoy

Improve password validity check.

2014-07-24T12:22:40+00:00

Allow use of characters that no longer cause troubles. Check for
leading and trailing characters in case of 389 Direcory Manager password.

Reviewed-By: Martin Kosek

Do not require dogtag-pki-server-theme

2014-07-24T11:57:24+00:00

Theme package is contains resources for PKI web interface. This interface
is not needed by FreeIPA as it rather utilizes it's API. As recommended in
https://bugzilla.redhat.com/show_bug.cgi?id=1068029#c5, remove this hard
dependency.

Reviewed-By: Alexander Bokovoy

baseldap: Remove redundant search from LDAPAddReverseMember and LDAPRemoveReverseMember

2014-07-23T13:12:30+00:00

Reviewed-By: Jan Cholasta

Always record that pkicreate has been executed.

2014-07-22T07:03:56+00:00

Record that pkicreate/pkispawn has been executed to allow cleanup even if the
installation did not finish correctly.

https://fedorahosted.org/freeipa/ticket/2796

Reviewed-By: Martin Kosek

Update freeipa-server krb5-server dependency to 1.11.5-5

2014-07-22T06:35:40+00:00

Previous versions of libkrb5 can't handle expired passwords
inside the FAST tunnel. This breaks the password change UI
in FreeIPA.

Reviewed-By: Martin Kosek

Fix login password expiration detection with OTP

2014-07-21T14:36:28+00:00

The preexisting code would execute two steps. First, it would perform a kinit.
If the kinit failed, it would attempt to bind using the same credentials to
determine if the password were expired. While this method is fairly ugly, it
mostly worked in the past.

However, with OTP this breaks. This is because the OTP code is consumed by
the kinit step. But because the password is expired, the kinit step fails.
When the bind is executed, the OTP token is already consumed, so bind fails.
This causes all password expirations to be reported as invalid credentials.

After discussion with MIT, the best way to handle this case with the standard
tools is to set LC_ALL=C and check the output from the command. This
eliminates the bind step altogether. The end result is that OTP works and
all password failures are more performant.

https://fedorahosted.org/freeipa/ticket/4412

Reviewed-By: Petr Vobornik

webui: fix disabled state of service's PAC type

2014-07-21T10:39:16+00:00

Nested options (MS-PAC and PAD) of service's PAC type should be
disabled if no value is supplied (default value is "Inherited
from server configuration"). That was not the case - regression.

This patch fixes it and along with it simplifies the update method
of option_widget_base to be more comprehensible.

Reviewed-By: Endi Sukma Dewata