freeipa.git/daemons/ipa-kdb, branch patternfly

Restore krbCanonicalName handling

2014-05-30T07:48:05+00:00

When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set,
rewrite the principal name to the canonical value, else error out,
instead of always returning an error if the requested name doesn't look
like the canonical one.

https://fedorahosted.org/freeipa/ticket/3966

Reviewed-By: Nathaniel McCallum

Accept any alias, not just the last value

2014-05-30T07:48:05+00:00

If the entry's krbPrincipalName attribute is multi-valued, accept any of
the values, not just the last one we happen to examine.

https://fedorahosted.org/freeipa/ticket/3966

Reviewed-By: Nathaniel McCallum

kdb: Don't provide password expiration when using only RADIUS

2014-05-22T14:46:01+00:00

If the KDC doesn't use the FreeIPA password for authentication, then it is
futile to provide this information. Doing so will only confuse the user. It
also causes password change dialogues when the password is irrelevant.

https://fedorahosted.org/freeipa/ticket/4299

Reviewed-By: Alexander Bokovoy

Avoid passing non-terminated string to is_master_host

2014-03-11T15:55:01+00:00

When string is not terminated, queries with corrupted base may be sent
to LDAP:

... cn=ipa1.example.com,cn=masters...

https://fedorahosted.org/freeipa/ticket/4214

Reviewed-By: Alexander Bokovoy

ipa-kdb: do not fetch client principal if it is the same as existing entry

2014-03-06T11:28:25+00:00

When client principal is the same as supplied client entry, don't fetch it
again.

Note that when client principal is not NULL, client entry might be NULL for
cross-realm case, so we need to make sure to not dereference NULL pointer here.

Also fix reverted condition for case when we didn't find the client principal
in the database, preventing a memory leak.

https://fedorahosted.org/freeipa/ticket/4223

Reviewed-By: Sumit Bose

fix filtering of subdomain-based trust users

2014-03-05T09:40:39+00:00

https://fedorahosted.org/freeipa/ticket/4207

Reviewed-By: Simo Sorce

ipa-kdb: make sure we don't produce MS-PAC in case of authdata flag cleared by admin

2014-02-26T13:19:49+00:00

When admin clears authdata flag for the service principal, KDC will pass
NULL client pointer (service proxy) to the DAL driver.

Make sure we bail out correctly.

Reviewed-By: Tomáš Babej 
Reviewed-By: Simo Sorce

ipa-kdb: in case of delegation use original client's database entry, not the proxy

2014-02-26T13:19:48+00:00

https://fedorahosted.org/freeipa/ticket/4195

Reviewed-By: Tomáš Babej 
Reviewed-By: Simo Sorce

Add support to ipa-kdb for keyless principals

2014-02-19T09:15:36+00:00

https://fedorahosted.org/freeipa/ticket/3779

Reviewed-By: Alexander Bokovoy

ipa-kdb: validate that an OTP user has tokens

2014-02-14T15:03:24+00:00

This handles the case where a user is configured for OTP in ipaUserAuthType,
but the user has not yet created any tokens. Until the user creates tokens,
the user should still be able to log in via password. This logic already
exists in LDAP, but ipa-kdb needs to perform the same validation to know
what data to return to the KDC.

https://fedorahosted.org/freeipa/ticket/4154

Reviewed-By: Alexander Bokovoy