freeipa.git/install/share, branch patternfly

dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone

2014-05-28T13:58:24+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Martin Kosek

Remove the global anonymous read ACI

2014-05-26T10:14:55+00:00

Also remove
- the deny ACIs that implemented exceptions to it:
  - no anonymous access to roles
  - no anonymous access to member information
  - no anonymous access to hbac
  - no anonymous access to sudo (2×)
- its updater plugin

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek

Replace "replica admins read access" ACI with a permission

2014-05-21T07:57:16+00:00

Add a 'Read Replication Agreements' permission to replace
the read ACI for cn=config.

https://fedorahosted.org/freeipa/ticket/3829

Reviewed-By: Martin Kosek

aci-update: Trim the admin write blacklist

2014-04-25T12:06:08+00:00

These attributes are removed from the blacklist, which means
high-level admins can now modify them:

- krbPrincipalAliases
- krbPrincipalType
- krbPwdPolicyReference
- krbTicketPolicyReference
- krbUPEnabled
- serverHostName

The intention is to only blacklist password attributes and attributes
that are managed by DS plugins.

Also, move the admin ACIs from ldif and trusts.update to aci.update.

Reviewed-By: Martin Kosek

Add a new ipaVirtualOperation objectClass to virtual operations

2014-04-24T09:19:51+00:00

The entries are moved from the ldif file to an update file.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek

schema-compat: set precedence to 49 to allow OTP binds over compat tree

2014-04-04T06:45:43+00:00

schema-compat plugin rewrites bind DN to point to the original entry
on LDAP bind operation. To work with OTP tokens this requires that
schema-compat's pre-bind callback is called before pre-bind callback of
the ipa-pwd-extop plugin. Therefore, schema-compat plugin should have
a nsslapd-pluginprecedence value lower than (default) 50 which is used
by the ipa-pwd-extop plugin.

Note that this will only work if ticket 47699 is fixed in 389-ds.

Reviewed-By: Nathaniel McCallum

Use LDAP API to upload CA certificate instead of ldapmodify command.

2014-03-25T15:54:54+00:00

Reviewed-By: Petr Viktorin

Make all ipatokenTOTP attributes mandatory

2014-02-21T15:07:39+00:00

Originally we made them all optional as a workaround for the lack of SELFDN
support in 389DS. However, with the advent of SELFDN, this hack is no longer
necessary. This patch updates TOTP to match HOTP in this regard.

Reviewed-By: Jan Cholasta

Add HOTP support

2014-02-21T09:26:02+00:00

Reviewed-By: Alexander Bokovoy

permissions: Use multivalued targetfilter

2014-02-20T12:11:41+00:00

Change the target filter to be multivalued.

Make the `type` option on permissions set location and an
(objectclass=...) targetfilter, instead of location and target.
Make changing or unsetting `type` remove existing
(objectclass=...) targetfilters only, and similarly,
changing/unsetting `memberof` to remove (memberof=...) only.

Update tests

Part of the work for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek