freeipa.git/install/updates, branch master

Allow hashed passwords in DS

2014-07-25T08:36:47+00:00

Without nsslapd-allow-hashed-passwords being turned on, user password
migration fails.

https://fedorahosted.org/freeipa/ticket/4450

Reviewed-By: Alexander Bokovoy

trusts: Make cn=adtrust agents sysaccount nestedgroup

2014-07-18T08:08:04+00:00

Since recent permissions work references this entry, we need to be
able to have memberOf attributes created on this entry. Hence we
need to include the nestedgroup objectclass.

https://fedorahosted.org/freeipa/ticket/4433

Reviewed-By: Jan Cholasta

Allow read access to services in cn=masters to auth'd users

2014-07-04T13:58:14+00:00

https://fedorahosted.org/freeipa/ticket/4425

Reviewed-By: Martin Kosek

Fix: Missing ACI for records in 40-dns.update

2014-07-04T10:27:24+00:00

Reviewed-By: Petr Viktorin

Add NSEC3PARAM to zone settings

2014-07-02T12:54:41+00:00

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik

Remove NSEC3PARAM record

2014-07-02T12:54:41+00:00

Revert 5b95be802c6aa12b9464813441f85eaee3e3e82b

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik

Fix ACI in DNS

2014-07-01T10:43:55+00:00

Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin

Allow admins to write krbLoginFailedCount

2014-07-01T08:02:02+00:00

Without write access to this attribute, admins could not unlock users.

https://fedorahosted.org/freeipa/ticket/4409

Reviewed-By: Martin Kosek

keytab: Add new extended operation to get a keytab.

2014-06-26T08:30:53+00:00

This new extended operation allow to create new keys or retrieve
existing ones. The new set of keys is returned as a ASN.1 structure
similar to the one that is passed in by the 'set keytab' extended
operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute named
ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the
operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

Reviewed-By: Nathaniel McCallum

sudorule: Enforce category ALL checks on dirsrv level

2014-06-25T18:14:51+00:00

https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin