freeipa.git/install/updates, branch sync-token

keytab: Add new extended operation to get a keytab.

2014-06-26T08:30:53+00:00

This new extended operation allow to create new keys or retrieve
existing ones. The new set of keys is returned as a ASN.1 structure
similar to the one that is passed in by the 'set keytab' extended
operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute named
ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the
operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

Reviewed-By: Nathaniel McCallum

sudorule: Enforce category ALL checks on dirsrv level

2014-06-25T18:14:51+00:00

https://fedorahosted.org/freeipa/ticket/4341

Reviewed-By: Petr Viktorin

sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute

2014-06-25T18:14:50+00:00

Makes sure we dereference the correct attribute. Also adds object class
checking.

https://fedorahosted.org/freeipa/ticket/4324

Reviewed-By: Petr Viktorin

sudorule: Allow using external groups as groups of runAsUsers

2014-06-25T18:14:49+00:00

Adds a new attribute ipaSudoRunAsExtUserGroup and corresponding hooks
sudorule plugin.

https://fedorahosted.org/freeipa/ticket/4263

Reviewed-By: Petr Viktorin

sudorule: Allow using hostmasks for setting allowed hosts

2014-06-25T18:14:49+00:00

Adds a new --hostmasks option to sudorule-add-host and sudorule-remove-host
commands, which allows setting a range of hosts specified by a hostmask.

https://fedorahosted.org/freeipa/ticket/4274

Reviewed-By: Petr Viktorin

trusts: Allow reading system trust accounts by adtrust agents

2014-06-25T13:01:52+00:00

Reviewed-By: Alexander Bokovoy

Convert Sudo Command Group default permissions to managed

2014-06-24T11:53:41+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Convert Sudo Command default permissions to managed

2014-06-24T11:53:41+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Convert SELinux User Map default permissions to managed

2014-06-24T11:53:41+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Convert HBAC Service Group default permissions to managed

2014-06-24T11:53:40+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek