freeipa.git/util, branch patternfly

Add support to ipa-kdb for keyless principals

2014-02-19T09:15:36+00:00

https://fedorahosted.org/freeipa/ticket/3779

Reviewed-By: Alexander Bokovoy

BUILD: Fix portability of NSS in file ipa_pwd.c

2014-01-28T15:35:34+00:00

Tested-by: Timo Aaltonen

Remove generation and handling of LM hashes

2013-11-01T08:28:35+00:00

https://fedorahosted.org/freeipa/ticket/3795

ipa-kdb: read SID blacklist from LDAP

2013-02-12T09:37:47+00:00

SIDs in incoming MS-PAC were checked and filtered with a fixed list of
well-known SIDs. Allow reading the SID blacklist from LDAP
(ipaNTSIDBlacklistIncoming and ipaNTSIDBlacklistOutgoing) and add the list
to mspac adtrust structure. Use the hardcoded SID list only if the LDAP
SID list is not configured.

LIMITATION: SID blacklist list is not used yet.

https://fedorahosted.org/freeipa/ticket/3289

Prevent integer overflow when setting krbPasswordExpiration

2013-02-08T14:54:21+00:00

Since in Kerberos V5 are used 32-bit unix timestamps, setting
maxlife in pwpolicy to values such as 9999 days would cause
integer overflow in krbPasswordExpiration attribute.

This would result into unpredictable behaviour such as users
not being able to log in after password expiration if password
policy was changed (#3114) or new users not being able to log
in at all (#3312).

The timestamp value is truncated to Jan 1, 2038 in ipa-kdc driver.

https://fedorahosted.org/freeipa/ticket/3312
https://fedorahosted.org/freeipa/ticket/3114

Make encode_ntlm_keys() public

2012-09-06T07:24:58+00:00

Move code into common krb5 utils

2012-07-30T14:31:47+00:00

This moves the decoding function that reads the keys from the ber format
into a structure in the common krb5 util code right below the function
that encodes the same data structure into a ber format.
This way the 2 functions are in the same place and can be both used by
all ia components.

Move some krb5 keys related functions from ipa-client to util

2012-06-11T10:04:05+00:00

Dereference pointer when comparing password history in qsort compare.

2012-04-10T16:33:04+00:00

The man page for qsort(3) says that the comparison function is called
with pointers to pointers to char but memcmp(3) wants a pointer to void
so we need to cast and dereference.

Without this the qsort() call wasn't properly sorting the elements so
a random password was being removed rather than the oldest when the
list overflowed.

https://fedorahosted.org/freeipa/ticket/2613

ipa-kdb: add AS auditing support

2012-02-14T23:03:45+00:00

Fixes: https://fedorahosted.org/freeipa/ticket/2334