.git/daemons/ipa-kdb, branch master

Add support to ipa-kdb for keyless principals

2014-02-19T09:15:36+00:00

https://fedorahosted.org/freeipa/ticket/3779

Reviewed-By: Alexander Bokovoy

ipa-kdb: validate that an OTP user has tokens

2014-02-14T15:03:24+00:00

This handles the case where a user is configured for OTP in ipaUserAuthType,
but the user has not yet created any tokens. Until the user creates tokens,
the user should still be able to log in via password. This logic already
exists in LDAP, but ipa-kdb needs to perform the same validation to know
what data to return to the KDC.

https://fedorahosted.org/freeipa/ticket/4154

Reviewed-By: Alexander Bokovoy

BUILD: Fix portability of NSS in file ipa_pwd.c

2014-01-28T15:35:34+00:00

Tested-by: Timo Aaltonen

Add krbticketPolicyAux objectclass if needed

2013-11-26T15:44:37+00:00

When modifying ticket flags add the objectclass to the object if it is missing.

https://fedorahosted.org/freeipa/ticket/3901

ipa-kdb: Handle parent-child relationship for subdomains

2013-10-04T08:25:31+00:00

When MS-PAC information is re-initialized, record also parent-child
relationship between trust root level domain and its subdomains.

Use parent incoming SID black list to check if child domain is not
allowed to access IPA realm.

We also should really use 'cn' of the entry as domain name.
ipaNTTrustPartner has different meaning on wire, it is an index
pointing to the parent domain of the domain and will be 0 for top
level domains or disjoint subdomains of the trust.

Finally, trustdomain-enable and trustdomain-disable commands should
force MS-PAC cache re-initalization in case of black list change.
Trigger that by asking for cross-realm TGT for HTTP service.

KDC: implement transition check for trusted domains

2013-10-04T08:25:31+00:00

When client principal requests for a ticket for a server principal
and we have to perform transition, check that all three belong to either
our domain or the domains we trust through forest trusts.

In case all three realms (client, transition, and server) match
trusted domains and our domain, issue permission to transition from client
realm to server realm.

Part of https://fedorahosted.org/freeipa/ticket/3909

Add Delegation Info to MS-PAC

2013-09-13T16:03:53+00:00

https://fedorahosted.org/freeipa/ticket/3442

kdb-princ: Fix memory leak

2013-08-28T10:42:56+00:00

If we do not store the keys in the entry we need to free the array before
continuing or the data is leaked.

CoverityID: 11910

Fixes:
https://fedorahosted.org/freeipa/ticket/3884

kdb-mspac: Fix out of bounds memset

2013-08-28T10:42:56+00:00

This memset was harmless as the following data is then set again, but an
optimizing compiler might conceivably reorder instructions causing issues.

CoverityID: 11909

Fixes:
https://fedorahosted.org/freeipa/ticket/3883

IPA KDB MS-PAC: remove unused variable

2013-07-23T13:25:26+00:00