diff options
| author | Alexander Bokovoy <abokovoy@redhat.com> | 2013-10-03 12:30:44 +0200 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2013-10-04 10:25:31 +0200 |
| commit | d228b1bd70aeebb19fbf64ee64bbd662eda19fc4 (patch) | |
| tree | 76113a53d65b690df0421cfae3ba8185daecdc2b /freeipa.spec.in | |
| parent | 749111e6c2dfbb288c864a6cd2f5ac228f30bec1 (diff) | |
| download | freeipa.git-d228b1bd70aeebb19fbf64ee64bbd662eda19fc4.tar.gz freeipa.git-d228b1bd70aeebb19fbf64ee64bbd662eda19fc4.tar.xz freeipa.git-d228b1bd70aeebb19fbf64ee64bbd662eda19fc4.zip | |
ipa-kdb: Handle parent-child relationship for subdomains
When MS-PAC information is re-initialized, record also parent-child
relationship between trust root level domain and its subdomains.
Use parent incoming SID black list to check if child domain is not
allowed to access IPA realm.
We also should really use 'cn' of the entry as domain name.
ipaNTTrustPartner has different meaning on wire, it is an index
pointing to the parent domain of the domain and will be 0 for top
level domains or disjoint subdomains of the trust.
Finally, trustdomain-enable and trustdomain-disable commands should
force MS-PAC cache re-initalization in case of black list change.
Trigger that by asking for cross-realm TGT for HTTP service.
Diffstat (limited to 'freeipa.spec.in')
0 files changed, 0 insertions, 0 deletions