freeipa.git, branch abbra

Set samba_portmapper SELinux boolean during ipa-adtrust-install

2012-05-30T10:26:56+00:00

Fix ipasam build

2012-05-30T10:26:56+00:00

ipa-sam: update sid_to_id() interface to follow passdb API changes in Samba

2012-05-30T10:14:40+00:00

Commit a6e29f23f09ba5b6b6d362f7683ae8088bc0ba85 in Samba changed id mapping
API in passdb interface to use 'struct unixid'. The change replaced three arguments
(uid, gid, type) by one (struct unixid). As result, ipa-sam became broken.

Without this change ipa-sam introduces stack corruption in Samba post 4.0.0alpha18
leading to corrupted security context stack as well and then crashing in setgroups(3).

get_fqdn() moved to ipaserver.installutils

2012-05-30T08:19:02+00:00

Add trust-related ACIs

2012-05-30T08:19:02+00:00

A high-level description of the design and ACIs for trusts is available at
https://www.redhat.com/archives/freeipa-devel/2011-December/msg00224.html
and
https://www.redhat.com/archives/freeipa-devel/2011-December/msg00248.html

Ticket #1731

ipa-kdb: Add MS-PAC on constrained delegation.

2012-05-30T07:24:43+00:00

Restart KDC after installing trust support to allow MS PAC generation

2012-05-30T07:24:43+00:00

Also make sure all exceptions are captured when creating CIFS service
record. The one we care about is duplicate entry and we do nothing
in that case anyway.

Also make uniform use of action descriptors.

Properly handle multiple IP addresses per host when installing trust support

2012-05-30T07:24:43+00:00

resolve_host() function returns a list of IP addresses. Handle it all rather
than expecting that there is a single address.

It wouldn't hurt to make a common function that takes --ip-address into account
when resolving host addresses and use it everywhere.

Perform case-insensitive searches for principals on TGS requests

2012-05-30T07:24:43+00:00

We want to always resolve TGS requests even if the user mistakenly sends a
request for a service ticket where the fqdn part contain upper case letters.

The actual implementation follows hints set by KDC. When AP_REQ is done, KDC
sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests.

https://fedorahosted.org/freeipa/ticket/1577

Use fully qualified PDC name when contacting for extended DN information

2012-05-30T07:24:43+00:00