freeipa.git, branch getkeytab

man: Add -r option to ipa-getkeytab.1

2014-06-09T18:53:56+00:00

Update the man page with the new ipa-getkeytab option.

ipa-getkeytab: Add support for get_keytab extop

2014-06-09T18:53:55+00:00

This new extended operation is tried by default and then the code falls back to
the old method if it fails.
The new method allows for server side password generation as well as retrieval
of existing credentials w/o causing regeneration of keys on the server.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

ipa-getkeytab: Modularize ldap_set_keytab function

2014-06-09T18:53:52+00:00

Isolate parts that will be reused in following patches.

keytab: Add new extended operation to get a keytab.

2014-06-09T18:49:42+00:00

This new extended operation allow to create new keys or retrieve
existing ones.
The new set of keys is returned as a ASN.1 structure similar to the one
that is passed in by the 'set keytab' extended operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute
named ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

keytabs: Expose and modify key encoding function

2014-06-09T18:35:00+00:00

Make it available outside of the encoding.c file for use in a follow-up
patch.
Add option to not pass a password and generate a random key instead.

Related:
https://fedorahosted.org/freeipa/ticket/3859

keytabs: Modularize setkeytab operation

2014-06-09T18:34:58+00:00

In preparation of adding another function to avoid code duplication.

Related:
https://fedorahosted.org/freeipa/ticket/3859

Add version and API version

2014-06-09T14:27:41+00:00

- Add API version to constants.py
- Add version option to plugable.py
- Add version to ipa manpage and fix a couple of typos

https://fedorahosted.org/freeipa/ticket/4316

Reviewed-By: Petr Viktorin

ipautil.run args log message is confusing

2014-06-09T14:27:41+00:00

https://fedorahosted.org/freeipa/ticket/3724

Reviewed-By: Petr Viktorin

Check for password expiration in pre-bind

2014-06-09T06:18:16+00:00

If the password is expired fail a password bind.

Resolves: https://fedorahosted.org/freeipa/ticket/1539
Reviewed-By: Martin Kosek 
Reviewed-By: Nathaniel McCallum

Add missing attributes to 'Modify Sudo rule' permission

2014-06-04T15:34:18+00:00

https://fedorahosted.org/freeipa/ticket/4344

Reviewed-By: Martin Kosek