freeipa.git/VERSION, branch custodia

vault: add vault container commands

2015-09-17T12:55:54+00:00

adds commands:
* vaultcontainer-show [--service |--user |--shared ]
* vaultcontainer-del [--service |--user |--shared ]
* vaultcontainer-add-owner
     [--service |--user |--shared ]
     [--users ]  [--groups ] [--services ]
* vaultcontainer-remove-owner
     [--service |--user |--shared ]
     [--users ]  [--groups ] [--services ]

https://fedorahosted.org/freeipa/ticket/5250

Reviewed-By: Petr Vobornik

certprofile: remove 'rename' option

2015-09-02T11:47:48+00:00

The initial fix of ticket 5247 rejected renames, but left the option
behind for API compatibility.  Remove the option now, according to
the consensus that because it never worked, it is fine to remove it.

Fixes: https://fedorahosted.org/freeipa/ticket/5247
Reviewed-By: Petr Vobornik

vault: change default vault type to symmetric

2015-08-26T08:56:28+00:00

https://fedorahosted.org/freeipa/ticket/5251

Reviewed-By: Martin Basti

Added support for changing vault encryption.

2015-08-25T17:11:53+00:00

The vault-mod command has been modified to support changing vault
encryption attributes (i.e. type, password, public/private keys)
in addition to normal attributes (i.e. description). Changing the
encryption requires retrieving the stored secret with the old
attributes and rearchiving it with the new attributes.

https://fedorahosted.org/freeipa/ticket/5176

Reviewed-By: Martin Basti

Add user-stage command

2015-08-21T10:29:03+00:00

This patch replaces 'stageuser-add --from-delete' with new command
user-stage.

Original way always required  to specify first and last name, and
overall combination of options was hard to manage. The new command
requires only login of deleted user (user-del --preserve).

https://fedorahosted.org/freeipa/ticket/5041

Reviewed-By: Thierry Bordaz 
Reviewed-By: Jan Cholasta

Add flag to list all service and user vaults

2015-08-19T12:47:58+00:00

The vault-find plugin has two additional arguments to list all
service vaults or user vaults. Since the name of a vault is only unique
for a particular user or service, the commands also print the vault user
or vault service. The virtual attributes were added in rev
01dd951ddc0181b559eb3dd5ff0336c81e245628.

Example:

$ ipa vault-find --users
----------------
2 vaults matched
----------------
  Vault name: myvault
  Type: standard
  Vault user: admin

  Vault name: UserVault
  Type: standard
  Vault user: admin
----------------------------
Number of entries returned 2
----------------------------

$ ipa vault-find --services
----------------
2 vaults matched
----------------
  Vault name: myvault
  Type: standard
  Vault service: HTTP/ipatest.freeipa.local@FREEIPA.LOCAL

  Vault name: myvault
  Type: standard
  Vault service: ldap/ipatest.freeipa.local@FREEIPA.LOCAL
----------------------------
Number of entries returned 2
----------------------------

https://fedorahosted.org/freeipa/ticket/5150

Reviewed-By: Jan Cholasta

vault: validate vault type

2015-08-18T11:28:32+00:00

https://fedorahosted.org/freeipa/ticket/5211

Reviewed-By: Jan Cholasta

Added CLI param and ACL for vault service operations.

2015-08-17T06:10:59+00:00

The CLIs to manage vault owners and members have been modified
to accept services with a new parameter.

A new ACL has been added to allow a service to create its own
service container.

https://fedorahosted.org/freeipa/ticket/5172

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Kosek

user-show: add --out option to save certificates to file

2015-07-31T14:11:17+00:00

Add the --out option to user-show, bringing it into line with
host-show and service-show with the ability to save the user's
certificate(s) to a file.

https://fedorahosted.org/freeipa/ticket/5171

Reviewed-By: Martin Basti

DNS: Consolidate DNS RR types in API and schema

2015-07-21T15:18:29+00:00

* Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API:
    These records never worked, they dont have attributes in schema.
    TSIG and TKEY are meta-RR should not be in LDAP
    TA is not supported by BIND
    NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be
    in LDAP.
    *! SIG, NSEC are already defined in schema, must stay in API.

* Add HINFO, MINFO, MD, NXT records to API as unsupported records
    These records are already defined in LDAP schema

* Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records
    These records were defined in IPA API as unsupported, but schema definition was
    missing. This causes that ACI cannot be created for these records
    and dnszone-find failed. (#5055)

https://fedorahosted.org/freeipa/ticket/4934
https://fedorahosted.org/freeipa/ticket/5055

Reviewed-By: Martin Babinsky 
Reviewed-By: Petr Spacek