freeipa.git/daemons/ipa-kdb, branch custodia

client referral support for trusted domain principals

2015-10-08T11:52:16+00:00

https://fedorahosted.org/freeipa/ticket/3559

Reviewed-By: Sumit Bose

ipa-kdb: add unit_tests for string_to_sid() and dom_sid_string()

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: make string_to_sid() and dom_sid_string() more robust

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: add unit-test for filter_logon_info()

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: convert test to cmocka

2015-07-07T23:56:52+00:00

Reviewed-By: Tomas Babej

ipa-kdb: filter out group membership from MS-PAC for exact SID matches too

2015-07-07T23:56:52+00:00

When incoming SID blacklist contains exact SIDs of users and groups,
attempt to filter them out as well, according to [MS-PAC] 4.1.1.2.

Note that we treat user's SID and primary group RID filtering as violation
of the KDC policy because the resulting MS-PAC will have no user SID or
primary group and thus will be invalid.

For group RIDs we filter them out. According to [MS-KILE] 3.3.5.6.3.1
it is OK to have empty group RIDs array as GroupCount SHOULD be
equal to Groups.MembershipCount returned by SamrGetGroupsForUser
[MS-SAMR] 3.1.5.9.1, not MUST, thus it may be empty.

Part of fix for https://bugzilla.redhat.com/show_bug.cgi?id=1222475

Reviewed-By: Tomas Babej

ipa-kdb: use proper memory chunk size when moving sids

2015-07-07T23:56:52+00:00

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1222475
Reviewed-By: Tomas Babej

ipa-kdb: common function to get key encodings/salt types

2015-06-29T15:15:00+00:00

This patch moves duplicate code in `ipadb_get_connection` to get default and
supported key encodings/salt types from Kerberos container to a common
function handling this task.

It is actually a small cosmetic enhancement of the fix of
https://fedorahosted.org/freeipa/ticket/4914

Reviewed-By: Martin Basti

Fix s4u2proxy README and add warning

2015-06-08T18:37:29+00:00

The attribute mentioned was using an older name that was later changed
in the implementation.
Also add a prominent warning about the use of the kadmin flags.

Reviewed-by: Rob Crittenden

Detect default encsalts kadmin password change

2015-05-27T13:45:56+00:00

When kadmin tries to change a password it will get the allowed keysalts
from the password policy. Failure to provide them will result in kadmin
using the defaults specified in the kdc.conf file or hardcoded defaults
(the default salt is then of type NORMAL).

This patch provides the supported values that have been read out of the
appropriate LDAP attribute when we read the server configuration.

Then at actual password change, check if kadmin is handing us back the exact
list of supported encsalts we sent it, and in that case replace it with the
real default encsalts.

Fixes https://fedorahosted.org/freeipa/ticket/4914

Signed-off-by: Simo Sorce 
Reviewed-by: Martin Babinsky