freeipa.git/daemons/ipa-kdb, branch mindatefix

kdb: check for local realm in enterprise principals

2016-07-12T10:26:28+00:00

Reviewed-By: Martin Babinsky 
Reviewed-By: Jakub Hrozek

Allow unexpiring passwords

2016-07-01T09:22:02+00:00

Treat maxlife=0 in password policy as "never expire". Delete
krbPasswordExpiration in user entry when password should never expire.

https://fedorahosted.org/freeipa/ticket/2795

Reviewed-By: Thierry Bordaz 
Reviewed-By: Pavel Vomacka

ipa-kdb: set krbCanonicalName when creating new principals

2016-06-23T07:48:06+00:00

Additionally, stop setting ipakrbprincipalalias attribute during principal
creation.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

perform case-insensitive principal search when canonicalization is requested

2016-06-23T07:48:06+00:00

When canonicalization is requested, the krbprincipalname attribute is searched
for case-insensitively.

In the case that krbcanonicalname is not set, the matched alias is returned
with the casing stored in backend, not the one input by client.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

adtrust: support UPNs for trusted domain users

2016-06-11T15:25:50+00:00

Add support for additional user name principal suffixes from
trusted Active Directory forests. UPN suffixes are property
of the forest and as such are associated with the forest root
domain.

FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued
attribute of ipaNTTrustedDomain object class.

In order to look up UPN suffixes, netr_DsRGetForestTrustInformation
LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts.

For more details on UPN and naming in Active Directory see
https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx

https://fedorahosted.org/freeipa/ticket/5354

Reviewed-By: Martin Babinsky

Migrate from #ifndef guards to #pragma once

2016-05-29T12:04:45+00:00

Using a pragma instead of guards is easier to write, less error prone
and avoids name clashes (a source of very subtle bugs). This pragma
is supported on almost all compilers, including all the compilers we
care about: https://en.wikipedia.org/wiki/Pragma_once#Portability.

This patch does not change the autogenerated files: asn1/asn1c/*.h.

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Enable authentication indicators for OTP and RADIUS

2016-05-26T16:47:05+00:00

If the user is configured for OTP or RADIUS authentication, insert the
relevant authentication indicator.

https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Sumit Bose

Return password-only preauth if passwords are allowed

2016-05-26T16:47:05+00:00

Before this patch, if either password or password+otp were permitted,
only the otp preauth mech would be returned to the client. Now, the
client will receive either enc_ts or enc_chl in addition to otp.

https://fedorahosted.org/freeipa/ticket/433

Reviewed-By: Sumit Bose

ipa_kdb: add krbPrincipalAuthInd handling

2016-05-02T17:15:45+00:00

Store and retrieve the authentication indicator "require_auth" string in
the krbPrincipalAuthInd attribute. Skip storing auth indicators to
krbExtraData.

https://fedorahosted.org/freeipa/ticket/5782

Reviewed-By: Sumit Bose

Allow to specify Kerberos authz data type per user

2016-03-09T18:00:43+00:00

Like for services setting the ipaKrbAuthzData attribute on a user object will
allow us to control exactly what authz data is allowed for that user.
Setting NONE would allow no authz data, while setting MS-PAC would allow only
Active Directory compatible data.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2579
Reviewed-By: Alexander Bokovoy