freeipa.git/daemons/ipa-slapi-plugins/ipa-pwd-extop, branch getkeytab

keytab: Add new extended operation to get a keytab.

2014-06-09T18:49:42+00:00

This new extended operation allow to create new keys or retrieve
existing ones.
The new set of keys is returned as a ASN.1 structure similar to the one
that is passed in by the 'set keytab' extended operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute
named ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

keytabs: Expose and modify key encoding function

2014-06-09T18:35:00+00:00

Make it available outside of the encoding.c file for use in a follow-up
patch.
Add option to not pass a password and generate a random key instead.

Related:
https://fedorahosted.org/freeipa/ticket/3859

keytabs: Modularize setkeytab operation

2014-06-09T18:34:58+00:00

In preparation of adding another function to avoid code duplication.

Related:
https://fedorahosted.org/freeipa/ticket/3859

Check for password expiration in pre-bind

2014-06-09T06:18:16+00:00

If the password is expired fail a password bind.

Resolves: https://fedorahosted.org/freeipa/ticket/1539
Reviewed-By: Martin Kosek 
Reviewed-By: Nathaniel McCallum

ipa-pwd-extop: Deny LDAP binds for accounts with expired principals

2014-05-05T15:50:01+00:00

Adds a check for krbprincipalexpiration attribute to pre_bind operation
in ipa-pwd-extop dirsrv plugin. If the principal is expired, auth is
denied and LDAP_UNWILLING_TO_PERFORM along with the error message is
sent back to the client. Since krbprincipalexpiration attribute is not
mandatory, if there is no value set, the check is passed.

https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Simo Sorce 
Reviewed-By: Alexander Bokovoy

ipa-pwd-extop: Fix memory leak in ipapwd_pre_bind

2014-04-08T12:23:18+00:00

We need to free the entry before returning from the function.

https://fedorahosted.org/freeipa/ticket/4295

Teach ipa-pwd-extop to respect global ipaUserAuthType settings

2014-02-21T09:26:02+00:00

https://fedorahosted.org/freeipa/ticket/4105

Reviewed-By: Alexander Bokovoy

Add OTP sync support to ipa-pwd-extop

2014-02-21T09:26:02+00:00

Reviewed-By: Alexander Bokovoy

BUILD: Fix portability of NSS in file ipa_pwd.c

2014-01-28T15:35:34+00:00

Tested-by: Timo Aaltonen

Harmonize policy discovery to kdb driver

2014-01-16T08:00:35+00:00

The KDB driver does not walk the tree back like the original password plugin.
Also we do not store the default policy in the base DN as we used to do in the
past anymore.
So doing a full subtree search and walking back the tree is just a waste of
time.
Instead hardcode the default policy like we do in the kdb driver.

Fixes: https://fedorahosted.org/freeipa/ticket/4085