freeipa.git/daemons/ipa-slapi-plugins/ipa-pwd-extop, branch kdc-fixes

ipa-pwd-extop: expand error message to tell what user is not allowed to fetch keytab

2015-07-07T23:56:52+00:00

When retrieving keytab, it is useful to know what user was attempting
to fetch the keyts and failed. This is useful to debug one-way trust
where SSSD forks out a process of ipa-getkeytab and it might be using
a wrong credentials cache for authentication purposes.

Part of https://fedorahosted.org/freeipa/ticket/4959

Reviewed-By: Tomas Babej

User life cycle: new stageuser commands activate

2015-05-18T07:37:21+00:00

Add plugin commands to stageuser plugin:
stageuser_activate: activate entries created by IPA CLIs

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka

fix Makefile.am for daemons

2015-03-26T13:58:37+00:00

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Sumit Bose

ipa-pwd-extop: added an informational comment about intentional fallthrough

2015-01-30T10:02:16+00:00

This patch is related to this defect reported by covscan in FreeIPA code:

"""
Error: MISSING_BREAK (CWE-484):
/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:631: unterminated_case: The
case for value "2" is not terminated by a 'break' statement.
/daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:638: fallthrough: The above
case falls through to this one.
"""

Added a comment informing about intentional falltrough in this place, so that
future generations reading the code don't get confused.

The patch is the part of a series related to
https://fedorahosted.org/freeipa/ticket/4795

Reviewed-By: Alexander Bokovoy

Make token auth and sync windows configurable

2014-12-05T12:42:19+00:00

This introduces two new CLI commands:
  * otpconfig-show
  * otpconfig-mod

https://fedorahosted.org/freeipa/ticket/4511

Reviewed-By: Thierry Bordaz 
Reviewed-By: Petr Vobornik

Move authentication configuration cache into libotp

2014-12-03T07:48:56+00:00

This enables plugins to share authentication configuration cache code.

Additionally, update the caching mechanism to be declarative and faster.

Reviewed-By: Thierry Bordaz

Preliminary refactoring of libotp files

2014-12-03T07:48:56+00:00

There are no major changes in this commit other than changing filenames
and symbols to have consistent namespaces. This prepares for larger
changes to come in subsequent commits.

Reviewed-By: Thierry Bordaz

Use asn1c helpers to encode/decode the getkeytab control

2014-11-20T15:52:13+00:00

Replaces manual encoding with automatically generated code.

Fixes:
https://fedorahosted.org/freeipa/ticket/4718
https://fedorahosted.org/freeipa/ticket/4728

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Nathaniel McCallum

Fix filtering of enctypes in server code.

2014-11-20T15:52:13+00:00

The filtering was incorrect and would result in always discarding all values.
Also make sure there are no duplicates in the list.

Partial fix for:
https://fedorahosted.org/freeipa/ticket/4718

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Nathaniel McCallum

Ensure that a password exists after OTP validation

2014-11-06T09:56:19+00:00

Before this patch users could log in using only the OTP value. This
arose because ipapwd_authentication() successfully determined that
an empty password was invalid, but 389 itself would see this as an
anonymous bind. An anonymous bind would never even get this far in
this code, so we simply deny requests with empty passwords.

This patch resolves CVE-2014-7828.

https://fedorahosted.org/freeipa/ticket/4690

Reviewed-By: Alexander Bokovoy