freeipa.git/daemons/ipa-slapi-plugins, branch ipasam_getkeytab

Improve keytab code to select the right principal.

2015-12-02T22:48:47+00:00

Whe requesting a keytab the salt used is the NORMAL type (for backwards and AD
compatibility), however since we added alias support we need to search for the
krbCanonicalName in preference, hen nothing is specified, and for the requested
principal name when a getkeytab operation is performed. This is so that the
correct salt can be applied. (Windows AD uses some peculiar aliases for some
special accounts to generate the salt).

Signed-off-by: Simo Sorce

Disable User's ability to use the setkeytab exop.

2015-12-02T21:14:03+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Introduce option to disable the SetKeytab exop

2015-12-02T21:14:03+00:00

If DisableSetKeytab is set in ipaConfig options then setkeytab will not be
available. The default is still to allow this operation for backwards
compatibility towards older clients that do not know how to use the new
GetKeytab extended operation.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Use only AES enctypes by default

2015-12-02T21:14:03+00:00

Remove des3 and arcfour from the defaults for new installs.

NOTE: the ipasam/dcerpc code sill uses arcfour

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/4740

cmocka_tests: Do not use deprecated cmocka interface

2015-11-18T11:54:43+00:00

The cmocka-1.0 introduced new interface for tests
which is not compatible with the old one.
And the old interface is deprecated which caused compiled warnings.

Reviewed-By: Martin Basti

ipa-extdom-extop: Fix warning Wformat

2015-11-13T17:37:23+00:00

In file included from ipa_extdom_extop.c:41:0:
ipa_extdom_extop.c: In function ‘ipa_extdom_init_ctx’:
ipa_extdom_extop.c:203:9: warning: format ‘%d’ expects argument of type ‘int’,
                          but argument 4 has type ‘size_t {aka long unsigned int}’ [-Wformat=]
     LOG("Maximal nss buffer size set to [%d]!\n", ctx->max_nss_buf_size);
         ^
../common/util.h:53:21: note: in definition of macro ‘LOG_PLUGIN_NAME’
                     fmt, ##__VA_ARGS__)
                     ^
ipa_extdom_extop.c:203:5: note: in expansion of macro ‘LOG’

Reviewed-By: Martin Basti

topology: Fix warning Wshadow

2015-11-13T17:37:23+00:00

topology_pre.c: In function ‘ipa_topo_pre_add’:
topology_pre.c:509:15: warning: declaration of ‘errtxt’ shadows a previous local [-Wshadow]
         char *errtxt;
               ^
topology_pre.c:494:11: note: shadowed declaration is here
     char *errtxt  = NULL;
           ^

Reviewed-By: Martin Basti

update list of managed servers when a suffix becomes managed

2015-10-30T12:47:25+00:00

    when a suffix becomes managed for a host, the host needs to
    be added to the managed servers, otherwise connectivity check would fail

Reviewed-By: Thierry Bordaz

reject agreement only if both ends are managed

2015-10-30T12:47:25+00:00

the creation or deletion of a replication agreemet is rejected if the
servers are managed for the suffix. But bot endpoints need to checked

Reviewed-By: Thierry Bordaz

handle cleaning of RUV in the topology plugin

2015-10-26T17:11:32+00:00

    After removing a server the replicaid needs to be cleared in the ruv entry and
    in the changelog.
    This was triggere by initiating a cleanallruv task in "ipa-replica-manage del",
    but the removal of a master already triggers a cleanup of segments and replication
    agreement by the topology plugin, so this could be handled by the plugin as well.

Reviewed-By: Thierry Bordaz