freeipa.git/daemons, branch coverity

Simplify date manipulation in pwd plugin

2016-07-25T09:08:55+00:00

Use a helper function to perform operations on dates in LDAP attributes.

Related to #2795

Signed-off-by: Simo Sorce 
Reviewed-by: David Kupka

Heap corruption in ipapwd plugin

2016-07-19T11:17:37+00:00

ipapwd_encrypt_encode_key allocates 'kset' on the heap but
with num_keys and keys not being initialized.
Then ipa_krb5_generate_key_data initializes them with the
generated keys.
If ipa_krb5_generate_key_data fails (here EINVAL meaning no
principal->realm.data), num_keys and keys are left uninitialized.
Upon failure, ipapwd_keyset_free is called to free 'kset'
that contains random num_keys and keys.

allocates kset with calloc so that kset->num_keys==0 and
kset->keys==NULL

https://fedorahosted.org/freeipa/ticket/6030

Reviewed-By: Simo Sorce 
Reviewed-By: Lukas Slebodnik

kdb: check for local realm in enterprise principals

2016-07-12T10:26:28+00:00

Reviewed-By: Martin Babinsky 
Reviewed-By: Jakub Hrozek

Allow unexpiring passwords

2016-07-01T09:22:02+00:00

Treat maxlife=0 in password policy as "never expire". Delete
krbPasswordExpiration in user entry when password should never expire.

https://fedorahosted.org/freeipa/ticket/2795

Reviewed-By: Thierry Bordaz 
Reviewed-By: Pavel Vomacka

Bump SSSD version in requires

2016-07-01T08:20:36+00:00

This is required by commit aa734da49440c5d12c0f8d4566505adaeef254e8 for
function sss_nss_getnamebycert()

https://fedorahosted.org/freeipa/ticket/4955

Reviewed-By: Alexander Bokovoy

ipapwd_extop should use TARGET_DN defined by a pre-extop plugin

2016-06-24T12:51:15+00:00

ipapwd_extop allows to update the password on a specific entry, identified by its DN.
It can be usefull to support virtual DN in the extop so that update of a virtual entry
would land into the proper real entry.

If a pre-extop sets the TARGET_DN, ipapwd_extop sets ORIGINAL_DN with the value
of TARGET_DN, instead of using the original one (in the ber req)
There is a dependency on slapi-nis >= 0.56-0.1 (https://fedorahosted.org/freeipa/ticket/5955)

https://fedorahosted.org/freeipa/ticket/5946

Reviewed-By: Alexander Bokovoy

ipa-enrollment: set krbCanonicalName attribute on enrolled host entry

2016-06-23T07:48:06+00:00

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

ipa-kdb: set krbCanonicalName when creating new principals

2016-06-23T07:48:06+00:00

Additionally, stop setting ipakrbprincipalalias attribute during principal
creation.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

perform case-insensitive principal search when canonicalization is requested

2016-06-23T07:48:06+00:00

When canonicalization is requested, the krbprincipalname attribute is searched
for case-insensitively.

In the case that krbcanonicalname is not set, the matched alias is returned
with the casing stored in backend, not the one input by client.

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

Topology plugins sigsev/heap corruption when adding a managed host

2016-06-22T15:51:53+00:00

A managed host may handle several ipaReplTopoManagedSuffix.
Removing (from the topology) such host, loops over the replicated
suffixes array to retrieve, in the hosts list, the host record and delete it.
The problem is that a variable used to manage a hosts list is not reset
when looking at the next suffix. That will messup the lists, keeping
freed elements in the lists.

The fix is to reset the variable inside the replicated suffix loop

https://fedorahosted.org/freeipa/ticket/5977

Reviewed-By: Ludwig Krispenz