freeipa.git/daemons, branch my-master

CLDAP: Return empty reply on non-fatal errors

2013-05-23T19:08:52+00:00

Windows DCs return an empty reply when a legal request cannot satisfied.
If we get EINVAL or ENOENT it means the information requested could not be
found or input parameters were bogus.
Always return an empty reply in these cases.

On any other internal error just return, the request may have been legit but we
can't really handle it right now, pretend we never saw it and hope the next
attempt will succeed.

Fixes: https://fedorahosted.org/freeipa/ticket/3639

Signed-off-by: Simo Sorce

CLDAP: Fix domain handling in netlogon requests

2013-05-23T16:55:27+00:00

1. Stop using getdomainname() as it is often not properly initialized
2. The code using getdomainname() was not working anyway it was trying to
look at the function call output in hostname which is always empty at that
point.
3. Always check the requested domain matches our own, we cannot reply to
anything else anyway.

Pre-requisite to fix: https://fedorahosted.org/freeipa/ticket/3639

Signed-off-by: Simo Sorce

WIP: Check for account/pw expiration in pre-bind

2013-05-23T16:55:27+00:00

Insure user accounts are valid and the password is not expired
before allowing a password bind.

TODO: handle returning a control with more detailed information about
failures (only if explicitly requested by client)

Add Delegation Info to MS-PAC

2013-05-23T16:55:27+00:00

NO-PUSH: TODO and 2.0->3.0 upgrade notes

2013-05-23T16:55:27+00:00

NO-PUSH: silence libtool a bit

2013-05-23T16:55:27+00:00

Add OTP support to ipa-pwd-extop

2013-05-17T07:30:51+00:00

During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.

    https://fedorahosted.org/freeipa/ticket/3367
    http://freeipa.org/page/V3/OTP

Remove unnecessary prefixes from ipa-pwd-extop files

2013-05-17T07:30:51+00:00

Add the krb5/FreeIPA RADIUS companion daemon

2013-05-17T07:30:51+00:00

This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.

https://fedorahosted.org/freeipa/ticket/3366
http://freeipa.org/page/V3/OTP

ipa-kdb: Add OTP support

2013-05-17T07:30:51+00:00

If OTP is enabled for a user, then:
  1. Long-term keys are not provided to KDB
  2. The user string 'otp' is defined to KDB

Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string to a known default
('[]') which enables the default configuration in the KDC.

https://fedorahosted.org/freeipa/ticket/3561
http://freeipa.org/page/V3/OTP