freeipa.git/install/share, branch review

Allow to specify Kerberos authz data type per user

2015-12-09T19:59:12+00:00

Like for services setting the ipaKrbAuthzData attribute on a user object will
allow us to control exactly what authz data is allowed for that user.
Setting NONE would allow no authz data, while setting MS-PAC would allow only
Active Directory compatible data.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2579

Disable User's ability to use the setkeytab exop.

2015-12-08T15:09:28+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Use only AES enctypes by default

2015-12-08T15:09:28+00:00

Remove des3 and arcfour from the defaults for new installs.

NOTE: the ipasam/dcerpc code sill uses arcfour

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/4740

aci: replace per-server ACIs with ipaserver-based ACIs

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: add IPA servers host group 'ipaservers'

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

rename topology suffixes to "domain" and "ca"

2015-12-04T11:59:21+00:00

https://www.redhat.com/archives/freeipa-devel/2015-November/msg00485.html

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Sync kerberos LDAP schema with upstream.

2015-12-03T15:02:55+00:00

All the new attributes are unused for now, but this allows us to keep tailing
upstream in case of other useful changes later on.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2086
Reviewed-By: Martin Basti

Add profiles and default CA ACL on migration

2015-11-24T09:12:24+00:00

Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers.  Update ipa-replica-install to add
these if they are missing.

Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.

To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.

Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.

Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta

Drop configure.jar

2015-11-13T13:02:45+00:00

Configure.jar used to be used with firefox version < 10 which is not
supported anymore, thus this can be removed.

https://fedorahosted.org/freeipa/ticket/5144

Reviewed-By: Petr Vobornik

Allow to setup the CA when promoting a replica

2015-10-15T12:24:33+00:00

This patch makes --setup-ca work to set upa clone CA while creating
a new replica. The standalone ipa-ca-install script is not converted
yet though.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta