freeipa.git/install/updates, branch kdc-fixes

DNS: Consolidate DNS RR types in API and schema

2015-07-21T15:18:29+00:00

* Remove NSEC3, DNSKEY, TSIG, TKEY, TA records from API:
    These records never worked, they dont have attributes in schema.
    TSIG and TKEY are meta-RR should not be in LDAP
    TA is not supported by BIND
    NSEC3, DNSKEY are DNSSEC records generated by BIND, should not be
    in LDAP.
    *! SIG, NSEC are already defined in schema, must stay in API.

* Add HINFO, MINFO, MD, NXT records to API as unsupported records
    These records are already defined in LDAP schema

* Add schema for RP, APL, IPSEC, DHCID, HIP, SPF records
    These records were defined in IPA API as unsupported, but schema definition was
    missing. This causes that ACI cannot be created for these records
    and dnszone-find failed. (#5055)

https://fedorahosted.org/freeipa/ticket/4934
https://fedorahosted.org/freeipa/ticket/5055

Reviewed-By: Martin Babinsky 
Reviewed-By: Petr Spacek

upgrade: Enable and start oddjobd if adtrust is available

2015-07-08T15:14:56+00:00

If ipa-adtrust-install has already been run on the system,
enable and start the oddjobd service.

Reviewed-By: Alexander Bokovoy

trusts: add ACIs to allow AD trust agents to fetch cross-realm keytabs

2015-07-07T23:56:52+00:00

Part of https://fedorahosted.org/freeipa/ticket/4959

Reviewed-By: Tomas Babej

Add ACI to allow hosts to add their own services

2015-06-29T11:41:52+00:00

Use wildcards and DN matching in an ACI to allow a host
that binds using GSSAPI to add a service for itself.

Set required version of 389-ds-base to 1.3.4.0 GA.

https://fedorahosted.org/freeipa/ticket/4567

Reviewed-By: Martin Basti

Fix indicies ntUserDomainId, ntUniqueId

2015-06-29T11:40:29+00:00

ntUserDomainId and ntUniqueId  contained "eq,pres" index value, which is
not valid.

Reviewed-By: Martin Babinsky

Server Upgrade: create default config for NIS Server plugin

2015-06-18T15:48:36+00:00

Plugin is disabled by default.

This commit prevents false positive upgrade errors.

Reviewed-By: Martin Basti

add DS index for userCertificate attribute

2015-06-18T13:42:03+00:00

'eq' and 'pres' indices for userCertificate attribute allow for more efficient
lookup and matching of binary certificates assigned to users, hosts, and
services.

Part of http://www.freeipa.org/page/V4/User_Certificates

Reviewed-By: Martin Basti

DNS: add UnknownRecord to schema

2015-06-18T12:37:28+00:00

defintion of UnknownRecord attributetype

https://fedorahosted.org/freeipa/ticket/4939

Reviewed-By: Petr Spacek

Add CA ACL plugin

2015-06-11T10:50:31+00:00

Implement the caacl commands, which are used to indicate which
principals may be issued certificates from which (sub-)CAs, using
which profiles.

At this commit, and until sub-CAs are implemented, all rules refer
to the top-level CA (represented as ".") and no ca-ref argument is
exposed.

Also, during install and upgrade add a default CA ACL that permits
certificate issuance for all hosts and services using the profile
'caIPAserviceCert' on the top-level CA.

Part of: https://fedorahosted.org/freeipa/ticket/57
Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Martin Basti

add entries required by topology plugin on update

2015-06-11T10:10:40+00:00

These entries were not added on upgrade from old IPA servers and on replica
creation.

https://fedorahosted.org/freeipa/ticket/4302

Reviewed-By: Martin Babinsky