freeipa.git/install/updates, branch mindatefix

replace an ACI relying on presence of deprecated objectclass

2016-07-01T07:37:25+00:00

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta

Add ACI for admins to modify principal attributes

2016-07-01T07:37:25+00:00

This is required for admins to utilize the APIs that enable them to add/remove
principal aliases to entities.

https://fedorahosted.org/freeipa/ticket/3864
https://fedorahosted.org/freeipa/ticket/3961
https://fedorahosted.org/freeipa/ticket/5413

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta

Add missing nsSystemIndex attributes

2016-06-27T08:49:51+00:00

https://fedorahosted.org/freeipa/ticket/5947

Reviewed-By: Martin Basti

add case-insensitive matching rule to krbprincipalname index

2016-06-23T07:48:06+00:00

Part of https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Simo Sorce

Make sure ipapwd_extop takes precedence over passwd_modify_extop

2016-06-20T17:09:45+00:00

DS core server provides a default plugin (passwd_modify_extop) to handle
1.3.6.1.4.1.4203.1.11.1 extended op (https://www.ietf.org/rfc/rfc3062.txt)

IPA delivers ipa_pwd_extop plugin that should take precedence over
the default DS plugin (passwd_modify_extop)

In addition make sure that slapi-nis has a low precedence

Reviewed-By: Alexander Bokovoy

DNS Locations: dnsserver: put server_id option into named.conf

2016-06-17T13:22:24+00:00

The option server_id is required for DNS location feature, otherwise it
will not work.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek 
Reviewed-By: Jan Cholasta

DNS Locations: dnsserver-* commands

2016-06-17T13:22:24+00:00

New commands for manipulation with DNS server configuration were added:
 * dnsserver-show
 * dnsserver-mod
 * dnsserver-find

https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP
https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek 
Reviewed-By: Jan Cholasta

DNS Locations: add index for ipalocation attribute

2016-06-17T13:22:24+00:00

For performace ipalocation should be indexed because it is used by
referint plugin

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek 
Reviewed-By: Jan Cholasta

Add 'ca' plugin

2016-06-15T05:13:38+00:00

This commit adds the 'ca' plugin for creating and managing
lightweight CAs.  The initial implementation supports a single level
of sub-CAs underneath the IPA CA.

This commit also:

- adds the container for FreeIPA CA objects

- adds schema for the FreeIPA CA objects

- updates ipa-pki-proxy.conf to allow access to the Dogtag
  lightweight CAs REST API.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Babinsky

adtrust: support GSSAPI authentication to LDAP as Active Directory user

2016-06-10T11:39:02+00:00

In case an ID override was created for an Active Directory user in the
default trust view, allow mapping the incoming GSSAPI authenticated
connection to the ID override for this user.

This allows to self-manage ID override parameters from the CLI, for
example, SSH public keys or certificates. Admins can define what can be
changed by the users via self-service permissions.

Part of https://fedorahosted.org/freeipa/ticket/2149
Part of https://fedorahosted.org/freeipa/ticket/3242

Reviewed-By: Martin Babinsky