freeipa.git/install/updates, branch pwdpolicy

Remove "Request Certificate with SubjectAltName" permission

2016-12-21T16:04:18+00:00

subjectAltName is required or relevant in most certificate use cases
(esp. TLS, where carrying DNS name in Subject DN CN attribute is
deprecated).  Therefore it does not really make sense to have a
special permission for this, over and above "request certificate"
permission.

Furthermore, we already do rigorously validate SAN contents again
the subject principal, and the permission is waived for self-service
requests or if the operator is a host principal.

So remove the permission, the associated virtual operation, and the
associated code in cert_request.

Fixes: https://fedorahosted.org/freeipa/ticket/6526
Reviewed-By: Martin Babinsky

password policy: Add explicit default password policy for hosts and services

2016-12-14T16:46:12+00:00

Set explicitly krbPwdPolicyReference attribute to all hosts (entries in
cn=computers,cn=accounts), services (entries in cn=services,cn=accounts) and
Kerberos services (entries in cn=$REALM,cn=kerberos). This is done using DS's
CoS so no attributes are really added.

The default policies effectively disable any enforcement or lockout for hosts
and services. Since hosts and services use keytabs passwords enforcements
doesn't make much sense. Also the lockout policy could be used for easy and
cheap DoS.

https://fedorahosted.org/freeipa/ticket/6561

Reviewed-By: Pavel Vomacka

Build: remove incorrect use of MAINTAINERCLEANFILES

2016-11-16T08:12:07+00:00

Automake manual section 13 What Gets Cleaned says that make maintainer-clean
should not remove files necessary for subsequent runs of ./configure.

It practically means that all usage of MAINTAINERCLEANFILES were incorrect
so I've removed them.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik 
Reviewed-By: Christian Heimes

Moved update of DNA plugin among update plugins

2016-11-11T11:13:56+00:00

To make the code more general, moved the update_dna_shared_config
among other update plugins.

Bugfix: DNA shared config connection protocol was compared to a
method string which would result in a try to always update it
even if there was no need to.

https://fedorahosted.org/389/ticket/48373 causes that two
shared DNA config entries are created instead of one.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Babinsky 
Reviewed-By: Jan Cholasta

Move ds.replica_populate to an update plugin

2016-11-11T11:13:56+00:00

Replica populate can be applied with other update plugins.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Babinsky 
Reviewed-By: Jan Cholasta

Build: fix distribution and installation of update LDIFs

2016-11-09T12:08:32+00:00

10-ipapwd.update file was missing in Makefile.am and thus missing in
tarball and installed system.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

DNS: Support URI resource record type

2016-10-11T14:48:47+00:00

https://fedorahosted.org/freeipa/ticket/6344

Reviewed-By: Martin Basti

support multiple uid values in schema compatibility tree

2016-08-25T08:34:51+00:00

https://fedorahosted.org/freeipa/ticket/6138

Reviewed-By: Thierry Bordaz

Create indexes for krbCanonicalName attribute

2016-07-27T17:25:29+00:00

krbCanonicalName is for a long time among the attributes guarded by uniqueness
plugins, but there was never an index for it. Now that the attribute is really
used to store canonical principal names we need to add index for it to avoid
performance regressions.

https://fedorahosted.org/freeipa/ticket/6100

Reviewed-By: Thierry Bordaz

replace an ACI relying on presence of deprecated objectclass

2016-07-01T07:37:25+00:00

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta