freeipa.git/install, branch fix_ber_scanf

adtrust: add default read_keys permission for TDO objects

2019-09-12T14:17:53+00:00

If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys
attribute values, it cannot be used by SSSD to retrieve TDO keys and the
whole communication with Active Directory domain controllers will not be
possible.

This seems to affect trusts which were created before
ipaAllowedToPerform;read_keys permission granting was introduced
(FreeIPA 4.2). Add back the default setting for the permissions which
grants access to trust agents and trust admins.

Resolves: https://pagure.io/freeipa/issue/8067

Signed-off-by: Alexander Bokovoy 
Reviewed-By: Florence Blanc-Renaud

WebUI: Make 'Unlock' option is available only on locked user page

2019-09-11T16:26:34+00:00

The implementation includes checking password policy for selected user.
'Unlock' option is available only in case user reached a limit of login failures.

Ticket: https://pagure.io/freeipa/issue/5062
Signed-off-by: Serhii Tsymbaliuk 
Reviewed-By: Petr Vobornik 
Reviewed-By: Armando Neto

Modify webUI to adhere to new IPA server API

2019-09-10T09:33:21+00:00

Given the changes in IPA server API changes, whebUI is modified to
utilize new authentication indicators, and disabled custom indicators
for services' white list.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Add a skeleton kdcpolicy plugin

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Move certauth configuration into a server krb5.conf template

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Add new authentication indicators in kdc.conf.template

2019-09-10T09:33:21+00:00

As of release 1.17, KDC can be configured to apply authentication
indicator for SPAKE, PKINIT, and encrypted challenge preauth via
FAST channel, which are not configured in current version of freeIPA.

Note that even though the value of encrypted_challenge_indicator is
attached only when encrypted challenge preauth is performed along
a FAST channel, it's possible to perform FAST without encrypted
challenge by using SPAKE. Since there is no reason to force clients
not to use SPAKE while using FAST, we made a design choice to merge
SPAKE and FAST in a new option called "Hardened Password", which
requires user to use at least one of SPAKE or FAST channel. Hence
same value attaching to both spake_preauth_indicator and
encrypted_challenge_indicator.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Skip lock and fork in ipa-server-guard on unsupported ops

2019-09-06T14:29:43+00:00

On startup certmonger performs a number of options on the
configured CA (IPA, not to be confused with the real dogtag CA)
and the tracking requests.

Break early for operations that are not supported by ipa-submit.
This will save both a fork and a lock call.

https://bugzilla.redhat.com/show_bug.cgi?id=1656519

Reviewed-By: Fraser Tweedale

Defer initializing the API in dogtag-ipa-ca-renew-agent-submit

2019-09-06T14:29:43+00:00

Wait until we know a supported operation is being called
(SUBMIT and POLL) before initializing the API, which can be
an expensive operation.

https://bugzilla.redhat.com/show_bug.cgi?id=1656519

Reviewed-By: Fraser Tweedale

Move ipachangeconf from ipaclient.install to ipapython

2019-08-29T02:15:50+00:00

This will let us call it from ipaplatform.

Mark the original location as deprecated.

Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden

install: Add missing scripts to app_DATA.

2019-08-11T08:37:29+00:00

Signed-off-by: Timo Aaltonen 
Reviewed-By: Alexander Bokovoy