freeipa.git/install, branch getkeytab

keytab: Add new extended operation to get a keytab.

2014-06-09T18:49:42+00:00

This new extended operation allow to create new keys or retrieve
existing ones.
The new set of keys is returned as a ASN.1 structure similar to the one
that is passed in by the 'set keytab' extended operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute
named ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

Convert Sudo rule default permissions to managed

2014-06-04T15:34:18+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek

Add read permissions for automember tasks

2014-06-02T11:04:59+00:00

Permission to read all tasks is given to high-level admins.
Managed permission for automember tasks is given to automember task admins.
"targetattr=*" is used because tasks are extensibleObject with
attributes that aren't in the schema.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek

dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone

2014-05-28T13:58:24+00:00

Part of the work for: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Martin Kosek

admin tools: Log IPA version

2014-05-27T10:08:55+00:00

Add the IPA version, and vendor version if applicable, to the beginning
of admintool logs -- both framework and indivitual tools that don't yet
use the framework.
This will make debugging easier.

https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy

Remove the global anonymous read ACI

2014-05-26T10:14:55+00:00

Also remove
- the deny ACIs that implemented exceptions to it:
  - no anonymous access to roles
  - no anonymous access to member information
  - no anonymous access to hbac
  - no anonymous access to sudo (2×)
- its updater plugin

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566

Reviewed-By: Martin Kosek

Replace "replica admins read access" ACI with a permission

2014-05-21T07:57:16+00:00

Add a 'Read Replication Agreements' permission to replace
the read ACI for cn=config.

https://fedorahosted.org/freeipa/ticket/3829

Reviewed-By: Martin Kosek

Fixed typo in ipa-replica-manage man page

2014-05-12T16:43:07+00:00

Reviewed-By: Nathaniel McCallum

webui static site delete command fixed

2014-05-07T14:55:01+00:00

When the static test site called batch delete,
it always referred to batch.json. This patch
fixes it, by referring entityname + '_batch_del.json'

Reviewed-By: Petr Vobornik

webui OTP token test data added

2014-05-07T14:55:01+00:00

Reviewed-By: Petr Vobornik