freeipa.git/install, branch ipasam_getkeytab

Convert ipa-sam to use the new getkeytab control

2015-12-03T13:19:14+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5495

Sync kerberos LDAP schema with upstream.

2015-12-02T21:14:04+00:00

All the new attributes are unused for now, but this allows us to keep tailing
upstream in case of other useful changes later on.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2086

Allow to specify Kerberos authz data type per user

2015-12-02T21:14:03+00:00

Like for services setting the ipaKrbAuthzData attribute on a user object will
allow us to control exactly what authz data is allowed for that user.
Setting NONE would allow no authz data, while setting MS-PAC would allow only
Active Directory compatible data.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2579

Disable User's ability to use the setkeytab exop.

2015-12-02T21:14:03+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Use only AES enctypes by default

2015-12-02T21:14:03+00:00

Remove des3 and arcfour from the defaults for new installs.

NOTE: the ipasam/dcerpc code sill uses arcfour

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/4740

implement domain level 1 specific topology checks into IPA server uninstaller

2015-12-02T13:10:19+00:00

When uninstalling domain level 1 master its removal from topology is checked
on remote masters. The uninstaller also checks whether the uninstallation
disconnects the topology and if yes aborts the procedure. The
'--ignore-disconnected-topology' options skips this check.

https://fedorahosted.org/freeipa/ticket/5377
https://fedorahosted.org/freeipa/ticket/5409

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

extract domain level 1 topology-checking code from ipa-replica-manage

2015-12-02T13:10:19+00:00

This facilitates reusability of this code in other components, e.g. IPA server
uninstallers.

https://fedorahosted.org/freeipa/ticket/5409

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

translations: Update ipa.pot file

2015-12-02T11:40:48+00:00

Reviewed-By: Petr Vobornik

Fixed small typo in stage-user documentation

2015-12-02T07:28:43+00:00

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Tomas Babej

fix 'iparepltopomanagedsuffix' attribute consumers

2015-12-01T12:47:14+00:00

Commit 46ae52569a179f73b1445922f7bac993d598c953 reimplemented reporting of
managed topology suffixes in server-find/show commands using membership
attributes. This patch fixes consumers of this attribute in ipa-replica-manage
command and webui to reflect this change.

Reviewed-By: Martin Basti