freeipa.git/install, branch review

Convert ipa-sam to use the new getkeytab control

2015-12-09T19:59:12+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5495

Allow to specify Kerberos authz data type per user

2015-12-09T19:59:12+00:00

Like for services setting the ipaKrbAuthzData attribute on a user object will
allow us to control exactly what authz data is allowed for that user.
Setting NONE would allow no authz data, while setting MS-PAC would allow only
Active Directory compatible data.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/2579

Disable User's ability to use the setkeytab exop.

2015-12-08T15:09:28+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Use only AES enctypes by default

2015-12-08T15:09:28+00:00

Remove des3 and arcfour from the defaults for new installs.

NOTE: the ipasam/dcerpc code sill uses arcfour

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/4740

replica promotion: use host credentials when setting up replication

2015-12-07T07:14:13+00:00

Use the local host credentials rather than the user credentials when
setting up replication. The host must be a member of the ipaservers host
group. The user credentials are still required for connection check.

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: allow members of ipaservers to set up replication

2015-12-07T07:14:13+00:00

Add ACIs which allow the members of the ipaservers host group to set up
replication. This allows IPA hosts to perform replica promotion on
themselves.

A number of checks which need read access to certain LDAP entries is done
during replica promotion. Add ACIs to allow these checks to be done using
any valid IPA host credentials.

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: replace per-server ACIs with ipaserver-based ACIs

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: add IPA servers host group 'ipaservers'

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

check whether replica exists before executing the domain level 1 deletion code

2015-12-04T22:09:50+00:00

Move this check before the parts that check topology suffix connectivity, wait
for removed segments etc. If the hostname does not exist, it should really be
one of the first errors user encounters during ipa-replica-manage del.

https://fedorahosted.org/freeipa/ticket/5424

Reviewed-By: Martin Basti 
Reviewed-By: Petr Vobornik

add '--auto-forwarders' description to server/replica/DNS installer man pages

2015-12-04T22:03:22+00:00

https://fedorahosted.org/freeipa/ticket/5438

Reviewed-By: Martin Basti