freeipa.git/ipalib/plugins, branch ipasam_getkeytab

Allow admins to disable preauth for SPNs.

2015-12-02T21:14:03+00:00

Some legacy softare is not able to properly cope with preauthentication,
allow the admins to disable the requirement to use preauthentication for
all Service Principal Names if they so desire. IPA Users are excluded,
for users, which use password of lessere entrpy, preauthentication is
always required by default.

This setting does NOT override explicit policies set on service principals
or in the global policy, it only affects the default.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/3860

Disable User's ability to use the setkeytab exop.

2015-12-02T21:14:03+00:00

Users can still obtain a keytab for themselves using the getkeytab exop
which does not circumvent password policy checks.

Users are disallowed from using setkeytab by default in new installations
but not in existing installations (no forced upgrade).

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Introduce option to disable the SetKeytab exop

2015-12-02T21:14:03+00:00

If DisableSetKeytab is set in ipaConfig options then setkeytab will not be
available. The default is still to allow this operation for backwards
compatibility towards older clients that do not know how to use the new
GetKeytab extended operation.

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5485

Removed duplicate domain name validating function

2015-12-02T16:26:56+00:00

Reviewed-By: Martin Basti

topology: replace "suffices" with "suffixes"

2015-12-01T08:30:21+00:00

Reviewed-By: Martin Babinsky

server: use topologysuffix name in iparepltopomanagedsuffix

2015-12-01T08:30:21+00:00

Reviewed-By: Martin Babinsky

Upgrade: increase time limit for upgrades

2015-12-01T07:51:44+00:00

Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta

topology: treat server suffix as multivalued attribute in API

2015-11-27T14:56:59+00:00

Reviewed-By: Martin Babinsky

webui: topology graph facet

2015-11-27T14:50:56+00:00

https://fedorahosted.org/freeipa/ticket/4286

Reviewed-By: Martin Babinsky

Compare objectclasses as case insensitive in baseuser.py

2015-11-25T13:56:30+00:00

Objectclasses must be handled as case insensitive.

https://fedorahosted.org/freeipa/ticket/5456

Reviewed-By: Martin Babinsky