freeipa.git/ipalib/plugins, branch mspac

ipa-kdb: Handle parent-child relationship for subdomains

2013-10-04T08:25:31+00:00

When MS-PAC information is re-initialized, record also parent-child
relationship between trust root level domain and its subdomains.

Use parent incoming SID black list to check if child domain is not
allowed to access IPA realm.

We also should really use 'cn' of the entry as domain name.
ipaNTTrustPartner has different meaning on wire, it is an index
pointing to the parent domain of the domain and will be 0 for top
level domains or disjoint subdomains of the trust.

Finally, trustdomain-enable and trustdomain-disable commands should
force MS-PAC cache re-initalization in case of black list change.
Trigger that by asking for cross-realm TGT for HTTP service.

trust: integrate subdomains support into trust-add

2013-10-04T08:25:31+00:00

ipaserver/dcerpc: remove use of trust account authentication

2013-10-04T08:25:31+00:00

Since FreeIPA KDC supports adding MS-PAC to HTTP/ipa.server principal,
it is possible to use it when talking to the trusted AD DC.

Remove support for authenticating as trust account because it should not
really be used other than within Samba.

trusts: support subdomains in a forest

2013-10-04T08:25:31+00:00

Add IPA CLI to manage trust domains.

ipa trust-fetch-domains       -- fetch list of subdomains from AD side and add new ones to IPA
ipa trustdomain-find          -- show all available domains
ipa trustdomain-del   -- remove domain from IPA view about 
ipa trustdomain-enable   -- allow users from trusted domain to access resources in IPA
ipa trustdomain-disable   -- disable access to resources in IPA from trusted domain

By default all discovered trust domains are allowed to access IPA resources

IPA KDC needs also information for authentication paths to subdomains in case they
are not hierarchical under AD forest trust root. This information is managed via capaths
section in krb5.conf. SSSD should be able to generate it once
ticket https://fedorahosted.org/sssd/ticket/2093 is resolved.

part of https://fedorahosted.org/freeipa/ticket/3909

Do not add trust to AD in case of IPA realm-domain mismatch

2013-10-03T10:01:56+00:00

Make sure that trust-add command fails when admin attempts
to add an Active Directory trust when the realm name and
the domain name of the IPA server do not match.

https://fedorahosted.org/freeipa/ticket/3923

Use correct super-calls in get_args() methods

2013-10-02T14:09:07+00:00

The get_args methods in ipalib.crud and ipalib.plugins.baseldap used
super() calls that skipped some of the classes in the inheritance
chain, and contained code that reimplemented some of the skipped
functionality.
This made it difficult to customize the get_args behavior.

Use proper super() calls.

Fix service-disable in CA-less install.

2013-08-29T08:18:32+00:00

https://fedorahosted.org/freeipa/ticket/3886

Fix tests which fail after ipa-adtrust-install

2013-08-28T14:45:57+00:00

Some unit tests were failing after ipa-adtrust-install has been run on the
IPA server, due to missing attributes ('ipantsecurityidentifier') and
objectclasses ('ipantuserattrs' and 'ipantgroupattrs'). This patch detects if
ipa-adtrust-install has been run, and adds missing attributes and objectclasses
where appropriate.

https://fedorahosted.org/freeipa/ticket/3852

Fix incorrect error message occurence when re-adding the trust

2013-08-27T15:01:37+00:00

You cannot re-add the trust and modify the range in the process.
The check in the code was malfunctioning since it assumed that
range_size parameter has default value. However, default value
is assigned only later in the add_range function.

https://fedorahosted.org/freeipa/ticket/3870

Add base-id, range-size and range-type options to trust-add dialog

2013-08-22T13:23:56+00:00

https://fedorahosted.org/freeipa/ticket/3049