freeipa.git/ipaserver/plugins, branch clisesshandling

ldap2: use LDAP whoami operation to retrieve bind DN for current connection

2017-03-22T16:19:22+00:00

For external users which are mapped to some DN in LDAP server, we
wouldn't neccesary be able to find a kerberos data in their LDAP entry.
Instead of searching for Kerberos principal use actual DN we are bound
to because for get_effective_rights LDAP control we only need the DN
itself.

Fixes https://pagure.io/freeipa/issue/6797

Reviewed-By: Martin Babinsky 
Reviewed-By: Pavel Vomacka

check for replica's KDC entry on master before requesting PKINIT cert

2017-03-15T15:39:39+00:00

This prevents replication-based race conditions to break PKINIT
certificate requests on replica installation.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

check that the master requesting PKINIT cert has KDC enabled

2017-03-15T15:39:39+00:00

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

idviews: correctly handle modification of non-existent view

2017-03-15T08:48:12+00:00

the pre-callback in `idview-mod` did not correctly handle non-existent
object during objectclass check. It will now correctly report that the
object was not found instead on generic 'no such entry'.

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti

Re-use trust domain retrieval code in certmap validators

2017-03-14T17:37:10+00:00

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

idview: add domain_resolution_order attribute

2017-03-14T17:37:10+00:00

`idview-add` and `idview-mod` can now set and validate the attribute.
The required objectclass is added on-demand after modification

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

ipaconfig: add the ability to manipulate domain resolution order

2017-03-14T17:37:10+00:00

optional attribute was added to config object along with validator that
check for valid domain names and also checks whether the specified
domains exist in FreeIPA or in trusted forests and, in case of trusted
domains, are not disabled.

Part of http://www.freeipa.org/page/V4/AD_User_Short_Names

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

cert: include certificate chain in cert command output

2017-03-14T11:58:45+00:00

Include the full certificate chain in the output of cert-request, cert-show
and cert-find if --chain or --all is specified.

If output file is specified in the CLI together with --chain, the full
certificate chain is written to the file.

https://pagure.io/freeipa/issue/6547

Reviewed-By: David Kupka

WebUI: add vault management

2017-03-14T09:40:10+00:00

Add vault management into WebUI, there are some constraints:
- There is no crypto library so Symmetric and Assymetric vaults
  are not supported in WebUI. Also retrieving or archiving data
  is not supported.
- There aren't any container support right now

Supported is:
- Browsing vaults
- Adding Standard vaults (users, service, shared)
- Removing vaults
- Adding and removing owners
- Adding and removing members

https://fedorahosted.org/freeipa/ticket/5426

Reviewed-By: Martin Basti 
Reviewed-By: Petr Vobornik

permissions: add permissions for read and mod of external group members

2017-03-13T17:18:31+00:00

Issue: "User Administrator" role cannot add users to an External Group.

https://fedorahosted.org/freeipa/ticket/5504

Reviewed-By: Martin Basti