freeipa.git/ipaserver, branch fix_ber_scanf

Add container environment check to replicainstall

2019-09-16T07:44:52+00:00

Inside the container environment master's IP address
does not resolve to its name.

Resolves: https://pagure.io/freeipa/issue/6210
Reviewed-By: Rob Crittenden

adtrust: add default read_keys permission for TDO objects

2019-09-12T14:17:53+00:00

If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys
attribute values, it cannot be used by SSSD to retrieve TDO keys and the
whole communication with Active Directory domain controllers will not be
possible.

This seems to affect trusts which were created before
ipaAllowedToPerform;read_keys permission granting was introduced
(FreeIPA 4.2). Add back the default setting for the permissions which
grants access to trust agents and trust admins.

Resolves: https://pagure.io/freeipa/issue/8067

Signed-off-by: Alexander Bokovoy 
Reviewed-By: Florence Blanc-Renaud

add default access control when migrating trust objects

2019-09-12T14:17:53+00:00

It looks like for some cases we do not have proper set up keytab
retrieval configuration in the old trusted domain object. This mostly
affects two-way trust cases. In such cases, create default configuration
as ipasam would have created when trust was established.

Resolves: https://pagure.io/freeipa/issue/8067

Signed-off-by: Alexander Bokovoy 
Reviewed-By: Florence Blanc-Renaud

Modify webUI to adhere to new IPA server API

2019-09-10T09:33:21+00:00

Given the changes in IPA server API changes, whebUI is modified to
utilize new authentication indicators, and disabled custom indicators
for services' white list.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Move certauth configuration into a server krb5.conf template

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Extend the list of supported pre-auth mechanisms in IPA server API

2019-09-10T09:33:21+00:00

As new authentication indicators implemented, we also modified server
API to support those new values. Also, "krbprincipalauthind" attribute
is modified to use a pre-defined set of values instead of arbitrary
strings.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

adtrust: avoid using timestamp in klist output

2019-09-10T09:25:07+00:00

When parsing a keytab to copy keys to a different keytab, we don't need
the timestamp, so don't ask klist to output it. In some locales (en_IN,
for example), the timestamp is output in a single field without a space
between date and time. In other locales it can be represented with date
and time separated by a space.

Fixes: https://pagure.io/freeipa/issue/8066
Reviewed-By: Thomas Woerner

Add missing timeout option to logging statement

2019-09-05T07:15:23+00:00

Reviewed-By: Florence Blanc-Renaud

Log dogtag auth timeout in install, provide hint to increase it

2019-09-04T12:52:14+00:00

There is a loop which keeps trying to bind as the admin user
which will fail until it is replicated.

In the case where there is a lot to replicate the default
5 minute timeout may be insufficient. Provide a hint for
tuning.

Fixes: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud

Log the replication wait timeout for debugging purposes

2019-09-04T12:52:14+00:00

Related: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud