freeipa.git/ipaserver, branch mindatefix

DNS install: Ensure that DNS servers container exists

2016-07-15T12:13:32+00:00

during DNS installation it is assumed that the cn=servers,cn=dns container is
always present in LDAP backend when migrating DNS server info to LDAP.

This may not always be the case (e.g. when a new replica is set up against
older master) so the code must take additional steps to ensure this container
is present.

https://fedorahosted.org/freeipa/ticket/6083

Reviewed-By: Stanislav Laznicka

schema: Fix subtopic -> topic mapping

2016-07-15T12:02:17+00:00

https://fedorahosted.org/freeipa/ticket/6069

Reviewed-By: Martin Babinsky

Preserve user principal aliases during rename operation

2016-07-15T11:51:03+00:00

When a MODRDN is performed on the user entry, the MODRDN plugin resets both
krbPrincipalName and krbCanonicalName to the value constructed from uid. In
doing so, hovewer, any principal aliases added to the krbPrincipalName are
wiped clean. In this patch old aliases are fetched before the MODRDN operation
takes place and inserted back after it is performed.

This also preserves previous user logins which can be used further for
authentication as aliases.

https://fedorahosted.org/freeipa/ticket/6028

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce

host-find: do not show SSH key by default

2016-07-13T16:37:15+00:00

Only function 'remove_sshpubkey_from_output_list_post' should be used in
postcallbacks of *-find, otherwise only one entry will be cleaned up

https://fedorahosted.org/freeipa/ticket/6043

Reviewed-By: Stanislav Laznicka

caacl: expand plugin documentation

2016-07-13T16:34:17+00:00

Expand the 'caacl' plugin documentation to explain some common
confusions including the fact that CA ACLs apply to the target
subject principal (not necessarily the principal requesting the
cert), and the fact that CA-less CA ACL implies the 'ipa' CA.

Fixes: https://fedorahosted.org/freeipa/ticket/6002
Reviewed-By: Alexander Bokovoy

ipa-advise: correct handling of plugin namespace iteration

2016-07-12T09:02:52+00:00

The API object namespace iterators now yield plugin classes themselves
instead of their names as strings. The method enumerating through available
plugins needs to be made aware of this change.

https://fedorahosted.org/freeipa/ticket/6044

Reviewed-By: Stanislav Laznicka

uninstall: untrack lightweight CA certs

2016-07-12T08:50:52+00:00

Fixes: https://fedorahosted.org/freeipa/ticket/6020
Reviewed-By: Martin Babinsky

Fix incorrect check for principal type when evaluating CA ACLs

2016-07-01T11:16:23+00:00

This error prevented hosts to request certificates for themselves.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: Petr Spacek

Allow unexpiring passwords

2016-07-01T09:22:02+00:00

Treat maxlife=0 in password policy as "never expire". Delete
krbPasswordExpiration in user entry when password should never expire.

https://fedorahosted.org/freeipa/ticket/2795

Reviewed-By: Thierry Bordaz 
Reviewed-By: Pavel Vomacka

Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3

2016-07-01T09:09:53+00:00

ipa-server-upgrade from pre-lightweight CAs version fails when
Dogtag is also being upgraded from pre-lightweight CAs version,
because Dogtag needs to be restarted after adding the lightweight
CAs container, before requesting information about the host
authority.

Move the addition of the Dogtag lightweight CAs container entry a
bit earlier in the upgrade procedure, ensuring restart.

Fixes: https://fedorahosted.org/freeipa/ticket/6011
Reviewed-By: Martin Babinsky