public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,503 Commits 9 Branches 0 Tags
ecc398c409e41ff4d1014e6e88bb5c82d6c19f75
Commit Graph
11 Commits
Author SHA1 Message Date
François Cami 438094f868 DSU: add Design for Disable Stale Users 
Add disable-stale-users.md: feature document for the upcoming DSU feature.

Fixes: https://pagure.io/freeipa/issue/8104
Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2019-11-23 00:12:24 +01:00
Alexander Bokovoy c5f32165d6 Add Authentication Indicator Kerberos ticket policy options 
For the authentication indicators 'otp', 'radius', 'pkinit', and
'hardened', allow specifying maximum ticket life and maximum renewable
age in Kerberos ticket policy.

The policy extensions are now loaded when a Kerberos principal data is
requested by the KDC and evaluated in AS_REQ KDC policy check. If one of
the authentication indicators mentioned above is present in the AS_REQ,
corresponding policy is applied to the ticket.

Related: https://pagure.io/freeipa/issue/8001

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
 2019-11-21 11:13:12 -05:00
Christian Heimes f0a1f084b6 Add group membership management 
A group membership manager is a user or a group that can add members to
a group or remove members from a group or host group.

Fixes: https://pagure.io/freeipa/issue/8114
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2019-11-11 09:31:14 +01:00
Tomas Halman bddf64b9da extdom: add extdom protocol documentation 
Add the description of extdom protocol and its versions

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2019-09-12 10:48:13 +03:00
Changmin Teng 952dd2a50f Add design document 
This document details authentication indicaters and kerberos ticket
policies implemented in IPA.

Resolves: https://pagure.io/freeipa/issue/8001
Signed-off-by: Changmin Teng <cteng@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Robbie Harwood <rharwood@redhat.com>
 2019-09-10 12:33:21 +03:00
Tibor Dudlák c18ee9b641 Add SMB attributes for users 
SMB attributes are used by Samba domain controller when reporting
details about IPA users via LSA DCE RPC calls.

Based on the initial work from the external plugin:
https://github.com/abbra/freeipa-user-trust-attributes

Related: https://pagure.io/freeipa/issue/3999

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Signed-off-by: Tibor Dudlák <tdudlak@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
 2019-07-01 13:21:21 +02:00
Alexander Bokovoy 84201e1daf adtrust: add design document for Samba domain member on IPA client 
Document general design for Samba file server running on IPA client as a
domain member in IPA domain.

Fixes: https://pagure.io/freeipa/issue/3999
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2019-06-29 11:00:28 +03:00
Alexander Bokovoy 34bfffd1be adtrust upgrade: fix wrong primary principal name 
Upgrade code had Kerberos principal names mixed up: instead of creating
krbtgt/LOCAL-FLAT@REMOTE and marking LOCAL-FLAT$@REMOTE as an alias to
it, it created LOCAL-FLAT$@REMOTE Kerberos principal and marked
krbtgt/LOCAL-FLAT@REMOTE as an alias.

This differs from what Active Directory expects and what is created by
ipasam plugin when trust is established. When upgrading such deployment,
an upgrade code then unexpectedly failed.

Resolves: https://pagure.io/freeipa/issue/7992
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2019-06-26 10:50:45 +02:00
François Cami c191c2573e Hidden replica documentation: fix typo 
The hidden replica documentation mentioned using
$ ipa server-state <hostname> --state=enable
whereas the right command is
$ ipa server-state <hostname> --state=enabled

Signed-off-by: François Cami <fcami@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
 2019-06-13 23:13:43 +02:00
Christian Heimes d727321ce3 Add design draft 
The design draft explains implementation details, limitations, and API
changes for the new feature.

Fixes: https://pagure.io/freeipa/issue/7892
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Francois Cami <fcami@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
 2019-03-28 17:57:58 +01:00
Alexander Bokovoy 2a8176ee03 Add design page for one-way trust to AD with shared secret 
Reviewed-By: Christian Heimes <cheimes@redhat.com>
 2019-03-28 14:08:19 +01:00