March 2019 - FreeIPA-devel - Fedora Mailing-Lists

[freeipa PR#2945][opened] [backport ipa-4-6] Backport one-way trust to AD with shared secret to ipa-4-6

by abbra

URL: https://github.com/freeipa/freeipa/pull/2945 Author: abbra Title: #2945: [backport ipa-4-6] Backport one-way trust to AD with shared secret to ipa-4-6 Action: opened PR body: """ Backport of https://github.com/freeipa/freeipa/pull/2926 to ipa-4-6. Includes additional patch with commit https://github.com/freeipa/freeipa/commit/703497532abe4189835d0a02b32f991... that wasn't backport to ipa-4-6 at the time it was introduced. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2945/head:pr2945 git checkout pr2945

5 years

2
1
0 / 0

[freeipa PR#2926][opened] support shared secret trust established from Active Directory domain controller side

by abbra

URL: https://github.com/freeipa/freeipa/pull/2926 Author: abbra Title: #2926: support shared secret trust established from Active Directory domain controller side Action: opened PR body: """ FreeIPA does support trust to an Active Directory forest. The trust can be established using administrative credentials from the forest root domain or using a so-called shared secret. In the latter case no administrative access is given to the remote side of the trust and each administrator performs their configuration separately: FreeIPA administrator configures IPA side, Active Directory administrator adds IPA forest as a trusted one on the Active Directory side. For trust to be active, one needs to validate it. Validation process includes a sequences of DCE RPC calls that force a domain controller on the trusted side to establish a so-called "secure channel" to a remote domain controller in the trusting domain. This is an administrative operation and requires administrative privileges to activate. If trust was established using a shared secret, IPA side will lack ability to initiate a validation process. At the same time, FreeIPA 4.6 or earlier versions do not include functionality to allow a remote validation from Active Directory to happen before trust objects are created and SSSD can retrieve information from the Active Directory side. Unfortunately, the latter is not possible until trust is validated. The purpose of this design is to extend FreeIPA setup to allow trust validation to be initiated from Windows UI in case a shared secret is used to create a trust agreement. TODO: while this code is useful as it is, there is no way to force AD DC to pull forest trust information from IPA DC side. This is due to the fact that Samba does not implement a required RPC call in the mode used by IPA. We need to implement a command that would allow pushing the forest trust topology from IPA side but this command requires administrative privileges on AD side which makes the situation a bit weird for a shared-secret trust. A lack of forest trust topology update does not prevent resolving users through the trust link. It only prevents single sign-on from Windows side to IPA resources using GSSAPI. Password-based authentication works fine. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2926/head:pr2926 git checkout pr2926

5 years

2
1
0 / 0

[freeipa PR#2947][opened] [Backport][ipa-4-7] Consolidate container_masters queries

by tiran

URL: https://github.com/freeipa/freeipa/pull/2947 Author: tiran Title: #2947: [Backport][ipa-4-7] Consolidate container_masters queries Action: opened PR body: """ Manual backport of PRs #2938 and #2144 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2947/head:pr2947 git checkout pr2947

5 years

1
1
0 / 0

[freeipa PR#2948][opened] [Backport][ipa-4-6] Consolidate container_masters queries

by tiran

URL: https://github.com/freeipa/freeipa/pull/2948 Author: tiran Title: #2948: [Backport][ipa-4-6] Consolidate container_masters queries Action: opened PR body: """ Manual backport of PRs #2938 and #2144 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2948/head:pr2948 git checkout pr2948

5 years

1
1
0 / 0

[freeipa PR#2772][opened] [testing_rawhide] Nightly PR

by freeipa-pr-ci

URL: https://github.com/freeipa/freeipa/pull/2772 Author: freeipa-pr-ci Title: #2772: [testing_rawhide] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2772/head:pr2772 git checkout pr2772

5 years

2
1
0 / 0

[freeipa PR#2938][opened] Refactor container_masters queries

by tiran

URL: https://github.com/freeipa/freeipa/pull/2938 Author: tiran Title: #2938: Refactor container_masters queries Action: opened PR body: """ Refactor for hidden replica PR #2927. All APIs that look for masters and services are now going through a set of well-defined APIs and use ``api.env.container_masters``. ## Use api.env.container_masters Replace occurences of ``('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc')`` with ``api.env.container_masters``. ## Consolidate container_masters queries Replace manual queries of ``container_masters`` with new APIs ``get_masters()`` and `is_service_enabled()``. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2938/head:pr2938 git checkout pr2938

5 years

1
1
0 / 0

[freeipa PR#2936][opened] [testing_master] Nightly PR

by freeipa-pr-ci

URL: https://github.com/freeipa/freeipa/pull/2936 Author: freeipa-pr-ci Title: #2936: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2936/head:pr2936 git checkout pr2936

5 years

1
1
0 / 0

[freeipa PR#2940][opened] [Backport] [ipa-4-6] replica install: acknowledge ca_host override

by Tiboris

URL: https://github.com/freeipa/freeipa/pull/2940 Author: Tiboris Title: #2940: [Backport] [ipa-4-6] replica install: acknowledge ca_host override Action: opened PR body: """ Fixup for commit c0fd5e39c726ef4dc12e87a2f9c08ebb32ed27fe. Only set ca_host to source master hostname if ca_host points to the local host. This permits users to override ca_host in /etc/ipa/default.conf when installing a replica. Related: https://pagure.io/freeipa/issue/7744 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com> Reviewed-By: Tibor Dudlak <tdudlak(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2940/head:pr2940 git checkout pr2940

5 years

2
1
0 / 0

[freeipa PR#2941][opened] [Backport] [ipa-4-7] replica install: acknowledge ca_host override

by Tiboris

URL: https://github.com/freeipa/freeipa/pull/2941 Author: Tiboris Title: #2941: [Backport] [ipa-4-7] replica install: acknowledge ca_host override Action: opened PR body: """ This PR is manual backport of https://github.com/freeipa/freeipa/pull/2939 please wait for CI before pushing. In case of questions or problems contact @tiran who is author of the original PR. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2941/head:pr2941 git checkout pr2941

5 years

2
1
0 / 0

[freeipa PR#2939][opened] replica install: acknowledge ca_host override

by tiran

URL: https://github.com/freeipa/freeipa/pull/2939 Author: tiran Title: #2939: replica install: acknowledge ca_host override Action: opened PR body: """ Fixup for commit c0fd5e39c726ef4dc12e87a2f9c08ebb32ed27fe. Only set ca_host to source master hostname if ca_host points to the local host. This permits users to override ca_host in /etc/ipa/default.conf when installing a replica. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Backport this PR together with commit from PR #2698 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2939/head:pr2939 git checkout pr2939

5 years

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel March 2019