IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 08:00:02 -06:00
Code Issues Packages Projects Releases Wiki Activity
64fa6b7241
freeipa/doc/designs/index.rst

32 lines
811 B
ReStructuredText
Raw Normal View History

Include design documentation
2020-03-18 03:23:28 -05:00
FreeIPA design documentation
============================
.. toctree::
:maxdepth: 1
adtrust/oneway-trust-with-shared-secret.md
adtrust/samba-domain-controller.md
adtrust/samba-domain-member.md
Add design page for managing IPA resources as a user from a trusted Active Directory forest Fixes: https://pagure.io/freeipa/issue/8357 Fixes: https://pagure.io/freeipa/issue/7816 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-06-05 11:00:20 -05:00
adtrust/admin-ipa-as-trusted-user.md
Add design document for using AD users/groups in SUDO rules Fixes: https://pagure.io/freeipa/issue/3226 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2021-01-24 06:12:55 -06:00
adtrust/sudorules-with-ad-objects.md
Design doc for idrange option "auto-private-groups" Related: https://pagure.io/freeipa/issue/8807 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-04-14 10:33:59 -05:00
adtrust/auto-private-groups.md
Design: Integrate SID configuration into base IPA installers Add design doc for the feature. Related: https://pagure.io/freeipa/issue/8995 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-09-27 10:07:13 -05:00
adtrust/sidconfig.md
doc: Design for HSM support Purpose is to add support for HSM installation of CA and KRA on both initial server and replicas. Related: https://pagure.io/freeipa/issue/9273 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2022-09-13 11:53:32 -05:00
hsm.md
Include design documentation
2020-03-18 03:23:28 -05:00
krb-ticket-policy.md
extdom-plugin-protocol.md
doc: Design for certificate pruning This describes how the certificate pruning capability of PKI introduced in v11.3.0 will be integrated into IPA, primarily for ACME. Related: https://pagure.io/freeipa/issue/9294 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2022-12-08 15:18:07 -06:00
expired_certificate_pruning.md
IPA-EPN: Add design draft The design draft lists the user stories, implementation choices, implementation details, limitations, and changes for the new Expired Password Notifications (EPN) feature. Fixes: https://pagure.io/freeipa/issue/3687 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-04-16 09:28:15 -05:00
expiring-password-notification.md
doc: Design document for LDAP graceperiod Implement part of RFC https://tools.ietf.org/id/draft-behera-ldap-password-policy-10.html Related: https://pagure.io/freeipa/issue/1539 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2022-05-31 13:48:30 -05:00
ldap_grace_period.md
Design doc to allow LDAP bind using the RADIUS auth type The RADIUS auth type is only supported with Kerberos currently. This design proposes a way to make it work with LDAP binds as well without relying ok workarounds. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-04-23 15:46:40 -05:00
ldap_pam_passthrough.md
Requirements and design for libpwquality integration https://pagure.io/freeipa/issue/6964 https://pagure.io/freeipa/issue/5948 https://pagure.io/freeipa/issue/2445 https://pagure.io/freeipa/issue/298 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2020-10-07 13:35:08 -05:00
libpwquality.md
Include design documentation
2020-03-18 03:23:28 -05:00
membermanager.md
Design for IPA-to-IPA migration There are some references and thoughts on expanding the current migrate-ds plugin as well. Related: https://pagure.io/freeipa/issue/3656 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2022-03-04 14:08:51 -06:00
ipa_to_ipa_migration.md
Include design documentation
2020-03-18 03:23:28 -05:00
hidden-replicas.md
disable-stale-users.md
Add design for LDAPI autobind Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
2020-12-17 07:14:25 -06:00
ldapi-autobind-services.md
Add basic support for subordinate user/group ids New LDAP object class "ipaUserSubordinate" with four new fields: - ipasubuidnumber / ipasubuidcount - ipasubgidnumber / ipasgbuidcount New self-service permission to add subids. New command user-auto-subid to auto-assign subid The code hard-codes counts to 65536, sets subgid equal to subuid, and does not allow removal of subids. There is also a hack that emulates a DNA plugin with step interval 65536 for testing. Work around problem with older SSSD clients that fail with unknown idrange type "ipa-local-subid", see: https://github.com/SSSD/sssd/issues/5571 Related: https://pagure.io/freeipa/issue/8361 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2021-03-19 05:48:38 -05:00
subordinate-ids.md
doc/designs: add External IdP support design documents External IdP objects represent OAuth 2.0 clients that can be used to perform OAuth 2.0 device authorization grant flow. Related: https://pagure.io/freeipa/issue/8805 Related: https://pagure.io/freeipa/issue/8804 Related: https://pagure.io/freeipa/issue/8803 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Sumit Bose <sbose@redhat.com>
2022-05-03 03:32:07 -05:00
external-idp/external-idp.md
external-idp/idp-api.md
doc/designs: add Random Serial Numbers v3 support Related: https://pagure.io/freeipa/issue/2016 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2022-05-27 15:53:56 -05:00
random-serial-numbers.md
Add PKINIT support to ipa-client-install The ``ipa-client-install`` command now supports PKINIT for client enrollment. Existing X.509 client certificates can be used to authenticate a host. Also restart KRB5 KDC during ``ipa-certupdate`` so KDC picks up new CA certificates for PKINIT. *Requirements* - The KDC must trust the CA chain of the client certificate. - The client must be able to verify the KDC's PKINIT cert. - The host entry must exist. This limitation may be removed in the future. - A certmap rule must match the host certificate and map it to a single host entry. *Example* ``` ipa-client-install \ --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \ --pkinit-anchor=/path/to/kdc-ca-bundle.pem ``` Fixes: https://pagure.io/freeipa/issue/9271 Fixes: https://pagure.io/freeipa/issue/9269 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2022-11-14 08:57:00 -06:00
client-install-pkinit.md
Reference in New Issue Copy Permalink