Merge branch 'upstream'

.wheelconstraints.in

@@ -10,6 +10,5 @@ ipaserver == @VERSION@
 ipatests == @VERSION@
 
 # keep pylint version in sync with current Fedora release
-# F36 has 2.12.2
-# https://pagure.io/freeipa/issue/8818 added pylint 2.8 support
-pylint ~= 2.12.2
+# F37 has 2.15.5
+pylint ~= 2.15.5

ACI.txt

@@ -153,6 +153,8 @@ aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Principals";allow (write) groupdn = "ldap:///cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Host Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "ipasshpubkey")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "description || ipaassignedidview || krbprincipalauthind || l || macaddress || nshardwareplatform || nshostlocation || nsosversion || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Modify Hosts";allow (write) groupdn = "ldap:///cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
@@ -161,7 +163,7 @@ aci: (targetattr = "cn || createtimestamp || entryusn || macaddress || modifytim
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "memberof")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Host Membership";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "cn || createtimestamp || description || enrolledby || entryusn || fqdn || ipaassignedidview || ipaclientversion || ipakrbauthzdata || ipasshpubkey || ipauniqueid || krbcanonicalname || krblastpwdchange || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || l || macaddress || managedby || memberprincipal || modifytimestamp || nshardwareplatform || nshostlocation || nsosversion || objectclass || serverhostname || usercertificate || userclass")(targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Read Hosts";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=computers,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipahost)")(version 3.0;acl "permission:System: Remove Hosts";allow (delete) groupdn = "ldap:///cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=hostgroups,cn=accounts,dc=ipa,dc=example
@@ -281,11 +283,15 @@ aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;read_keys
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "krbcanonicalname || krbprincipalname")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Principals";allow (write) groupdn = "ldap:///cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "memberprincipal || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation";allow (delete,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
+aci: (targetattr = "createtimestamp || entryusn || ipaallowedtoperform;write_delegation || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Manage Service Resource Delegation Permissions";allow (compare,read,search,write) groupdn = "ldap:///cn=System: Manage Service Resource Delegation Permissions,cn=permissions,cn=pbac,dc=ipa,dc=example";)
+dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "krbprincipalauthind || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Modify Services";allow (write) groupdn = "ldap:///cn=System: Modify Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetattr = "cn || createtimestamp || entryusn || gecos || gidnumber || homedirectory || ipantsecurityidentifier || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read POSIX details of SMB services";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
-aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
+aci: (targetattr = "createtimestamp || entryusn || ipakrbauthzdata || ipakrbprincipalalias || ipauniqueid || krbcanonicalname || krblastpwdchange || krbobjectreferences || krbpasswordexpiration || krbprincipalaliases || krbprincipalauthind || krbprincipalexpiration || krbprincipalname || managedby || memberof || memberprincipal || modifytimestamp || objectclass || usercertificate")(targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Read Services";allow (compare,read,search) userdn = "ldap:///all";)
 dn: cn=services,cn=accounts,dc=ipa,dc=example
 aci: (targetfilter = "(objectclass=ipaservice)")(version 3.0;acl "permission:System: Remove Services";allow (delete) groupdn = "ldap:///cn=System: Remove Services,cn=permissions,cn=pbac,dc=ipa,dc=example";)
 dn: cn=s4u2proxy,cn=etc,dc=ipa,dc=example

API.txt

@@ -2507,6 +2507,17 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: host_add_delegation/1
+args: 2,4,3
+arg: Str('fqdn', cli_name='hostname')
+arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('version?')
+output: Entry('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: PrimaryKey('value')
 command: host_add_managedby/1
 args: 1,5,3
 arg: Str('fqdn', cli_name='hostname')
@@ -2529,6 +2540,20 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: host_allow_add_delegation/1
+args: 1,8,3
+arg: Str('fqdn', cli_name='hostname')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Str('group*', alwaysask=True, cli_name='groups')
+option: Str('host*', alwaysask=True, cli_name='hosts')
+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('user*', alwaysask=True, cli_name='users')
+option: Str('version?')
+output: Output('completed', type=[<type 'int'>])
+output: Output('failed', type=[<type 'dict'>])
+output: Entry('result')
 command: host_allow_create_keytab/1
 args: 1,8,3
 arg: Str('fqdn', cli_name='hostname')
@@ -2573,6 +2598,20 @@ option: Str('version?')
 output: Output('result', type=[<type 'bool'>])
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: host_disallow_add_delegation/1
+args: 1,8,3
+arg: Str('fqdn', cli_name='hostname')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Str('group*', alwaysask=True, cli_name='groups')
+option: Str('host*', alwaysask=True, cli_name='hosts')
+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('user*', alwaysask=True, cli_name='users')
+option: Str('version?')
+output: Output('completed', type=[<type 'int'>])
+output: Output('failed', type=[<type 'dict'>])
+output: Entry('result')
 command: host_disallow_create_keytab/1
 args: 1,8,3
 arg: Str('fqdn', cli_name='hostname')
@@ -2685,6 +2724,17 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: host_remove_delegation/1
+args: 2,4,3
+arg: Str('fqdn', cli_name='hostname')
+arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('version?')
+output: Entry('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: PrimaryKey('value')
 command: host_remove_managedby/1
 args: 1,5,3
 arg: Str('fqdn', cli_name='hostname')
@@ -4705,6 +4755,17 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: service_add_delegation/1
+args: 2,4,3
+arg: Principal('krbcanonicalname', cli_name='canonical_principal')
+arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('version?')
+output: Entry('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: PrimaryKey('value')
 command: service_add_host/1
 args: 1,5,3
 arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4743,6 +4804,20 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: service_allow_add_delegation/1
+args: 1,8,3
+arg: Principal('krbcanonicalname', cli_name='canonical_principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Str('group*', alwaysask=True, cli_name='groups')
+option: Str('host*', alwaysask=True, cli_name='hosts')
+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('user*', alwaysask=True, cli_name='users')
+option: Str('version?')
+output: Output('completed', type=[<type 'int'>])
+output: Output('failed', type=[<type 'dict'>])
+output: Entry('result')
 command: service_allow_create_keytab/1
 args: 1,8,3
 arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4786,6 +4861,20 @@ option: Str('version?')
 output: Output('result', type=[<type 'bool'>])
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: service_disallow_add_delegation/1
+args: 1,8,3
+arg: Principal('krbcanonicalname', cli_name='canonical_principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Str('group*', alwaysask=True, cli_name='groups')
+option: Str('host*', alwaysask=True, cli_name='hosts')
+option: Str('hostgroup*', alwaysask=True, cli_name='hostgroups')
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('user*', alwaysask=True, cli_name='users')
+option: Str('version?')
+output: Output('completed', type=[<type 'int'>])
+output: Output('failed', type=[<type 'dict'>])
+output: Entry('result')
 command: service_disallow_create_keytab/1
 args: 1,8,3
 arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -4866,6 +4955,17 @@ option: Str('version?')
 output: Entry('result')
 output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
 output: PrimaryKey('value')
+command: service_remove_delegation/1
+args: 2,4,3
+arg: Principal('krbcanonicalname', cli_name='canonical_principal')
+arg: Str('memberprincipal+', alwaysask=True, cli_name='principal')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Flag('no_members', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Str('version?')
+output: Entry('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: PrimaryKey('value')
 command: service_remove_host/1
 args: 1,5,3
 arg: Principal('krbcanonicalname', cli_name='canonical_principal')
@@ -7092,17 +7192,21 @@ default: hbactest/1
 default: host/1
 default: host_add/1
 default: host_add_cert/1
+default: host_add_delegation/1
 default: host_add_managedby/1
 default: host_add_principal/1
+default: host_allow_add_delegation/1
 default: host_allow_create_keytab/1
 default: host_allow_retrieve_keytab/1
 default: host_del/1
 default: host_disable/1
+default: host_disallow_add_delegation/1
 default: host_disallow_create_keytab/1
 default: host_disallow_retrieve_keytab/1
 default: host_find/1
 default: host_mod/1
 default: host_remove_cert/1
+default: host_remove_delegation/1
 default: host_remove_managedby/1
 default: host_remove_principal/1
 default: host_show/1
@@ -7272,18 +7376,22 @@ default: server_state/1
 default: service/1
 default: service_add/1
 default: service_add_cert/1
+default: service_add_delegation/1
 default: service_add_host/1
 default: service_add_principal/1
 default: service_add_smb/1
+default: service_allow_add_delegation/1
 default: service_allow_create_keytab/1
 default: service_allow_retrieve_keytab/1
 default: service_del/1
 default: service_disable/1
+default: service_disallow_add_delegation/1
 default: service_disallow_create_keytab/1
 default: service_disallow_retrieve_keytab/1
 default: service_find/1
 default: service_mod/1
 default: service_remove_cert/1
+default: service_remove_delegation/1
 default: service_remove_host/1
 default: service_remove_principal/1
 default: service_show/1

Contributors.txt

@@ -18,6 +18,7 @@ Developers:
 	Alexander Scheel
 	Alexandre Mulatinho
 	Alexey Slaykovsky
+	Alexey Tikhonov
 	Amit Kumar
 	Ana Krivokapić
 	Andika Triwidada
@@ -33,6 +34,7 @@ Developers:
 	Brian J. Murrell
 	Brian Turek
 	Carl George
+	Carla Martinez
 	Cédric Jeanneret
 	Changmin Teng
 	Chris Kelley
@@ -42,6 +44,7 @@ Developers:
 	David Kreitschmann
 	David Kupka
 	David O'Brien
+	David Pascual
 	David Spångberg
 	Diane Trout
 	Dinesh Prasanth M K
@@ -51,8 +54,11 @@ Developers:
 	Drew Erny
 	Emilio Herrera
 	Endi Sukma Dewata
+	Erik
+	Erik Belko
 	Fabiano Fidêncio
 	Felipe Volpone
+	Filip Dvorak
 	Filip Skola
 	Florence Blanc-Renaud
 	Francesco Marella
@@ -77,12 +83,15 @@ Developers:
 	Jan Kuparinen
 	Jan Pazdziora
 	Jan Zelený
+	Jarl Gullberg
 	Jason Gerard DeRose
 	Jason Woods
 	Jayesh
 	Jayesh Garg
 	Jeremy Frasier
 	Jérôme Fenal
+	Jerry James
+	Jesse Sandberg
 	jh23453
 	Jim Meyering
 	Jochen Kellner
@@ -117,6 +126,7 @@ Developers:
 	Martin Nagy
 	Matt Rogers
 	Matthew Davis
+	mbhalodi
 	Michael Simacek
 	Michal Polovka
 	Michal Reznik
@@ -132,6 +142,7 @@ Developers:
 	ndehadra
 	Nick Hatch
 	Nikhil Dehadrai
+	Nikola Knazekova
 	Nikolai Kondrashov
 	Niranjan Mallapadi
 	Niranjan MR
@@ -159,13 +170,16 @@ Developers:
 	realsobek
 	René Genz
 	Rich Megginson
+	Ricky Tigg
 	Rishabh Dave
 	Rob Crittenden
 	Robbie Harwood
 	Robert Collins
 	Robert Kuska
+	s1341
 	Sam Bristow
 	Sam Morris
+	Scott Poore
 	Sergey Orlov
 	Sergio Oliveira Campos
 	Serhii Tsymbaliuk
@@ -184,17 +198,20 @@ Developers:
 	Sumit Bose
 	Sylvain Baubeau
 	Takeshi MIZUTA
+	Temuri Doghonadze
 	Theodor van Nahl
 	Thierry Bordaz
 	Thomas Woerner
 	Thorsten Scherf
 	Tibor Dudlák
 	Timo Aaltonen
+	Todd Zullinger
 	Tomáš Babej
 	Tomas Halman
 	Tomáš Křížek
 	Troy Dawson
 	Varun Mylaraiah
+	Viacheslav Sychov
 	Viktor Ashirov
 	Vit Mojzis
 	W. Michael Petullo
@@ -205,6 +222,7 @@ Developers:
 	Yuri Chornoivan
 	Zdenek Pytela
 	zdover
+	김인수
 
 Documentation:
 	Gabe Alford

Makefile.am

@@ -244,7 +244,7 @@ fastcodestyle: $(GENERATED_PYTHON_FILES) ipasetup.py
 	    | xargs -n1 file 2>/dev/null | grep Python \
 	    | cut -d':' -f1; ); \
 	if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
-	    FILES="$$( printf $${PYFILES}\\n$${INFILES} )" ; \
+	    FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
 	elif [ -n "$${PYFILES}" ]; then \
 	    FILES="$${PYFILES}" ; \
 	else \
@@ -274,7 +274,7 @@ endif
 	    | xargs -n1 file 2>/dev/null | grep Python \
 	    | cut -d':' -f1; ); \
 	if [ -n "$${PYFILES}" ] && [ -n "$${INFILES}" ]; then \
-	    FILES="$$( printf $${PYFILES}\\n$${INFILES} )" ; \
+	    FILES="$$( printf '%s\n' "$${PYFILES}" "$${INFILES}" )" ; \
 	elif [ -n "$${PYFILES}" ]; then \
 	    FILES="$${PYFILES}" ; \
 	else \

VERSION.m4

@@ -21,7 +21,7 @@
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
 define(IPA_VERSION_MINOR, 10)
-define(IPA_VERSION_RELEASE, 1)
+define(IPA_VERSION_RELEASE, 2)
 
 ########################################################
 # For 'pre' releases the version will be               #
@@ -86,8 +86,8 @@ define(IPA_DATA_VERSION, 20100614120000)
 #                                                      #
 ########################################################
 define(IPA_API_VERSION_MAJOR, 2)
-# Last change: fix vault interoperability issues.
-define(IPA_API_VERSION_MINOR, 251)
+# Last change: RBCD implementation
+define(IPA_API_VERSION_MINOR, 252)
 
 ########################################################
 # Following values are auto-generated from values above
@@ -137,6 +137,11 @@ ifelse(IPA_VERSION_IS_GIT_SNAPSHOT, yes,
 IPA_GIT_VERSION),
 NEWLINE)) dnl IPA_VERSION end
 
+########################################################
+# Version of MIT krb5 used to build IPA
+########################################################
+define(IPA_KRB5_BUILD_VERSION, translit(esyscmd(krb5-config --version | awk '{ print $NF }'), NEWLINE))
+
 dnl DEBUG: uncomment following lines and run command m4 VERSION.m4
 dnl `IPA_VERSION: ''IPA_VERSION'
 dnl `IPA_GIT_VERSION: ''IPA_GIT_VERSION'
@@ -144,3 +149,4 @@ dnl `IPA_GIT_BRANCH: ''IPA_GIT_BRANCH'
 dnl `IPA_API_VERSION: ''IPA_API_VERSION'
 dnl `IPA_DATA_VERSION: ''IPA_DATA_VERSION'
 dnl `IPA_NUM_VERSION: ''IPA_NUM_VERSION'
+dnl `IPA_KRB5_BUILD_VERSION: ''IPA_KRB5_BUILD_VERSION'

client/man/ipa-client-install.1

@@ -253,6 +253,12 @@ Remove the IPA client software and restore the configuration to the pre\-IPA sta
 \fB\-U\fR, \fB\-\-unattended\fR
 Unattended uninstallation. The user will not be prompted.
 
+.SH "DISABLED SERVICES"
+.TP
+ipa-client-install will automatically disable the Name Service Caching Daemon (nscd) when configuring the SSSD client. These are competing services and cannot co-exist.
+.TP
+If there are other similar services providing nss capabilities they will need to be manually disabled by the user. An example is unscd, a complete replacement for nscd.
+
 .SH "FILES"
 .TP
 Files that will be replaced if SSSD is configured (default):

configure.ac

@@ -460,6 +460,7 @@ AC_SUBST(VENDOR_SUFFIX)
 AC_SUBST([VERSION], [IPA_VERSION])
 AC_SUBST([GIT_VERSION], [IPA_GIT_VERSION])
 AC_SUBST([GIT_BRANCH], [IPA_GIT_BRANCH])
+AC_SUBST([KRB5_BUILD_VERSION], [IPA_KRB5_BUILD_VERSION])
 # used by Makefile.am for files depending on templates
 AC_SUBST([CONFIG_STATUS])
 

contrib/lite-server.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/python3
 #
 # Copyright (C) 2017 FreeIPA Contributors see COPYING for license
 #

contrib/lite-setup.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/python3
 #
 # Copyright (C) 2020 FreeIPA Contributors see COPYING for license
 #

daemons/dnssec/ipa-dnskeysyncd.in

@@ -57,7 +57,7 @@ KEYTAB_FB = paths.IPA_DNSKEYSYNCD_KEYTAB
 def commenceShutdown(signum, stack):
     # Declare the needed global variables
     global watcher_running
-    global ldap_connection  # pylint: disable=global-variable-not-assigned
+    global ldap_connection
 
     logger.info('Signal %s received: Shutting down!', signum)
 

daemons/ipa-kdb/ipa_kdb.c

@@ -49,6 +49,11 @@ static void ipadb_context_free(krb5_context kcontext,
     size_t c;
 
     if (*ctx != NULL) {
+        if ((*ctx)->magic != IPA_CONTEXT_MAGIC) {
+            krb5_klog_syslog(LOG_ERR, "IPA context is corrupted");
+            *ctx = NULL;
+            return;
+        }
         free((*ctx)->uri);
         free((*ctx)->base);
         free((*ctx)->realm_base);
@@ -615,6 +620,8 @@ static krb5_error_code ipadb_init_module(krb5_context kcontext,
         goto fail;
     }
 
+    ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_UNDEFINED;
+
     ret = ipadb_get_connection(ipactx);
     if (ret != 0) {
         /* Not a fatal failure, as the LDAP server may be temporarily down. */
@@ -628,6 +635,7 @@ static krb5_error_code ipadb_init_module(krb5_context kcontext,
         goto fail;
     }
 
+
     return 0;
 
 fail:
@@ -839,7 +847,7 @@ kdb_vftabl kdb_function_table = {
     .check_allowed_to_delegate = ipadb_check_allowed_to_delegate,
     .free_principal_e_data = ipadb_free_principal_e_data,
     .get_s4u_x509_principal = NULL,
-    .allowed_to_delegate_from = NULL,
+    .allowed_to_delegate_from = ipadb_allowed_to_delegate_from,
     .issue_pac = ipadb_v9_issue_pac,
 };
 #endif

daemons/ipa-kdb/ipa_kdb.h

@@ -126,6 +126,12 @@ struct ipadb_global_config {
     bool disable_preauth_for_spns;
 };
 
+enum ipadb_tristate_option {
+	IPADB_TRISTATE_FALSE = FALSE,
+	IPADB_TRISTATE_TRUE = TRUE,
+	IPADB_TRISTATE_UNDEFINED,
+};
+
 #define IPA_CONTEXT_MAGIC 0x0c027ea7
 struct ipadb_context {
     int magic;
@@ -143,6 +149,7 @@ struct ipadb_context {
     krb5_key_salt_tuple *def_encs;
     int n_def_encs;
     struct ipadb_mspac *mspac;
+    enum ipadb_tristate_option optional_pac_tkt_chksum;
 #ifdef HAVE_KRB5_CERTAUTH_PLUGIN
     krb5_certauth_moddata certauth_moddata;
 #endif
@@ -222,6 +229,16 @@ int ipadb_ldap_attr_has_value(LDAP *lcontext, LDAPMessage *le,
 int ipadb_ldap_deref_results(LDAP *lcontext, LDAPMessage *le,
                              LDAPDerefRes **results);
 
+krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry,
+                                  krb5_int16 type,
+                                  krb5_ui_2 length,
+                                  krb5_octet *data);
+
+krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry,
+                                  krb5_int16 type,
+                                  krb5_ui_2 length,
+                                  const krb5_octet *data);
+
 struct ipadb_multires;
 krb5_error_code ipadb_multires_init(LDAP *lcontext, struct ipadb_multires **r);
 void ipadb_multires_free(struct ipadb_multires *r);
@@ -374,6 +391,12 @@ krb5_error_code ipadb_check_allowed_to_delegate(krb5_context kcontext,
                                                 const krb5_db_entry *server,
                                                 krb5_const_principal proxy);
 
+krb5_error_code ipadb_allowed_to_delegate_from(krb5_context context,
+                                               krb5_const_principal client,
+                                               krb5_const_principal server,
+                                               krb5_pac server_pac,
+                                               const krb5_db_entry *proxy);
+
 /* AS AUDIT */
 
 void ipadb_audit_as_req(krb5_context kcontext,

daemons/ipa-kdb/ipa_kdb_common.c

@@ -158,12 +158,75 @@ static bool ipadb_need_retry(struct ipadb_context *ipactx, int error)
     return false;
 }
 
+static char *no_attrs[] = {
+    LDAP_NO_ATTRS,
+
+    NULL
+};
+
+static int
+should_support_pac_tkt_sign(struct ipadb_context *ipactx, bool *result)
+{
+    int ret;
+    LDAPMessage *res = NULL;
+    char *masters_dn = NULL;
+    int count;
+
+    char *kdc_filter = "(&(cn=KDC)(objectClass=ipaConfigObject)"
+                       "(!(ipaConfigString=pacTktSignSupported)))";
+
+    if (!ipactx) {
+        ret = KRB5_KDB_DBNOTINITED;
+        goto done;
+    }
+
+    count = asprintf(&masters_dn, "cn=masters,cn=ipa,cn=etc,%s", ipactx->base);
+    if (count < 0) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ret = ipadb_simple_search(ipactx, masters_dn, LDAP_SCOPE_SUBTREE,
+                               kdc_filter, no_attrs, &res);
+    if (ret)
+        goto done;
+
+    count = ldap_count_entries(ipactx->lcontext, res);
+
+    if (result)
+        *result = (count == 0);
+
+done:
+    free(masters_dn);
+    ldap_msgfree(res);
+    return ret;
+}
+
 static int ipadb_check_connection(struct ipadb_context *ipactx)
 {
+    int ret = 0;
+
     if (ipactx->lcontext == NULL) {
-        return ipadb_get_connection(ipactx);
+        ret = ipadb_get_connection(ipactx);
     }
-    return 0;
+    if ((ret == 0) && (ipactx->optional_pac_tkt_chksum == IPADB_TRISTATE_UNDEFINED)) {
+        bool pac_tkt_sign_supported;
+
+	/* Enforce PAC ticket signature verification if supported by all KDCs
+	 * To avoid loops as all search functions call into
+	 * ipadb_check_connection(), mark that the init is complete at this
+	 * point. Default to not issuing PAC to be safe.
+         */
+        ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_FALSE;
+	ret = should_support_pac_tkt_sign(ipactx,
+                                          &pac_tkt_sign_supported);
+        if (ret == 0) {
+            ipactx->optional_pac_tkt_chksum = !pac_tkt_sign_supported;
+        } else {
+            ipactx->optional_pac_tkt_chksum = IPADB_TRISTATE_UNDEFINED;
+	}
+    }
+    return ret;
 }
 
 krb5_error_code ipadb_simple_search(struct ipadb_context *ipactx,

daemons/ipa-kdb/ipa_kdb_delegation.c

@@ -42,7 +42,7 @@ static krb5_error_code ipadb_get_delegation_acl(krb5_context kcontext,
 {
     struct ipadb_context *ipactx;
     krb5_error_code kerr;
-    char *filter = NULL;
+    char *filter = NULL, *basedn = NULL;
     int ret;
 
     ipactx = ipadb_get_context(kcontext);
@@ -58,12 +58,20 @@ static krb5_error_code ipadb_get_delegation_acl(krb5_context kcontext,
         goto done;
     }
 
+    ret = asprintf(&basedn,
+                   "cn=s4u2proxy,cn=etc,%s", ipactx->base);
+    if (ret == -1) {
+        kerr = ENOMEM;
+        goto done;
+    }
+
     /* == Search ACL info == */
-    kerr = ipadb_deref_search(ipactx, ipactx->base,
+    kerr = ipadb_deref_search(ipactx, basedn,
                               LDAP_SCOPE_SUBTREE, filter, acl_attrs,
                               search_attrs, acl_attrs, results);
 
 done:
+    free(basedn);
     free(filter);
     return kerr;
 }
@@ -284,3 +292,44 @@ done:
     ldap_msgfree(res);
     return kerr;
 }
+
+
+krb5_error_code ipadb_allowed_to_delegate_from(krb5_context context,
+                                               krb5_const_principal client,
+                                               krb5_const_principal server,
+                                               krb5_pac server_pac,
+                                               const krb5_db_entry *proxy)
+{
+    char **acl_list = NULL;
+    krb5_error_code kerr;
+    size_t i;
+
+    kerr = ipadb_get_tl_data((krb5_db_entry *) proxy, KRB5_TL_CONSTRAINED_DELEGATION_ACL,
+                             sizeof(acl_list), (krb5_octet *)&acl_list);
+
+    if (kerr != 0 && kerr != ENOENT) {
+        return KRB5KDC_ERR_BADOPTION;
+    }
+
+    if (kerr == ENOENT) {
+        return KRB5_PLUGIN_OP_NOTSUPP;
+    }
+
+    kerr = KRB5KDC_ERR_BADOPTION;
+    if (acl_list != NULL) {
+        krb5_principal acl;
+        for (i = 0; acl_list[i] != NULL; i++) {
+            if (krb5_parse_name(context, acl_list[i], &acl) != 0)
+                continue;
+            if ((server == NULL) ||
+                (krb5_principal_compare(context, server, acl) == TRUE)) {
+                kerr = 0;
+                krb5_free_principal(context, acl);
+                break;
+            }
+            krb5_free_principal(context, acl);
+        }
+    }
+
+    return kerr;
+}

daemons/ipa-kdb/ipa_kdb_mspac.c

@@ -1086,7 +1086,7 @@ krb5_error_code ipadb_get_pac(krb5_context kcontext,
                 }
 
                 sentry = ldap_first_entry(ipactx->lcontext, sresults);
-                if (!lentry) {
+                if (!sentry) {
                     kerr = ENOENT;
                     goto done;
                 }
@@ -1827,11 +1827,43 @@ krb5_error_code filter_logon_info(krb5_context context,
     bool result;
     char *domstr = NULL;
 
+    ipactx = ipadb_get_context(context);
+    if (!ipactx || !ipactx->mspac) {
+        return KRB5_KDB_DBNOTINITED;
+    }
+
     domain = get_domain_from_realm_update(context, realm);
     if (!domain) {
         return EINVAL;
     }
 
+    /* check exact sid */
+    result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
+    if (!result) {
+        struct ipadb_mspac *mspac_ctx = ipactx->mspac;
+        result = FALSE;
+        /* Didn't match but perhaps the original PAC was issued by a child domain's DC? */
+        for (k = 0; k < mspac_ctx->num_trusts; k++) {
+            result = dom_sid_check(&mspac_ctx->trusts[k].domsid,
+                             info->info->info3.base.domain_sid, true);
+            if (result) {
+                domain = &mspac_ctx->trusts[k];
+                break;
+            }
+        }
+        if (!result) {
+            domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
+            krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
+                                      "expected domain SID = %s, "
+                                      "found domain SID = %s",
+                                      domain->domain_name, domain->domain_sid,
+                                      domstr ? domstr : "<failed to display>");
+            talloc_free(domstr);
+            return EINVAL;
+        }
+    }
+
+    /* At this point we may have changed the domain we look at, */
     /* check netbios/flat name */
     if (strcasecmp(info->info->info3.base.logon_domain.string,
                    domain->flat_name) != 0) {
@@ -1843,21 +1875,6 @@ krb5_error_code filter_logon_info(krb5_context context,
         return EINVAL;
     }
 
-    /* check exact sid */
-    result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
-    if (!result) {
-        domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
-        if (!domstr) {
-            return EINVAL;
-        }
-        krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
-                                  "expected domain SID = %s, "
-                                  "found domain SID = %s",
-                                  domain->domain_name, domain->domain_sid, domstr);
-        talloc_free(domstr);
-        return EINVAL;
-    }
-
     /* Check if this domain has been filtered out by the trust itself*/
     if (domain->parent != NULL) {
         for(k = 0; k < domain->parent->len_sid_blocklist_incoming; k++) {
@@ -1944,10 +1961,6 @@ krb5_error_code filter_logon_info(krb5_context context,
      * should include different possibilities into account
      * */
     if (info->info->info3.sidcount != 0) {
-        ipactx = ipadb_get_context(context);
-        if (!ipactx || !ipactx->mspac) {
-            return KRB5_KDB_DBNOTINITED;
-        }
         count = info->info->info3.sidcount;
         i = 0;
         j = 0;
@@ -2354,7 +2367,10 @@ krb5_error_code ipadb_common_verify_pac(krb5_context context,
     for (i = 0; i < num_buffers; i++) {
         if (types[i] == KRB5_PAC_SERVER_CHECKSUM ||
             types[i] == KRB5_PAC_PRIVSVR_CHECKSUM ||
-            types[i] == KRB5_PAC_CLIENT_INFO) {
+#ifdef KRB5_PAC_FULL_CHECKSUM
+            types[i] == KRB5_PAC_FULL_CHECKSUM ||
+#endif
+	    types[i] == KRB5_PAC_CLIENT_INFO) {
             continue;
         }
 

daemons/ipa-kdb/ipa_kdb_mspac_v6.c

@@ -176,11 +176,21 @@ static krb5_error_code ipadb_sign_pac(krb5_context context,
 
     /* only pass with_realm TRUE when it is cross-realm ticket and S4U2Self
      * was requested */
+#ifdef HAVE_KRB5_PAC_FULL_SIGN_COMPAT
+    kerr = krb5_pac_full_sign_compat(
+        context, pac, authtime, client_princ, server->princ, server_key,
+        right_krbtgt_signing_key,
+        (is_issuing_referral && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
+        pac_data
+    );
+#else
+    /* Use standard function, PAC extended KDC signature not supported */
     kerr = krb5_pac_sign_ext(context, pac, authtime, client_princ, server_key,
                              right_krbtgt_signing_key,
                              (is_issuing_referral &&
                               (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION)),
                              pac_data);
+#endif
 
 done:
     free(princ);

daemons/ipa-kdb/ipa_kdb_principals.c

@@ -82,6 +82,7 @@ static char *std_principal_attrs[] = {
     "krbAuthIndMaxRenewableAge",
     "ipaNTSecurityIdentifier",
     "ipaUniqueID",
+    "memberPrincipal",
 
     "objectClass",
     NULL
@@ -113,6 +114,14 @@ static char *std_principal_obj_classes[] = {
 
 #define DEFAULT_TL_DATA_CONTENT "\x00\x00\x00\x00principal@UNINITIALIZED"
 
+#ifndef KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM
+#define KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM "optional_pac_tkt_chksum"
+#endif
+
+#ifndef KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE
+#define KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE "pac_privsvr_enctype"
+#endif
+
 static int ipadb_ldap_attr_to_tl_data(LDAP *lcontext, LDAPMessage *le,
                                       char *attrname,
                                       krb5_tl_data **result, int *num)
@@ -178,10 +187,56 @@ done:
     return ret;
 }
 
-static krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry,
-                                         krb5_int16 type,
-                                         krb5_ui_2 length,
-                                         const krb5_octet *data)
+static bool
+is_tgs_princ(krb5_context kcontext, krb5_const_principal princ)
+{
+    krb5_data *primary;
+    size_t l_tgs_name;
+
+    if (2 != krb5_princ_size(kcontext, princ))
+        return false;
+
+    primary = krb5_princ_component(kcontext, princ, 0);
+
+    l_tgs_name = strlen(KRB5_TGS_NAME);
+
+    if (l_tgs_name != primary->length)
+        return false;
+
+    return 0 == memcmp(primary->data, KRB5_TGS_NAME, l_tgs_name);
+}
+
+static krb5_error_code
+cmp_local_tgs_princ(krb5_context kcontext, const char *local_realm,
+                   krb5_const_principal princ, bool *result)
+{
+    krb5_principal local_tgs_princ;
+    size_t l_local_realm;
+    krb5_error_code kerr;
+    bool res;
+
+    l_local_realm = strlen(local_realm);
+
+    kerr = krb5_build_principal(kcontext, &local_tgs_princ,
+                                l_local_realm, local_realm,
+                                KRB5_TGS_NAME, local_realm, NULL);
+    if (kerr)
+        goto end;
+
+    res = (bool) krb5_principal_compare(kcontext, local_tgs_princ, princ);
+
+    if (result)
+        *result = res;
+
+end:
+    krb5_free_principal(kcontext, local_tgs_princ);
+    return kerr;
+}
+
+krb5_error_code ipadb_set_tl_data(krb5_db_entry *entry,
+                                  krb5_int16 type,
+                                  krb5_ui_2 length,
+                                  const krb5_octet *data)
 {
     krb5_error_code kerr;
     krb5_tl_data *new_td = NULL;
@@ -633,6 +688,7 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
     char *uidstring;
     char **authz_data_list;
     char *princ_sid;
+    char **acl_list;
     krb5_timestamp restime;
     bool resbool;
     int result;
@@ -1029,6 +1085,30 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext,
         ied->has_sid = true;
     }
 
+    /* check if it has the serviceDelegation objectclass */
+    ret = ipadb_ldap_attr_has_value(lcontext, lentry,
+                                    "objectClass", "resourceDelegation");
+    if (ret != 0 && ret != ENOENT) {
+        kerr = ret;
+        goto done;
+    }
+    if (ret == 0) {
+        ret = ipadb_ldap_attr_to_strlist(lcontext, lentry,
+                                        "memberPrincipal", &acl_list);
+        if (ret != 0 && ret != ENOENT) {
+            kerr = KRB5_KDB_INTERNAL_ERROR;
+            goto done;
+        }
+        if (ret == 0) {
+            kerr = ipadb_set_tl_data(entry, KRB5_TL_CONSTRAINED_DELEGATION_ACL,
+                                     sizeof(acl_list),
+                                     (const krb5_octet *) &acl_list);
+            if (kerr) {
+                goto done;
+            }
+        }
+    }
+
     kerr = 0;
 
 done:
@@ -1459,6 +1539,14 @@ done:
     return kerr;
 }
 
+/* For krb5 1.19, there is no KRB5_KDB_FLAG_REFERRAL_OK, emulate it
+ * See krb5 commit a441fbe329ebbd7775eb5d4ccc4a05eef370f08b */
+#ifndef KRB5_KDB_FLAG_REFERRAL_OK
+#ifdef KRB5_KDB_FLAG_CANONICALIZE
+#define KRB5_KDB_FLAG_REFERRAL_OK KRB5_KDB_FLAG_CANONICALIZE
+#endif
+#endif
+
 static krb5_error_code dbget_alias(krb5_context kcontext,
                                    struct ipadb_context *ipactx,
                                    krb5_const_principal search_for,
@@ -1472,18 +1560,39 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
     krb5_db_entry *kentry = NULL;
     krb5_data *realm;
     krb5_boolean check = FALSE;
+    /* KRB5_NT_PRINCIPAL must be the last element */
+    krb5_int32 supported_types[] = {
+        [0] = KRB5_NT_ENTERPRISE_PRINCIPAL,
+        [1] = KRB5_NT_PRINCIPAL,
+        -1,
+    };
+    size_t i = 0;
 
-    /* TODO: also support hostbased aliases */
+    /* For TGS-REQ server principal lookup, KDC asks with KRB5_KDB_FLAG_REFERRAL_OK
+     * and client usually asks for an KRB5_NT_PRINCIPAL type principal. */
+    if ((flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0) {
+       /* this is *not* TGS-REQ server principal search, remove
+	* KRB5_NT_PRINCIPAL from the supported principal types for this lookup */
+       supported_types[(sizeof(supported_types) / sizeof(supported_types[0])) - 2] = -1;
+    }
 
     /* Enterprise principal name type is for potential aliases or principals
-     * from trusted realms. The logic below only applies to this type */
-    if (krb5_princ_type(kcontext, search_for) != KRB5_NT_ENTERPRISE_PRINCIPAL) {
+     * from trusted realms. Except for the TGS-REQ server lookup, we only
+     * expect enterprise principals here */
+    for (i = 0; supported_types[i] != -1; i++) {
+        if (krb5_princ_type(kcontext, search_for) == supported_types[i]) {
+            break;
+        }
+    }
+
+    if (supported_types[i] == -1) {
         return KRB5_KDB_NOENTRY;
     }
 
     /* enterprise principal can only have single component in the name
      * according to RFC6806 section 5. */
-    if (krb5_princ_size(kcontext, search_for) != 1) {
+    if ((krb5_princ_type(kcontext, search_for) == KRB5_NT_ENTERPRISE_PRINCIPAL) &&
+        (krb5_princ_size(kcontext, search_for) != 1)) {
         return KRB5_KDB_NOENTRY;
     }
 
@@ -1507,6 +1616,12 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
     if (krb5_realm_compare(kcontext, ipactx->local_tgs, norm_princ)) {
         /* In realm alias, try to retrieve it and let the caller handle it. */
         kerr = dbget_princ(kcontext, ipactx, norm_princ, flags, entry);
+    }
+
+    /* if we haven't found the principal in our realm, it might still
+     * be a referral to a known realm. Otherwise, bail out with the result */
+    if ((kerr != KRB5_KDB_NOENTRY) &&
+        (flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0) {
         goto done;
     }
 
@@ -1550,7 +1665,30 @@ static krb5_error_code dbget_alias(krb5_context kcontext,
                                                  &trusted_realm);
     }
 
+    if (kerr == KRB5_KDB_NOENTRY) {
+        krb5_data *hstname = NULL;
+        int ncomponents = krb5_princ_size(kcontext, norm_princ);
+
+        /* We did not find any alias so far for non-server principal lookups */
+        if ((ncomponents < 2) && ((flags & KRB5_KDB_FLAG_REFERRAL_OK) == 0)) {
+            goto done;
+        }
+
+	/* At this point it is a server principal lookup that might be
+         * referencing a host name in a trusted domain. It might also
+         * have multiple service components so take the last one for the
+         * hostname or the domain name. See MS-ADTS 2.2.21 and MS-DRSR 2.2.4.2.
+         */
+        hstname = krb5_princ_component(kcontext, norm_princ, ncomponents - 1);
+
+        kerr = ipadb_is_princ_from_trusted_realm(kcontext,
+                                                 hstname->data,
+                                                 hstname->length,
+                                                 &trusted_realm);
+    }
+
     if (kerr != 0) {
+        kerr = KRB5_KDB_NOENTRY;
         goto done;
     }
 
@@ -1632,6 +1770,8 @@ krb5_error_code ipadb_get_principal(krb5_context kcontext,
                                     krb5_db_entry **entry)
 {
     struct ipadb_context *ipactx;
+    bool is_local_tgs_princ;
+    const char *opt_pac_tkt_chksum_val;
     krb5_error_code kerr;
 
     *entry = NULL;
@@ -1647,11 +1787,47 @@ krb5_error_code ipadb_get_principal(krb5_context kcontext,
 
     /* Lookup local names and aliases first. */
     kerr = dbget_princ(kcontext, ipactx, search_for, flags, entry);
-    if (kerr != KRB5_KDB_NOENTRY) {
+    if (kerr == KRB5_KDB_NOENTRY) {
+        kerr = dbget_alias(kcontext, ipactx, search_for, flags, entry);
+    }
+    if (kerr)
         return kerr;
+
+    /* If TGS principal, some virtual attributes may be added */
+    if (is_tgs_princ(kcontext, (*entry)->princ)) {
+        kerr = cmp_local_tgs_princ(kcontext, ipactx->realm, (*entry)->princ,
+                                   &is_local_tgs_princ);
+        if (kerr)
+            return kerr;
+
+        /* for trusted AD forests we currently must use SHA-1-based
+         * encryption types. For details, see
+         * https://github.com/krb5/krb5/commit/5af907156f8f502bbe268f0c62274f88a61261e4
+         */
+        if (!is_local_tgs_princ) {
+            kerr = krb5_dbe_set_string(kcontext, *entry,
+                                       KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE,
+                                       "aes256-sha1");
+        }
+
+        /* We should have been initialized at this point already */
+        if (ipactx->optional_pac_tkt_chksum == IPADB_TRISTATE_UNDEFINED) {
+                return KRB5_KDB_SERVER_INTERNAL_ERR;
+        }
+        /* PAC ticket signature should be optional for foreign realms, and local
+         * realm if not supported by all servers
+         */
+        if (!is_local_tgs_princ || ipactx->optional_pac_tkt_chksum)
+            opt_pac_tkt_chksum_val = "true";
+        else
+            opt_pac_tkt_chksum_val = "false";
+
+        kerr = krb5_dbe_set_string(kcontext, *entry,
+                                   KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM,
+                                   opt_pac_tkt_chksum_val);
     }
 
-    return dbget_alias(kcontext, ipactx, search_for, flags, entry);
+    return kerr;
 }
 
 void ipadb_free_principal_e_data(krb5_context kcontext, krb5_octet *e_data)
@@ -1682,12 +1858,20 @@ void ipadb_free_principal_e_data(krb5_context kcontext, krb5_octet *e_data)
 void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
 {
     krb5_tl_data *prev, *next;
+    size_t i;
 
     if (entry) {
         krb5_free_principal(kcontext, entry->princ);
         prev = entry->tl_data;
         while(prev) {
             next = prev->tl_data_next;
+            /* Handle RBCD ACL type */
+            if (prev->tl_data_type == KRB5_TL_CONSTRAINED_DELEGATION_ACL) {
+                char **acl_list = (char **) prev->tl_data_contents;
+                for (i = 0; (acl_list != NULL) && (acl_list[i] != NULL); i++) {
+                    free(acl_list[i]);
+                }
+            }
             free(prev->tl_data_contents);
             free(prev);
             prev = next;
@@ -1702,10 +1886,10 @@ void ipadb_free_principal(krb5_context kcontext, krb5_db_entry *entry)
     }
 }
 
-static krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry,
-                                         krb5_int16 type,
-                                         krb5_ui_2 length,
-                                         krb5_octet *data)
+krb5_error_code ipadb_get_tl_data(krb5_db_entry *entry,
+                                  krb5_int16 type,
+                                  krb5_ui_2 length,
+                                  krb5_octet *data)
 {
     krb5_tl_data *td;
 
@@ -1954,6 +2138,21 @@ done:
     return kerr;
 }
 
+static bool should_filter_out_attr(krb5_tl_data *data)
+{
+    switch (data->tl_data_type) {
+        case KRB5_TL_CONSTRAINED_DELEGATION_ACL:
+        case KRB5_TL_DB_ARGS:
+        case KRB5_TL_KADM_DATA:
+        case KRB5_TL_LAST_ADMIN_UNLOCK:
+        case KRB5_TL_LAST_PWD_CHANGE:
+        case KRB5_TL_MKVNO:
+            return true;
+        default:
+            return false;
+    }
+}
+
 static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
                                                      krb5_tl_data *tl_data,
                                                      int mod_op)
@@ -1965,13 +2164,8 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
     int n, i;
 
     for (n = 0, data = tl_data; data; data = data->tl_data_next) {
-        if (data->tl_data_type == KRB5_TL_LAST_PWD_CHANGE ||
-            data->tl_data_type == KRB5_TL_KADM_DATA ||
-            data->tl_data_type == KRB5_TL_DB_ARGS ||
-            data->tl_data_type == KRB5_TL_MKVNO ||
-            data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
+        if (should_filter_out_attr(data))
             continue;
-        }
         n++;
     }
 
@@ -1987,13 +2181,8 @@ static krb5_error_code ipadb_get_ldap_mod_extra_data(struct ipadb_mods *imods,
 
     for (i = 0, data = tl_data; data; data = data->tl_data_next) {
 
-        if (data->tl_data_type == KRB5_TL_LAST_PWD_CHANGE ||
-            data->tl_data_type == KRB5_TL_KADM_DATA ||
-            data->tl_data_type == KRB5_TL_DB_ARGS ||
-            data->tl_data_type == KRB5_TL_MKVNO ||
-            data->tl_data_type == KRB5_TL_LAST_ADMIN_UNLOCK) {
+        if (should_filter_out_attr(data))
             continue;
-        }
 
         be_type = htons(data->tl_data_type);
 
@@ -2745,10 +2934,43 @@ done:
     return kerr;
 }
 
+static krb5_error_code
+remove_virtual_str_attrs(krb5_context kcontext, krb5_db_entry *entry)
+{
+    char *str_attr_val;
+    krb5_error_code kerr;
+    const char *str_attrs[] = {
+        KRB5_KDB_SK_OPTIONAL_PAC_TKT_CHKSUM,
+        KRB5_KDB_SK_PAC_PRIVSVR_ENCTYPE,
+        NULL};
+
+    for(int i = 0; str_attrs[i] != NULL; i++) {
+        kerr = krb5_dbe_get_string(kcontext, entry,
+                                   str_attrs[i],
+                                   &str_attr_val);
+        if (kerr)
+            return kerr;
+
+        if (str_attr_val)
+            kerr = krb5_dbe_set_string(kcontext, entry,
+                                       str_attrs[i],
+                                       NULL);
+
+        krb5_dbe_free_string(kcontext, str_attr_val);
+    }
+    return kerr;
+}
+
 krb5_error_code ipadb_put_principal(krb5_context kcontext,
                                     krb5_db_entry *entry,
                                     char **db_args)
 {
+    krb5_error_code kerr;
+
+    kerr = remove_virtual_str_attrs(kcontext, entry);
+    if (kerr)
+        return kerr;
+
     if (entry->mask & KMASK_PRINCIPAL) {
         return ipadb_add_principal(kcontext, entry);
     } else {

daemons/ipa-otpd/ipa-otpd@.service.in

@@ -7,4 +7,4 @@ EnvironmentFile=@sysconfdir@/ipa/default.conf
 ExecStart=@libexecdir@/ipa/ipa-otpd $ldap_uri
 StandardInput=socket
 StandardOutput=socket
-StandardError=syslog
+StandardError=journal

doc/api/A6Record.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _A6Record:
 
-# A6Record
+# A6Record
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A6 DNS record.

doc/api/AAAARecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _AAAARecord:
 
-# AAAARecord
+# AAAARecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+AAAA DNS record.

doc/api/AFSDBRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _AFSDBRecord:
 
-# AFSDBRecord
+# AFSDBRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+AFSDB DNS record.

doc/api/APLRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _APLRecord:
 
-# APLRecord
+# APLRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+APL DNS record.

doc/api/ARecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _ARecord:
 
-# ARecord
+# ARecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A DNS record.

doc/api/AccessTime.md

@@ -1,3 +1,9 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _AccessTime:
 
-# AccessTime
+# AccessTime
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Access time parameter type.
+
+Accepts values conforming to generalizedTime as defined in RFC 4517 section 3.3.13 without time zone information.

doc/api/Any.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Any:
 
-# Any
+# Any
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter capable of holding values of any type. For internal use only.

doc/api/BinaryFile.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _BinaryFile:
 
-# BinaryFile
+# BinaryFile
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Binary file parameter type.

doc/api/Bool.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Bool:
 
-# Bool
+# Bool
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for boolean values (stored in the ``bool`` type).

doc/api/Bytes.md

@@ -1,3 +1,11 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Bytes:
 
-# Bytes
+# Bytes
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for binary data (stored in the ``str`` type).
+This class is named *Bytes* instead of *Str* so it's aligned with the
+Python v3 ``(str, unicode) => (bytes, str)`` clean-up.
+See: http://docs.python.org/3.0/whatsnew/3.0.html
+Also see the `Str` parameter.

doc/api/BytesEnum.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _BytesEnum:
 
-# BytesEnum
+# BytesEnum
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Enumerable for binary data (stored in the ``str`` type).

doc/api/CERTRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _CERTRecord:
 
-# CERTRecord
+# CERTRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+CERT DNS record.

doc/api/CNAMERecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _CNAMERecord:
 
-# CNAMERecord
+# CNAMERecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+CNAME DNS record.

doc/api/Certificate.md

@@ -1,3 +1,5 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Certificate:
 
-# Certificate
+# Certificate
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)

doc/api/CertificateSigningRequest.md

@@ -1,3 +1,5 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _CertificateSigningRequest:
 
-# CertificateSigningRequest
+# CertificateSigningRequest
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)

doc/api/DHCIDRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DHCIDRecord:
 
-# DHCIDRecord
+# DHCIDRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DHCID DNS record.

doc/api/DLVRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DLVRecord:
 
-# DLVRecord
+# DLVRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DLV DNS record.

doc/api/DNAMERecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DNAMERecord:
 
-# DNAMERecord
+# DNAMERecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DNAME DNS record.

doc/api/DNOrURL.md

@@ -1,3 +1,9 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DNOrURL:
 
-# DNOrURL
+# DNOrURL
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DN parameter that allows, and strips, a "ldap:///" prefix on input.
+
+Used for ``subtree`` to maintain backward compatibility.

doc/api/DNParam.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DNParam:
 
-# DNParam
+# DNParam
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+LDAP DN.

doc/api/DNSNameParam.md

@@ -1,3 +1,10 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DNSNameParam:
 
-# DNSNameParam
+# DNSNameParam
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Domain name parameter type.
+
+* `only_absolute`: a domain name has to be absolute (makes it absolute from unicode input)
+* `only_relative`: a domain name has to be relative

doc/api/DNSRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DNSRecord:
 
-# DNSRecord
+# DNSRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Base class for DNS records, subclass of `Str`.

doc/api/DSRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DSRecord:
 
-# DSRecord
+# DSRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DS DNS record.

doc/api/Data.md

@@ -1,3 +1,11 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Data:
 
-# Data
+# Data
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Base class for the `Bytes` and `Str` parameters.
+
+Previously `Str` was as subclass of `Bytes`.  Now the common functionality
+has been split into this base class so that ``isinstance(foo, Bytes)`` wont
+be ``True`` when ``foo`` is actually an `Str` instance (which is confusing).

doc/api/DateTime.md

@@ -1,3 +1,19 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _DateTime:
 
-# DateTime
+# DateTime
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+DateTime parameter type.
+
+Accepts LDAP Generalized time without in the following format:
+   '%Y%m%d%H%M%SZ'
+
+Accepts subset of values defined by ISO 8601:
+    '%Y-%m-%dT%H:%M:%SZ'
+    '%Y-%m-%dT%H:%MZ'
+    '%Y-%m-%dZ'
+
+Also accepts above formats using ' ' (space) as a separator instead of 'T'.
+
+Refer to the `man strftime` for the explanations for the %Y,%m,%d,%H.%M,%S.

doc/api/Decimal.md

@@ -1,3 +1,12 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Decimal:
 
-# Decimal
+# Decimal
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for floating-point values (stored in the ``Decimal`` type).
+
+Python Decimal type helps overcome problems tied to plain "float" type,
+e.g. problem with representation or value comparison. In order to safely
+transfer the value over RPC libraries, it is being converted to string
+which is then converted back to Decimal number.

doc/api/Dict.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Dict:
 
-# Dict
+# Dict
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for dictionary.

doc/api/Enum.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Enum:
 
-# Enum
+# Enum
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Base class for parameters with enumerable values.

doc/api/File.md

@@ -1,3 +1,9 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _File:
 
-# File
+# File
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Text file parameter type.
+
+Accepts file names and loads their content into the parameter value.

doc/api/Flag.md

@@ -1,3 +1,37 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Flag:
 
-# Flag
+# Flag
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A boolean parameter that always gets filled in with a default value.
+
+This `Bool` subclass forces ``autofill=True`` in `Flag.__init__()`.  If no
+default is provided, it also fills in a default value of ``False``.
+Lastly, unlike the `Bool` class, the default must be either ``True`` or
+``False`` and cannot be ``None``.
+
+For example:
+```
+>>> flag = Flag('my_flag')
+>>> (flag.autofill, flag.default)
+(True, False)
+```
+
+To have a default value of ``True``, create your `Flag` intance with
+``default=True``.  For example:
+
+```
+>>> flag = Flag('my_flag', default=True)
+>>> (flag.autofill, flag.default)
+(True, True)
+```
+
+Also note that creating a `Flag` instance with ``autofill=False`` will have
+no effect.  For example:
+
+```
+>>> flag = Flag('my_flag', autofill=False)
+>>> flag.autofill
+True
+```

doc/api/ForwardRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _ForwardRecord:
 
-# ForwardRecord
+# ForwardRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Forward DNS record.

doc/api/HINFORecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _HINFORecord:
 
-# HINFORecord
+# HINFORecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+HINFO DNS record.

doc/api/HIPRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _HIPRecord:
 
-# HIPRecord
+# HIPRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+HIP DNS record.

doc/api/HostPassword.md

@@ -1,3 +1,11 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _HostPassword:
 
-# HostPassword
+# HostPassword
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A data type for host passwords to not log password values.
+
+The `Password` type cannot be used because it disallows
+setting a password on the command-line which would break
+backwards compatibility.

doc/api/IA5Str.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _IA5Str:
 
-# IA5Str
+# IA5Str
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+An IA5String per RFC 4517.

doc/api/IPSECKEYRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _IPSECKEYRecord:
 
-# IPSECKEYRecord
+# IPSECKEYRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+IPSECKEY DNS record.

doc/api/Int.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Int:
 
-# Int
+# Int
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for integer values (stored in the ``int`` type).

doc/api/IntEnum.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _IntEnum:
 
-# IntEnum
+# IntEnum
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Enumerable for integer data (stored in the ``int`` type).

doc/api/KEYRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _KEYRecord:
 
-# KEYRecord
+# KEYRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+KEY DNS record.

doc/api/KXRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _KXRecord:
 
-# KXRecord
+# KXRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+KX DNS record.

doc/api/LOCRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _LOCRecord:
 
-# LOCRecord
+# LOCRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+LOC DNS record.

doc/api/MDRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _MDRecord:
 
-# MDRecord
+# MDRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+MD DNS record.

doc/api/MINFORecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _MINFORecord:
 
-# MINFORecord
+# MINFORecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+MINFO DNS record.

doc/api/MXRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _MXRecord:
 
-# MXRecord
+# MXRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+MX DNS record.

doc/api/NAPTRRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _NAPTRRecord:
 
-# NAPTRRecord
+# NAPTRRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+NAPTR DNS record.

doc/api/NSECRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _NSECRecord:
 
-# NSECRecord
+# NSECRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+NSEC DNS record.

doc/api/NSRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _NSRecord:
 
-# NSRecord
+# NSRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+NS DNS record.

doc/api/NXTRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _NXTRecord:
 
-# NXTRecord
+# NXTRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+NXT DNS record.

doc/api/Number.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Number:
 
-# Number
+# Number
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Base class for the `Int` and `Decimal` parameters.

doc/api/OTPTokenKey.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _OTPTokenKey:
 
-# OTPTokenKey
+# OTPTokenKey
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A binary password type specified in base32.

doc/api/PTRRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _PTRRecord:
 
-# PTRRecord
+# PTRRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+PTR DNS record.

doc/api/Password.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Password:
 
-# Password
+# Password
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for passwords (stored in the ``unicode`` type).

doc/api/Principal.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Principal:
 
-# Principal
+# Principal
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Kerberos principal name.

doc/api/RPRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _RPRecord:
 
-# RPRecord
+# RPRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+RP DNS record.

doc/api/RRSIGRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _RRSIGRecord:
 
-# RRSIGRecord
+# RRSIGRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+RRSIG DNS record.

doc/api/SIGRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _SIGRecord:
 
-# SIGRecord
+# SIGRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+SIG DNS record.

doc/api/SPFRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _SPFRecord:
 
-# SPFRecord
+# SPFRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+SPF DNS record.

doc/api/SRVRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _SRVRecord:
 
-# SRVRecord
+# SRVRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+SRV DNS record.

doc/api/SSHFPRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _SSHFPRecord:
 
-# SSHFPRecord
+# SSHFPRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+SSHFP DNS record.

doc/api/SerialNumber.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _SerialNumber:
 
-# SerialNumber
+# SerialNumber
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Certificate serial number parameter type.

doc/api/Str.md

@@ -1,3 +1,14 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _Str:
 
-# Str
+# Str
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+A parameter for Unicode text (stored in the ``unicode`` type).
+
+This class is named `Str` instead of `Unicode` so it's aligned with the
+Python v3 ``(str, unicode) => (bytes, str)`` clean-up.  
+
+See: http://docs.python.org/3.0/whatsnew/3.0.html
+
+Also see the `Bytes` parameter.

doc/api/StrEnum.md

@@ -1,3 +1,19 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _StrEnum:
 
-# StrEnum
+# StrEnum
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Enumerable for Unicode text (stored in the ``unicode`` type).
+
+For example:
+
+```
+>>> enum = StrEnum('my_enum', values=(u'One', u'Two', u'Three'))
+>>> enum.validate(u'Two', 'cli') is None
+True
+>>> enum.validate(u'Four', 'cli')
+Traceback (most recent call last):
+  ...
+ValidationError: invalid 'my_enum': must be one of 'One', 'Two', 'Three'
+```

doc/api/TLSARecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _TLSARecord:
 
-# TLSARecord
+# TLSARecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+TLSA DNS record.

doc/api/TXTRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _TXTRecord:
 
-# TXTRecord
+# TXTRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+TXT DNS record.

doc/api/URIRecord.md

@@ -1,3 +1,7 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _URIRecord:
 
-# URIRecord
+# URIRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+URI DNS record.

doc/api/UnsupportedDNSRecord.md

@@ -1,3 +1,8 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 .. _UnsupportedDNSRecord:
 
-# UnsupportedDNSRecord
+# UnsupportedDNSRecord
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+
+Records which are not supported by IPA, but we allow to show them if LDAP
+contains these records.

doc/api/access_control_guide.md

@@ -0,0 +1,66 @@
+# Access control examples
+
+IPA provides a way to manage delegation of rights. Permissions allows to define
+certain management actions, which can then be grouped in privileges. These
+privileges can then be added to roles, which can be assigned to users and
+groups.
+
+- [Access control examples](#access-control-examples)
+  - [Managing permissions](#managing-permissions)
+  - [Managing privileges](#managing-privileges)
+  - [Managing roles](#managing-roles)
+  - [Assigning roles to users and groups](#assigning-roles-to-users-and-groups)
+
+## Managing permissions
+
+Add a permission for creating users.
+
+```python
+api.Command.permission_add("Create users", ipapermright='add', type='user')
+```
+
+Add a permission for managing group membership.
+
+```python
+api.Command.permission_add("Manage group membership", ipapermright='write', type='group', attrs="member")
+```
+
+## Managing privileges
+
+Add a privilege for user creation process (creating user, adding it to groups,
+manage user certificates).
+
+```python
+api.Command.permission_add("Create users", ipapermright='add', type='user')
+api.Command.permission_add("Manage group membership", ipapermright='write', type='group', attrs="member")
+api.Command.permission_add("Manage User certificates", ipapermright='write', type='user', attrs='usercertificate')
+
+api.Command.privilege_add("User creation")
+api.Command.privilege_add_permission("User creation", permission="Create users")
+api.Command.privilege_add_permission("User creation", permission="Manage group membership")
+api.Command.privilege_add_permission("User creation", permission="Manage User certificates")
+```
+
+## Managing roles
+
+Add a role with the privilege created earlier.
+
+```python
+api.Command.role_add("usermanager", description="Users manager")
+api.Command.role_add_privilege("usermanager", privilege="User creation")
+```
+
+## Assigning roles to users and groups
+
+Assign the role `usermanager` to user `bob`.
+
+```python
+api.Command.role_add_member("usermanager", user="bob")
+```
+
+Users, groups, hosts and hostgroups may be members of a role. Assign the
+`usermanager` role to `managers` group.
+
+```python
+api.Command.role_add_member("usermanager", group="managers")
+```

doc/api/api_cli_differences.md

@@ -0,0 +1,47 @@
+# Differences between API and CLI usage
+
+While the functionality between API and CLI is mostly the same, there are some
+difference in their usage that should be taken into account.
+
+- [Differences between API and CLI usage](#differences-between-api-and-cli-usage)
+  - [Command naming](#command-naming)
+  - [Parameter naming](#parameter-naming)
+  - [Date format](#date-format)
+  - [CLI-specific tools](#cli-specific-tools)
+
+## Command naming
+
+Commands in the CLI are constructed by specifying a topic and an action, with a
+hyphen between them: `user-add`, `group-mod`, `host-del`. When accessing through
+the API, the topic and the action are divided by an underscore instead:
+`user_add`, `group_mod`, `host_del`. All available commands can be found below
+`api.Command` after the API is initialized.
+
+## Parameter naming
+
+When managing plugins through the CLI, their parameters have different names
+than the API, where names are the same as the LDAP attributes. For example,
+`user-add` takes the `first` parameter in the CLI. However, this is named
+`givenname` when calling `user_add` through the Python API.
+
+## Date format
+
+When passing dates through the CLI, multiple date string formats are available:
+
+* %Y%m%d%H%M%SZ
+* %Y-%m-%dT%H:%M:%SZ
+* %Y-%m-%dT%H:%MZ
+* %Y-%m-%dZ
+* %Y-%m-%d %H:%M:%SZ
+* %Y-%m-%d %H:%MZ
+
+When using the API, apart from these formats, the Python built-in `datetime` class
+can be used as well.
+
+## CLI-specific tools
+
+FreeIPA provides multiple tools that are mainly useful for CLI usage:
+
+* `console`: starts an interactive Python console with an IPA API object already initialized.
+* `help`: shows help about topics and commands, including examples for the CLI.
+* `show-mappings`: shows the mapping between CLI parameter names and LDAP attributes.

doc/api/basic_usage.md

@@ -6,6 +6,8 @@
   - [Running commands](#running-commands)
   - [Passing arguments and options](#passing-arguments-and-options)
   - [Retrieving output](#retrieving-output)
+  - [Displaying information about commands and parameters](#displaying-information-about-commands-and-parameters)
+  - [API Contexts](#api-contexts)
   - [Batch operations](#batch-operations)
 
 ## Introduction
@@ -18,7 +20,12 @@ that can be accessed through Python, allowing users to interact with FreeIPA
 programatically and develop custom tools to respond to specific needs not 
 covered by the main interfaces. For users looking to perform stateless
 operations or manage deployments with statically defined properties,
-[ansible-freeipa](https://github.com/freeipa/ansible-freeipa) is recommended instead.
+[ansible-freeipa](https://github.com/freeipa/ansible-freeipa) is recommended
+instead.
+
+While FreeIPA API provides a JSON-RPC interface, it is recommended to access the
+API through Python instead, since it automates important parts such as the
+metadata retrieval from the server, which allows to list all available commands.
 
 ## Initializing API access
 
@@ -92,6 +99,10 @@ kw = {
 api.Command.user_show(*args, **kw)
 ```
 
+The full list of available arguments and options for each command can be found
+in the API Reference. Alternatively, it is possible to see the mapping of CLI
+option to API attribute through `ipa show-mappings`.
+
 ## Retrieving output
 
 Command output is returned as a Python dictionary. Example shown is the output
@@ -165,6 +176,86 @@ The output contains four sections:
 * `messages`: Different diagnostic information provided by FreeIPA after the operation.
 * `summary`: A summary of the operation.
 
+## Displaying information about commands and parameters
+
+All available information about commands and their parameters is provided in the
+API Reference. Additionally, the API provides tools to display this information. 
+It can be retrieved using the `command_show` and `param_show` commands.
+
+```python
+api.Command.command_show("user_add")
+```
+
+```python
+{
+    "result": {
+        "name": "user_add",
+        "version": "1",
+        "full_name": "user_add/1",
+        "doc": "Add a new user.",
+        "topic_topic": "user/1",
+        "obj_class": "user/1",
+        "attr_name": "add",
+    },
+    "value": "user_add",
+    "messages": [
+        {
+            "type": "warning",
+            "name": "VersionMissing",
+            "message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.251",
+            "code": 13001,
+            "data": {"server_version": "2.251"},
+        }
+    ],
+    "summary": None,
+}
+```
+
+For listing all available parameters for a certain command, the `param_find`
+command can be used. We can additionally show information of a certain
+parameter from a command using `param_show`.
+
+
+```python
+api.Command.param_show("user_add", name="givenname")
+```
+
+```python
+{
+    "result": {
+        "name": "givenname",
+        "type": "str",
+        "positional": False,
+        "cli_name": "first",
+        "label": "First name",
+    },
+    "value": "givenname",
+    "messages": [
+        {
+            "type": "warning",
+            "name": "VersionMissing",
+            "message": "API Version number was not sent, forward compatibility not guaranteed. Assuming server's API version, 2.251",
+            "code": 13001,
+            "data": {"server_version": "2.251"},
+        }
+    ],
+    "summary": None,
+}
+```
+
+## API Contexts
+
+As explained earlier, a context can be specified before initializing the API.
+The purpose of the context is to define the set of methods that can be
+performed. FreeIPA defines by default four major contexts:
+
+* `server`: plugins validate any arguments and options passed and then execute
+  the requested action.
+* `client`: plugins validate any arguments and options passed and then forward
+  the request to the FreeIPA server to execute.
+* `installer`: plugins specific to the installation process are loaded.
+* `updates`: plugins specific the update process are loaded.
+
 ## Batch operations
 
 Batch operations are useful for executing multiple commands at once, as it

doc/api/commands.rst

@@ -182,17 +182,21 @@ IPA API Commands
    hbactest.md
    host_add.md
    host_add_cert.md
+   host_add_delegation.md
    host_add_managedby.md
    host_add_principal.md
+   host_allow_add_delegation.md
    host_allow_create_keytab.md
    host_allow_retrieve_keytab.md
    host_del.md
    host_disable.md
+   host_disallow_add_delegation.md
    host_disallow_create_keytab.md
    host_disallow_retrieve_keytab.md
    host_find.md
    host_mod.md
    host_remove_cert.md
+   host_remove_delegation.md
    host_remove_managedby.md
    host_remove_principal.md
    host_show.md
@@ -336,18 +340,22 @@ IPA API Commands
    server_state.md
    service_add.md
    service_add_cert.md
+   service_add_delegation.md
    service_add_host.md
    service_add_principal.md
    service_add_smb.md
+   service_allow_add_delegation.md
    service_allow_create_keytab.md
    service_allow_retrieve_keytab.md
    service_del.md
    service_disable.md
+   service_disallow_add_delegation.md
    service_disallow_create_keytab.md
    service_disallow_retrieve_keytab.md
    service_find.md
    service_mod.md
    service_remove_cert.md
+   service_remove_delegation.md
    service_remove_host.md
    service_remove_principal.md
    service_show.md

doc/api/dnszone_add.md

@@ -10,7 +10,6 @@ Create new DNS zone (SOA record).
 ### Options
 * idnssoarname : :ref:`DNSNameParam<DNSNameParam>` **(Required)**
  * Default: hostmaster
-* idnssoaserial : :ref:`Int<Int>` **(Required)**
 * idnssoarefresh : :ref:`Int<Int>` **(Required)**
  * Default: 3600
 * idnssoaretry : :ref:`Int<Int>` **(Required)**
@@ -34,6 +33,7 @@ Create new DNS zone (SOA record).
 * idnsforwardpolicy : :ref:`StrEnum<StrEnum>`
  * Values: ('only', 'first', 'none')
 * idnssoamname : :ref:`DNSNameParam<DNSNameParam>`
+* idnssoaserial : :ref:`Int<Int>`
 * dnsttl : :ref:`Int<Int>`
 * dnsdefaultttl : :ref:`Int<Int>`
 * dnsclass : :ref:`StrEnum<StrEnum>`

doc/api/group_management.md

@@ -0,0 +1,98 @@
+# Group management examples
+
+This guide provides various examples on how to perform common tasks related to
+group management in a IPA environment making use of the provided API.
+
+- [Group management examples](#group-management-examples)
+  - [Creating a group](#creating-a-group)
+  - [Adding members to a group](#adding-members-to-a-group)
+  - [Adding group managers](#adding-group-managers)
+  - [Finding a group](#finding-a-group)
+  - [Showing group information](#showing-group-information)
+  - [Modifying a group](#modifying-a-group)
+  - [Removing members from a group](#removing-members-from-a-group)
+  - [Removing group managers](#removing-group-managers)
+  - [Removing a group](#removing-a-group)
+
+
+## Creating a group
+
+Create a group for developers, with an specific Group ID number.
+
+```python
+api.Command.group_add("developers", gidnumber=500, description="Developers")
+```
+
+## Adding members to a group
+
+Add the admin user to the `developers` group.
+
+```python
+api.Command.group_add_member("developers", user="admin")
+```
+
+Apart from users, groups can also have services and groups as members:
+
+```python
+api.Command.group_add_member("developers", service="HTTP/server.ipa.test")
+```
+
+```python
+api.Command.group_add_member("developers", group="admins")
+```
+
+## Adding group managers
+
+Add `bob` as the group manager for `developers` group.
+
+```python
+api.Command.group_add_member_manager("developers", user="bob")
+```
+
+## Finding a group
+
+Find all groups managed by `bob`.
+
+```python
+api.Command.group_find(membermanager_user="bob")
+```
+
+## Showing group information
+
+Show information about the `developers` group, excluding the members list.
+
+```python
+api.Command.group_show("developers", no_members=True)
+```
+
+## Modifying a group
+
+Convert a non-POSIX group to POSIX:
+
+```python
+api.Command.group_mod("testgroup", posix=True)
+```
+
+## Removing members from a group
+
+Remove the admin user to the `developers` group.
+
+```python
+api.Command.group_remove_member("developers", user="admin")
+```
+
+## Removing group managers
+
+Remove `bob` as the group manager from `developers` group.
+
+```python
+api.Command.group_remove_member_manager("developers", user="bob")
+```
+
+## Removing a group
+
+Remove the `developers` group.
+
+```python
+api.Command.group_del("developers")
+```

doc/api/guides.rst

@@ -4,3 +4,10 @@ IPA API Guides
    :maxdepth: 1
 
    basic_usage.md
+   jsonrpc_usage.md
+   api_cli_differences.md
+   user_management.md
+   group_management.md
+   access_control_guide.md
+   hbac_guide.md
+   sudorule_management.md

doc/api/hbac_guide.md

@@ -0,0 +1,89 @@
+# Host-based Access Control (HBAC) Examples
+
+HBAC rules allow to define policies to control how hosts and services are
+accessed based on the user, user's group or host that is attempting to access.
+
+- [Host-based Access Control (HBAC) Examples](#host-based-access-control-hbac-examples)
+  - [Creating an HBAC rule](#creating-an-hbac-rule)
+  - [Managing members of a HBAC rule](#managing-members-of-a-hbac-rule)
+  - [Managing targets of a HBAC rule](#managing-targets-of-a-hbac-rule)
+  - [Testing a HBAC rule](#testing-a-hbac-rule)
+  - [Enabling and disabling HBAC rules](#enabling-and-disabling-hbac-rules)
+
+
+## Creating an HBAC rule
+
+Create a base rule that will handle SSH service access.
+
+```python
+api.Command.hbacrule_add("sshd_rule")
+```
+
+## Managing members of a HBAC rule
+
+Add user `john` to the previously created HBAC rule.
+
+```python
+api.Command.hbacrule_add_user("sshd_rule", user="john")
+```
+
+Additionally, you can set access based on groups:
+
+```python
+api.Command.hbacrule_add_user("sshd_rule", group="developers")
+```
+
+Remove user `john` from the HBAC rule.
+
+```python
+api.Command.hbacrule_remove_user("sshd_rule", user="john")
+```
+
+## Managing targets of a HBAC rule
+
+After we have created the rule and set the members, targets must be registered
+before being added to the rule.
+
+Adding a new HBAC service.
+
+```python
+api.Command.hbacsvc_add("chronyd")
+```
+
+Services must be attached to rules. Attach the sshd service to the previously
+created rule. This service is registered in IPA by default, so there's no need
+to add it with `hbacsvc_add` before.
+
+```python
+api.Command.hbacrule_add_service("sshd_rule", hbacsvc="sshd")
+```
+
+Hosts can be added as targets as well. Allow the SSH service to be accessed only in
+the hosts part of the `workstations` hostgroup.
+
+```python
+api.Command.hbacrule_add_host("sshd_rule", hostgroup="workstations")
+```
+
+## Testing a HBAC rule
+
+Simulate the use of the rule we previously created, against the host
+`workstation.ipa.test`, the service `sshd` coming from the user `john`.
+
+```python
+api.Command.hbactest(user="john", targethost="workstation.ipa.test", service="sshd", rules="sshd_rule")
+```
+
+## Enabling and disabling HBAC rules
+
+Enable a HBAC rule.
+
+```python
+api.Command.hbacrule_enable("sshd_rule")
+```
+
+Disable a HBAC rule.
+
+```python
+api.Command.hbacrule_disable("sshd_rule")
+```

doc/api/host_add_delegation.md

@@ -0,0 +1,32 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
+# host_add_delegation
+Add new resource delegation to a host
+
+### Arguments
+|Name|Type|Required
+|-|-|-
+|fqdn|:ref:`Str<Str>`|True
+|memberprincipal|:ref:`Str<Str>`|True
+
+### Options
+* all : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* raw : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* no_members : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* version : :ref:`Str<Str>`
+
+### Output
+|Name|Type
+|-|-
+|result|Entry
+|summary|Output
+|value|PrimaryKey
+
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+### Semantics
+
+### Notes
+
+### Version differences

doc/api/host_allow_add_delegation.md

@@ -0,0 +1,35 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
+# host_allow_add_delegation
+Allow users, groups, hosts or host groups to handle a resource delegation of this host.
+
+### Arguments
+|Name|Type|Required
+|-|-|-
+|fqdn|:ref:`Str<Str>`|True
+
+### Options
+* all : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* raw : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* no_members : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* version : :ref:`Str<Str>`
+* user : :ref:`Str<Str>`
+* group : :ref:`Str<Str>`
+* host : :ref:`Str<Str>`
+* hostgroup : :ref:`Str<Str>`
+
+### Output
+|Name|Type
+|-|-
+|completed|Output
+|failed|Output
+|result|Entry
+
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+### Semantics
+
+### Notes
+
+### Version differences

doc/api/host_disallow_add_delegation.md

@@ -0,0 +1,35 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
+# host_disallow_add_delegation
+Disallow users, groups, hosts or host groups to handle a resource delegation of this host.
+
+### Arguments
+|Name|Type|Required
+|-|-|-
+|fqdn|:ref:`Str<Str>`|True
+
+### Options
+* all : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* raw : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* no_members : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* version : :ref:`Str<Str>`
+* user : :ref:`Str<Str>`
+* group : :ref:`Str<Str>`
+* host : :ref:`Str<Str>`
+* hostgroup : :ref:`Str<Str>`
+
+### Output
+|Name|Type
+|-|-
+|completed|Output
+|failed|Output
+|result|Entry
+
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+### Semantics
+
+### Notes
+
+### Version differences

doc/api/host_remove_delegation.md

@@ -0,0 +1,32 @@
+[//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
+# host_remove_delegation
+Remove resource delegation from a host
+
+### Arguments
+|Name|Type|Required
+|-|-|-
+|fqdn|:ref:`Str<Str>`|True
+|memberprincipal|:ref:`Str<Str>`|True
+
+### Options
+* all : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* raw : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* no_members : :ref:`Flag<Flag>` **(Required)**
+ * Default: False
+* version : :ref:`Str<Str>`
+
+### Output
+|Name|Type
+|-|-
+|result|Entry
+|summary|Output
+|value|PrimaryKey
+
+[//]: # (ADD YOUR NOTES BELOW. THESE WILL BE PICKED EVERY TIME THE DOCS ARE REGENERATED. //end)
+### Semantics
+
+### Notes
+
+### Version differences

doc/api/idp_add.md

@@ -1,6 +1,6 @@
 [//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 # idp_add
-Add a new Identity Provider server.
+Add a new Identity Provider reference.
 
 ### Arguments
 |Name|Type|Required

doc/api/idp_del.md

@@ -1,6 +1,6 @@
 [//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 # idp_del
-Delete an Identity Provider server.
+Delete an Identity Provider reference.
 
 ### Arguments
 |Name|Type|Required

doc/api/idp_find.md

@@ -1,6 +1,6 @@
 [//]: # (THE CONTENT BELOW IS GENERATED. DO NOT EDIT.)
 # idp_find
-Search for Identity Provider servers.
+Search for Identity Provider references.
 
 ### Arguments
 |Name|Type|Required