IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
6,089 Commits 11 Branches 63 Tags
689399fce930fb9d28ca81dfffbad411d12186e3
Commit Graph
10 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Nathaniel McCallum d5c1b18bcc Fix for small syntax error in OTP schema 
https://fedorahosted.org/freeipa/ticket/3765
 2013-07-11 12:39:29 +03:00
Nathaniel McCallum 4bbbc11029 Permit reads to ipatokenRadiusProxyUser objects 
This fixes an outstanding permissions issue from the OTP work.

https://fedorahosted.org/freeipa/ticket/3693
 2013-07-11 12:39:27 +03:00
Nathaniel McCallum 784f484cad Fix client install exception if /etc/ssh is missing 
https://fedorahosted.org/freeipa/ticket/3766
 2013-07-09 12:07:25 -04:00
Nathaniel McCallum 5b58348cd3 Add OTP support to ipa-pwd-extop 
During LDAP bind, this now plugin determines if a user is enabled
for OTP authentication. If so, then the OTP is validated in addition
to the password. This allows 2FA during user binds.

    https://fedorahosted.org/freeipa/ticket/3367
    http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum 1e1bab4edc Remove unnecessary prefixes from ipa-pwd-extop files 2013-05-17 09:30:51 +02:00
Nathaniel McCallum 203754691c Add the krb5/FreeIPA RADIUS companion daemon 
This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.

https://fedorahosted.org/freeipa/ticket/3366
http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum 5d51ae50a5 ipa-kdb: Add OTP support 
If OTP is enabled for a user, then:
  1. Long-term keys are not provided to KDB
  2. The user string 'otp' is defined to KDB

Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string to a known default
('[]') which enables the default configuration in the KDC.

https://fedorahosted.org/freeipa/ticket/3561
http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum cb68935435 Add IPA OTP schema and ACLs 
This commit adds schema support for two factor authentication via
OTP devices, including RADIUS or TOTP. This schema will be used
by future patches which will enable two factor authentication
directly.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum bc26d87b34 Add ipaUserAuthType and ipaUserAuthTypeClass 
This schema addition will be useful for future commits. It allows us to
define permitted external authentication methods on both the user and
global config. The implementation is generic, but the immediate usage
is for otp support.

https://fedorahosted.org/freeipa/ticket/3365
http://freeipa.org/page/V3/OTP
 2013-05-17 09:30:51 +02:00
Nathaniel McCallum 039b78abee Ignore log files from automake tests 2013-05-02 15:19:39 -04:00