Nathaniel McCallum 98851256f9 Add support for managedBy to tokens ... This also constitutes a rethinking of the token ACIs after the introduction of SELFDN support. Admins, as before, have full access to all token permissions. Normal users have read/search/compare access to all of the non-secret data for tokens assigned to them, whether managed by them or not. Users can add tokens if, and only if, they will also manage this token. Managers can also read/search/compare tokens they manage. Additionally, they can write non-secret data to their managed tokens and delete them. When a normal user self-creates a token (the default behavior), then managedBy is automatically set. When an admin creates a token for another user (or no owner is assigned at all), then managed by is not set. In this second case, the token is effectively read-only for the assigned owner. This behavior enables two important other behaviors. First, an admin can create a hardware token and assign it to the user as a read-only token. Second, when the user is deleted, only his self-managed tokens are deleted. All other (read-only) tokens are instead orphaned. This permits the same token object to be reasigned to another user without loss of any counter data. https://fedorahosted.org/freeipa/ticket/4228 https://fedorahosted.org/freeipa/ticket/4259 Reviewed-By: Jan Cholasta <jcholast@redhat.com>		2014-06-16 10:13:59 +02:00
..
advise	Add ipa-advise plugins for nss-pam-ldapd legacy clients	2013-10-18 16:15:12 +02:00
05rfc2247.ldif	Make schema files conform to new updater	2013-11-18 16:54:21 +01:00
15rfc2307bis.ldif	Add formerly update-only schema	2013-11-18 16:54:21 +01:00
15rfc4876.ldif	Add formerly update-only schema	2013-11-18 16:54:21 +01:00
60basev2.ldif	Make schema files conform to new updater	2013-11-18 16:54:21 +01:00
60basev3.ldif	Add a new ipaVirtualOperation objectClass to virtual operations	2014-04-24 11:19:51 +02:00
60ipaconfig.ldif	Unify capitalization of attribute names in schema files	2013-11-18 16:54:22 +01:00
60ipadns.ldif	dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone	2014-05-28 15:58:24 +02:00
60kerberos.ldif	Add support for account unlocking	2011-01-28 10:23:02 -05:00
60policyv2.ldif	Re-number some attributes to compress our usage to be contiguous	2010-05-27 10:50:49 -04:00
60samba.ldif	Make schema files conform to new updater	2013-11-18 16:54:21 +01:00
61kerberos-ipav3.ldif	Perform case-insensitive searches for principals on TGS requests	2012-06-07 09:39:10 +02:00
65ipasudo.ldif	Unify capitalization of attribute names in schema files	2013-11-18 16:54:22 +01:00
70ipaotp.ldif	Add support for managedBy to tokens	2014-06-16 10:13:59 +02:00
anonymous-vlv.ldif	Let anonymous users browse the VLV index	2009-07-10 16:45:45 -04:00
automember.ldif	34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin	2011-08-31 09:49:43 +02:00
bind.named.conf.template	Remove --no-serial-autoincrement	2013-10-11 09:47:59 +02:00
bind.zone.db.template	Use A/AAAA records instead of CNAME records in ipa-ca.	2013-04-15 21:12:36 +02:00
bootstrap-template.ldif	Remove entitlement support	2013-06-26 14:11:42 +02:00
caJarSigningCert.cfg.template	Add signing profile to CA installation so we can sign the firefox jar file.	2009-05-04 16:54:42 -04:00
certmap.conf.template	Fix selected minor issues in the spec file and license	2013-08-13 15:31:46 +02:00
copy-schema-to-ca.py	Use /usr/bin/python2	2014-01-03 09:46:05 +01:00
default-aci.ldif	Add support for managedBy to tokens	2014-06-16 10:13:59 +02:00
default-hbac.ldif	Remove sourcehostcategory from the default HBAC rule.	2014-02-06 16:46:24 +01:00
default-smb-group.ldif	Change DNA magic value to -1 to make UID 999 usable	2013-03-11 17:07:07 +01:00
delegation.ldif	Convert User default permissions to managed	2014-06-10 13:55:56 +02:00
disable-betxn.ldif	Explicitly disable betxn plugins for the time being.	2012-10-10 20:24:10 -04:00
dna.ldif	Change DNA magic value to -1 to make UID 999 usable	2013-03-11 17:07:07 +01:00
dns.ldif	Per-domain DNS record permissions	2012-06-28 15:21:21 +02:00
ds-nfiles.ldif	Autotune directory server to use a greater number of files	2010-11-22 12:42:16 -05:00
encrypted_attribute.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
entryusn.ldif	Address entryusn initialization on replica installation	2011-01-28 13:58:43 -05:00
fedora-ds.init.patch	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
host_nis_groups.ldif	Move Managed Entries into their own container in the replicated space.	2011-09-12 16:28:27 -04:00
indices.ldif	Add missing equality index for ipaUniqueId.	2013-07-11 12:39:26 +03:00
kdc_extensions.template	Add support for configuring KDC certs for PKINIT	2010-11-18 15:09:36 -05:00
kdc_req.conf.template	Add support for configuring KDC certs for PKINIT	2010-11-18 15:09:36 -05:00
kdc.conf.template	ipa-kdb: Change install to use the new ipa-kdb kdc backend	2011-08-26 08:24:50 -04:00
kerberos.ldif	Add Camellia ciphers to allowed list.	2013-07-18 10:49:38 +03:00
key_escrow_schema.ldif	Re-number some attributes to compress our usage to be contiguous	2010-05-27 10:50:49 -04:00
krb5.conf.template	Allow kernel keyring CCACHE when supported	2013-12-09 12:21:22 +01:00
krb5.ini.template	Set master_kdc and dns_lookup_kdc to true	2012-09-19 20:47:12 -04:00
krb.con.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
krb.js.template	Build and installation of Kerberos authentication extension	2012-10-04 18:08:04 -04:00
krbrealm.con.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
ldapi.ldif	Enable ldapi connections in the management framework.	2009-08-27 13:36:58 -04:00
Makefile.am	Use LDAP API to upload CA certificate instead of ldapmodify command.	2014-03-25 16:54:54 +01:00
managed-entries.ldif	Move Managed Entries into their own container in the replicated space.	2011-09-12 16:28:27 -04:00
master-entry.ldif	Use FQDN in place of FQHN for consistency in sub_dict.	2012-02-15 20:27:34 -05:00
memberof-conf.ldif	Display user and host membership in netgroups.	2010-11-24 08:38:41 -05:00
memberof-task.ldif	Wait for memberof task and DS to start before proceeding in installation.	2011-04-22 11:43:50 +02:00
modrdn-krbprinc.ldif	The precendence on the modrdn plugin was set in the wrong location.	2011-09-13 17:36:59 +02:00
nis.uldif	Enable transactions by default, make password and modrdn TXN-aware	2012-11-21 14:55:12 +01:00
preferences.html.template	Set network.http.sendRefererHeader to 2 on browser config	2012-06-22 10:44:45 +02:00
referint-conf.ldif	Expand Referential Integrity checks	2012-09-16 17:59:27 -04:00
replica-acis.ldif	Replace "replica admins read access" ACI with a permission	2014-05-21 09:57:16 +02:00
replica-automember.ldif	34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin	2011-08-31 09:49:43 +02:00
replica-s4u2proxy.ldif	Add cifs principal to S4U2Proxy targets only when running ipa-adtrust-install	2012-10-09 18:15:01 -04:00
repoint-managed-entries.ldif	Move Managed Entries into their own container in the replicated space.	2011-09-12 16:28:27 -04:00
root-autobind.ldif	Remove root autobind search restriction, fix upgrade logging & error handling.	2011-06-13 09:51:05 +02:00
sasl-mapping-fallback.ldif	Enable SASL mapping fallback.	2013-06-27 17:06:51 +02:00
schema_compat.uldif	schema-compat: set precedence to 49 to allow OTP binds over compat tree	2014-04-04 08:45:43 +02:00
schema-update.ldif	Fix nsslapdPlugin object class after initial replication.	2013-09-10 09:49:43 +02:00
smb.conf.empty	Add trust management for Active Directory trusts	2012-06-07 09:39:09 +02:00
smb.conf.template	ipa-adtrust-install: configure host netbios name by default	2014-01-20 10:35:03 +01:00
sudobind.ldif	Create default disabled sudo bind user	2011-02-23 15:32:24 -05:00
unique-attributes.ldif	Add uniqueness plugin configuration for sudorule cn	2012-10-08 18:32:41 -04:00
user_private_groups.ldif	Move Managed Entries into their own container in the replicated space.	2011-09-12 16:28:27 -04:00
uuid-ipauniqueid.ldif	UUIDs: remove uuid python plugin and let DS always autogenerate	2010-10-28 07:58:31 -04:00
wsgi.py	Tweak the session auth to reflect developer consensus.	2012-02-27 05:54:29 -05:00