freeipa

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00

Files

Fraser Tweedale 5ab24ddf8a ca-del: require CA to already be disabled

Currently ca-del disables the target CA before deleting it.
Conceptually, this involves two separate permissions: modify and
delete.  A user with delete permission does not necessarily have
modify permission.

As we head toward enforcing IPA permissions in Dogtag, it is
necessary to decouple disablement from deletion, otherwise the
disable operation shall fail if the user does not have modify
permission.  Although it introduces an additional step for
administrators, the process is consistent, required permissions map
1:1 to the operations, and the error messages make it clear what
needs to happen (i.e. disable first).

Part of: https://fedorahosted.org/freeipa/ticket/5011

Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2020-07-07 10:07:48 -04:00

advise

ipa-advise: fallback to /usr/libexec/platform-python if python3 not found

2020-05-05 11:50:01 +02:00

dnssec

handle Y2038 in timestamp to datetime conversions

2020-06-25 09:18:02 +03:00

install

cainstance.is_crlgen_enabled: handle missing ipa-pki-proxy.conf

2020-07-06 19:13:00 +03:00

plugins

ca-del: require CA to already be disabled