Simo Sorce 5c0e7a5fb4 keytab: Add new extended operation to get a keytab. ... This new extended operation allow to create new keys or retrieve existing ones. The new set of keys is returned as a ASN.1 structure similar to the one that is passed in by the 'set keytab' extended operation. Access to the operation is regulated through a new special ACI that allows 'retrieval' only if the user has access to an attribute named ipaProtectedOperation postfixed by the subtypes 'read_keys' and 'write_keys' to distinguish between creation and retrieval operation. For example for allowing retrieval by a specific user the following ACI is set on cn=accounts: (targetattr="ipaProtectedOperation;read_keys") ... ... userattr=ipaAllowedToPerform;read_keys#USERDN) This ACI matches only if the service object hosts a new attribute named ipaAllowedToPerform that holds the DN of the user attempting the operation. Resolves: https://fedorahosted.org/freeipa/ticket/3859 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>		2014-06-26 10:30:53 +02:00
..
ipa-kdb	Periodically refresh global ipa-kdb configuration	2014-06-19 14:50:32 +02:00
ipa-otpd	Move ipa-otpd socket directory	2014-02-11 17:36:19 +01:00
ipa-sam	ipa-sam: cache gid to sid and uid to sid requests in idmap cache	2014-03-12 12:19:06 +01:00
ipa-slapi-plugins	keytab: Add new extended operation to get a keytab.	2014-06-26 10:30:53 +02:00
configure.ac	Add OTP last token plugin	2014-02-21 10:26:02 +01:00
ipa-version.h.in	Fix typos	2011-09-07 13:20:42 +02:00
Makefile.am	Add the krb5/FreeIPA RADIUS companion daemon	2013-05-17 09:30:51 +02:00