Simo Sorce 5c0e7a5fb4 keytab: Add new extended operation to get a keytab. ...

This new extended operation allow to create new keys or retrieve
existing ones. The new set of keys is returned as a ASN.1 structure
similar to the one that is passed in by the 'set keytab' extended
operation.

Access to the operation is regulated through a new special ACI that
allows 'retrieval' only if the user has access to an attribute named
ipaProtectedOperation postfixed by the subtypes 'read_keys' and
'write_keys' to distinguish between creation and retrieval operation.

For example for allowing retrieval by a specific user the following ACI
is set on cn=accounts:

(targetattr="ipaProtectedOperation;read_keys") ...
 ... userattr=ipaAllowedToPerform;read_keys#USERDN)

This ACI matches only if the service object hosts a new attribute named
ipaAllowedToPerform that holds the DN of the user attempting the
operation.

Resolves:
https://fedorahosted.org/freeipa/ticket/3859

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>

2014-06-26 10:30:53 +02:00

..

ipa_krb5.c

keytabs: Expose and modify key encoding function

2014-06-26 10:30:53 +02:00

ipa_krb5.h

keytab: Add new extended operation to get a keytab.

2014-06-26 10:30:53 +02:00

ipa_mspac.h

ipa-kdb: read SID blacklist from LDAP

2013-02-12 10:37:47 +01:00

ipa_pwd_ntlm.c

Remove generation and handling of LM hashes

2013-11-01 09:28:35 +01:00

ipa_pwd.c

BUILD: Fix portability of NSS in file ipa_pwd.c

2014-01-28 16:35:34 +01:00

ipa_pwd.h

Remove generation and handling of LM hashes

2013-11-01 09:28:35 +01:00