Rob Crittenden 813dfe5013 Use kerberos password policy. ... This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51		2010-11-01 14:15:42 -04:00
..
05rfc2247.ldif	Incorporate new schema for IPAv2	2009-02-11 17:13:41 -05:00
60basev2.ldif	Remove group nesting from the HBAC service groups	2010-10-28 17:34:34 -04:00
60ipaconfig.ldif	Add Generic config class.	2010-10-05 08:54:07 -04:00
60kerberos.ldif	Use kerberos password policy.	2010-11-01 14:15:42 -04:00
60policyv2.ldif	Re-number some attributes to compress our usage to be contiguous	2010-05-27 10:50:49 -04:00
60radius.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
60samba.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
60sudo.ldif	Change SUDO command attr to be case sensitive	2010-10-26 13:23:10 -04:00
anonymous-vlv.ldif	Let anonymous users browse the VLV index	2009-07-10 16:45:45 -04:00
bind.named.conf.template	named.conf: Add trailing dot to the fake_mname	2010-05-06 10:27:21 -04:00
bind.zone.db.template	Add new DNS install argument for setting the zone mgr e-mail addr.	2010-09-23 12:00:12 -04:00
bootstrap-template.ldif	Use kerberos password policy.	2010-11-01 14:15:42 -04:00
caJarSigningCert.cfg.template	Add signing profile to CA installation so we can sign the firefox jar file.	2009-05-04 16:54:42 -04:00
certmap.conf.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
default-aci.ldif	Disallow writes on serverHostName and memberOf	2010-10-22 21:41:01 -04:00
default-hbac.ldif	UUIDs: remove uuid python plugin and let DS always autogenerate	2010-10-28 07:58:31 -04:00
default-keytypes.ldif	pwd-plugin: Always use a special salt by default.	2010-10-28 17:18:03 -04:00
default-pwpolicy.ldif	Use kerberos password policy.	2010-11-01 14:15:42 -04:00
delegation.ldif	Basic changes to get a default principal for DNS	2009-07-10 09:42:22 -04:00
dna-posix.ldif	Ensure that dnaMaxValue is higher than dnaNextValue at install time	2009-09-09 22:05:24 -04:00
dna-upg.ldif	Add support for User-Private Groups	2010-07-06 15:39:34 -04:00
dns.ldif	Use the dns plug-in for addition of records during installation	2010-01-21 17:09:18 -05:00
encrypted_attribute.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
fedora-ds.init.patch	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
indices.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
kdc.conf.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
kerberos.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
key_escrow_schema.ldif	Re-number some attributes to compress our usage to be contiguous	2010-05-27 10:50:49 -04:00
krb5.conf.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
krb5.ini.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
krb.con.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
krbrealm.con.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
ldapi.ldif	Enable ldapi connections in the management framework.	2009-08-27 13:36:58 -04:00
Makefile.am	Use kerberos password policy.	2010-11-01 14:15:42 -04:00
master-entry.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
memberof-conf.ldif	No longer use the IPA-specific memberof plugin. Use the DS-supplied one.	2009-10-12 09:37:38 -04:00
memberof-task.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
modrdn-krbprinc.ldif	ipa-modrdn: Enable plugin to handle krbPrincipalName on renames	2010-10-28 07:58:31 -04:00
nis.uldif	Enable compat plugin by default and configure netgroups	2010-08-19 10:50:07 -04:00
preferences.html.template	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
referint-conf.ldif	Mass tree reorganization for IPAv2. To view previous history of files use:	2009-02-03 15:27:14 -05:00
schema_compat.uldif	Enable compat plugin by default and configure netgroups	2010-08-19 10:50:07 -04:00
unique-attributes.ldif	Set ipaUniqueId to be unwritable and add to uniqueness configuration.	2010-09-20 15:59:53 -04:00
user_private_groups.ldif	Add support for User-Private Groups	2010-07-06 15:39:34 -04:00
uuid-ipauniqueid.ldif	UUIDs: remove uuid python plugin and let DS always autogenerate	2010-10-28 07:58:31 -04:00
wsgi.py	Make the server log level more configurable, not defaulting to debug.	2010-08-19 10:49:12 -04:00