Alexander Bokovoy 693c165ce8 SMB: switch IPA domain controller role ...

As a part of CVE-2020-25717 mitigations, Samba now assumes 'CLASSIC
PRIMARY DOMAIN CONTROLLER' server role does not support Kerberos
operations.  This is the role that IPA domain controller was using for
its hybrid NT4/AD-like operation.

Instead, 'IPA PRIMARY DOMAIN CONTROLLER' server role was introduced in
Samba. Switch to this role for new installations and during the upgrade
of servers running ADTRUST role.

Fixes: https://pagure.io/freeipa/issue/9031

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2021-11-11 16:11:05 -05:00

..

plugins

Redesign subid feature

2021-07-12 17:17:51 -04:00

server

SMB: switch IPA domain controller role

2021-11-11 16:11:05 -05:00

__init__.py

Remove __all__ specifications in ipaclient and ipaserver.install

2013-09-06 15:42:33 +02:00

adtrust.py

adtrust install: define constants for rid bases

2021-11-03 11:02:00 +01:00

adtrustinstance.py

SMB: switch IPA domain controller role

2021-11-11 16:11:05 -05:00

bindinstance.py

BIND: Setup logging

2021-05-25 16:45:37 +03:00

ca.py

Add SHA384withRSA as a certificate signing algorithm

2021-07-12 09:01:59 +02:00

cainstance.py

Catch and log errors when adding CA profiles

2021-09-02 21:09:29 +02:00

certs.py

CA-less install: non-ASCII chars in CA cert subject

2021-06-17 08:11:43 +02:00

conncheck.py

install: introduce installer class hierarchy

2016-11-11 12:17:25 +01:00

custodiainstance.py

Add user and group wrappers

2020-09-22 09:23:18 -04:00

dns.py

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

dnskeysyncinstance.py

dnskeysyncinstance: use late binding for UID/GID resolution

2020-12-22 16:17:00 +02:00

dogtag.py

Verify pki ini override early

2019-04-10 13:43:23 +02:00

dogtaginstance.py

Specify PKI installation log paths

2021-08-27 09:46:01 +02:00

dsinstance.py

Add basic support for subordinate user/group ids

2021-07-12 17:17:51 -04:00

httpinstance.py

cleanup: Drop never used path for httpd's ccache

2021-03-05 08:42:45 +01:00

installutils.py

Server install: do not use unchecked ip addr for ipa-ca record

2021-07-08 22:44:11 +02:00

ipa_acme_manage.py

ipa-acme-manage: user a cookie created for the communication with dogtag REST endpoints

2020-11-17 18:48:24 +02:00

ipa_backup.py

BIND: Setup logging

2021-05-25 16:45:37 +03:00

ipa_cacert_manage.py

lint: Make Pylint-2.4 happy again

2020-02-12 18:08:32 +02:00

ipa_cert_fix.py

ipa-cert-fix man page: add note about certmonger renewal

2021-06-12 11:21:04 +03:00

ipa_crlgen_manage.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

ipa_kra_install.py

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

ipa_ldap_updater.py

Remove -s option from ipa-ldap-updater usage

2021-05-21 09:15:28 +02:00

ipa_otptoken_import.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00

ipa_pkinit_manage.py

Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server

2021-06-18 10:43:39 -04:00

ipa_replica_install.py

Enable replica install info logging to match ipa-server-install

2018-11-01 13:08:58 +01:00

ipa_restore.py

Add user and group wrappers

2020-09-22 09:23:18 -04:00

ipa_server_certinstall.py

Require an ipa-ca SAN on 3rd party certs if ACME is enabled

2020-11-02 14:01:05 -05:00

ipa_server_install.py

Improve console logging for ipa-server-install

2018-06-20 08:38:03 +02:00

ipa_server_upgrade.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipa_subids.py

Redesign subid feature

2021-07-12 17:17:51 -04:00

ipa_trust_enable_agent.py

ipa-adtrust-install: run remote configuration for new agents

2020-03-05 14:40:58 +01:00

ipa_winsync_migrate.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipactl.py

Ensure IPA is running (ideally) before uninstalling the KRA

2021-02-04 14:14:51 +01:00

kra.py

ipa-kra-install: exit if ca_host is overriden

2021-07-27 17:38:45 +02:00

krainstance.py

ipatests: test_installation: move tracking_reqs dependency to ipalib constants ipaserver: krainstance: utilize moved tracking_reqs dependency

2021-07-13 19:30:55 +02:00

krbinstance.py

Ensure that KDC cert has SAN DNS entry

2021-01-31 15:02:48 +01:00

ldapupdate.py

Fix ldapupdate.get_sub_dict() for missing named user

2021-08-02 09:53:36 -04:00

odsexporterinstance.py

odsexporterinstance: use late binding for UID/GID resolution

2020-12-22 16:17:00 +02:00

opendnssecinstance.py

opendnssecinstance: use late binding for UID/GID resolution

2020-12-22 16:17:00 +02:00

otpdinstance.py

Enable pylint missing-final-newline check

2015-12-23 07:59:22 +01:00

replication.py

Use get_replication_plugin_name in LDAP updater

2021-06-22 09:26:18 +02:00

schemaupdate.py

Unify access to FQDN

2020-10-26 17:11:19 +11:00

service.py

service: enforce keytab user when retrieving the keytab

2021-06-03 14:58:47 +02:00

sysupgrade.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

upgradeinstance.py

Use get_replication_plugin_name in LDAP updater

2021-06-22 09:26:18 +02:00