Rob Crittenden 813dfe5013 Use kerberos password policy. ... This lets the KDC count password failures and can lock out accounts for a period of time. This only works for KDC >= 1.8. There currently is no way to unlock a locked account across a replica. MIT Kerberos 1.9 is adding support for doing so. Once that is available unlock will be added. The concept of a "global" password policy has changed. When we were managing the policy using the IPA password plugin it was smart enough to search up the tree looking for a policy. The KDC is not so smart and relies on the krbpwdpolicyreference to find the policy. For this reason every user entry requires this attribute. I've created a new global_policy entry to store the default password policy. All users point at this now. The group policy works the same and can override this setting. As a result the special "GLOBAL" name has been replaced with global_policy. This policy works like any other and is the default if a name is not provided on the command-line. ticket 51		2010-11-01 14:15:42 -04:00
..
install	Use kerberos password policy.	2010-11-01 14:15:42 -04:00
plugins	Populate indirect members when showing a group object.	2010-10-28 15:15:52 -04:00
__init__.py	Run ipaserver under mod_wsgi	2010-03-01 20:22:22 -07:00
conn.py	Renamed ipa_server/ to ipaserver/ and tests/test_ipa_server/ to tests/test_ipaserver	2009-01-04 18:44:16 -07:00
ipaldap.py	Add LDAP upgrade over ldapi support.	2010-06-01 09:52:10 -04:00
ipautil.py	Remove (un)wrap_binary_data cruft from */ipautil.py	2010-01-28 14:26:29 -05:00
rpcserver.py	language as a list	2010-09-21 16:28:14 -04:00
servercore.py	Clean up some problems discovered with pylint and pychecker	2009-08-12 13:18:15 -04:00