freeipa/install/updates
Alexander Bokovoy 703497532a Support Samba 4.9
Samba 4.9 became a bit more strict about creating a local NT token and a
failure to resolve or create BUILTIN\Guests group will cause a rejection
of the connection for a successfully authenticated one.

Add a default mapping of the nobody group to BUILTIN\Guests.

BUILTIN\Guests is a special group SID that is added to the NT token for
authenticated users.

For real guests there is 'guest account' option in smb.conf which
defaults to 'nobody' user.

This was implicit behavior before as 'guest account = nobody' by
default would pick up 'nobody' group as well.

Fixes: https://pagure.io/freeipa/issue/7705
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-09-26 11:40:19 +02:00
..
05-pre_upgrade_plugins.update server upgrade: fix upgrade from pre-4.0 2017-02-20 13:00:50 +00:00
10-config.update 10-config.update: remove nsslapd-sasl-max-buffer-size override as https://pagure.io/389-ds-base/issue/47457 was fixed directly in 389 Directory Server. 2018-01-04 16:36:54 +01:00
10-enable-betxn.update
10-ipapwd.update
10-rootdse.update
10-selinuxusermap.update
10-uniqueness.update Add uniqueness constraint on CA ACL name 2017-12-12 14:36:44 +01:00
19-managed-entries.update
20-aci.update ACL: Allow hosts to remove services they manage 2018-04-19 08:59:45 -04:00
20-default_password_policy.update password policy: Add explicit default password policy for hosts and services 2016-12-14 17:46:12 +01:00
20-dna.update Moved update of DNA plugin among update plugins 2016-11-11 12:13:56 +01:00
20-enable_dirsrv_plugins.update ensuring 389-ds plugins are enabled after install 2017-12-14 16:41:01 +01:00
20-host_nis_groups.update
20-idoverride_index.update Fix index definition for ipaAnchorUUID 2017-05-30 12:32:34 +02:00
20-indices.update Add indexing to improve host-find performance 2017-11-07 16:49:36 +01:00
20-ipaservers_hostgroup.update
20-nss_ldap.update
20-replication.update
20-sslciphers.update
20-syncrepl.update ldap: limit the retro changelog to dns subtree 2017-10-26 12:40:28 +02:00
20-user_private_groups.update
20-uuid.update
20-whoami.update Adds whoami DS plugin in case that plugin is missing 2017-09-05 14:07:02 +02:00
20-winsync_index.update
21-ca_renewal_container.update
21-certstore_container.update
21-replicas_container.update
25-referint.update
30-provisioning.update ACI: grant access to admins group instead of admin user 2018-02-19 15:51:44 +01:00
30-s4u2proxy.update
37-locations.update
40-automember.update
40-certprofile.update
40-delegation.update Remove "Request Certificate with SubjectAltName" permission 2016-12-21 17:04:18 +01:00
40-dns.update
40-otp.update
40-realm_domains.update
40-replication.update
40-vault.update
41-caacl.update
41-lightweight-cas.update
45-roles.update Add Role 'Enrollment Administrator' 2017-06-09 16:37:40 +02:00
50-7_bit_check.update
50-dogtag10-migration.update
50-externalmembers.update
50-groupuuid.update
50-hbacservice.update
50-ipaconfig.update Use replace instead of add to set new default ipaSELinuxUserMapOrder 2018-06-08 10:49:18 +02:00
50-krbenctypes.update
50-nis.update
55-pbacmemberof.update
59-trusts-sysacount.update
60-trusts.update
61-trusts-s4u2proxy.update
62-ranges.update
71-idviews-sasl-mapping.update
71-idviews.update
72-domainlevels.update
73-certmap.update Support for Certificate Identity Mapping 2017-03-02 15:09:42 +01:00
73-custodia.update
73-winsync.update
80-schema_compat.update compat plugin: Update link to slapi-nis project 2017-04-24 17:11:51 +02:00
90-post_upgrade_plugins.update Support Samba 4.9 2018-09-26 11:40:19 +02:00
Makefile.am ensuring 389-ds plugins are enabled after install 2017-12-14 16:41:01 +01:00
README

The update files are sorted before being processed because there are
cases where order matters (such as getting schema added first, creating
parent entries, etc).

Updates are applied in blocks of ten so that any entries that are dependant
on another can be added successfully without having to rely on the length
of the DN to get the sorting correct.

The file names should use the format #-<description>.update where # conforms
to this:

10 - 19: Configuration
20 - 29: 389-ds configuration, new indices
30 - 39: Structual elements of the DIT
40 - 49: Pre-loaded data
50 - 59: Cleanup existing data
60 - 69: AD Trust
70 - 79: Reserved
80 - 89: Reserved

These numbers aren't absolute, there may be reasons to put an update
into one place or another, but by adhereing to the scheme it will be
easier to find existing updates and know where to put new ones.