Fraser Tweedale ba7e5df194 Fix KRB5PrincipalName / UPN SAN comparison ...

Depending on how the target principal name is conveyed to the
command (i.e. with / without realm), the KRB5PrincipalName / UPN
subjectAltName validation could be comparing unequal strings and
erroneously rejecting a valid request.

Normalise both side of the comparison to ensure that the principal
names contain realm information.

Fixes: https://fedorahosted.org/freeipa/ticket/5191
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

2015-08-11 17:31:25 +02:00

..

__init__.py

Change FreeIPA license to GPLv3+

2010-12-20 17:19:53 -05:00

aci.py

aci plugin: Fix internal error when ACIs are not readable

2014-05-29 16:22:37 +02:00

automember.py

Fix error message for nonexistent members and add tests.

2014-11-24 16:04:57 +01:00

automount.py

Add several CRUD default permissions

2014-06-24 13:53:41 +02:00

baseldap.py

include more information in metadata

2015-07-03 10:42:16 +02:00

baseuser.py

store certificates issued for user entries as userCertificate;binary

2015-08-04 13:57:33 +02:00

batch.py

Update all remaining plugins to the new Registry API

2014-06-11 09:24:22 +02:00

caacl.py

caacl: fix incorrect construction of HbacRequest for hosts

2015-07-08 17:13:25 +02:00

cert.py

Fix KRB5PrincipalName / UPN SAN comparison

2015-08-11 17:31:25 +02:00

certprofile.py

certprofile-import: do not require profileId in profile data

2015-07-31 16:00:57 +02:00

config.py

Expose the disabled User Auth Type

2015-02-12 10:31:24 +01:00

delegation.py

Update all remaining plugins to the new Registry API

2014-06-11 09:24:22 +02:00

dns.py

Modernize number literals

2015-07-31 15:22:19 +02:00

domainlevel.py

domainlevel: Fix incorrect initializations of InvalidDomainLevelError exceptions

2015-07-20 13:53:21 +02:00

group.py

idviews: Remove ID overrides for permanently removed users and groups

2015-07-01 13:06:40 +02:00

hbacrule.py

fix hbac rule search for non-admin users

2015-07-16 15:37:24 +02:00

hbacsvc.py

Convert HBAC Service default permissions to managed

2014-06-24 13:53:40 +02:00

hbacsvcgroup.py

Do not require description in UI.

2014-09-29 12:53:43 +02:00

hbactest.py

Remove tuple unpacking from except clause ipalib/plugins/hbactest.py

2015-07-14 13:43:50 +02:00

host.py

new commands to manage user/host/service certificates

2015-07-02 14:43:44 +00:00

hostgroup.py

hostgroup: Selected PEP8 fixes for the hostgroup plugin

2014-09-30 10:42:06 +02:00

idrange.py

idrange: include raw range type in output

2014-11-11 10:56:16 +01:00

idviews.py

idviews: Enforce objectclass check in idoverride*-del

2015-07-23 15:37:01 +02:00

internal.py

webui: add LDAP vs Kerberos behavior description to user auth types

2015-08-10 14:54:16 +02:00

kerberos.py

Update all remaining plugins to the new Registry API

2014-06-11 09:24:22 +02:00

krbtpolicy.py

Make 'permission' the default bind type for managed permissions

2014-06-11 13:21:29 +02:00

migration.py

plugable: Pass API to plugins on initialization rather than using set_api

2015-07-01 13:05:30 +00:00

misc.py

plugable: Pass API to plugins on initialization rather than using set_api

2015-07-01 13:05:30 +00:00

netgroup.py

Do not require description in UI.

2014-09-29 12:53:43 +02:00

otpconfig.py

Fix TOTP Synchronization Window label

2015-02-17 08:26:42 +01:00

otptoken_yubikey.py

Create an OTP help topic

2014-12-05 13:44:51 +01:00

otptoken.py

Fix otptoken-remove-managedby command summary

2015-08-05 12:27:48 +02:00

passwd.py

ipa-passwd: add OTP support

2014-06-26 12:37:38 +02:00

permission.py

Validate adding privilege to a permission

2015-07-17 04:57:54 +00:00

ping.py

Allow API plugin registration via a decorator

2013-08-14 12:08:27 +02:00

pkinit.py

Update all remaining plugins to the new Registry API

2014-06-11 09:24:22 +02:00

privilege.py

Validate adding privilege to a permission

2015-07-17 04:57:54 +00:00

pwpolicy.py

pwpolicy-add: Added better error handling

2014-09-02 10:40:12 +02:00

radiusproxy.py

Split long docstrings that were recently modified

2014-06-10 13:19:32 +02:00

realmdomains.py

Add Modify Realm Domains permission

2014-07-04 12:17:04 +02:00

role.py

speed up indirect member processing

2015-04-27 05:55:04 +00:00

rpcclient.py

Switch client to JSON-RPC

2013-11-26 16:59:59 +01:00

selfservice.py

Update all remaining plugins to the new Registry API

2014-06-11 09:24:22 +02:00

selinuxusermap.py

fix selinuxusermap search for non-admin users

2015-07-16 15:38:47 +02:00

server.py

server: add "del" command

2015-06-15 16:06:48 +02:00

service.py

new commands to manage user/host/service certificates

2015-07-02 14:43:44 +00:00

servicedelegation.py

Fix minor typos

2015-07-17 14:33:30 +02:00

session.py

do not import memcache on client

2015-07-16 11:23:40 +02:00

stageuser.py

ULC: Fix stageused-add --from-delete command

2015-07-29 17:06:54 +02:00

sudocmd.py

Convert Sudo Command default permissions to managed

2014-06-24 13:53:41 +02:00

sudocmdgroup.py

Do not require description in UI.

2014-09-29 12:53:43 +02:00

sudorule.py

Sudorule RunAsUser should work with external groups

2014-10-02 11:06:47 +02:00

topology.py

domainlevel: Fix incorrect initializations of InvalidDomainLevelError exceptions

2015-07-20 13:53:21 +02:00

trust.py

Fix incorrect type comparison in trust-fetch-domains

2015-08-06 10:16:30 +02:00

user.py

store certificates issued for user entries as userCertificate;binary

2015-08-04 13:57:33 +02:00

vault.py

Validate vault's file parameters

2015-07-31 15:33:49 +02:00

virtual.py

Give more info on virtual command access denial

2015-08-11 12:25:51 +02:00