freeipa

mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00

Files

Alexander Bokovoy e157ea1e14 ipaserver/dcerpc.py: use Kerberos authentication for discovery

In FIPS mode we cannot rely on NTLMSSP at all, so we have ensure
Kerberos is used by Samba Python libraries. This is achieved by
requiring credentials objects to always use Kerberos authentication.

Additionally, we have to normalize the principal used to authenticate.
In case it was passed without realm, add forest root domain as a realm.
In case it was passed with NetBIOS domain name, remove it and replace
with a realm. Since we only know about the forest root domain as a
realm, require that for other domains' users a real Kerberos principal
is specified.

Fixes: https://pagure.io/freeipa/issue/8655
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

2021-01-13 20:56:13 +02:00

advise

ipa-advise: fallback to /usr/libexec/platform-python if python3 not found

2020-05-05 11:50:01 +02:00

dnssec

Change mkdir logic in DNSSEC

2020-12-18 20:40:36 +02:00

install

ipa-cert-fix: do not fail when CSR is missing from CS.cfg

2021-01-07 16:21:16 +01:00

plugins

Remove virtual attributes before rolling back a permission