freeipa

#8659 ipa-kdb: provide correct logon time in MS-PAC from authentication time
Closed: fixed by rcritten. Opened by abbra.

Closed: fixed
Reopen Issue

When MS-PAC structure is created, we get passed the time of authentication from KDC. Use this to record logon time in MS-PAC structure.

Set allow password change time to the last password change. We need to refer to the actual password policy here in future.

Also use INT64_MAX to represent the resulting value for logoff and kickoff times according to MS-PAC 2.6.

Metadata Update from @abbra:
- Issue assigned to abbra

Metadata Update from @abbra:
- Issue tagged with: trust

master:

  • 968f8ada650ead218055026d1acfb5d41b87cdf0 ipa-kdb: provide correct logon time in MS-PAC from authentication time
  • e6f8d8bc9bc53fe6947867e4918585654fd4acfb ipasam: implement PASSDB getgrnam call
  • 75882516c4126fde403291357c991917616a5314 ipasam: allow search of users by user principal name (UPN)
  • a1e2fe9c32ca44e4c06aadd6aa75565ccb6910c3 ipasam: free trusted domain context on failure
  • 08d7d90ab0934ecefaaccf7866c73dca8ccf636f ipasam: derive parent domain for subdomains automatically
  • 214aeb724308c91847d4643a9a4f4c2d38d5abfa ipaserver/dcerpc: store forest topology as a blob in ipasam
  • 9d19c08269226ec15a6e99208aff66ca85fe2c51 ipatests: use fully qualified name for AD admin when establishing trust
  • 94242563d52adc0d6c539a78a70b5e486d6047ed Update ipa_sam.c
  • ae7cd4702dcbeb9479a3e4975a44f5e7b17061f5 trust-fetch-domains: use custom krb5.conf overlay for all trust operations
  • 54e5ffc0005d273773618fb0c23f96cc7e4a16c1 use a constant instead of /var/lib/sss/keytabs

ipa-4-9:

  • f8bf37422b7c49a4a39b4704b18158b37ee9ef80 ipa-kdb: provide correct logon time in MS-PAC from authentication time
  • 962052a0567b6878843272b1882d0a0b3b2debd1 ipasam: implement PASSDB getgrnam call
  • 2e8eb0f5fe82be58be88fa0d9b07ee7af69d8829 ipasam: allow search of users by user principal name (UPN)
  • e8f927db7da00d1671f871d3b2e89429aec3beb9 ipasam: free trusted domain context on failure
  • f103172954c259443f0c5b4ac89474e66cf3a1d6 ipasam: derive parent domain for subdomains automatically
  • 3d706b6f57309ec394df617cecb9a73d021fc2f7 ipaserver/dcerpc: store forest topology as a blob in ipasam
  • dc16c2484c1006bc249848383d86ef828abd921a ipatests: use fully qualified name for AD admin when establishing trust
  • b53592492879f87465774eb9a4d6c02a8ba26a5e Update ipa_sam.c
  • c842d4b5c2404d263d56aa0c4ba33fe32b2ca61e trust-fetch-domains: use custom krb5.conf overlay for all trust operations
  • 9f63afb4408e308c2ee972a72875525afefa5d54 use a constant instead of /var/lib/sss/keytabs

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to Trust to Active Directory support was improved to be more compatible with AD DC queries: lookup groups via LSA RPCs, allow user principal name lookups, more complete PAC record generation.
Metadata

trust

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.