# changelog

author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-15
changelog:
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-15
changelog:
  - Patch for indexing uidnumber and gidnumber
  - Patch to change DNA default values for replicas
  - Patch to fix uninitialized variable in ipa-getkeytab (454873)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-16
changelog:
  - ipa-server-install fails due to rpcbind taking 750/udp (451936)
  - Not easily reproduceable crash in password change (453185)
  - ldapadd: need acl for add operation (451889)
  - ipa-server-certinstall - Directory name error (451014)
  - ipa-server-certinstall for httpd problem (451098)
  - ipa-replica-prepare assumes self-signed certificate (452402)
  - "ipa-delgroup it" gets confused with group "editors" (453222)
  - Infinite recursion in memberof plug-in (452537)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.0-17
changelog:
  - NSS 3.11.99 and NSS 3.12 include a header in certutil output. Skip it. (#456694)
  - If the Firefox autoconfiguration jar has not been signed don't include it in replicas. (#452402)


author: Simo Sorce <ssorce@redhat.com> - 1.0.0-23
changelog:
  - Fix inititalization bug in /usr/sbin/ipa-fix-CVE-2008-3274
  - Fix compile error in a python module and syntax errors
    related: #457835


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-18
changelog:
  - fix syntax error in kadmin init script (#373011,#381011)
  - turn off content/size/date verification on krb5.conf (#329771)
  - fix storage of delegated krb5 credentials when they've been wrapped up in
    spnego (#319351)
  - return a delegated credential handle even if the application didn't pass a
    location to store the flags which would be used to indicate that credentials
    were delegated (#314651)
  - in login, allow PAM to interact with the user when they've been strongly
    authenticated (#309951)
  - signal PAM when we're changing an expired password that it's an expired
    password, so that when cracklib flags a password as being weak it's treated
    as an error even if we're running as root (#308131)
  - set the key expiration time in an AS-REP using the sooner of the client's
    entry's key expiration time and the entry's expiration time, instead of
    just the entry's expiration time (#250257)
  - in ftp, don't lose track of a client socket when a server-side error
    causes a download to fail (#248618)
  - in ftp, fix runique when mget is used (#247633)
  - add the snippet documenting the kdc_tcp_ports option to kdc.conf's man
    page, using text taken from the administrator's guide (#282191)
  - in kpasswd, when reading the client's principal name from the ccache fails
    for any reason, fall back to the user's name (#248631)
  - init script cleanups (Michal Marciniszyn, #242500)
  - tweak the telnet man page to refer to the telnet rlogin escape character
    as such instead of rereferring to it simly as the escape character or the
    telnet escape character (#247741)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-19
changelog:
  - backport from 1.6.3 to initialize a library-allocated get_init_creds_opt
    structure the same way we would one which was allocated by the calling
    application, to restore kinit's traditional behavior of doing a password
    change right when it detects an expired password (#413051)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-20
changelog:
  - allocate space for the relative path including the nul-terminator (Jose
    Plans, #426085)
  - fix a couple of spots where a file context wouldn't be freed


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-21
changelog:
  - add conditional logic to allow building only the krb5-server-ldap subpackage
    (#427790)
  - use the right sequence numbers when generating password-set/change requests
    for kpasswd servers after the first one (#427789)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-22
changelog:
  - add patch to fall back to TCP kpasswd servers for kdc-unreachable,
    can't-resolve-server, and response-too-big errors (#392631)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-23
changelog:
  - backport changes from 1.6.3 which allow callers of the the sendto-kdc
    functions to override the failover behavior on a per-response basis, and
    default to failing over on service-unavailable errors (#230384)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-24
changelog:
  - kdb_ldap: add patch to recognize "nsAccountLock: TRUE" as indicating that
    an entry should have the DISALLOW_ALL_TIX flag set (read only), for better
    interop with Fedora, Netscape, Red Hat Directory Server (Simo Sorce, #431784)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-25.el5ipa
changelog:
  - add preliminary patch to fix use of uninitialized pointer / double-free in
    KDC (CVE-2008-0062,CVE-2008-0063) (#432620, #432621)
  - add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901)
    (#415321)
  - add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971)
    (#415351)
  - add preliminary patch to fix incorrect handling of high-numbered descriptors
    in the RPC library (CVE-2008-0947) (#433596)


author: Rob Crittenden <rcritten@redhat.com> - 0.1735-2
changelog:
  - Include GSS_C_DELEG_FLAG in gss_init_sec_context() so the command-line
    tools can do kerberos ticket forwarding.


author: Rob Crittenden <rcritten@redhat.com> - 1.0-1
changelog:
  - Change name to python-kerberos from PyKerberos
  - Change license from "Apache License" to ASL 2.0 per guidelines
  - Upstream released 1.0 which is equivalent to version 1541. Reverting
    to that.


author: Mike Bonnet <mikeb@redhat.com>
changelog:
  - fix typo in error definition
  - change the return value of recvauth() from ac to (ac, princ), where princ is the principal sent by sendauth()
  - rename the package and reorganize the BuildRequires, to be more Extras-friendly


author: Mike Bonnet <mikeb@redhat.com> - 1.0.12-2
changelog:
  - configure.in: parse version number out of spec file
  - add URL tag
  - add LGPL text
  - remove Requires: krb5-libs, let rpm pick up library dependencies
  - bump revision


author: - Devrim GUNDUZ <devrim@commandprompt.com> 2.0.3-2
changelog:
  - Fixed 64 bit builds
  - Fixed license
  - Added Zope subpackage
  - Fixed typo in doc description
  - Added macro for zope subpackage dir


author: - Devrim GUNDUZ <devrim@commandprompt.com> 2.0.3-3
changelog:
  - Fixed zope package dependencies and macro definition, per bugzilla review (#199784)
  - Fixed zope package directory ownership, per bugzilla review (#199784)
  - Fixed cp usage for zope subpackage, per bugzilla review (#199784)


author: Luke Macken <lmacken@redhat.com> 0.5a0-0.1.svnr2115
changelog:
  - Use sitearch instead of sitelib in the files
  - Remove python-abi requirement
  - Ghost the .pyo files
  - Add the URL


author: Rich Megginson <rmeggins@redhat.com> - 8.0.0-4.el5dsrv
changelog:
  - several migration fixes
  - fix usage of open() with O_CREAT and db4->open() calls
  - update License to GPLv2 with exceptions as per Fedora


author: Rich Megginson <rmeggins@redhat.com> - 8.0.4-5.el5dsrv
changelog:
  - Resolves: bug 458171 - approx search accidentally fails with timelimit although it hasn't hit timelimit.


author: Rich Megginson <rmeggins@redhat.com> - 8.0.4-6.el4dsrv
changelog:
  - Resolves: bug 458506 - CVE-2008-3283 SASL bind can leak credentials in some cases
  - Resolves: bug 458507 - Memory leak setting new password storage scheme
  - Resolves: bug 458510 - Memory leak setting password with passwd extop
  - Resolves: bug 458666 - Memory leaks in check_trivial_words, check_pw_storagescheme_value
  - Resolves: bug 458668 - Memory leaks in ids_sasl_user_search
  - Resolves: bug 458675 - Memory leaks in valueset code
  - Resolves: bug 458677 - Memory leaks in index code doing indexed & range & matching rule searches


