Releases/4.0.0

ipa dnsforwardzone
--forwarder
ipa dnszone
ipa dnszone-* --forwarder
ipa dnsforwardzone-* --forwarder
ipa dnszone
ipa dnsforwardzone
cd "/var/named/dyndb-ldap/ipa/$ZONE/keys"
dnssec-keygen -3 -b 2048 -f KSK "$ZONE"
dnssec-keygen -3 -b 2048 "$ZONE"

/var/named/dyndb-ldap/ipa/$ZONE/keys
named
cd "/var/named/dyndb-ldap/ipa/$ZONE/keys"
chown named: *
chmod u=rw,go= *
rndc sign "$ZONE"

ipa dnszone-mod "$ZONE" --nsec3param-rec="1 0 8 1B3140F28A1C"

# ipa-ldap-updater --upgrade
# ipa-upgradeconfig

Adam Misnyovszki (17):
     ipactl can not restart ipa services if current status is stopped
     Add --force option to ipactl
     Certificate search max_serial_number problem fixed
     Extending user plugin with inetOrgPerson fields
     CA-less tests generate failure
     automember rebuild nowait feature added
     plugin registration refactoring for automembership
     CI - test_forced_client_reenrollment stability fix
     webui doc: typo fixes in guides
     webui: select all checkbox remains selected after operation
     plugin registration refactoring for pwpolicy
     Trust add datetime fix
     webui OTP token test data added
     webui static site delete command fixed
     webui tests: callback, assert_disabled feature added
     webui tests: range test extended
     Call generate-rndc-key.sh during ipa-server-install

Alexander Bokovoy (39):
     Remove systemd upgrader as it is not used anymore
     ipa-sam: do not modify objectclass when trust object already created
     ipa-sam: do not leak LDAPMessage on ipa-sam initialization
     ipa-sam: report supported enctypes based on Kerberos realm configuration
     ipaserver/dcerpc.py: populate forest trust information using realmdomains
     trusts: support subdomains in a forest
     frontend: report arguments errors with better detail
     ipaserver/dcerpc: remove use of trust account authentication
     trust: integrate subdomains support into trust-add
     ipasam: for subdomains pick up defaults for missing values
     KDC: implement transition check for trusted domains
     ipa-kdb: Handle parent-child relationship for subdomains
     Guard import of adtrustinstance for case without trusts
     Map NT_STATUS_INVALID_PARAMETER to most likely error cause: clock skew
     subdomains: Use AD admin credentials when trust is being established
     trust: fix get_dn() to distinguish creating and re-adding trusts
     trust-fetch-domains: create ranges for new child domains
     trustdomain-find: report status of the (sub)domain
     ipaserver/install/installutils: clean up properly after yield
     group-show: resolve external members of the groups
     ipa-adtrust-install: configure host netbios name by default
     ipasam: delete trusted child domains before removing the trust
     libotp: do not call internal search for NULL dn
     bindinstance: make sure zone manager is initialized in add_master_dns_records
     ipa-kdb: in case of delegation use original client's database entry, not the proxy
     ipa-kdb: make sure we don't produce MS-PAC in case of authdata flag cleared by admin
     trustdomain_find: make sure we skip short entries when --pkey-only is specified
     trust: make sure we always discover topology of the      forest trust
     ipaserver/dcerpc: catch the case of insuffient permissions when establishing trust
     adtrustinstance: make sure to stop and disable winbind in uninstall()
     fix filtering of subdomain-based trust users
     ipa-kdb: do not fetch client principal if it is the same as existing entry
     ipaserver/dcerpc: make sure to always return unicode SID of the trust domain
     trust: do not fetch subdomains in case shared secret was used to set up the trust
     schema-compat: set precedence to 49 to allow OTP binds over compat tree
     freeipa.spec.in: update dependencies to 389-ds and selinux-policy
     Fix packaging issue with doubly specified directories
     Add missing ipa-otptoken-import.1.gz to spec file
     ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration

Ana Krivokapić (33):
     Handle --subject option in ipa-server-install
     Fix handling of CSS files in sync.sh script
     Fix broken replica installation
     Add integration tests for Kerberos Flags
     Fix tests which fail after ipa-adtrust-install
     Add integration tests for forced client re-enrollment
     Create DS user and group during ipa-restore
     Add warning when uninstalling active replica
     Add option to ipa-client-install to configure automount
     Replace ntpdate calls with ntpd
     Fix invocations of FileError in ipa-client-install
     Do not crash if DS is down during server uninstall
     Do not show unexpected error in ipa-ldap-updater
     Follow tmpfiles.d packaging guidelines
     Add ipa-advise plugins for nss-pam-ldapd legacy clients
     Do not roll back failed client installation on server
     Make sure nsds5ReplicaStripAttrs is set on agreements
     Add test for external CA installation
     Fix regression which prevents creating a winsync agreement
     Use EXTERNAL auth mechanism in ldapmodify
     Add automember rebuild command
     Add a privilege and a permission needed for automember rebuild command
     Add unit tests for automember rebuild command
     Fix error message when adding duplicate automember rule
     Add automember rebuild command to the web UI
     Web UI integration test driver enhancement
     Add web UI integration tests for automember rebuild
     Add userClass attribute for users
     WebUI: Add userClass attribute to user and host pages
     Make Expression field required when adding automember condition
     Make sure state of services is preserved after client uninstall
     Enable Retro Changelog and Content Synchronization DS plugins
     Improve error message on failed Kerberos authentication

Gabe (8):
     ipa-join usage instructions are incorrect
     Typo in warning message where IPA realm and domain name differ
     Fix order of synchronizing time when running ipa-client-install
     fix typo in ipa -v migrate-ds
     ipa-client-automount should not configure nsswitch.conf manually
     ipa recursively adds old backups
     ipautil.run args log message is confusing
     Add version and API version

Jakub Hrozek (2):
     EXTDOM: Do not overwrite domain_name for INP_SID
     trusts: combine filters with AND to make sure only the intended domain matches

Jan Cholasta (105):
     Make PKCS#12 handling in ipa-server-certinstall closer to what other tools do.
     Port ipa-server-certinstall to the admintool framework.
     Remove unused NSSDatabase and CertDB method find_root_cert_from_pkcs12.
     Ignore empty mod error when updating DS SSL config in ipa-server-certinstall.
     Replace only the cert instead of the whole NSS DB in ipa-server-certinstall.
     Untrack old and track new cert with certmonger in ipa-server-certinstall.
     Add --pin option to ipa-server-certinstall.
     Ask for PKCS#12 password interactively in ipa-server-certinstall.
     Fix nsSaslMapping object class before configuring SASL mappings.
     Add --dirman-password option to ipa-server-certinstall.
     Fix ipa-server-certinstall usage string.
     Fix service-disable in CA-less install.
     Fix nsslapdPlugin object class after initial replication.
     Read passwords from stdin when importing PKCS#12 files with pk12util.
     Allow PKCS#12 files with empty password in install tools.
     Track DS certificate with certmonger on replicas.
     Make LDAPEntry a wrapper around dict rather than a dict subclass.
     Introduce IPASimpleLDAPObject.decode method for decoding LDAP values.
     Always use lists for values in LDAPEntry internally.
     Decode and encode attribute values in LDAPEntry on demand.
     Make sure attributeTypes updates are done before objectClasses updates.
     Remove legacy toDict and origDataDict methods of LDAPEntry.
     Store encoded attribute values from search results directly in entry objects.
     Use encoded values from entry objects directly when generating modlists.
     Use encoded values from entry objects directly when adding new entries.
     Turn LDAPEntry.single_value into a dictionary-like property.
     Remove mod_ssl port workaround.
     Move IPA specific code from LDAPClient to the ldap2 plugin.
     Add wrapper for result3 to IPASimpleLDAPObject.
     Support searches with paged results control in LDAPClient.
     Refactor indirect membership processing.
     Remove unused method get_api of the ldap2 plugin.
     Use hardening flags for ipa-optd.
     Own /usr/share/ipa/ui/js/ in the spec file.
     Prefer user CFLAGS/CPPFLAGS over those provided by rpmbuild in the spec file.
     Include LDFLAGS provided by rpmbuild in global LDFLAGS in the spec file.
     Add stricter default CFLAGS to Makefile.
     Fix compilation error in ipa-cldap.
     Remove CFLAGS duplication.
     Fix internal error in the user-status command.
     Convert remaining backend code to LDAPEntry API.
     Prevent garbage from readline on standard output of dogtag-ipa-retrieve-agent.
     PKI service restart after CA renewal failed
     Rename LDAPEntry method commit to reset_modlist.
     Use old entry state in LDAPClient.update_entry.
     Move LDAPClient method get_single_value to IPASimpleLDAPObject.
     Make IPASimpleLDAPObject.get_single_value result overridable.
     Use LDAPClient.update_entry for LDAP mods in ldapupdate.
     Reduce amount of LDAPEntry.reset_modlist calls in ldapupdate.
     Add LDAPEntry method generate_modlist.
     Remove unused LDAPClient methods get_syntax and get_single_value.
     Remove legacy LDAPEntry properties data and orig_data.
     Store old entry state in dict rather than LDAPEntry.
     Do not crash on bad LDAP data when formatting decode error message.
     Use raw LDAP data in ldapupdate.
     Fix ipa-client-automount uninstall when fstore is empty.
     Do not start the service in stopped_service if it was not running before.
     Increase service startup timeout default.
     Fix ntpd config on clients.
     Get original entry state from LDAP in LDAPUpdate.
     Convert remaining installer code to LDAPEntry API.
     Convert remaining update code to LDAPEntry API.
     Convert remaining test code to LDAPEntry API.
     Raise an exception when legacy LDAP API is used.
     Convert remaining frontend code to LDAPEntry API.
     Remove sourcehostcategory from the default HBAC rule.
     Always use real entry DNs for memberOf in ldap2.
     Fix modlist generation code not to generate empty replace mods.
     Log unhandled exceptions in certificate renewal scripts.
     Fix certificate renewal scripts to work with separate CA DS instance.
     Move CACERT definition to a single place.
     Do not create CA certificate files in CA-less server install.
     Use LDAP API to upload CA certificate instead of ldapmodify command.
     Upload CA certificate from DS NSS database in CA-less server install.
     Remove unused method export_ca_cert of dsinstance.
     Show progress when enabling SSL in DS in ipa-server-install output.
     Use certmonger D-Bus API to configure certmonger in CA install.
     Add new certmonger CA helper dogtag-ipa-ca-renew-agent.
     Update pkcs10 module functions to always load CSRs and allow selecting format.
     Remove unused function get_subjectaltname from the cert plugin.
     Add function for parsing friendly name from certificate requests.
     Support retrieving renewed certificates from LDAP in dogtag-ipa-ca-renew-agent.
     Use dogtag-ipa-ca-renew-agent to retrieve renewed certificates from LDAP.
     Remove dogtag-ipa-retrieve-agent-submit.
     Support storing renewed certificates to LDAP in dogtag-ipa-ca-renew-agent.
     Use dogtag-ipa-ca-renew-agent to track certificates on master CA.
     Store information about which CA server is master for renewals in LDAP.
     Make the default dogtag-ipa-ca-renew-agent behavior depend on CA setup.
     Merge restart_pkicad functionality to renew_ca_cert and remove restart_pkicad.
     Merge restart_httpd functionality to renew_ra_cert.
     Use the same certmonger configuration for both CA masters and clones.
     Update certmonger configuration in ipa-upgradeconfig.
     Support exporting CSRs in dogtag-ipa-ca-renew-agent.
     Remove unused method is_master of CAInstance.
     Fix upload of CA certificate to LDAP in CA-less install.
     Fix update_ca_renewal_master plugin on CA-less installs.
     Allow primary keys to use different type than unicode.
     Support API version-specific RPC marshalling.
     Replace get_syntax method of IPASimpleObject with new get_type method.
     Use raw attribute values in command result when --raw is specified.
     Keep original name when setting attribute in LDAPEntry.
     Allow SAN in IPA certificate profile.
     Support requests with SAN in cert-request.
     Remove GetEffectiveRights control when ldap2.get_effective_rights fails.
     Do not corrupt sshd_config in client install when trailing newline is missing.

Jan Pazdziora (1):
     Adding verb to error message to make it less confusing.

Jason Woods (1):
     ipa-sam: cache gid to sid and uid to sid requests in idmap cache

Krzysztof Klimonda (1):
     Fix -Wformat-security warnings

Lukáš Slebodník (1):
     BUILD: Fix portability of NSS in file ipa_pwd.c

Martin Bašti (72):
     Added warning if cert '/etc/ipa/ca.crt' exists
     ipa-client-install: Added options to configure firefox
     Removed old firefox configuration scripts
     Changed CLI to allow to use FILE as optional param
     migrate-ds added --ca-cert-file=FILE option
     PTR records can be added without specify FQDN zone name
     DNS classless support for reverse domains
     DNS tests for classless reverse domains
     Fix test_host_plugin for DNS Classless Reverse zones
     Allows to sort non text entries
     DNSName type
     DNSNameParam parameter
     dns_name_values capability added
     get_ancestors_primary_keys clone
     CLI conversion of DNSName type
     DNSName conversion in ipaldap
     Modified has_output attributes
     Modified dns related global functions
     Modified records and zone parameters to use DNSNameParam
     Modified record and zone class to support IDN
     _domain_name_validatord moved from DNS to realmdomains
     move hostname validation from DNS to hosts
     DNS modified tests
     DNS new tests
     PTR record target can be relative
     Test DNS: wildcard in RR owner
     Fix indentation
     Test DNS: dnsrecord-* zone.test. zone.test. should work
     Make zonenames absolute in host plugin
     Python-kerberos update in freeipa.spec.in
     Separate master and forward DNS zones
     Prevent commands to modify different type of a zone
     Create BASE zone class
     Tests DNS: forward zones
     Fix handle python-dns UnicodeError
     DNSSEC: remove unsuported records
     DNSSEC: added NSEC3PARAM record type
     DNSSEC: webui update DNSSEC attributes
     Tests: remove unused records from tests
     Tests: tests for NSEC3PARAM records
     DNSSEC: DLVRecord type added
     DNSSEC: Test: DLV record
     Digest part in DLV/DS records allows only heaxadecimal characters
     DNSSEC: WebUI add DLV record type
     Fix ipa.service restart
     Fix incompatible DNS permission
     Added upgrade step executed before schmema is upgraded
     Upgrade special master zones to forward zones
     Check normalization only for IDNA domains
     DNSSEC: add TLSA record type
     DNSSEC: WebUI: add TLSA record
     Fix ACI in DNS
     Remove NSEC3PARAM record
     Add NSEC3PARAM to zone settings
     NSEC3PARAM tests
     Allow to add non string values to named conf
     DNSSEC: Add experimental support for DNSSEC
     Add warning about semantic change for zones
     Add DNSSEC experimental support warning message
     Use documentation addresses in dns help
     Help for forward zones
     Split dns docstring
     Fix upgrade to forward zones
     Fix incompatible permission name *zone-del
     Non IDNA zonename should be normalized to lowercase
     Fix tests dns_realmdomains_integration
     Fix: Missing ACI for records in 40-dns.update
     Restore privileges after forward zones update
     Allow to add managed permission for reverse zones
     Test DNS: test zone normalization
     Test DNS: TLSA record
     Test DNS: add zone with consecutive dash characters

Martin Košek (58):
     Bump 3.4 development version to 3.3.90
     Prevent *.pyo and *.pyc multilib problems
     Remove rpmlint warnings in spec file
     Fix selected minor issues in the spec file and license
     Use FQDN when creating MSDCS SRV records
     Do not set DNS discovery domain in server mode
     Require new SSSD to pull required AD subdomain fixes
     Remove faulty DNS memberOf Task
     Do not allow '%' in DM password
     Remove --no-serial-autoincrement
     PKI installation on replica failing due to missing proxy conf
     Use consistent realm name in cainstance and dsinstance
     Winsync re-initialize should not run memberOf fixup task
     Installer should always wait until CA starts up
     Administrative password change does not respect password policy
     Do not add kadmin/changepw ACIs on new installs
     Make set_directive and get_directive more strict
     Remove mod_ssl conflict
     Add nsswitch.conf to FILES section of ipa-client-install man page
     Remove ipa-pwd-extop and ipa-enrollment duplicate error strings
     Remove deprecated AllowLMhash config
     Server does not detect different server and IPA domain
     Allow kernel keyring CCACHE when supported
     Consolidate .gitignore entries
     Increase Java stack size on PPC platforms
     Increase Java stack size on s390 platforms
     Revert restart scripts file permissions change
     hbactest does not work for external users
     sudoOrder missing in sudoers
     Add missing example to sudorule
     Remove missing VERSION warning in dnsrecord-mod
     Hide trust-resolve command
     Add runas option to run function
     Switch httpd to use default CCACHE
     httpd should destroy all CCACHEs
     ntpconf: remove redundant comment
     Fallback to global policy in ipa-lockout plugin
     ipa-lockout: do not fail when default realm cannot be read
     Migration does not add users to default group
     .mailmap: use correct name format for Adam
     Avoid passing non-terminated string to is_master_host
     ipa-replica-install never checks for 7389 port
     Fix idrange unit test failure
     Update Dogtag 9 database during replica installation
     Proxy PKI clone /ca/ee/ca/profileSubmit URI
     Add missing dependencies to freeipa-python package
     Add requires for pki-core-10.1.1-1.fc20
     Make ipa-client-automount backwards compatible
     Make trust objects available to regular users
     Revert "Check for password expiration in pre-bind"
     Add python-yubico to BuildRequires
     Fix objectClass casing in LDIF to prevent schema update error
     Let Host Administrators use host-disable command
     Remove python-cherrypy BuildRequires
     Update X-ORIGIN for 4.0
     Clear NSS session cache when socket is closed
     Add Modify Realm Domains permission
     Prepare spec for 4.0 release

Nalin Dahyabhai (3):
     Add missing dependency
     Accept any alias, not just the last value
     Restore krbCanonicalName handling

Nathaniel McCallum (41):
     Bypass ipa-replica-conncheck ssh tests when ssh is not installed
     Ensure credentials structure is initialized
     Document no_search in Param flags
     Don't special case the Password class in Param.__init__()
     Add optional_create flag
     Allow multiple types in Param type validation
     Add IntEnum parameter to ipalib
     Add support for managing user auth types
     Add RADIUS proxy support to ipalib CLI
     Add OTP support to ipalib CLI
     Add rpmbuild/ to .gitignore
     Move ipa-otpd socket directory
     Fix OTP token names/labels
     Fix generation of invalid OTP URIs
     Update ACIs to permit users to add/delete their own tokens
     ipa-kdb: validate that an OTP user has tokens
     Enable building in C99 mode
     Add libotp internal library for slapi plugins
     Add support to ipa-kdb for keyless principals
     Add HOTP support
     Add OTP last token plugin
     Add OTP sync support to ipa-pwd-extop
     Teach ipa-pwd-extop to respect global ipaUserAuthType settings
     Use super() properly to avoid an exception
     Make all ipatokenTOTP attributes mandatory
     Remove NULLS from constants.py
     Rework how otptoken defaults are handled
     Fix token secret length RFC compliance
     Fix a typo in the otptoken doc string
     kdb: Don't provide password expiration when using only RADIUS
     Only specify the ipatokenuniqueid default in the add operation
     Default the token owner to the person adding the token
     Update all remaining plugins to the new Registry API
     Add support for managedBy to tokens
     Periodically refresh global ipa-kdb configuration
     Make otptoken use os.urandom() for random data
     Implement OTP token importing
     Change OTPSyncRequest structure to use OctetString
     Add /session/token_sync POST support
     Add the otptoken-add-yubikey command
     Add otptoken-sync command

Nick Hatch (1):
     Don't exclude symlinks when loading plugins

Petr Viktorin (258):
     Allow freeipa-tests to work with older paramiko versions
     Allow API plugin registration via a decorator
     Add missing license header to ipa-test-config
     Add CA-less install tests
     Add man pages for testing tools
     Remove __all__ specifications in ipaclient and ipaserver.install
     Make make-lint compatible with Pylint 1.0
     Move tests to test directories
     Convert test_ipautil from unittest to nose
     Add missing dict methods to CIDict
     Raise an error when updating CIDict with duplicate keys
     Use correct super-calls in get_args() methods
     test_integration.host: Move transport-related functionality to a new module
     test_integration: Add OpenSSHTransport, used if paramiko is not available
     ipatests.test_integration.test_caless: Fix mkdir_recursive call
     ipatests.beakerlib_plugin: Warn instead of failing when some logs are missing
     ipatests.order_plugin: Exclude test generators from the order
     ipatests.beakerlib_plugin: Add argument of generated tests to test captions
     ipatests.test_cmdline.test_help: Re-raise unexpected exceptions on failure
     Add tests for installing with empty PKCS#12 password
     Update translations from Transifex
     ipa-client-install: Use direct RPC instead of api.Command
     ipa-client-install: Verify RPC connection with a ping
     Do not fail upgrade if the global anonymous read ACI is not found
     ipapython.nsslib: Name arguments to NSPRError
     test_ipalib.test_crud: Don't use a string in takes_options
     Add tests for the IntEnum class
     test_caless.TestCertInstall: Fix 'test_no_ds_password' test case
     Use new CLI options in certinstall tests
     Use a user result template in tests
     test_simple_replication: Fix waiting for replication
     Fix date in last changelog entry
     Update Permission and ACI plugins to decorator registration API
     Fix indentation in permission plugin tests
     Fix invalid assumption NSS initialization check in SSLTransport
     Help plugin: don't fail if a topic's module is not found
     Use new ipaldap entry API in aci and permission plugin
     Improve permission plugin test cleanup
     Tests: mkdir_recursive: Don't fail when top-level directory doesn't exist
     beakerlib plugin: Don't try to submit logs if they are missing
     Fix debug output in integration test
     Add tests for user auth type management
     Remove unused utf8_encode_value functions
     ldapupdate: Factor out connection code
     dsinstance: Move the list of schema filenames to a constant
     Add schema updater based on IPA schema files
     Update the man page for ipa-ldap-updater
     Remove schema modifications from update files
     Remove schema special-casing from the LDAP updater
     Make schema files conform to new updater
     Add formerly update-only schema
     Unify capitalization of attribute names in schema files
     Update translations from Transifex
     Add ConcatenatedLazyText object
     Break long doc string in the Host plugin
     Improve LDAPEntry.__repr__ for freshly created entries
     Remove changelog from the spec
     Switch client to JSON-RPC
     Make jsonserver_kerb start a cookie-based session
     Add server/protocol type to rpcserver logs
     Add tests for the radiusproxy plugin
     test_integration: Support external names for hosts
     test_integration: Log external hostname in Host.ldap_connect
     Regression test for user_status crash
     test_webui: Allow False values in configuration for no_ca, no_dns, has_trusts
     Allow sets for initialization of frozenset-typed Param keywords
     Allow Declarative test classes to specify the API version
     Add tests for permission plugin with older clients
     Add new permission schema
     Rewrite the Permission plugin
     Verify ACIs are added correctly in tests
     Roll back ACI changes on failed permission updates
     permission plugin: Ensure ipapermlocation (subtree) always exists
     Make sure SYSTEM permissions can be retreived with --all --raw
     Test adding noaci/system permissions to privileges
     Remove default from the ipapermlocation option
     permission_find: Do not fail for ipasearchrecordslimit=-1
     cli.print_attribute: Convert values to strings
     Use new registration API in the privilege plugin
     Allow anonymous and all permissions
     rpcserver: Consolidate __call__ in xmlclient and jsonclient_kerb
     Implement XML introspection
     ipa-replica-install: Move check for existing host before DNS resolution check
     integration tests OpenSSHTransport: Expand tilde to home in root_ssh_key_filename
     ipa tool: Print the name of the server we are connecting to with -v
     Add a .mailmap file
     Correct Jenny Severance's last name
     Update README and BUILD
     Remove the TODO file
     Permission plugin fixes
     permission plugin: Convert options in execute, not args_options_2_params
     permission plugin: Generate ACIs in the plugin
     Make it possible to call custom functions in Declarative tests
     Add support for managed permissions
     .mailmap: Remove spurious Kyle Baker line
     permission-mod: Do not copy member attributes to new entry
     permissions: Use multivalued targetfilter
     Add permission_filter_objectclasses for explicit type filters
     Add tests for multivalued filters
     Remove the unused ipalib.frontend.Property class
     permission plugin: Do not assume attribute-level rights for new attributes are present
     Update API.txt
     ipalib.plugins: Expose LDAPObjects' eligibility for permission --type in JSON metadata
     Test fixed modlist generation code
     test_integration.config: Fix crash in to_env when no replica is defined
     test_integration.config: Do not save the input environment
     test_integration.config: Use a more declarative approach to test-wide settings
     test_integration.config: Do not store the index in Domain and Host objects
     test_integration.config: Load/store from/to dicts
     test_integration.config: Add environment variables for JSON/YAML
     ipa-test-config: Add --json and --yaml output options
     test_integration.config: Convert some text values to str
     Add tests for integration test configuration
     ipalib.plugable: Always set the parser in bootstrap()
     tests: Create the testing service certificate on demand
     permission-mod: Remove attributelevelrights before reverting entry
     permission plugin: Allow multiple values for memberof
     permissions plugin: Don't crash with empty targetfilter
     permission-find: Cache the root entry for legacy permissions
     permission_add: Remove permission entry if adding the ACI fails
     Do not hardcode path to ipa-getkeytab in tests
     ipaserver.install.service: Fix estimated time display
     permission plugin: Output the extratargetfilter virtual attribute
     permission plugin: Write support for extratargetfilter
     permission CLI: Rename filter to rawfilter, extratargetfilter to filter
     permission plugin: Add tests for extratargetfilter
     permission plugin: Support searching by extratargetfilter
     permission plugin: Do not fail on non-DN memberof filters
     permission plugin: Do not change extra target filters by "views"
     Add Nathaniel McCallum to .mailmap
     test_integration.tasks: Do not fail cleanup if backup directory does not exist
     cli: Clean up imports
     cli: Show list of values in --help for all Enums
     cli: Add mechanism for deprecated option name aliases
     permission CLI: rename --permissions to --right
     permission plugin: Do not add the ipapermissionv2 for output
     Allow indexing API object types by class
     permission-find: Fix handling of the search term for legacy permissions
     test_permission_plugin: Fix tests that make too broad assumptions
     Allow modifying permissions with ":" in the name
     Add Object metadata and update plugin for managed permissions
     permission plugin: Add 'top' to the list of object classes
     Allow anonymous read access to containers
     Add managed read permissions to HBAC objects
     Document the managed permission updater operation
     Allow overriding all attributes of default permissions
     ipalib.errors: Fix TaskTimeout doctest
     Add managed read permissions to Sudo objects
     Add managed read permissions to group
     Add managed read permission to hostgroup
     CA-less tests: Use sequential certificate serial numbers
     Add mechanism for adding default permissions to privileges
     Add managed read permissions to RBAC objects
     Add managed read permissions to realmdomains
     Add managed read permission for SELinux user map
     test_realmdomains_plugin: Add default ACI to expected output
     Add managed read permissions to host
     Add managed read permissions to pwpolicy and cosentry
     Fix expected output in permission tests
     Add managed read permission to config
     Add managed read permissions to krbtpolicy
     Allow anonymous read access to Kerberos containers
     Add managed read permission to idrange
     Add managed read permission to automount
     Do not ask for memberindirect when updating managed permissions
     Add managed read permissions to automember
     test_integration.host: Export the hostname to dict as string
     Add a new ipaVirtualOperation objectClass to virtual operations
     Extend anonymous read ACI for containers
     Add managed read permission to service
     Add support for non-plugin default permissions
     Add several managed read permissions under cn=etc
     test_ldap: Read a publicly accessible attribute when testing anonymous bind
     aci-update: Trim the admin write blacklist
     aci-update: Add ACI for read-only admin attributes
     trust plugin: Remove ipatrustauth{incoming,outgoing} from default attrs
     Add managed read permissions to trust
     ipalib.aci: Add support for == and != operators to ACI
     Move ACI tests to the testsuite
     ipalib.aci: Allow alternate "aci" keyword in ACIs
     ipa-client-automount: Use rpcclient, not xmlclient, for automountlocation_show
     Replace "replica admins read access" ACI with a permission
     ipalib.cli: Add filename argument to ipa console
     Add managed read permissions to user
     update_managed_permissions: Pass around anonymous ACI rather than its blacklist
     Set user addressbook/IPA attribute read ACI to anonymous on upgrades from 3.x
     Remove the global anonymous read ACI
     ldap2.find_entries: Do not modify attrs_list in-place
     ipalib.version: Add VENDOR_VERSION
     admin tools: Log IPA version
     dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone
     pwpolicy-mod: Fix crash when priority is changed
     aci plugin: Fix internal error when ACIs are not readable
     Add managed read permission for the UPG Definition
     ldap2.has_upg: Raise an error if the UPG definition is not found
     krbtpolicy plugin: Code cleanup
     krbtpolicy plugin: Fix internal error when global policy is not readable
     Add read permissions for automember tasks
     ipalib.aci: Fix bugs in comparison
     test_permission_plugin: limit results in targetfilter find test
     Add mechanism for updating permissions to managed
     Convert Sudo rule default permissions to managed
     Add missing attributes to 'Modify Sudo rule' permission
     Split long docstrings that were recently modified
     managed perm updater: Handle case where we changed default ACIs in the past
     Convert User default permissions to managed
     Add missing attributes to User managed permissions
     permission plugin: Sort rights when writing the ACI
     Add method to enumerate managed permission templates
     Add ACI.txt
     Make 'permission' the default bind type for managed permissions
     Make sure member* attrs are always granted together in read permissions
     ipalib.frontend: Do API version check before converting arguments
     ipalib.config: Only convert basedn to DN
     ipalib.config: Don't autoconvert values to float
     Fix self argument in tasks
     managed permission updater: Add mechanism to replace SYSTEM permissions
     Convert DNS default permissions to managed
     Remove the update_dns_permissions plugin
     Add $REALM to variables supported by the managed permission updater
     Convert COSTemplate default permissions to managed
     Convert Password Policy default permissions to managed
     Allow read access to masters, but not their services, to auth'd users
     Fix: Allow read access to masters, but not their services, to auth'd users
     Allow anonymous read access to virtual operation entries
     Test and docstring fixes
     permission plugin: Join --type objectclass filters with OR
     Add posixgroup to groups' permission object filter
     Convert Host default permissions to managed
     host permissions: Allow writing attributes needed for automatic enrollment
     netgroup: Add objectclass attribute to read permissions
     Convert Automount default permissions to managed
     Convert Group default permissions to managed
     Convert HBAC Rule default permissions to managed
     Convert HBAC Service default permissions to managed
     Convert HBAC Service Group default permissions to managed
     Convert Hostgroup default permissions to managed
     Convert Netgroup default permissions to managed
     Convert the Modify privilege membership permission to managed
     Convert Role default permissions to managed
     Convert SELinux User Map default permissions to managed
     Convert Service default permissions to managed
     Convert Sudo Command default permissions to managed
     Convert Sudo Command Group default permissions to managed
     Add several CRUD default permissions
     test_permission_plugin: Fix permission_find test for legacy permissions
     Update translations
     install/ui/build: Build core.js
     permission plugin: Ignore unparseable ACIs
     Allow admins to write krbLoginFailedCount
     Do not fail if there are multiple nsDS5ReplicaId values in cn=replication,cn=etc
     test_ipagetkeytab: Fix expected error message
     test_ipaserver: Add OTP token test data to ipatests package
     ldapupdate: Restore 'replace' functionality
     Allow read access to services in cn=masters to auth'd users
     makeaci: Use the DN where the ACI is stored, not the permission's DN
     Update translations
     Become IPA 4.0.0

Petr Voborník (264):
     Make ssh_widget not-editable if attr is readonly
     Hide delete button in multivalued widget if attr is not writable
     Removal of deprecated selenium tests
     Add base-id, range-size and range-type options to trust-add dialog
     Hide 'New Certificate' action on CA-less install
     Web UI integration tests: CA-less
     Web UI Integration tests: Kerberos Flags
     Web UI integration tests: ID range types
     Show human-readable error name in error dialog title
     Update idrange search facet after trust creation
     Fix RUV search scope in ipa-replica-manage
     Fix redirection on deletion of last dns record entry
     Allow edit of ipakrbokasdelegate in Web UI when attrlevelrights are unknown
     Fix enablement of automount map type selector
     ipatests.test_integration.host: Add logging to ldap_connect()
     Load updated Web UI files after server upgrade
     Removal of unused code
     Web UI source code annotation
     Configuration for JSDuck documentation generator
     Phases Guide
     Debugging Web UI guide
     Plugin Infrastructure Guide
     Navigation Guide
     Registries and Build Guide
     Fix password expiration notification
     Fix license in some Web UI files
     Increase stack size for Web UI builder
     Remove SID resolve call from Web UI
     Fix disabled logic of menu item
     RCUE initial commit
     Move RCUE styles to its own directory
     Delete Overpass fonts in UI root
     Use RCUE fonts
     Updated sync.sh
     Change menu rendering to match RCUE structure
     Allow RCUE
     Prefer Open Sans Regular font
     Remove background
     Remove width limit
     Remove jquery UI
     RCUE Navigation
     RCUE Header
     New header logo
     Adapt password expiration notification to new navigation
     Fix breadcrumb
     Fix search facet table styling - bug in chrome
     Fix action panel list styles
     Remove jquery button usage and unify button code
     Change undo to regular button
     Change undo-all to regular button
     New checkboxes and radio styles
     Always create radio and checkbox with label
     New Fluid form layout
     Use Fluid layout be default
     Do not display tooltip everywhere
     RCUE dialog implementation
     RCUE dialog close icon
     Dialog keyboard behavior
     Fluid layout in DNS Zone adder dialog
     Fix Association adder dialog styling
     CSS: make hostname in host adder dialog wider
     Do not open dialog in a container
     Remove left-margin from details-section
     Fix h1 style in dialog
     Fix radios behavior in automount map adder dialog
     CSS: fix network activity indicator position in control panel
     Fix padding of link buttons and labels in forms
     CSS: fix footer padding
     Fix hbac test styling
     Fix search input styling
     Combobox styles
     Action list styling
     Dojo event support in widgets
     Display required, enabled and error widget states in fluid layout
     Focus input on label click in fluid layout
     Do not show section header in unauthorized dialog
     username_r in password reset part of unauthorized dialog should be enabled as well
     Fix notification area
     Add style to dialog message area
     Update Dojo to 1.9.1
     Remove last usage of jQuery UI
     Update jQuery to version 2.0.3
     Add Font Awesome
     Change font-awesome to be compilable by lesscpy
     Font Awesome icons in header
     Replace icons with the ones from Font Awesome
     Status widgets icons
     Facet title status icons
     Use font awesome glyph for dialog close button
     Font awesome glyphs as checkboxes and radios
     Increase margin between facet control buttons
     Fix association adder dialog table-body position
     New header spinner
     Increase distance between control buttons and facet-tabs
     About dialog
     Use fluid layout in host adder dialog fqdn widget
     Web UI integration tests: maximize browser window by default
     Use only system fonts
     Trust domains Web UI
     webui: Focus expand/collapse link in batch_error dialog
     webui: Don't act on keyboard events which originated in different dialog
     Added empty value meaning to boolean formatter
     Declarative replacement of array item in specification object
     Fixed doc examples in Spec_mod
     Password Dialog
     Use general password dialog for host OTP
     Fix handling of action visibility change in action panel
     UI for OTP tokens
     UI for radius proxy
     UI for managing user-auth types
     Added QRcode generation to Web UI
     Support OTP in form based auth
     webui: use unique ids for checkboxes
     webui: Datetime parsing and formatting
     webui: remove hover effect from disabled action button
     webui-css: improve radio,checkbox keyboard support and color
     webui: do not use dom for getting selected automount keys
     webui-static: update metadata files
     webui: fix unit tests
     webui: better check for existing options in attributes_widgets
     webui: do not create ⟨hr⟩ delimiter between sections
     webui: reflect enabled state in child widgets of a multivalued widget
     webui: change permissions UI to v2
     webui: update license information of used third party code
     webui-ci: fix test_rebuild_membership_hosts on server without DNS
     webui: rename domNode to dom_node
     webui: make navigation module independent on app module
     webui: move RPC code from IPA module to its own module
     webui: replace IPA.command usage with rpc.command
     webui: field and widget binding refactoring
     webui: replace widget's hidden property with visible
     webui: change widget updated event into value change event
     webui-tests: binding test suite
     webui: facet container
     webui: FormMixin
     webui: ContainerMixin
     webui: standalone facet
     webui: activity widget
     webui: publish network activity topics
     webui: load page
     webui: validation summary widget
     webui: login screen widget
     webui: login page
     webui: authentication module
     webui: use asynchronous call for authentication
     webui: fix combobox styles to work with selenium testing
     webui-ci: adapt to new login screen
     webui: remove IPA.unauthorized_dialog
     webui: fix OTP Token add regression
     webui: regression - enable fields on idrange type change (add)
     webui-ci: adjust id range tests to new validator
     webui: fix switching between multiple_choice_section choices
     webui: otptoken-adder dialog - remove obsolete comment
     migration: fix import of wsgiref.util
     webui-ci: save screenshot on test failure
     webui-ci: decorate all webui tests with screenshot decorator
     rpcserver: login_password datetime fix in expiration check
     Increase Java stack size for Web UI build on aarch64
     webui: remove logout.html
     webui: remove login.html
     webui: add PaternFly css
     webui: apply PatternFly login theme on reset_password.html
     webui: apply PatternFly theme on config pages
     webui: styles for alert icons
     webui: apply PatternFly theme on migration pages
     webui: remove remnants of jquery-ui
     webui: remove unused icons
     webui: remove unused collapsible feature from section
     webui: remove unused images
     webui: change absolutely positioned layout to fluid
     webui: remove column sizing in tables, use PF styles
     webui: change navigation from RCUE to PatternFly
     webui: adjust styles to PatternFly
     webui: display undo and multivalued delete buttons in input-group
     webui: allow multiple base section layouts
     webui: change breadcrumb to PatternFly
     webui: use h1 in facet title instead of h3
     webui: remove action list widget
     webui: add action dropdown
     webui: add space between action buttons's icon and text
     webui: remove select action
     webui: add confirmation to action dropdown actions
     webui: move certificate actions to action dropdown
     webui: move user reset password action to action dropdown
     webui: patternFly dialog
     webui: adjust association adder dialog to PatternFly
     webui: activity indicators
     webui: improve pagination
     webui: do not show empty table footer
     webui: restyle automember default group
     webui: preload automember default group select list
     webui: adjust login page to PatternFly
     webui: use BS alerts in validation_summary_widget
     webui-ci: select search table item - chrome issue
     webui: remove old css for standalone pages
     webui: adjust header controls alignment
     webui: add search box placeholder text
     webui: change control buttons to normal buttons
     webui: certificate search - select search attribute only when defined
     webui: association adder dialog - change find label to filter
     webui: use dark color for facet titles without pkey
     webui-ci: assert_action_list_action
     webui: move host action panel actions to action dropdown
     webui: move service action panel actions to action dropdown
     webui: use normal buttons instead of link buttons in multivalued widget
     webui: move radius proxy action panel commands to header actions
     webui: proper alerts in dialogs
     webui: use propert alerts in header notification area
     webui: fix search box overlap in mobile mode
     webui: fix layout of QR code on wide screens
     webui: break long text in a code element in a modal
     webui: fix regression: enabled gid field on group add
     webui: add idnsSecInlineSigning option to DNS zone details facet
     webui: simplify self-service menu
     webui: display only dialogs which belong to current facet
     webui: handle back button when unauthenticated
     webui: fix SSH Key widget update
     webui: handle "unknown" result of automember-default-group-show
     webui: control sudo rule deny command tables by category switch
     webui: add sudoorder field to sudo rule page
     webui: move RPC result extraction logic to Adapter
     webui: expose krbprincipalexpiration
     webui: fix excessive registration of state change event listeners
     webui: support standalone facets in navigation module
     webui: generic routing
     webui: add parent link to widgets in ContainerMixin
     webui: plugin API
     webui-ci: adjust tests to dns changes
     webui: fix field's default value
     webui: don't limit permission search in privileges
     ldap2: add otp support to modify_password
     rpcserver: add otp support to change_password handler
     ipa-passwd: add OTP support
     webui: support password change with OTP in login screen
     webui: placeholder attribute support in textbox and textarea
     webui: add placeholders to login screen
     webui: rebase user password dialog on password dialog and add otp support
     webui: support otp in reset_password.html
     rpcserver: fix local vs utc time comparison
     webui: add confirmation for dns zone permission actions
     webui: dns forward zones
     webui-ci: dns forward zone tests
     webui-test: static metadata update
     webui-test: dns forward zone json data
     webui: fix detection of RPC command
     webui: send API version in RPC requests
     webui: extract rpc value from object envelope
     webui: base class for LoginScreen-like facets
     webui: add OTP token synchronization
     webui: add link pointing to OTP sync page to login
     webui: support global notifications in all containers
     webui: bind Login facet and OTP sync facet
     webui: fix confirmation mixin origin check
     webui: layer for standalone pages which use WebUI framework
     webui: add sync_otp.html
     webui-ci: fix action list action visibility and enablement assertion
     webui: support unlock user command
     webui: show notification instead of modal dialog on validation error
     webui: fix required error notification in multivalued widget
     webui: focus invalid widget on validation error
     webui-build: use /usr/share/java/js.jar instead of rhino.jar
     webui: change ipatokennotbefore and ipatokennotafter types to datetime
     webui: new navigation structure
     webui: display messages contained in API responses

Petr Špaček (15):
     Add timestamps to named debug logs in /var/named/data/named.run
     Clarify error message about IPv6 socket creation in ipa-cldap plugin
     Treat error during write to /etc/resolv.conf as non-fatal.
     Limit memberOf and refInt DS plugins to main IPA suffix.
     Remove working directory for bind-dyndb-ldap plugin.
     Use private IPv4 addresses for tests
     Rename variables in test xmlrpc/dns_plugin
     Use reserved domain names for tests
     tests: Move zone enable/disable tests to end of test_dns_plugin.py
     Fix regular expression for LOC records in DNS.
     Modify DNS tests with LOC records to workaround bug in python-dns.
     Clarify error message about missing DNS component in ipa-replica-prepare.
     Add wait_for_dns option to default.conf.
     Fix --ttl description for DNS zones
     Clarify LDAPClient docstrings about get_entry, get_entries and find_entries

Rob Crittenden (5):
     Re-order NULL check in ipa_lockout.
     Change the way we determine if the host has a password set.
     Implement an IPA Foreman smartproxy server
     Clean up Smartproxy support, drop unused code
     Remove IPA Foreman Smart Proxy

Simo Sorce (16):
     pwd-plugin: Fix ignored return error
     kdb-mspac: Fix out of bounds memset
     kdb-princ: Fix memory leak
     Add Delegation Info to MS-PAC
     Add krbticketPolicyAux objectclass if needed
     Fix license tag in python setup files
     Harmonize policy discovery to kdb driver
     Stop adding a default password policy reference
     Check for password expiration in pre-bind
     keytabs: Modularize setkeytab operation
     keytabs: Expose and modify key encoding function
     keytab: Add new extended operation to get a keytab.
     ipa-getkeytab: Modularize ldap_set_keytab function
     ipa-getkeytab: Add support for get_keytab extop
     man: Add -r option to ipa-getkeytab.1
     Fix getkeytab code to always use implicit tagging.

Sumit Bose (9):
     CLDAP: make sure an empty reply is returned on any error
     CLDAP: do not read IPA domain from hostname
     Use the right attribute with ipapwd_entry_checks for MagicRegen
     Remove AllowLMhash from the allowed IPA config strings
     Remove generation and handling of LM hashes
     CLDAP: do not prepend \\
     CLDAP: generate NetBIOS name like ipa-adtrust-install does
     CLDAP: add unit tests for make_netbios_name
     extdom: do not return results from the wrong domain

Thorsten Scherf (4):
     Fixed typo how to create an example gpg key
     Fixed typo in ipa-test-task man page
     Fixed various typos in ipa-client-install man page
     Fixed typo in ipa-replica-manage man page

Timo Aaltonen (2):
     Use /usr/bin/python as fallback python path
     Don't search platform path

Tomáš Babej (139):
     Remove support for IPA deployments with no persistent search
     Remove redundant shebangs
     Perform dirsrv tuning at platform level
     Make CS.cfg edits with CA instance stopped
     Fix incorrect error message occurence when re-adding the trust
     Log proper error message when defaultNamingContext not found
     Use getent admin@domain for nss check in ipa-client-install
     Do not add trust to AD in case of IPA realm-domain mismatch
     Warn user about realm-domain mismatch in install scripts
     trusts: Do not create ranges for subdomains in case of POSIX trust
     ipa-upgradeconfig: Remove backed up smb.conf
     ipa-adtrust-install: Add warning that we will break existing samba configuration
     adtrustinstance: Properly handle uninstall of AD trust instance
     adtrustinstance: Move attribute definitions from setup to init method
     ipatests: Extend the order plugin to properly handle inheritance
     Get the created range type in case of re-establishing trust
     ipatests: Add Active Directory support to configuration
     ipatests: Extend domain object with 'ad' role support and WinHosts
     ipatests: Extend IntegrationTest with multiple AD domain support
     ipatests: Create util module for ipatests
     ipatests: Add WinHost class
     ipatests: Add AD-integration related tasks
     ipatests: Add AD integration test case
     trusts: Fix typo in error message for realm-domain mismatch
     advice: Add legacy client configuration script using nss-ldap
     ipatests: Extend clear_sssd_cache to support non-systemd platforms
     ipatests: Restore SELinux context after restoring files from backup
     ipatests: Do not use /usr/bin hardcoded paths
     ipatests: Add support for extra roles referenced by a keyword
     ipatests: Use command -v instead of which in legacy client advice
     ipatests: Add integration tests for legacy clients
     ipatests: test_trust: use domain name instead of realm for user lookups
     platform: Add Fedora 19 platform file
     ipa-client-install: Publish CA certificate to systemwide store
     trusts: Do not pass base-id to the subdomain ranges
     trusts: Always stop and disable smb service on uninstall
     ipa-client-install: Always pass hostname to the ipa-join
     ipa-cldap: Cut NetBIOS name after 15 characters
     Fix incorrect path in error message on sysrestore failure
     acl: Remove krbPrincipalExpiration from list of admin's excluded attrs
     ipatests: Remove sudo calls from tasks
     ipatests: Check for legacy_client attribute presence if unapplying fixes
     ipatests: test_legacy_clients: Change "test group" to "testgroup"
     ipatests: Add records for all hosts in master's domain
     ipatests: Run restoring backup files and restoring their context in one session
     ipatests: legacy_clients: Test legacy clients with non-posix trust
     ipatests: Perform a connection test before preparing the client
     ipatests: Make sure we re-kinit as admin before adding the disabledipauser
     ipatests: Stop sssd service before deleting the cache
     ipatests: Add test cases for subdomain users on legacy clients
     ipatests: Change expected home directories returned by getent
     ipatests: Do not require group name resolution for the non-posix tests
     ipatests: Fix incorrect order of operations when restoring backup
     trusts: Remove usage of deprecated LDAP API
     man: sshd should be run at least once before client enrollment
     Prohibit deletion of active subdomain range
     ipatests: test_trust: Change expected home directories for posix users
     ipatests: Do not depend on the case of the attributes when testing ID ranges
     ipatests: Make sure that remnants of PKI are removed
     ipatests: legacy_clients: Use hostname instead of external hostname for AD subdomain
     ipatests: legacy_clients: Relax regex checks
     ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cache
     ipa-pwd-extop: Fix memory leak in ipapwd_pre_bind
     ipa-range-check: Fix memory leaks when freeing range object
     Extend ipa-range-check DS plugin to handle range types
     ipatests: Fix apache semaphores prior to installing IPA server
     ipatests: tasks: Accept extra arguments when installing client
     ipatests: Allow using FQDN with trailing dot as final hostname
     ipatests: Fix incorrect UID/GID reference for subdomain users and groups
     ipa_range_check: Use special attributes to determine presence of RID bases
     ipa_range_check: Connect the new node of the linked list
     ipa_range_check: Make a new copy of forest_root_id attribute for range_info struct
     ipa_range_check: Do not fail when no trusted domain is available
     ipa_range_check: Fix typo when comparing strings using strcasecmp
     ipa_range_check: Change range_check return values from int to range_check_result_t enum
     ipatests: Extend test suite for ID ranges
     ipa-pwd-extop: Deny LDAP binds for accounts with expired principals
     ipalib: Add DateTime parameter
     ipatests: Cover DateTime in test_parameters.py
     ipalib: Expose krbPrincipalExpiration in CLI
     ipatests: Fix formatting errors in test_user_plugin.py
     ipatests: Add coverage for setting krbPrincipalExpiration
     ipatests: Add test for denying expired principals
     ipa-client: Set NIS domain name in the installer
     ipa-client-install: Configure sudo to use SSSD as data source
     ipatests: Add Sudo integration test
     ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
     ipatests: Setup SSSD debugging mode by default
     ipatests: Enable SSSD debugging on legacy clients with SSSD
     ipaplatform: Create separate module for platform files
     ipaplatform: Move service base platfrom related functionality to ipaplatform/base/service.py
     ipaplatform: Move default implementations of tasks from service.py.in
     ipaplatform: Create default implementations for tasks that were missing them
     ipaplatform: Add base fedora platform module
     ipaplatform: Moved Fedora 16 service implementations and refactored them as base Fedora module service implementations
     ipaplatform: Move restore_context and check_selinux_status implementations to base fedora platform tasks
     ipaplatform: Do not require custom Authconfig implementations from platform modules
     ipaplatform: Remove legacy redhat platform module
     ipaplatform: Move Fedora-specific implementations of tasks to fedora base platform file
     ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasks
     ipaplatform: Change service code in freeipa to use ipaplatform services
     ipaplatform: Change paths dependant on ipaservices to use ipaplatform.paths
     ipaplatform: Remove redundant imports of ipaservices
     ipaplatform: Move all filesystem paths to ipaplatform.paths module
     ipaplatform: Remove remnants of the ipapython/platform
     ipaplatform: Change makefiles to accomodate for new platform package
     ipaplatform: Let fedora path module use PathNamespace class
     ipaplatform: Link to platform module during build time
     ipaplatform: Pylint fixes
     ipaplatform: Contain all the tasks in the TaskNamespace
     ipaplatform: Move hardcoded paths from Fedora platform files to path namespace
     sudorule: Allow unsetting sudoorder
     trusts: Allow reading ipaNTSecurityIdentifier in user and group objects
     trusts: Add more read attributes
     trusts: Allow reading system trust accounts by adtrust agents
     sudorule: PEP8 fixes in sudorule.py
     sudorule: Allow using hostmasks for setting allowed hosts
     sudorule: Allow using external groups as groups of runAsUsers
     sudorule: Make sure sudoRunAsGroup is dereferencing the correct attribute
     sudorule: Include externalhost and ipasudorunasextgroup in the list of default attributes
     sudorule: Allow adding deny commands when command category set to ALL
     sudorule: Make sure all the relevant attributes are checked when setting category to ALL
     sudorule: Fix the order of the parameters to have less chaotic output
     sudorule: Enforce category ALL checks on dirsrv level
     ipatests: test_sudo: Add tests for allowing hosts via hostmasks
     ipatests: test_sudo: Add coverage for external entries
     ipatests: test_sudo: Add coverage for category ALL validation
     ipatests: test_sudo: Fix assertions not assuming runasgroupcat set to ALL
     ipatests: test_sudo: Do not expect enumeration of runasuser groups
     ipatests: test_sudo: Expect root listed out if no RunAsUser available
     sudorule: Refactor add and remove external_post_callback
     ipaplatform: Document the platform tasks API
     ipaplatform: Drop the base authconfig class
     ipaplatform: Fix build warnings
     ipaplatform: Fix misspelled path constant
     ipaplatform: Move paths from installers to paths module
     ipa-client-install: Restart nisdomain service instead of starting
     ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}
     ipalib: Use DateTime parameter class for OTP token timestamp attributes

Xiao-Long Chen (1):
     Use /usr/bin/python2

Releases/4.0.0

Contents

Highlights in 4.0.0

Enhancements

Bug fixes

2FA Kerberos Authenication

Limitations

Reworked Control Access

DNS Master and Forward Zones

Experimental DNSSEC Support

Upgrading

Transformation Master to Forward zones

Feedback

Detailed Changelog since 3.3.0