freeipa.git/install/tools, branch views

Fix typo causing ipa-upgradeconfig to fail.

2014-09-11T11:27:04+00:00

Replace 'post-certsave-command' by 'cert-postsave-command'.

https://fedorahosted.org/freeipa/ticket/4529

Reviewed-By: Jan Cholasta

install: create ff krb extension on every install, replica install and upgrade

2014-09-11T07:41:51+00:00

We don't want to copy the extension from master to replica because the
replica may use newer version of FreeIPA and therefore the extension
code might be obsolete. Same reason for upgrades.

https://fedorahosted.org/freeipa/ticket/4478

Reviewed-By: Endi Sukma Dewata

Backup CS.cfg before modifying it

2014-09-05T14:10:49+00:00

https://fedorahosted.org/freeipa/ticket/4166

Reviewed-By: Petr Viktorin

Make CA-less ipa-server-install option --root-ca-file optional.

2014-09-05T11:59:04+00:00

The CA cert specified by --root-ca-file option must always be the CA cert of
the CA which issued the server certificates in the PKCS#12 files. As the cert
is not actually user selectable, use CA cert from the PKCS#12 files by default
if it is present.

Document --root-ca-file in ipa-server-install man page.

https://fedorahosted.org/freeipa/ticket/4457

Reviewed-By: Petr Viktorin

Do not restart apache server when not necessary.

2014-09-05T11:15:46+00:00

https://fedorahosted.org/freeipa/ticket/4352

Reviewed-By: Martin Kosek

Use certmonger D-Bus API instead of messing with its files.

2014-09-05T08:51:42+00:00

FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.

>=certmonger-0.75.13 is needed for this to work.

https://fedorahosted.org/freeipa/ticket/4280

Reviewed-By: Jan Cholasta

Allow changing CA renewal master in ipa-csreplica-manage.

2014-09-02T13:28:51+00:00

https://fedorahosted.org/freeipa/ticket/4039

Reviewed-By: Petr Viktorin

Add man page for ipa-kra-install

2014-08-26T13:21:21+00:00

https://fedorahosted.org/freeipa/ticket/4504

Reviewed-By: Petr Viktorin

Add a KRA to IPA

2014-08-22T07:59:31+00:00

This patch adds the capability of installing a Dogtag KRA
to an IPA instance.  With this patch,  a KRA is NOT configured
by default when ipa-server-install is run.  Rather, the command
ipa-kra-install must be executed on an instance on which a Dogtag
CA has already been configured.

The KRA shares the same tomcat instance and DS instance as the
Dogtag CA.  Moreover, the same admin user/agent (and agent cert) can
be used for both subsystems.  Certmonger is also confgured to
monitor the new subsystem certificates.

To create a clone KRA, simply execute ipa-kra-install 
on a replica on which a Dogtag CA has already been replicated.
ipa-kra-install will use the security domain to detect whether the
system being installed is a replica, and will error out if a needed
replica file is not provided.

The install scripts have been refactored somewhat to minimize
duplication of code.  A new base class dogtagintance.py has
been introduced containing code that is common to KRA and CA
installs.  This will become very useful when we add more PKI
subsystems.

The KRA will install its database as a subtree of o=ipaca,
specifically o=ipakra,o=ipaca.  This means that replication
agreements created to replicate CA data will also replicate KRA
data.  No new replication agreements are required.

Added dogtag plugin for KRA.  This is an initial commit providing
the basic vault functionality needed for vault.  This plugin will
likely be modified as we create the code to call some of these
functions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

The uninstallation option in ipa-kra-install is temporarily disabled.

Reviewed-By: Rob Crittenden 
Reviewed-By: Petr Viktorin

Convert external CA chain to PKCS#7 before passing it to pkispawn.

2014-08-14T08:06:27+00:00

https://fedorahosted.org/freeipa/ticket/4397

Reviewed-By: Petr Viktorin