freeipa.git/ipa-client/ipa-install, branch hbactest

Make ipa-client-install error messages more understandable and relevant.

2011-07-20T00:41:54+00:00

* Check remote LDAP server to see if it is a V2 server
* Replace numeric return values with alphanumeric constants
* Display the error message from the ipa-enrollment extended op
* Remove generic join failed error message when XML-RPC fails
* Don't display Certificate subject base when enrollment fails
* Return proper error message when LDAP bind fails

https://fedorahosted.org/freeipa/ticket/1417

Fix sssd.conf to always have IPA certificate for the domain.

2011-07-18T23:42:04+00:00

Fixes https://fedorahosted.org/freeipa/ticket/1476

SSSD will need TLS for checking if ipaMigrationEnabled attribute is set
Note that SSSD will force StartTLS because the channel is later used for
authentication as well if password migration is enabled. Thus set the option
unconditionally.

Change client enrollment principal prompt to hopefully be clearer.

2011-07-19T06:43:45+00:00

ticket https://fedorahosted.org/freeipa/ticket/1449

Rearrange logging for NSCD daemon.

2011-07-18T12:03:09+00:00

https://fedorahosted.org/freeipa/ticket/1373

When SSSD is in use, we actually trying to disable NSCD daemon. Telling
that we failed to configure automatic _startup_ of the NSCD is wrong then.

Configure SSSD to store user password if offline.

2011-07-14T23:26:25+00:00

ticket 1359

Remove redundant configuration values from krb5.conf.

2011-06-28T05:10:06+00:00

ticket 1358

On a master configure sssd to only talk to the local master.

2011-06-21T14:07:06+00:00

Otherwise it is possible for sssd to pick a different master to
communicate with via the DNS SRV records and if the remote master
goes down the local one will have problems as well.

ticket https://fedorahosted.org/freeipa/ticket/1187

Fix support for nss-pam-ldapd

2011-06-08T08:00:27+00:00

Client installation with --no-sssd option was broken if the client
was based on a nss-pam-ldap instead of nss_ldap. The main issue is
with authconfig rewriting the nslcd.conf after it has been
configured by ipa-client-install.

This has been fixed by changing an order of installation steps.
Additionally, nslcd daemon needed for nss-pam-ldap function is
correctly started.

https://fedorahosted.org/freeipa/ticket/1235

Properly configure nsswitch.conf when using the --no-sssd option.

2011-05-18T11:19:06+00:00

Even with --no-sssd authconfig was setting nsswitch.conf to use sssd
for users, groups, shadow and netgroups. We need to pass in the
--enableforcelegacy option hwen configuring nss_ldap.

Also always back up and restore sssd.conf. It still gets configured for
kerberos.

ticket 1142

KDC autodiscovery may fail when domain is not realm

2011-05-17T06:56:22+00:00

When ipa-client-install autodiscovers IPA server values it
doesn't fill the fixed KDC address to Kerberos configuration
file. However, when realm != domain or the autodiscovered values
are overridden, installation may fail because it cannot find the
KDC.

This patch adds a failover to use static KDC address in case when
such an issue occurs.

https://fedorahosted.org/freeipa/ticket/1100