freeipa.git/ipapython, branch views

Use certmonger D-Bus API instead of messing with its files.

2014-09-05T08:51:42+00:00

FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.

>=certmonger-0.75.13 is needed for this to work.

https://fedorahosted.org/freeipa/ticket/4280

Reviewed-By: Jan Cholasta

Add a KRA to IPA

2014-08-22T07:59:31+00:00

This patch adds the capability of installing a Dogtag KRA
to an IPA instance.  With this patch,  a KRA is NOT configured
by default when ipa-server-install is run.  Rather, the command
ipa-kra-install must be executed on an instance on which a Dogtag
CA has already been configured.

The KRA shares the same tomcat instance and DS instance as the
Dogtag CA.  Moreover, the same admin user/agent (and agent cert) can
be used for both subsystems.  Certmonger is also confgured to
monitor the new subsystem certificates.

To create a clone KRA, simply execute ipa-kra-install 
on a replica on which a Dogtag CA has already been replicated.
ipa-kra-install will use the security domain to detect whether the
system being installed is a replica, and will error out if a needed
replica file is not provided.

The install scripts have been refactored somewhat to minimize
duplication of code.  A new base class dogtagintance.py has
been introduced containing code that is common to KRA and CA
installs.  This will become very useful when we add more PKI
subsystems.

The KRA will install its database as a subtree of o=ipaca,
specifically o=ipakra,o=ipaca.  This means that replication
agreements created to replicate CA data will also replicate KRA
data.  No new replication agreements are required.

Added dogtag plugin for KRA.  This is an initial commit providing
the basic vault functionality needed for vault.  This plugin will
likely be modified as we create the code to call some of these
functions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

The uninstallation option in ipa-kra-install is temporarily disabled.

Reviewed-By: Rob Crittenden 
Reviewed-By: Petr Viktorin

Enable NSS PKIX certificate path discovery and validation for Dogtag.

2014-07-30T14:04:21+00:00

Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden

Provide additional functions to ipapython.certmonger.

2014-07-30T14:04:21+00:00

Reviewed-By: Rob Crittenden

ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration

2014-07-04T06:13:23+00:00

When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek

Clear NSS session cache when socket is closed

2014-07-02T14:31:50+00:00

Even when NSS connection is closed, there may be still cached
certificates in the NSS lib. This may cause subsequent NSS
initialization to crash. This problem especially reproduces in the
unit tests.

Reviewed-By: Petr Viktorin

ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}

2014-07-02T14:12:05+00:00

The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek

Fix handle python-dns UnicodeError

2014-06-20T11:28:53+00:00

Reviewed-By: Jan Cholasta

Clarify LDAPClient docstrings about get_entry, get_entries and find_entries

2014-06-20T10:38:58+00:00

Reviewed-By: Martin Basti

ipaplatform: Change makefiles to accomodate for new platform package

2014-06-16T17:48:20+00:00

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin