Mass tree reorganization for IPAv2. To view previous history of files use:

% git log --follow -- <file>

renamed: ipa-server/autogen.sh -> autogen.sh
renamed: ipa-server/ipa-kpasswd/Makefile.am -> daemons/ipa-kpasswd/Makefile.am
renamed: ipa-server/ipa-kpasswd/README -> daemons/ipa-kpasswd/README
renamed: ipa-server/ipa-kpasswd/ipa_kpasswd.c -> daemons/ipa-kpasswd/ipa_kpasswd.c
renamed: ipa-server/ipa-kpasswd/ipa_kpasswd.init -> daemons/ipa-kpasswd/ipa_kpasswd.init
renamed: ipa-server/ipa-slapi-plugins/Makefile.am -> daemons/ipa-slapi-plugins/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/README -> daemons/ipa-slapi-plugins/README
renamed: ipa-server/ipa-slapi-plugins/dna/Makefile.am -> daemons/ipa-slapi-plugins/dna/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/dna/dna-conf.ldif -> daemons/ipa-slapi-plugins/dna/dna-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/dna/dna.c -> daemons/ipa-slapi-plugins/dna/dna.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am -> daemons/ipa-slapi-plugins/ipa-memberof/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof.c -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof.h -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof.h
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/ipa-memberof_config.c -> daemons/ipa-slapi-plugins/ipa-memberof/ipa-memberof_config.c
renamed: ipa-server/ipa-slapi-plugins/ipa-memberof/memberof-conf.ldif -> daemons/ipa-slapi-plugins/ipa-memberof/memberof-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am -> daemons/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/README -> daemons/ipa-slapi-plugins/ipa-pwd-extop/README
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c -> daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
renamed: ipa-server/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif -> daemons/ipa-slapi-plugins/ipa-pwd-extop/pwd-extop-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/Makefile.am -> daemons/ipa-slapi-plugins/ipa-winsync/Makefile.am
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/README -> daemons/ipa-slapi-plugins/ipa-winsync/README
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync-conf.ldif -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-conf.ldif
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync-config.c -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync-config.c
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync.c -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync.c
renamed: ipa-server/ipa-slapi-plugins/ipa-winsync/ipa-winsync.h -> daemons/ipa-slapi-plugins/ipa-winsync/ipa-winsync.h
renamed: ipa-server/xmlrpc-server/ipa-rewrite.conf -> install/conf/ipa-rewrite.conf
renamed: ipa-server/xmlrpc-server/ipa.conf -> install/conf/ipa.conf
renamed: ipa-server/xmlrpc-server/ssbrowser.html -> install/html/ssbrowser.html
renamed: ipa-server/xmlrpc-server/unauthorized.html -> install/html/unauthorized.html
renamed: ipa-server/ipa-install/share/60ipaconfig.ldif -> install/share/60ipaconfig.ldif
renamed: ipa-server/ipa-install/share/60kerberos.ldif -> install/share/60kerberos.ldif
renamed: ipa-server/ipa-install/share/60radius.ldif -> install/share/60radius.ldif
renamed: ipa-server/ipa-install/share/60samba.ldif -> install/share/60samba.ldif
renamed: ipa-server/ipa-install/share/Makefile.am -> install/share/Makefile.am
renamed: ipa-server/ipa-install/share/bind.named.conf.template -> install/share/bind.named.conf.template
renamed: ipa-server/ipa-install/share/bind.zone.db.template -> install/share/bind.zone.db.template
renamed: ipa-server/ipa-install/share/bootstrap-template.ldif -> install/share/bootstrap-template.ldif
renamed: ipa-server/ipa-install/share/certmap.conf.template -> install/share/certmap.conf.template
renamed: ipa-server/ipa-install/share/default-aci.ldif -> install/share/default-aci.ldif
renamed: ipa-server/ipa-install/share/default-keytypes.ldif -> install/share/default-keytypes.ldif
renamed: ipa-server/ipa-install/share/dna-posix.ldif -> install/share/dna-posix.ldif
renamed: ipa-server/ipa-install/share/encrypted_attribute.ldif -> install/share/encrypted_attribute.ldif
renamed: ipa-server/ipa-install/share/fedora-ds.init.patch -> install/share/fedora-ds.init.patch
renamed: ipa-server/ipa-install/share/indices.ldif -> install/share/indices.ldif
renamed: ipa-server/ipa-install/share/kdc.conf.template -> install/share/kdc.conf.template
renamed: ipa-server/ipa-install/share/kerberos.ldif -> install/share/kerberos.ldif
renamed: ipa-server/ipa-install/share/krb.con.template -> install/share/krb.con.template
renamed: ipa-server/ipa-install/share/krb5.conf.template -> install/share/krb5.conf.template
renamed: ipa-server/ipa-install/share/krb5.ini.template -> install/share/krb5.ini.template
renamed: ipa-server/ipa-install/share/krbrealm.con.template -> install/share/krbrealm.con.template
renamed: ipa-server/ipa-install/share/master-entry.ldif -> install/share/master-entry.ldif
renamed: ipa-server/ipa-install/share/memberof-task.ldif -> install/share/memberof-task.ldif
renamed: ipa-server/ipa-install/share/ntp.conf.server.template -> install/share/ntp.conf.server.template
renamed: ipa-server/ipa-install/share/ntpd.sysconfig.template -> install/share/ntpd.sysconfig.template
renamed: ipa-server/ipa-install/share/preferences.html.template -> install/share/preferences.html.template
renamed: ipa-server/ipa-install/share/referint-conf.ldif -> install/share/referint-conf.ldif
renamed: ipa-server/ipa-install/share/schema_compat.uldif -> install/share/schema_compat.uldif
renamed: ipa-server/ipa-install/share/unique-attributes.ldif -> install/share/unique-attributes.ldif
renamed: ipa-server/ipa-install/Makefile.am -> install/tools/Makefile.am
renamed: ipa-server/ipa-install/README -> install/tools/README
renamed: ipa-server/ipa-compat-manage -> install/tools/ipa-compat-manage
renamed: ipa-server/ipa-fix-CVE-2008-3274 -> install/tools/ipa-fix-CVE-2008-3274
renamed: ipa-server/ipa-ldap-updater -> install/tools/ipa-ldap-updater
renamed: ipa-server/ipa-install/ipa-replica-install -> install/tools/ipa-replica-install
renamed: ipa-server/ipa-install/ipa-replica-manage -> install/tools/ipa-replica-manage
renamed: ipa-server/ipa-install/ipa-replica-prepare -> install/tools/ipa-replica-prepare
renamed: ipa-server/ipa-install/ipa-server-certinstall -> install/tools/ipa-server-certinstall
renamed: ipa-server/ipa-install/ipa-server-install -> install/tools/ipa-server-install
renamed: ipa-server/ipa-upgradeconfig -> install/tools/ipa-upgradeconfig
renamed: ipa-server/ipa-install/ipactl -> install/tools/ipactl
renamed: ipa-server/man/Makefile.am -> install/tools/man/Makefile.am
renamed: ipa-server/man/ipa-compat-manage.1 -> install/tools/man/ipa-compat-manage.1
renamed: ipa-server/man/ipa-ldap-updater.1 -> install/tools/man/ipa-ldap-updater.1
renamed: ipa-server/man/ipa-replica-install.1 -> install/tools/man/ipa-replica-install.1
renamed: ipa-server/man/ipa-replica-manage.1 -> install/tools/man/ipa-replica-manage.1
renamed: ipa-server/man/ipa-replica-prepare.1 -> install/tools/man/ipa-replica-prepare.1
renamed: ipa-server/man/ipa-server-certinstall.1 -> install/tools/man/ipa-server-certinstall.1
renamed: ipa-server/man/ipa-server-install.1 -> install/tools/man/ipa-server-install.1
renamed: ipa-server/man/ipa_kpasswd.8 -> install/tools/man/ipa_kpasswd.8
renamed: ipa-server/man/ipa_webgui.8 -> install/tools/man/ipa_webgui.8
renamed: ipa-server/man/ipactl.8 -> install/tools/man/ipactl.8
renamed: ipa-server/ipa-install/updates/Makefile.am -> install/updates/Makefile.am
renamed: ipa-server/ipa-install/updates/RFC2307bis.update -> install/updates/RFC2307bis.update
renamed: ipa-server/ipa-install/updates/RFC4876.update -> install/updates/RFC4876.update
renamed: ipa-server/ipa-install/updates/indices.update -> install/updates/indices.update
renamed: ipa-server/ipa-install/updates/nss_ldap.update -> install/updates/nss_ldap.update
renamed: ipa-server/ipa-install/updates/replication.update -> install/updates/replication.update
renamed: ipa-server/ipa-install/updates/winsync_index.update -> install/updates/winsync_index.update
renamed: ipa-server/ipaserver/Makefile.am -> ipaserver/install/Makefile.am
renamed: ipa-server/ipaserver/__init__.py -> ipaserver/install/__init__.py
renamed: ipa-server/ipaserver/bindinstance.py -> ipaserver/install/bindinstance.py
renamed: ipa-server/ipaserver/certs.py -> ipaserver/install/certs.py
renamed: ipa-server/ipaserver/dsinstance.py -> ipaserver/install/dsinstance.py
renamed: ipa-server/ipaserver/httpinstance.py -> ipaserver/install/httpinstance.py
renamed: ipa-server/ipaserver/installutils.py -> ipaserver/install/installutils.py
renamed: ipa-server/ipaserver/ipaldap.py -> ipaserver/install/ipaldap.py
renamed: ipa-server/ipaserver/krbinstance.py -> ipaserver/install/krbinstance.py
renamed: ipa-server/ipaserver/ldapupdate.py -> ipaserver/install/ldapupdate.py
renamed: ipa-server/ipaserver/ntpinstance.py -> ipaserver/install/ntpinstance.py
renamed: ipa-server/ipaserver/replication.py -> ipaserver/install/replication.py
renamed: ipa-server/ipaserver/service.py -> ipaserver/install/service.py
renamed: ipa-server/selinux/Makefile -> selinux/Makefile
renamed: ipa-server/selinux/ipa-server-selinux.spec.in -> selinux/ipa-server-selinux.spec.in
renamed: ipa-server/selinux/ipa_kpasswd/ipa_kpasswd.fc -> selinux/ipa_kpasswd/ipa_kpasswd.fc
renamed: ipa-server/selinux/ipa_kpasswd/ipa_kpasswd.te -> selinux/ipa_kpasswd/ipa_kpasswd.te
renamed: ipa-server/selinux/ipa_webgui/ipa_webgui.fc -> selinux/ipa_webgui/ipa_webgui.fc
renamed: ipa-server/selinux/ipa_webgui/ipa_webgui.te -> selinux/ipa_webgui/ipa_webgui.te
renamed: ipa-server/version.m4.in -> version.m4.in

1 files changed, 0 insertions, 428 deletions

diff --git a/ipa-server/ipaserver/krbinstance.py b/ipa-server/ipaserver/krbinstance.py
deleted file mode 100644
index 25284430..00000000
--- a/ipa-server/ipaserver/krbinstance.py
+++ /dev/null
@@ -1,428 +0,0 @@
-# Authors: Simo Sorce <ssorce@redhat.com>
-#
-# Copyright (C) 2007  Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License as
-# published by the Free Software Foundation; version 2 only
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
-#
-
-import subprocess
-import string
-import tempfile
-import shutil
-import logging
-import fileinput
-import re
-import sys
-import os
-import pwd
-import socket
-import shutil
-
-import service
-import installutils
-from ipa import sysrestore
-from ipa import ipautil
-from ipa import ipaerror
-
-import ipaldap
-
-import ldap
-from ldap import LDAPError
-from ldap import ldapobject
-
-from pyasn1.type import univ, namedtype
-import pyasn1.codec.ber.encoder
-import pyasn1.codec.ber.decoder
-import struct
-import base64
-
-KRBMKEY_DENY_ACI = """
-(targetattr = "krbMKey")(version 3.0; acl "No external access"; deny (all) userdn != "ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";)
-"""
-
-def update_key_val_in_file(filename, key, val):
-    if os.path.exists(filename):
-        pattern = "^[\s#]*%s\s*=\s*%s\s*" % (re.escape(key), re.escape(val))
-        p = re.compile(pattern)
-        for line in fileinput.input(filename):
-            if p.search(line):
-                fileinput.close()
-                return
-        fileinput.close()
-
-        pattern = "^[\s#]*%s\s*=" % re.escape(key)
-        p = re.compile(pattern)
-        for line in fileinput.input(filename, inplace=1):
-            if not p.search(line):
-                sys.stdout.write(line)
-        fileinput.close()
-    f = open(filename, "a")
-    f.write("%s=%s\n" % (key, val))
-    f.close()
-
-class KpasswdInstance(service.SimpleServiceInstance):
-    def __init__(self):
-        service.SimpleServiceInstance.__init__(self, "ipa_kpasswd")
-
-class KrbInstance(service.Service):
-    def __init__(self, fstore=None):
-        service.Service.__init__(self, "krb5kdc")
-        self.ds_user = None
-        self.fqdn = None
-        self.realm = None
-	self.domain = None
-        self.host = None
-        self.admin_password = None
-        self.master_password = None
-        self.suffix = None
-        self.kdc_password = None
-        self.sub_dict = None
-
-        self.kpasswd = KpasswdInstance()
-
-        if fstore:
-            self.fstore = fstore
-        else:
-            self.fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
-
-    def __common_setup(self, ds_user, realm_name, host_name, domain_name, admin_password):
-        self.ds_user = ds_user
-        self.fqdn = host_name
-        self.realm = realm_name.upper()
-        self.host = host_name.split(".")[0]
-        self.ip = socket.gethostbyname(host_name)
-        self.domain = domain_name
-        self.suffix = ipautil.realm_to_suffix(self.realm)
-        self.kdc_password = ipautil.ipa_generate_password()
-        self.admin_password = admin_password
-
-        self.__setup_sub_dict()
-
-        # get a connection to the DS
-        try:
-            self.conn = ipaldap.IPAdmin(self.fqdn)
-            self.conn.do_simple_bind(bindpw=self.admin_password)
-        except Exception, e:
-            logging.critical("Could not connect to the Directory Server on %s" % self.fqdn)
-            raise e
-
-        self.backup_state("running", self.is_running())
-        try:
-            self.stop()
-        except:
-            # It could have been not running
-            pass
-
-    def __common_post_setup(self):
-        self.step("starting the KDC", self.__start_instance)
-        self.step("configuring KDC to start on boot", self.__enable)
-
-    def create_instance(self, ds_user, realm_name, host_name, domain_name, admin_password, master_password):
-        self.master_password = master_password
-
-        self.__common_setup(ds_user, realm_name, host_name, domain_name, admin_password)
-
-        self.step("setting KDC account password", self.__configure_kdc_account_password)
-        self.step("adding sasl mappings to the directory", self.__configure_sasl_mappings)
-        self.step("adding kerberos entries to the DS", self.__add_krb_entries)
-        self.step("adding default ACIs", self.__add_default_acis)
-        self.step("configuring KDC", self.__create_instance)
-        self.step("adding default keytypes", self.__add_default_keytypes)
-        self.step("creating a keytab for the directory", self.__create_ds_keytab)
-        self.step("creating a keytab for the machine", self.__create_host_keytab)
-        self.step("exporting the kadmin keytab", self.__export_kadmin_changepw_keytab)
-        self.step("adding the password extension to the directory", self.__add_pwd_extop_module)
-        self.step("adding the kerberos master key to the directory", self.__add_master_key)
-
-        self.__common_post_setup()
-
-        self.start_creation("Configuring Kerberos KDC")
-
-        self.kpasswd.create_instance()
-
-    def create_replica(self, ds_user, realm_name, host_name, domain_name, admin_password, ldap_passwd_filename, kpasswd_filename):
-        self.__copy_ldap_passwd(ldap_passwd_filename)
-        self.__copy_kpasswd_keytab(kpasswd_filename)
-
-        self.__common_setup(ds_user, realm_name, host_name, domain_name, admin_password)
-
-        self.step("adding sasl mappings to the directory", self.__configure_sasl_mappings)
-        self.step("writing stash file from DS", self.__write_stash_from_ds)
-        self.step("configuring KDC", self.__create_replica_instance)
-        self.step("creating a keytab for the directory", self.__create_ds_keytab)
-        self.step("creating a keytab for the machine", self.__create_host_keytab)
-        self.step("adding the password extension to the directory", self.__add_pwd_extop_module)
-
-        self.__common_post_setup()
-
-        self.start_creation("Configuring Kerberos KDC")
-
-        self.kpasswd.create_instance()
-
-    def __copy_ldap_passwd(self, filename):
-        self.fstore.backup_file("/var/kerberos/krb5kdc/ldappwd")
-        shutil.copy(filename, "/var/kerberos/krb5kdc/ldappwd")
-        os.chmod("/var/kerberos/krb5kdc/ldappwd", 0600)
-
-    def __copy_kpasswd_keytab(self, filename):
-        self.fstore.backup_file("/var/kerberos/krb5kdc/kpasswd.keytab")
-        shutil.copy(filename, "/var/kerberos/krb5kdc/kpasswd.keytab")
-        os.chmod("/var/kerberos/krb5kdc/kpasswd.keytab", 0600)
-
-
-    def __configure_kdc_account_password(self):
-        hexpwd = ''
-	for x in self.kdc_password:
-            hexpwd += (hex(ord(x))[2:])
-        self.fstore.backup_file("/var/kerberos/krb5kdc/ldappwd")
-        pwd_fd = open("/var/kerberos/krb5kdc/ldappwd", "w")
-        pwd_fd.write("uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix+"#{HEX}"+hexpwd+"\n")
-        pwd_fd.close()
-        os.chmod("/var/kerberos/krb5kdc/ldappwd", 0600)
-
-    def __enable(self):
-        self.backup_state("enabled", self.is_enabled())
-        self.chkconfig_on()
-
-    def __start_instance(self):
-        try:
-            self.start()
-        except:
-            logging.critical("krb5kdc service failed to start")
-
-    def __setup_sub_dict(self):
-        self.sub_dict = dict(FQDN=self.fqdn,
-                             IP=self.ip,
-                             PASSWORD=self.kdc_password,
-                             SUFFIX=self.suffix,
-                             DOMAIN=self.domain,
-                             HOST=self.host,
-                             REALM=self.realm)
-
-    def __ldap_mod(self, ldif):
-        txt = ipautil.template_file(ipautil.SHARE_DIR + ldif, self.sub_dict)
-        fd = ipautil.write_tmp_file(txt)
-
-        [pw_fd, pw_name] = tempfile.mkstemp()
-        os.write(pw_fd, self.admin_password)
-        os.close(pw_fd)
-
-        args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv",
-                "-D", "cn=Directory Manager", "-y", pw_name, "-f", fd.name]
-
-        try:
-            try:
-                ipautil.run(args)
-            except ipautil.CalledProcessError, e:
-                logging.critical("Failed to load %s: %s" % (ldif, str(e)))
-        finally:
-            os.remove(pw_name)
-
-        fd.close()
-
-    def __configure_sasl_mappings(self):
-        # we need to remove any existing SASL mappings in the directory as otherwise they
-        # they may conflict. There is no way to define the order they are used in atm.
-
-        # FIXME: for some reason IPAdmin dies here, so we switch
-        # it out for a regular ldapobject.
-        conn = self.conn
-        self.conn = ldapobject.SimpleLDAPObject("ldap://127.0.0.1/")
-        self.conn.bind("cn=directory manager", self.admin_password)
-        try:
-            msgid = self.conn.search("cn=mapping,cn=sasl,cn=config", ldap.SCOPE_ONELEVEL, "(objectclass=nsSaslMapping)")
-            res = self.conn.result(msgid)
-            for r in res[1]:
-                mid = self.conn.delete_s(r[0])
-        #except LDAPError, e:
-        #    logging.critical("Error during SASL mapping removal: %s" % str(e))
-        except Exception, e:
-            logging.critical("Could not connect to the Directory Server on %s" % self.fqdn)
-            raise e
-            print type(e)
-            print dir(e)
-            raise e
-
-        self.conn = conn
-
-        entry = ipaldap.Entry("cn=Full Principal,cn=mapping,cn=sasl,cn=config")
-        entry.setValues("objectclass", "top", "nsSaslMapping")
-        entry.setValues("cn", "Full Principal")
-        entry.setValues("nsSaslMapRegexString", '\(.*\)@\(.*\)')
-        entry.setValues("nsSaslMapBaseDNTemplate", self.suffix)
-        entry.setValues("nsSaslMapFilterTemplate", '(krbPrincipalName=\\1@\\2)')
-
-        try:
-            self.conn.add_s(entry)
-        except ldap.ALREADY_EXISTS:
-            logging.critical("failed to add Full Principal Sasl mapping")
-            raise e
-
-        entry = ipaldap.Entry("cn=Name Only,cn=mapping,cn=sasl,cn=config")
-        entry.setValues("objectclass", "top", "nsSaslMapping")
-        entry.setValues("cn", "Name Only")
-        entry.setValues("nsSaslMapRegexString", '\(.*\)')
-        entry.setValues("nsSaslMapBaseDNTemplate", self.suffix)
-        entry.setValues("nsSaslMapFilterTemplate", '(krbPrincipalName=\\1@%s)' % self.realm)
-
-        try:
-            self.conn.add_s(entry)
-        except ldap.ALREADY_EXISTS:
-            logging.critical("failed to add Name Only Sasl mapping")
-            raise e
-
-    def __add_krb_entries(self):
-        self.__ldap_mod("kerberos.ldif")
-
-    def __add_default_acis(self):
-        self.__ldap_mod("default-aci.ldif")
-
-    def __add_default_keytypes(self):
-        self.__ldap_mod("default-keytypes.ldif")
-
-    def __create_replica_instance(self):
-        self.__create_instance(replica=True)
-
-    def __template_file(self, path):
-        template = os.path.join(ipautil.SHARE_DIR, os.path.basename(path) + ".template")
-        conf = ipautil.template_file(template, self.sub_dict)
-        self.fstore.backup_file(path)
-        fd = open(path, "w+")
-        fd.write(conf)
-        fd.close()
-
-    def __create_instance(self, replica=False):
-        self.__template_file("/var/kerberos/krb5kdc/kdc.conf")
-        self.__template_file("/etc/krb5.conf")
-        self.__template_file("/usr/share/ipa/html/krb5.ini")
-        self.__template_file("/usr/share/ipa/html/krb.con")
-        self.__template_file("/usr/share/ipa/html/krbrealm.con")
-
-        if not replica:
-            #populate the directory with the realm structure
-            args = ["/usr/kerberos/sbin/kdb5_ldap_util", "-D", "uid=kdc,cn=sysaccounts,cn=etc,"+self.suffix, "-w", self.kdc_password, "create", "-s", "-P", self.master_password, "-r", self.realm, "-subtrees", self.suffix, "-sscope", "sub"]
-            try:
-                ipautil.run(args)
-            except ipautil.CalledProcessError, e:
-                print "Failed to populate the realm structure in kerberos", e
-
-    def __write_stash_from_ds(self):
-        try:
-            entry = self.conn.getEntry("cn=%s, cn=kerberos, %s" % (self.realm, self.suffix), ldap.SCOPE_SUBTREE)
-        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND), e:
-            logging.critical("Could not find master key in DS")
-            raise e
-
-        krbMKey = pyasn1.codec.ber.decoder.decode(entry.krbmkey)
-        keytype = int(krbMKey[0][1][0])
-        keydata = str(krbMKey[0][1][1])
-
-        format = '=hi%ss' % len(keydata)
-        s = struct.pack(format, keytype, len(keydata), keydata)
-        try:
-            fd = open("/var/kerberos/krb5kdc/.k5."+self.realm, "w")
-            fd.write(s)
-            fd.close()
-        except os.error, e:
-            logging.critical("failed to write stash file")
-            raise e
-
-    #add the password extop module
-    def __add_pwd_extop_module(self):
-        self.__ldap_mod("pwd-extop-conf.ldif")
-
-    def __add_master_key(self):
-        #get the Master Key from the stash file
-        try:
-            stash = open("/var/kerberos/krb5kdc/.k5."+self.realm, "r")
-            keytype = struct.unpack('h', stash.read(2))[0]
-            keylen = struct.unpack('i', stash.read(4))[0]
-            keydata = stash.read(keylen)
-        except os.error:
-            logging.critical("Failed to retrieve Master Key from Stash file: %s")
-	#encode it in the asn.1 attribute
-        MasterKey = univ.Sequence()
-        MasterKey.setComponentByPosition(0, univ.Integer(keytype))
-        MasterKey.setComponentByPosition(1, univ.OctetString(keydata))
-        krbMKey = univ.Sequence()
-        krbMKey.setComponentByPosition(0, univ.Integer(0)) #we have no kvno
-        krbMKey.setComponentByPosition(1, MasterKey)
-        asn1key = pyasn1.codec.ber.encoder.encode(krbMKey)
-
-        dn = "cn="+self.realm+",cn=kerberos,"+self.suffix
-        #protect the master key by adding an appropriate deny rule along with the key
-        mod = [(ldap.MOD_ADD, 'aci', ipautil.template_str(KRBMKEY_DENY_ACI, self.sub_dict)),
-               (ldap.MOD_ADD, 'krbMKey', str(asn1key))]
-        try:
-            self.conn.modify_s(dn, mod)
-        except ldap.TYPE_OR_VALUE_EXISTS, e:
-            logging.critical("failed to add master key to kerberos database\n")
-            raise e
-
-    def __create_ds_keytab(self):
-        ldap_principal = "ldap/" + self.fqdn + "@" + self.realm
-        installutils.kadmin_addprinc(ldap_principal)
-
-        self.fstore.backup_file("/etc/dirsrv/ds.keytab")
-        installutils.create_keytab("/etc/dirsrv/ds.keytab", ldap_principal)
-
-        self.fstore.backup_file("/etc/sysconfig/dirsrv")
-        update_key_val_in_file("/etc/sysconfig/dirsrv", "export KRB5_KTNAME", "/etc/dirsrv/ds.keytab")
-        pent = pwd.getpwnam(self.ds_user)
-        os.chown("/etc/dirsrv/ds.keytab", pent.pw_uid, pent.pw_gid)
-
-    def __create_host_keytab(self):
-        host_principal = "host/" + self.fqdn + "@" + self.realm
-        installutils.kadmin_addprinc(host_principal)
-
-        self.fstore.backup_file("/etc/krb5.keytab")
-        installutils.create_keytab("/etc/krb5.keytab", host_principal)
-
-        # Make sure access is strictly reserved to root only for now
-        os.chown("/etc/krb5.keytab", 0, 0)
-        os.chmod("/etc/krb5.keytab", 0600)
-
-    def __export_kadmin_changepw_keytab(self):
-        installutils.kadmin_modprinc("kadmin/changepw", "+requires_preauth")
-
-        self.fstore.backup_file("/var/kerberos/krb5kdc/kpasswd.keytab")
-        installutils.create_keytab("/var/kerberos/krb5kdc/kpasswd.keytab", "kadmin/changepw")
-
-        self.fstore.backup_file("/etc/sysconfig/ipa_kpasswd")
-        update_key_val_in_file("/etc/sysconfig/ipa_kpasswd", "export KRB5_KTNAME", "/var/kerberos/krb5kdc/kpasswd.keytab")
-
-    def uninstall(self):
-        self.kpasswd.uninstall()
-
-        running = self.restore_state("running")
-        enabled = self.restore_state("enabled")
-
-        try:
-            self.stop()
-        except:
-            pass
-
-        for f in ["/var/kerberos/krb5kdc/ldappwd", "/var/kerberos/krb5kdc/kdc.conf", "/etc/krb5.conf"]:
-            try:
-                self.fstore.restore_file(f)
-            except ValueError, error:
-                logging.debug(error)
-                pass
-
-        if not enabled is None and not enabled:
-            self.chkconfig_off()
-
-        if not running is None and running:
-            self.start()