freeipa.git/install/tools, branch certauth

scripts, tests: explicitly set confdir in the rest of server code

2017-02-22T08:07:48+00:00

Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir
setting to api.bootstrap() calls of a randomly selected portion of
server-side scripts and tests. This commit adds it to the rest of
server-side code for consistency.

https://fedorahosted.org/freeipa/ticket/6389

Reviewed-By: Stanislav Laznicka

Move AD trust installation code to a separate module

2017-02-17T12:34:35+00:00

This facilitates calling the necessary checks and configuration code as
a module from e.g. a composite installer. The code that checks for the
admin credentials stays in the standalone installer as the code inside
the adtrust module is expected to operate also without admin
credentials.

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Martin Basti

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Update man page of ipa-server-install

2017-02-17T07:54:10+00:00

This fix adds information about --ignore-last-of-role in
ipa-server-install man page

Fixes https://fedorahosted.org/freeipa/ticket/6634

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Stanislav Laznicka

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Remove is_fips_enabled checks in installers and ipactl

2017-02-13T17:10:55+00:00

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek

Replace exit() calls with exceptions

2017-02-09T13:05:22+00:00

In order to enable correct handling of hard errors from within the
composite installer code, all calls to `sys.exit` have to be replaced
with raising ScriptError.

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Basti

Remove unused variables in exception handling

2017-02-09T13:05:22+00:00

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Basti

ipa-adtrust-install: format the code for PEP-8 compliance

2017-02-09T13:05:22+00:00

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Basti

ipa-ca-install: do not fail without --subject-base and --ca-subject

2017-01-31T06:18:39+00:00

When --subject-base and --ca-subject are not specified in ipa-ca-install,
default values are used. DN objects are used as the default values in
ipa-ca-install, but the CA installer expects the values to be strings. This
causes ipa-ca-install to fail unless both --subject-base and --ca-subject
are specified.

Convert the DN objects to strings to fix the issue.

https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Fraser Tweedale