freeipa.git/install, branch certauth

Support for Certificate Identity Mapping

2017-02-23T12:05:07+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Remove non-sensical kdestroy on https stop

2017-02-22T14:50:48+00:00

This kdestroy runs as root and wipes root's own ccachs ...
this is totally inappropriate.
Use a file ccache that ends up in the private tmp, so that if the
service is restarted the file is automatically removed.

https://fedorahosted.org/freeipa/ticket/6673

Signed-off-by: Simo Sorce 
Reviewed-By: Martin Babinsky 
Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

scripts, tests: explicitly set confdir in the rest of server code

2017-02-22T08:07:48+00:00

Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir
setting to api.bootstrap() calls of a randomly selected portion of
server-side scripts and tests. This commit adds it to the rest of
server-side code for consistency.

https://fedorahosted.org/freeipa/ticket/6389

Reviewed-By: Stanislav Laznicka

server upgrade: fix upgrade from pre-4.0

2017-02-20T13:00:50+00:00

update_ca_renewal_master uses ipaCert certmonger tracking information to
decide whether the local server is the CA renewal master or not. The
information is lost when migrating from /etc/httpd/alias to
/var/lib/ipa/radb in update_ra_cert_store.

Make sure update_ra_cert_store is executed after update_ca_renewal_master
so that correct information is used.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

WebUI: fix incorrect behavior of ESC button on combobox

2017-02-17T16:50:32+00:00

When combobox is opened then ESC key should close it. There was a bug
that ESC key closed also the dialog. It was caused by bad keyboard event
handling. The CB was closed by keydown event and the dialog by keyup.

Therefore the propagating of keyup and keydown event is stopped when CB
is opened (when the event is fired on CB element).

https://fedorahosted.org/freeipa/ticket/6388

Reviewed-By: Petr Vobornik 
Reviewed-By: Martin Basti

WebUI: add default on_cancel function in adder_dialog

2017-02-17T16:50:32+00:00

Adder dialog is mixed with confirmation_mixin. That mixin calls on_cancel method
when closing dialog using ESC key. Previously the on_cancel method
was not defined, therefore dialog was not correctly closed. This was the root
cause of the bug, that adder dialog cannot be opened after closing it using ESC.

Now the default function for on_cancel is dialog.close. So dialog
is correctly closed.

https://fedorahosted.org/freeipa/ticket/6388

Reviewed-By: Petr Vobornik 
Reviewed-By: Martin Basti

Move AD trust installation code to a separate module

2017-02-17T12:34:35+00:00

This facilitates calling the necessary checks and configuration code as
a module from e.g. a composite installer. The code that checks for the
admin credentials stays in the standalone installer as the code inside
the adtrust module is expected to operate also without admin
credentials.

https://fedorahosted.org/freeipa/ticket/6629

Reviewed-By: Martin Basti

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Deduplicate session cookies in headers

2017-02-17T08:57:23+00:00

This removes one of the 2 identical copies of the ipa_session cookie

Fixes https://fedorahosted.org/freeipa/ticket/6676

Signed-off-by: Simo Sorce 
Reviewed-By: Alexander Bokovoy

Update man page of ipa-server-install

2017-02-17T07:54:10+00:00

This fix adds information about --ignore-last-of-role in
ipa-server-install man page

Fixes https://fedorahosted.org/freeipa/ticket/6634

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Stanislav Laznicka