freeipa.git/ipalib, branch certauth

Support for Certificate Identity Mapping

2017-02-23T12:05:07+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Add fips_mode variable to env

2017-02-21T16:09:00+00:00

Variable fips_mode indicating whether machine is running in
FIPS-enabled mode was added to env.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: Stanislav Laznicka

Add fix for ipa plugins command

2017-02-17T09:22:07+00:00

Fix adds count of plugins loaded to return dict

Fixes https://fedorahosted.org/freeipa/ticket/6513

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Martin Basti 
Reviewed-By: Martin Babinsky

Explicitly remove support of SSLv2/3

2017-02-17T09:04:00+00:00

It was possible to set tls_version_min/max to 'ssl2' or 'ssl3',
even though newer versions of NSS will fail to set this as a valid
TLS version. This patch explicitly checks for deprecated TLS versions
prior to creating a TLS connection.

Also, we don't allow tls_version_min/max to be set to a random
string anymore.

https://fedorahosted.org/freeipa/ticket/6607

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Explain more performance tricks in doc string

2017-02-15T16:27:56+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Pretty print JSON in debug mode (debug level >= 2)

2017-02-15T16:27:56+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Convert list to tuples

2017-02-15T16:27:56+00:00

Some tests assume that JSON deserializier returns tuples instead of
lists. I don't think it is necessary but let's pass the tests for now.

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Faster JSON encoder/decoder

2017-02-15T16:27:56+00:00

Improve performance of FreeIPA's JSON serializer and deserializer.

* Don't indent and sort keys. Both options trigger a slow path in
  Python's json package. Without indention and sorting, encoding
  mostly happens in optimized C code.
* Replace O(n) type checks with O(1) type lookup and eliminate
  the use of isinstance().
* Check each client capability only once for every conversion.
* Use decoder's obj_hook feature to traverse the object tree once and
  to eliminate calls to isinstance().

Closes: https://fedorahosted.org/freeipa/ticket/6655
Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Insure removal of session on identity change

2017-02-15T06:13:37+00:00

If we are changing identiy (different principal) insure we remove the
session cookie stored on the rpc context so that we do not mistakenly
connect with the previous identity credentials.

https://fedorahosted.org/freeipa/ticket/6543

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Allow rpc callers to pass ccache and service names

2017-02-15T06:13:37+00:00

This allows code to use multiple ccaches without having to muck with the
process global environment variables (KRB5CCNAME).

https://fedorahosted.org/freeipa/ticket/6543

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta