freeipa.git/ipapython, branch certauth

Support for Certificate Identity Mapping

2017-02-23T12:05:07+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Don't prepend option names with additional '--'

2017-02-21T14:30:24+00:00

The options now have '--' prepended by their names already, don't
add it.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Basti

client install: create /etc/ipa/nssdb with correct mode

2017-02-20T13:00:50+00:00

The NSS database directory is created with mode 640, which causes the IPA
client to fail to connect to any IPA server, because it is unable to read
trusted CA certificates from the NSS database.

Create the directory with mode 644 to fix the issue.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

ipactl restart: log httplib failues as debug

2017-02-17T11:11:56+00:00

There are several excerptions ConnectionRefusedError raised
before ipactl is able to connect to dogtag after restart. These
exception should be logged on debug level until timeout is reached.

https://fedorahosted.org/freeipa/ticket/6674

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Christian Heimes

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Explicitly remove support of SSLv2/3

2017-02-17T09:04:00+00:00

It was possible to set tls_version_min/max to 'ssl2' or 'ssl3',
even though newer versions of NSS will fail to set this as a valid
TLS version. This patch explicitly checks for deprecated TLS versions
prior to creating a TLS connection.

Also, we don't allow tls_version_min/max to be set to a random
string anymore.

https://fedorahosted.org/freeipa/ticket/6607

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Simplify NSSDatabase password file handling

2017-02-15T06:13:37+00:00

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Change session handling

2017-02-15T06:13:37+00:00

Stop using memcache, use mod_auth_gssapi filesystem based ccaches.
Remove custom session handling, use mod_auth_gssapi and mod_session to
establish and keep a session cookie.
Add loopback to mod_auth_gssapi to do form absed auth and pass back a
valid session cookie.
And now that we do not remove ccaches files to move them to the
memcache, we can avoid the risk of pollutting the filesystem by keeping
a common ccache file for all instances of the same user.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

py3: ipa_generate_password: do not compare None and Int

2017-02-10T13:03:04+00:00

The one cannot compare None and Int in Py3
"""
unorderable types: NoneType() > int()
"""

Continue when class is disabled with None value

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta