freeipa.git/ipaserver/install/server, branch certauth

Fix ipa-server-upgrade

2017-02-23T09:14:49+00:00

Running ipa-server-upgrade would fail to stop ipa_memcached if
it's already uninstalled.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Christian Heimes

FIPS: perform replica installation check

2017-02-21T16:09:00+00:00

Check status of remote server's FIPS mode and proceed with
installation only if it matches the current replica's FIPS mode.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: Stanislav Laznicka

replicainstall: add context manager for rpc client

2017-02-21T16:09:00+00:00

Abstract creating rpc client into a context manager to allow re-use.

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: Stanislav Laznicka

check_remote_version: update exception and docstring

2017-02-21T16:09:00+00:00

Refactor function to use ScriptError exception and provide docstring.

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: Stanislav Laznicka

server upgrade: uninstall ipa_memcached properly

2017-02-20T13:00:50+00:00

Make sure ipa_memcached is not running and no stale state is left in the
sysupgrade state file on server upgrade.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

server upgrade: always upgrade KRA agent PEM file

2017-02-20T13:00:50+00:00

Before the KRA agent PEM file is exported in server upgrade, the sysupgrade
state file is consulted. This causes the KRA agent PEM file not to be
exported to the new location if the upgrade was executed in the past.

Do not consult the sysupgrade state file to decide whether to upgrade the
KRA agent PEM file or not, the existence of the file is enough to make this
decision.

https://fedorahosted.org/freeipa/ticket/6675

Reviewed-By: Stanislav Laznicka

Update warning message for replica install

2017-02-17T11:19:37+00:00

New warning message in replica install describes more about
"insufficient privilege" error

Fixes https://fedorahosted.org/freeipa/ticket/6352

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Stanislav Laznicka 
Reviewed-By: Martin Basti

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

pkinit: make sure to have proper dictionary for Kerberos instance on upgrade

2017-02-16T08:51:38+00:00

When running PKINIT upgrade we need to make sure full substitution
dictionary is in place or otherwise executing LDAP updates will fail to
find proper objects because $SUFFIX, $DOMAIN, and other variables
will not be substituted.

Fixes https://fedorahosted.org/freeipa/ticket/6670

Reviewed-By: Simo Sorce

Fix uninstall stopping ipa.service

2017-02-15T06:13:37+00:00

When uninstalling systemd is told to disable the service, but it is not
told to sopt it, so it believes it is still running. This can cause
issues in some cases if a reinstall is performed right after an
uninstall, as systemd may decide to stop the disabled service while we
are reinstalling, causing the new install to fail.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta