summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/custodiainstance.py
Commit message (Collapse)AuthorAgeFilesLines
* Allow CustodiaClient to be used by arbitrary principalsFraser Tweedale2016-06-081-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | Currently CustodiaClient assumes that the client is the host principal, and it is hard-coded to read the host keytab and server keys. For the Lightweight CAs feature, Dogtag on CA replicas will use CustodiaClient to retrieve signing keys from the originating replica. Because this process runs as 'pkiuser', the host keys cannot be used; instead, each Dogtag replica will have a service principal to use for Custodia authentication. Update CustodiaClient to require specifying the client keytab and Custodia keyfile to use, and change the client argument to be a full GSS service name (instead of hard-coding host service) to load from the keytab. Update call sites accordingly. Also pass the given 'ldap_uri' argument through to IPAKEMKeys because without it, the client tries to use LDAPI, but may not have access. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix remaining relative import and enable Pylint checkPetr Viktorin2016-05-101-1/+1
| | | | | | | | Relative imports are not supported in Python 3. Part of the work for: https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Look up HTTPD_USER's UID and GID during installation.David Kupka2016-03-231-1/+5
| | | | | | | | | Those values differ among distributions and there is no guarantee that they're reserved. It's better to look them up based on HTTPD_USER's name. https://fedorahosted.org/freeipa/ticket/5712 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-install support caless install with promotion.David Kupka2015-12-031-2/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5441 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* custodia: Make sure container is created with first custodia replicaTomas Babej2015-11-301-0/+15
| | | | | | | | | | If a first 4.3+ replica is installed in the domain, the custodia container does not exist. Make sure it is created to avoid failures during key generation. https://fedorahosted.org/freeipa/ticket/5474 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: enable custodia service during upgradeMartin Basti2015-11-101-4/+6
| | | | | | | | There was missing step in upgrade that enables the service in LDAP https://fedorahosted.org/freeipa/ticket/5429 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Allow to install the KRA on a promoted serverSimo Sorce2015-10-221-6/+23
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add function to extract CA certs for installSimo Sorce2015-10-151-0/+55
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Implement replica promotion functionalitySimo Sorce2015-10-151-6/+36
| | | | | | | | | | | | | | | | | | This patch implements a new flag --promote for the ipa-replica-install command that allows an administrative user to 'promote' an already joined client to become a full ipa server. The only credentials used are that of an administrator. This code relies on ipa-custodia being available on the peer master as well as a number of other patches to allow a computer account to request certificates for its services. Therefore this feature is marked to work only with domain level 1 and above servers. Ticket: https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ipa-custodia serviceSimo Sorce2015-10-151-0/+51
Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 23:45:05 +0000