freeipa.git, branch cachetickets

Store session cookie in a ccache option

2017-03-06T23:47:56+00:00

Instead of using the kernel keyring,s tore the session cookie within the
ccache. This way kdestroy will really wipe away all creedntials.

Ticket: https://pagure.io/freeipa/issue/6661

Signed-off-by: Simo Sorce

Use GSS-SPNEGO if connecting locally

2017-03-06T19:19:30+00:00

GSS-SPNEGO allows us to negotiate a sasl bind with less roundrtrips
therefore use it when possible.

We only enable it for local connections for now because we only
recently fixed Cyrus SASL to do proper GSS-SPNEGO negotiation. This
change means a newer and an older version are not compatible.

Restricting ourselves to the local host prevents issues with
incomaptible services, and it is ok for us as we are only really lloking
at speedups for the local shortlived connections performed by the
framework. Most other clients have llonger lived connections, so
peformance improvements there are not as important.

Signed-off-by: Simo Sorce

Add options to allow ticket caching

2017-03-06T18:46:44+00:00

This new option (planned to land in gssproxy 0.7) we cache the ldap
ticket properly and avoid a ticket lookup to the KDC on each and every
ldap connection. (Also requires krb5 libs 1.15.1 to benefit from caching).

Signed-off-by: Simo Sorce

We don't offer no quickies

2017-03-06T12:13:10+00:00

It's not our main priority as developers to offer any forms of quickies
nor guides on how to perform them.

Reviewed-By: David Kupka

Fix cookie with Max-Age processing

2017-03-06T10:48:32+00:00

When cookie has Max-Age set it tries to get expiration by adding
to a timestamp. Without this patch the timestamp would be set to
None and thus the addition of timestamp + max_age fails

https://pagure.io/freeipa/issue/6718

Reviewed-By: Simo Sorce

Use https to get security domain from Dogtag

2017-03-03T12:33:51+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek

Extract method to map principal to princpal type

2017-03-03T11:09:57+00:00

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

Remove redundant principal_type argument

2017-03-03T11:09:57+00:00

Minor refactor to remove the redundant 'principal_type' argument
from 'caacl_check' and associated functions.

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

man: update ipa-cacert-manage

2017-03-02T16:02:25+00:00

Make it clear this command is used to only renew certificate for
the CA and provide guidance on how to renew other certificates.

https://pagure.io/freeipa/issue/6648

Reviewed-By: Stanislav Laznicka

Change README to use Markdown

2017-03-02T15:55:57+00:00

So that it will be nicely formatted on FreeIPA Pagure landing page.
  https://pagure.io/freeipa

Some links were updated as other projects also moved to Pagure.io.

Reviewed-By: Stanislav Laznicka