freeipa.git, branch replica_kdc

Configure KDC to use certs after they are deployed

2017-03-09T17:49:54+00:00

Certmonger needs to access the KDC when it tries to obtain certs,
so make sure the KDC can run, then reconfigure it to use pkinit anchors
once certs are deployed.

Signed-off-by: Simo Sorce

backup: backup anonymous keytab

2017-03-09T17:22:34+00:00

Freeipa stops working without anon keytab

https://pagure.io/freeipa/issue/5959

Reviewed-By: Martin Babinsky

server install: require IPv6 stack to be enabled

2017-03-09T15:50:21+00:00

Add checks to install and replica install to verify IPv6 stack
is enabled. IPv6 is required by some IPA parts (AD, conncheck, ...).

https://pagure.io/freeipa/issue/6608

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

add whoami command

2017-03-09T13:10:02+00:00

Whoami command allows to query details about currently
authenticated identity. The command returns following information:

  * object class name
  * function to call to get actual details about the object
  * arguments to pass to the function

There are five types of objects that could bind to IPA using their
credentials. `ipa whoami` call expects one of the following:

  * users
  * staged users
  * hosts
  * Kerberos services
  * ID user override from the default trust view

The latter category of objects is automatically mapped by SASL GSSAPI
mapping rule in 389-ds for users from trusted Active Directory forests.

The command is expected to be used by Web UI to define proper view for
the authenticated identity. It is not visible in the command line
interface is `ipa` command.

Below is an example of how communication looks like for a host
principal:

   # kinit -k
   # ipa console
   (Custom IPA interactive Python console)
   >>> api.Command.whoami()
   {u'command': u'host_show/1', u'object': u'host', u'arguments': (u'ipa.example.com',)}
   >>>

Fixes https://pagure.io/freeipa/issue/6643

Reviewed-By: Stanislav Laznicka

ipa-managed-entries: only permit running the command on IPA master

2017-03-09T09:31:43+00:00

https://pagure.io/freeipa/issue/6735

Reviewed-By: Tomas Krizek

ipa-managed-entries: use server-mode API

2017-03-09T09:31:43+00:00

During LDAP connection management refactoring the ad-hoc ldap connection
in `ipa-managed-entries` was replaced by calls to ldap2 backend without
updating API initialization.

https://pagure.io/freeipa/issue/6735

Reviewed-By: Tomas Krizek

Don't use weak ciphers for client HTTPS connections

2017-03-09T09:27:55+00:00

https://pagure.io/freeipa/issue/6730

Reviewed-By: Martin Basti

WebUI: Add cermapmatch module

2017-03-08T15:22:01+00:00

Add module which can show users which are mapped to the provided certificate.
Additionaly, the certificate is parsed and parsed information are
also displayed.

https://pagure.io/freeipa/issue/6601

Reviewed-By: Petr Vobornik

WebUI: Add Adapter for certmap_match result table

2017-03-08T15:22:01+00:00

Result of certmap_match command is in the following format:
[{domain: 'domain1', uid:[uid11,uid12,uid13]}, {domain: 'domain2',
uid:[uid21, uid22, uid23},...]

For correct displaying in table we need to reformat it to the following:
[{domain: 'domain1', uid: 'uid11'}, {domain: 'domain1', uid: 'uid12'},...

This can be done using this Adapter.

Part of: https://pagure.io/freeipa/issue/6601

Reviewed-By: Petr Vobornik

WebUI: Possibility to choose object when API call returns list of objects

2017-03-08T15:22:01+00:00

In case that API call returns array of objects which contains data, using
'object_index' attribute in adapter specification we can set which object
should be used.

It is possible to choose only one object specified by its index in array.

Part of: https://pagure.io/freeipa/issue/6601

Reviewed-By: Petr Vobornik