freeipa.git/client/ipa-client-install, branch coverity

server uninstall fails to remove krb principals

2016-07-20T14:35:49+00:00

This patch fixes the 3rd issue of ticket 6012:
ipa-server-install --uninstall -U
complains while removing Kerberos service principals from /etc/krb5.keytab
----
Failed to remove Kerberos service principals: Command '/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r DOM-221.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM' returned non-zero exit status 5
----

This happens because the uninstaller performs the following sequence:
1/ restore pre-install files, including /etc/krb5.keytab
At this point /etc/krb5.keytab does not contain any principal for
IPA domain
2/ call ipa-client-install --uninstall, which in turns runs
ipa-rmkeytab -k /etc/krb5.keytab -r 
to remove the principals.

The fix ignores ipa-rmkeytab's exit code 5 (Principal name or realm not
found in keytab)

https://fedorahosted.org/freeipa/ticket/6012

Reviewed-By: Martin Basti

Create server and host certs with DNS altname

2016-07-19T12:18:04+00:00

Currently server (HTTP / LDAP) certs are created without a Subject
Alternative Name extension during server install, replica prepare
and host enrolment, a potentially problematic violation of RFC 2818.

Add the hostname as a SAN dNSName when these certs are created.

(Certmonger adds an appropriate request extension when renewing the
certificate, so nothing needs to be done for renewal).

Fixes: https://fedorahosted.org/freeipa/ticket/4970
Reviewed-By: Petr Spacek

client-install: log exceptions from certmonger.request_cert

2016-07-01T11:33:49+00:00

Reviewed-By: Martin Basti

Do not allow installation in FIPS mode

2016-06-29T14:17:27+00:00

https://fedorahosted.org/freeipa/ticket/5761

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden

client-install: do not fail if DNS times out during DNS update generation

2016-06-29T12:19:59+00:00

https://fedorahosted.org/freeipa/ticket/5962

Reviewed-By: Martin Basti

client: Share validator and domain name normalization with server install

2016-06-28T12:14:32+00:00

https://fedorahosted.org/freeipa/ticket/5976

Reviewed-By: Martin Basti

Added krb5.conf.d/ to included dirs in krb5.conf

2016-06-05T07:47:13+00:00

The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly

https://fedorahosted.org/freeipa/ticket/5912

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

client install: finalize API after CA certs are available

2016-06-03T07:00:34+00:00

This is required for the finalize call to be able connect to the server to
retrieve API schema.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

rpc: specify connection options in API config

2016-06-03T07:00:34+00:00

Specify RPC connection options once in API.bootstrap rather than in each
invocation of rpcclient.connect.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka

rpc: respect API config in RPCClient.create_connection

2016-06-03T07:00:34+00:00

When connecting rpcclient, get the default values of the `verbose`,
`fallback` and `delegate` options from API config rather than hard-code
them.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka