freeipa.git/client, branch coverity

server uninstall fails to remove krb principals

2016-07-20T14:35:49+00:00

This patch fixes the 3rd issue of ticket 6012:
ipa-server-install --uninstall -U
complains while removing Kerberos service principals from /etc/krb5.keytab
----
Failed to remove Kerberos service principals: Command '/usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r DOM-221.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM' returned non-zero exit status 5
----

This happens because the uninstaller performs the following sequence:
1/ restore pre-install files, including /etc/krb5.keytab
At this point /etc/krb5.keytab does not contain any principal for
IPA domain
2/ call ipa-client-install --uninstall, which in turns runs
ipa-rmkeytab -k /etc/krb5.keytab -r 
to remove the principals.

The fix ignores ipa-rmkeytab's exit code 5 (Principal name or realm not
found in keytab)

https://fedorahosted.org/freeipa/ticket/6012

Reviewed-By: Martin Basti

Create server and host certs with DNS altname

2016-07-19T12:18:04+00:00

Currently server (HTTP / LDAP) certs are created without a Subject
Alternative Name extension during server install, replica prepare
and host enrolment, a potentially problematic violation of RFC 2818.

Add the hostname as a SAN dNSName when these certs are created.

(Certmonger adds an appropriate request extension when renewing the
certificate, so nothing needs to be done for renewal).

Fixes: https://fedorahosted.org/freeipa/ticket/4970
Reviewed-By: Petr Spacek

client-install: log exceptions from certmonger.request_cert

2016-07-01T11:33:49+00:00

Reviewed-By: Martin Basti

Do not allow installation in FIPS mode

2016-06-29T14:17:27+00:00

https://fedorahosted.org/freeipa/ticket/5761

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden

client-install: do not fail if DNS times out during DNS update generation

2016-06-29T12:19:59+00:00

https://fedorahosted.org/freeipa/ticket/5962

Reviewed-By: Martin Basti

client: Share validator and domain name normalization with server install

2016-06-28T12:14:32+00:00

https://fedorahosted.org/freeipa/ticket/5976

Reviewed-By: Martin Basti

ipa-rmkeytab, ipa-join: don't fail if init of gettext failed

2016-06-27T10:34:18+00:00

If locale setting was incorect, gettext failed to initialize and scripts
failed. this commit replaces error exit with warning message. (Better to
have untranslated output than fail)

https://fedorahosted.org/freeipa/ticket/5973

Reviewed-By: Petr Spacek

Increase ipa-getkeytab LDAP timeout to 100sec

2016-06-27T07:33:02+00:00

On slower machines, the original time 10s is not enough. Raising timeout
to 100sec should help.

https://fedorahosted.org/freeipa/ticket/5842

Reviewed-By: Petr Spacek

man: Decribe ipa-client-install workaround for broken D-Bus enviroment.

2016-06-09T11:08:46+00:00

https://fedorahosted.org/freeipa/ticket/5694

Reviewed-By: Florence Blanc-Renaud

Added krb5.conf.d/ to included dirs in krb5.conf

2016-06-05T07:47:13+00:00

The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly

https://fedorahosted.org/freeipa/ticket/5912

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy