freeipa.git/init, branch master

ipa systemd unit should define Wants=network instead of Requires=network

2017-03-07T19:06:35+00:00

The file ipa.service defines
    Requires=network.target
which means that ipa stack will be restarted each time the network stack
is restarted. This is not needed, and Wants=network.target will be sufficient.

https://fedorahosted.org/freeipa/ticket/6723

Reviewed-By: Tomas Krizek

Fix ipa.service unit re. gssproxy

2017-03-01T09:29:57+00:00

ipa.service unit defines Requires=gssproxy. Because of this, during
ipa-server-upgrade, the restart of gssproxy triggers a restart of ipa unit
(hence stopping LDAP server and breaking the connection api.Backend.ldap2).
Calls using this connection after gssproxy restart fail and ipa-server-upgrade
exits on failure.
The fix defines Wants=gssproxy to avoid the restart of ipa.service

https://fedorahosted.org/freeipa/ticket/6705

Reviewed-By: Alexander Bokovoy

Configure HTTPD to work via Gss-Proxy

2017-02-15T06:13:37+00:00

https://fedorahosted.org/freeipa/ticket/4189
https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Generate tmpfiles config at install time

2017-02-15T06:13:37+00:00

We do not want to generate runtime directories just because the packages
are installed, but only if the server is actually setup and run. Also this
will be needed later because we will create a user at install time and some
tmpfiles will need to be owned by this user.
As we are changing this code also rationalize the directory structure and
move it from the http rundir to the ipa specific rundir.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Change session handling

2017-02-15T06:13:37+00:00

Stop using memcache, use mod_auth_gssapi filesystem based ccaches.
Remove custom session handling, use mod_auth_gssapi and mod_session to
establish and keep a session cookie.
Add loopback to mod_auth_gssapi to do form absed auth and pass back a
valid session cookie.
And now that we do not remove ccaches files to move them to the
memcache, we can avoid the risk of pollutting the filesystem by keeping
a common ccache file for all instances of the same user.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Build: create /var/run directories at install time

2016-11-09T12:08:32+00:00

Directory creating was moved from SPEC file to install-data-hook.
At the same time, it is using systemd-tmpfiles to create the directories
so we do not risk any inconsistency between SPEC file and tmpfilesd
configuration.

systemd-tmpfiles call is non-critical on purpose: The build would fail
when run under unprivileged user because systemd-tmpfiles tries to
change ownership. Luckily it creates all the files and just do not
change ownership so it works even under unprivileged user.

Interestingly, systemd-tmpfiles continues if user does not have
sufficient permissions to change ownership but fails if target username
does not exist at all. For this reason there is BuildRequires on httpd.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: integrate init and init/systemd into build system

2016-11-09T12:08:32+00:00

At the same time, I've renamed tmpfilesd config file to static name
"ipa.conf" instead of using package-specific name. It had no purpose
and just complicated build and packaging.

Variable substitution into configuration has to be done in Makefile
and not in Autoconf as documented in:
Autoconf v2.69 manual chapter 4.8.2 Installation Directory Variables:
  ... Most of these variables have values that rely on prefix or
  exec_prefix. ... Similarly, you should not rely on AC_CONFIG_FILES
  to replace bindir and friends in your shell scripts and other files;
  instead, let make manage their replacement.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: remove init/SystemV directory

2016-11-09T12:08:32+00:00

FreeIPA has hard dependency on systemd for a long time already.
SystemV directory was just polluting the tarball (while being useless).

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Configure httpd service from installer instead of directly from RPM

2016-04-22T08:19:25+00:00

File httpd.service was created by RPM, what causes that httpd service may
fail due IPA specific configuration even if IPA wasn't installed or was
uninstalled (without erasing RPMs).

With this patch httpd service is configured by httpd.d/ipa.conf during
IPA installation and this config is removed by uninstaller, so no
residual http configuration related to IPA should stay there.

https://fedorahosted.org/freeipa/ticket/5681

Reviewed-By: Stanislav Laznicka

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta