freeipa.git/init, branch pwdpolicy

Build: create /var/run directories at install time

2016-11-09T12:08:32+00:00

Directory creating was moved from SPEC file to install-data-hook.
At the same time, it is using systemd-tmpfiles to create the directories
so we do not risk any inconsistency between SPEC file and tmpfilesd
configuration.

systemd-tmpfiles call is non-critical on purpose: The build would fail
when run under unprivileged user because systemd-tmpfiles tries to
change ownership. Luckily it creates all the files and just do not
change ownership so it works even under unprivileged user.

Interestingly, systemd-tmpfiles continues if user does not have
sufficient permissions to change ownership but fails if target username
does not exist at all. For this reason there is BuildRequires on httpd.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: integrate init and init/systemd into build system

2016-11-09T12:08:32+00:00

At the same time, I've renamed tmpfilesd config file to static name
"ipa.conf" instead of using package-specific name. It had no purpose
and just complicated build and packaging.

Variable substitution into configuration has to be done in Makefile
and not in Autoconf as documented in:
Autoconf v2.69 manual chapter 4.8.2 Installation Directory Variables:
  ... Most of these variables have values that rely on prefix or
  exec_prefix. ... Similarly, you should not rely on AC_CONFIG_FILES
  to replace bindir and friends in your shell scripts and other files;
  instead, let make manage their replacement.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: remove init/SystemV directory

2016-11-09T12:08:32+00:00

FreeIPA has hard dependency on systemd for a long time already.
SystemV directory was just polluting the tarball (while being useless).

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Configure httpd service from installer instead of directly from RPM

2016-04-22T08:19:25+00:00

File httpd.service was created by RPM, what causes that httpd service may
fail due IPA specific configuration even if IPA wasn't installed or was
uninstalled (without erasing RPMs).

With this patch httpd service is configured by httpd.d/ipa.conf during
IPA installation and this config is removed by uninstaller, so no
residual http configuration related to IPA should stay there.

https://fedorahosted.org/freeipa/ticket/5681

Reviewed-By: Stanislav Laznicka

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

destroy httpd ccache after stopping the service

2015-09-23T11:04:18+00:00

This will force recreation of the file-based ccache after IPA restore and
prevent a mismatch between cached and restored Kerberos keys.

https://fedorahosted.org/freeipa/ticket/5296

Reviewed-By: Martin Basti

Provide Kerberos over HTTP (MS-KKDCP)

2015-06-24T08:43:58+00:00

Add integration of python-kdcproxy into FreeIPA to support the MS
Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD
client requests over HTTP and HTTPS.

- freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy
  dependencies are already satisfied.
- The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa,
  cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is
  present.
- The installers and update create a new Apache config file
  /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on
  /KdcProxy. The app is run inside its own WSGI daemon group with
  a different uid and gid than the webui.
- A ExecStartPre script in httpd.service symlinks the config file to
  /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present.
- The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf,
  so that an existing config is not used. SetEnv from Apache config does
  not work here, because it doesn't set an OS env var.
- python-kdcproxy is configured to *not* use DNS SRV lookups. The
  location of KDC and KPASSWD servers are read from /etc/krb5.conf.
- The state of the service can be modified with two ldif files for
  ipa-ldap-updater. No CLI script is offered yet.

https://www.freeipa.org/page/V4/KDC_Proxy

https://fedorahosted.org/freeipa/ticket/4801

Reviewed-By: Nathaniel McCallum 
Reviewed-By: Simo Sorce

move IPA-related http runtime directories to common subdirectory

2015-05-19T12:59:18+00:00

When both 'mod_auth_kerb' and 'mod_auth_gssapi' are installed at the same
time, they use common directory for storing Apache ccache file. Uninstallation
of 'mod_auth_kerb' removes this directory leading to invalid CCache path for
httpd and authentication failure.

Using an IPA-specific directory for credential storage during apache runtime
avoids this issue.

https://fedorahosted.org/freeipa/ticket/4973

Reviewed-By: David Kupka

provide dedicated ccache file for httpd

2015-05-12T11:01:45+00:00

httpd service stores Kerberos credentials in kernel keyring which gets
destroyed and recreated during service install/upgrade, causing problems when
the process is run under SELinux context other than 'unconfined_t'. This patch
enables HTTPInstance to set up a dedicated CCache file for Apache to store
credentials.

https://fedorahosted.org/freeipa/ticket/4973

Reviewed-By: Jan Cholasta 
Reviewed-By: Alexander Bokovoy

Use mod_auth_gssapi instead of mod_auth_kerb.

2015-03-30T13:06:12+00:00

https://fedorahosted.org/freeipa/ticket/4190

Reviewed-By: Jan Cholasta 
Reviewed-By: Petr Vobornik 
Reviewed-By: Rob Crittenden 
Reviewed-By: Simo Sorce