freeipa.git/install/certmonger, branch pwdpolicy

renew agent: handle non-replicated certificates

2017-01-16T13:37:25+00:00

In addition to replicated certificates (Dogtag certificates, RA
certificate), handle non-replicated certificates in
dogtag-ipa-ca-renew-agent as well.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Alexander Bokovoy

Set explicit confdir option for global contexts

2016-12-02T08:14:35+00:00

Some API contexts are used to modify global state (e.g. files in /etc
and /var). These contexts do not support confdir overrides. Initialize
the API with an explicit confdir argument to paths.ETC_IPA.

The special contexts are:

* backup
* cli_installer
* installer
* ipctl
* renew
* restore
* server
* updates

The patch also corrects the context of the ipa-httpd-kdcproxy script to
'server'.

https://fedorahosted.org/freeipa/ticket/6389

Signed-off-by: Christian Heimes 
Reviewed-By: Jan Cholasta

Build: remove incorrect use of MAINTAINERCLEANFILES

2016-11-16T08:12:07+00:00

Automake manual section 13 What Gets Cleaned says that make maintainer-clean
should not remove files necessary for subsequent runs of ./configure.

It practically means that all usage of MAINTAINERCLEANFILES were incorrect
so I've removed them.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik 
Reviewed-By: Christian Heimes

Refactor installer code requesting certificates

2016-11-10T13:15:57+00:00

- Temporary modify certmonger dogtag-ipa-ca-renew helper to request the IPA RA
agent cert, using the temp cert created during pkispawn. The cert request
is now processed through certmonger, and the helper arguments are restored
once the agent cert is obtained.

- Modify the installer code creating HTTP and LDAP certificates to use
certmonger's IPA helper with temporary parameters (calling dogtag-submit
instead of ipa-submit)

- Clean-up for the integration tests: sometimes ipa renewal.lock is not
released during ipa-server-uninstall. Make sure that the file is removed
to allow future installations.

https://fedorahosted.org/freeipa/ticket/6433

Reviewed-By: Jan Cholasta 
Reviewed-By: Fraser Tweedale

Use autobind instead of host keytab authentication in dogtag-ipa-ca-renew-agent

2016-11-10T13:15:57+00:00

This commit makes sure that dogtag-ipa-ca-renew-agent CA helper can be used
before Kerberos is configured.

Reviewed-By: Jan Cholasta 
Reviewed-By: Fraser Tweedale

pkcs10: remove pyasn1 PKCS #10 spec

2016-11-10T09:21:47+00:00

In the dogtag-ipa-ca-renew-agent-submit certmonger renewal helper,
we currently use our hand-rolled PKCS #10 pyasn1 specification to
parse the friendlyName out of CSRs generated by certmonger (it
contains the NSSDB nickname of the cert).

Use other information from the renewal helper process environment to
determine the nickname and remove our PKCS #10 pyasn1 spec.

Part of: https://fedorahosted.org/freeipa/ticket/6398

Reviewed-By: Jan Cholasta 
Reviewed-By: Florence Blanc-Renaud

libexec scripts: ldap conn management

2016-11-09T14:32:45+00:00

Certificate renewal scripts require connection to LDAP. Properly
handle connects and disconnects from LDAP.

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Florence Blanc-Renaud

install: remove dirman_pw from services

2016-11-07T10:34:03+00:00

Remove directory manager's password from service's constructors

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Pylint: remove unused variables from installers and scripts

2016-10-06T08:43:36+00:00

Reviewed-By: Stanislav Laznicka

Pylint: enable check for unused-variables

2016-09-27T11:35:58+00:00

Unused variables may:
* make code less readable
* create dead code
* potentialy hide issues/errors

Enabled check should prevent to leave unused variable in code

Check is locally disabled for modules that fix is not clear or easy or have too many occurences of
unused variables

Reviewed-By: Florence Blanc-Renaud 
Reviewed-By: Stanislav Laznicka