freeipa.git/install/restart_scripts, branch custodia

install: always export KRA agent PEM file

2015-10-08T11:42:58+00:00

Export the file even when KRA is not installed locally so that vault commands
work on all IPA replicas.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti

install: fix KRA agent PEM file permissions

2015-10-08T11:41:08+00:00

This fixes CVE-2015-5284.

https://fedorahosted.org/freeipa/ticket/5347

Reviewed-By: Martin Basti

cert renewal: Automatically update KRA agent PEM file

2015-08-27T13:53:42+00:00

https://fedorahosted.org/freeipa/ticket/5253

Reviewed-By: Alexander Bokovoy

Modernize 'except' clauses

2015-08-12T16:17:23+00:00

The 'as' syntax works from Python 2 on, and Python 3 will
drop the "comma" syntax.

Reviewed-By: Tomas Babej

plugable: Pass API to plugins on initialization rather than using set_api

2015-07-01T13:05:30+00:00

https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky

Adopted kinit_keytab and kinit_password for kerberos auth

2015-04-20T08:27:35+00:00

Calls to ipautil.run using kinit were replaced with calls
kinit_keytab/kinit_password functions implemented in the PATCH 0015.

Reviewed-By: Jan Cholasta 
Reviewed-By: Simo Sorce 
Reviewed-By: Petr Spacek

Make certificate renewal process synchronized

2015-01-13T18:34:59+00:00

Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka

Add a KRA to IPA

2014-08-22T07:59:31+00:00

This patch adds the capability of installing a Dogtag KRA
to an IPA instance.  With this patch,  a KRA is NOT configured
by default when ipa-server-install is run.  Rather, the command
ipa-kra-install must be executed on an instance on which a Dogtag
CA has already been configured.

The KRA shares the same tomcat instance and DS instance as the
Dogtag CA.  Moreover, the same admin user/agent (and agent cert) can
be used for both subsystems.  Certmonger is also confgured to
monitor the new subsystem certificates.

To create a clone KRA, simply execute ipa-kra-install 
on a replica on which a Dogtag CA has already been replicated.
ipa-kra-install will use the security domain to detect whether the
system being installed is a replica, and will error out if a needed
replica file is not provided.

The install scripts have been refactored somewhat to minimize
duplication of code.  A new base class dogtagintance.py has
been introduced containing code that is common to KRA and CA
installs.  This will become very useful when we add more PKI
subsystems.

The KRA will install its database as a subtree of o=ipaca,
specifically o=ipakra,o=ipaca.  This means that replication
agreements created to replicate CA data will also replicate KRA
data.  No new replication agreements are required.

Added dogtag plugin for KRA.  This is an initial commit providing
the basic vault functionality needed for vault.  This plugin will
likely be modified as we create the code to call some of these
functions.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3872

The uninstallation option in ipa-kra-install is temporarily disabled.

Reviewed-By: Rob Crittenden 
Reviewed-By: Petr Viktorin

Update external CA cert in Dogtag NSS DB on IPA CA cert renewal.

2014-07-30T14:04:21+00:00

Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden

Update CS.cfg on IPA CA certificate chaining change in renew_ca_cert.

2014-07-30T14:04:21+00:00

Part of https://fedorahosted.org/freeipa/ticket/3737

Reviewed-By: Rob Crittenden