freeipa.git/install/share, branch cakeysfix

Move the compat plugin setup at the end of install

2017-04-24T15:11:51+00:00

The compat plugin was causing deadlocks with the topology plugin. Move
its setup at the end of the installation and remove the
cn=topology,cn=ipa,cn=etc subtree from its scope.

https://pagure.io/freeipa/issue/6821

Reviewed-By: Martin Basti

Replace hard-coded kdcproxy path with WSGI script

2017-04-12T11:05:23+00:00

mod_wsgi has no way to import a WSGI module by dotted module name. A new
kdcproxy.wsgi script is used to import kdcproxy from whatever Python
version mod_wsgi is compiled against. This will simplify moving FreeIPA
to Python 3 and solves an import problem on Debian.

Resolves: https://pagure.io/freeipa/issue/6834

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti

Set "KDC:Disable Last Success" by default

2017-03-27T16:24:05+00:00

In big deployments enabled recording of the last sucesfull login
this creates a huge changelog on DS side and cause performance
issues even if this is excluded from replication.

Actually this is not used directly by FreeIPA so it is safe to remove
in new installations. User who need this must manually remove
"KDC:Disable Last Success" using `ipa config-mod` command or WebUI.

https://pagure.io/freeipa/issue/5313

Reviewed-By: Stanislav Laznicka

Support 8192-bit RSA keys in default cert profile

2017-03-22T11:29:23+00:00

Update the caIPAserviceCert profile to accept 8192-bit RSA keys.
Affects new installs only, because there is not yet a facility to
update included profiles.

Fixes: https://pagure.io/freeipa/issue/6319
Reviewed-By: Tomas Krizek

Add options to allow ticket caching

2017-03-16T12:10:37+00:00

This new option (planned to land in gssproxy 0.7) we cache the ldap
ticket properly and avoid a ticket lookup to the KDC on each and every
ldap connection. (Also requires krb5 libs 1.15.1 to benefit from caching).

Ticket: https://pagure.io/freeipa/issue/6771

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Remove allow_constrained_delegation from gssproxy.conf

2017-03-14T17:56:03+00:00

The Apache process must not allowed to use constrained delegation to
contact services because it is already allowed to impersonate
users to itself. Allowing it to perform constrained delegation would
let it impersonate any user against the LDAP service without authentication.

https://pagure.io/freeipa/issue/6225

Reviewed-By: Simo Sorce

Short name resolution: introduce the required schema

2017-03-14T17:37:10+00:00

Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema.
Extend ipaConfig object with ipaNameResolutionData objectclass during
update.

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

Remove copy-schema-to-ca.py from master branch

2017-03-14T14:16:20+00:00

This script is used only for IPA <3.1, so it must be compatible with
ipa-3-0 branch, so it should be placed there

https://pagure.io/freeipa/issue/6540

Reviewed-By: Stanislav Laznicka

Support certificate login after installation and upgrade

2017-03-14T14:13:43+00:00

Add necessary steps which set SSSD and set SELinux boolean during
installation or upgrade. Also create new endpoint in apache for
login using certificates.

https://pagure.io/freeipa/issue/6225

Reviewed-By: Florence Blanc-Renaud 
Reviewed-By: Petr Vobornik 
Reviewed-By: David Kupka

Move csrgen templates into ipaclient package

2017-03-08T14:59:26+00:00

csrgen broke packaging of ipaclient for PyPI. All csrgen related
resources are now package data of ipaclient package. Package data is
accessed with Jinja's PackageLoader() or through pkg_resources.

https://pagure.io/freeipa/issue/6714

Signed-off-by: Christian Heimes 
Reviewed-By: Ben Lipton 
Reviewed-By: Martin Basti