freeipa.git/install/share, branch pwdpolicy

dsinstance: extract function for writing certmap.conf

2017-01-11T14:26:20+00:00

For full customisability of the IPA CA subject DN, we will need the
ability to update DS `certmap.conf' when upgrading a deployment from
CA-less to CA-ful.

Extract the existing behaviour, which is private to DsInstance, to
the `write_certmap_conf' top-level function.

Also update `certmap.conf.template' for substition of the whole CA
subject DN (not just the subject base).

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.conf

2016-12-12T15:39:32+00:00

Samba 4.5 does not allow to specify access mode for the keytab (FILE: or
WRFILE:) from external sources. Thus, change the defaults to a path
(implies FILE: prefix) while Samba Team fixes the code to allow the
access mode prefix for keytabs.

On upgrade we need to replace 'dedicated keytab file' value with the
path to the Samba keytab that FreeIPA maintains. Since the configuration
is stored in the Samba registry, we use net utility to manipulate the
configuration:

    net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab

Fixes https://fedorahosted.org/freeipa/ticket/6551

Reviewed-By: Martin Babinsky

Configure Anonymous PKINIT on server install

2016-12-12T12:39:44+00:00

Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST
authentication (necessary for 2FA for example) using an anonymous krbtgt
obtained via Pkinit.

https://fedorahosted.org/freeipa/ticket/5678

Signed-off-by: Simo Sorce 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Babinsky

Revert "upgrade: add replica bind DN group check interval to CA topology config"

2016-12-09T14:47:13+00:00

This reverts commit 8c6a10ceddb4fce9a3dd4a334e6804800b5c89f9 since it
leads to errors in upgrade of first master.

https://fedorahosted.org/freeipa/ticket/6508

Reviewed-By: Martin Basti

Set explicit confdir option for global contexts

2016-12-02T08:14:35+00:00

Some API contexts are used to modify global state (e.g. files in /etc
and /var). These contexts do not support confdir overrides. Initialize
the API with an explicit confdir argument to paths.ETC_IPA.

The special contexts are:

* backup
* cli_installer
* installer
* ipctl
* renew
* restore
* server
* updates

The patch also corrects the context of the ipa-httpd-kdcproxy script to
'server'.

https://fedorahosted.org/freeipa/ticket/6389

Signed-off-by: Christian Heimes 
Reviewed-By: Jan Cholasta

upgrade: add replica bind DN group check interval to CA topology config

2016-11-29T15:09:59+00:00

Without this attribute explicitly set the replication plugin won't recognize
updates from members of 'replication managers' sysaccount group, leading to
stuck replica CA installation.

https://fedorahosted.org/freeipa/ticket/6508

Reviewed-By: Florence Blanc-Renaud

ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIR

2016-11-29T13:50:51+00:00

SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform.

Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove
both SHARE_DIR and PLUGIN_SHARE_DIR.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

ipapython: move dnssec, p11helper and secrets to ipaserver

2016-11-29T13:50:51+00:00

The dnssec and secrets subpackages and the p11helper module depend on
ipaplatform.

Move them to ipaserver as they are used only on the server.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

custodiainstance: automatic restart on config file update

2016-11-29T13:50:51+00:00

Automatically restart Custodia during IPA server upgrade if custodia.conf
was updated.

Use the new store class name in custodia.conf.template.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

Add main guards to a couple of Python scripts

2016-11-24T15:35:43+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti