freeipa.git/install/tools, branch mindatefix

ipa-compat-manage: use server API to retrieve plugin status

2016-07-12T08:59:59+00:00

https://fedorahosted.org/freeipa/ticket/6033

Reviewed-By: Stanislav Laznicka

ipa-nis-manage: Use server API to retrieve plugin status

2016-07-12T08:53:03+00:00

https://fedorahosted.org/freeipa/ticket/6027

Reviewed-By: Florence Blanc-Renaud

Add option --no-log for ipa-replica-conncheck script

2016-07-01T07:05:33+00:00

When option is sued, ipa-replica-conncheck will not log into file

https://fedorahosted.org/freeipa/ticket/5757

Reviewed-By: Martin Babinsky

Fix replica install with CA

2016-06-30T11:18:51+00:00

The incorrect api was used, and CA record updated was duplicated.

https://fedorahosted.org/freeipa/ticket/5966

Reviewed-By: Petr Spacek

Do not allow installation in FIPS mode

2016-06-29T14:17:27+00:00

https://fedorahosted.org/freeipa/ticket/5761

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden

DNS Locations: hide option --no-msdcs in adtrust-install

2016-06-27T11:35:00+00:00

Since DNS location mechanism is active, this option has no effect,
because records are generate dynamically.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek

Fix to ipa-ca-install asking for host principal password

2016-06-23T10:26:20+00:00

With a ca_cert_file specified in options, the nss_db was used before the
certificates from the file were added to it, which caused an exception
that led to fallback to ssh which is broken.

https://fedorahosted.org/freeipa/ticket/5965

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

ipa-replica-manage: use `server_del` when removing domain level 1 replica

2016-06-17T16:55:19+00:00

`ipa-replica-manage del` will now call `server_del` behind the scenes when a
removal of replica from managed topology is requested. The existing removal
options were mapped on the server_del options to maintain backwards
compatibility with earlier versions.

https://fedorahosted.org/freeipa/ticket/5588

Reviewed-By: Martin Basti

delegate removal of master DNS record and replica keys to separate functions

2016-06-17T16:55:19+00:00

https://fedorahosted.org/freeipa/ticket/5588

Reviewed-By: Martin Basti

Always qualify requests for admin in ipa-replica-conncheck

2016-06-17T15:31:08+00:00

ipa-replica-conncheck connects to the master using an SSH command:
ssh -o StrictHostKeychecking=no -o UserKnownHostsFile= \
    -o GSSAPIAuthentication=yes @ \
    echo OK

The issue is that the principal name is not fully qualified (for instance
'admin' is used, even if ipa-replica-conncheck was called with
--principal admin@EXAMPLE.COM).
When the FreeIPA server is running with a /etc/sssd/sssd.conf containing
    [sssd]
    default_domain_suffix = ad.domain.com
this leads to the SSH connection failure because admin is not defined in
the default domain.

The fix uses the fully qualified principal name, and calls ssh with
ssh -o StrictHostKeychecking=no -o UserKnownHostsFile= \
    -o GSSAPIAuthentication=yes -o User= \
     echo OK
to avoid syntax issues with admin@DOMAIN@master

https://fedorahosted.org/freeipa/ticket/5812

Reviewed-By: Martin Basti