freeipa.git/install/tools, branch pwdpolicy

Remove deprecated ipa-upgradeconfig command

2017-01-24T08:51:39+00:00

Fixes https://fedorahosted.org/freeipa/ticket/6620

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Martin Babinsky

Add sanity checks for use of --ca-subject and --subject-base

2017-01-11T14:28:50+00:00

Print an error and terminate if --ca-subject or --subject-base are
used when installing a CA-less master or when performing standalone
installation of a CA replica.

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

Indicate that ca subject / subject base uses LDAP RDN order

2017-01-11T14:27:55+00:00

Update man pages and help output to indicate that --subject-base and
--ca-subject options interpret their arguments in LDAP order.

Fixes: https://fedorahosted.org/freeipa/ticket/6455
Reviewed-By: Christian Heimes

Allow full customisability of IPA CA subject DN

2017-01-11T14:26:20+00:00

Currently only the "subject base" of the IPA CA subject DN can be
customised, via the installer's --subject-base option.  The RDN
"CN=Certificate Authority" is appended to form the subject DN, and
this composition is widely assumed.

Some administrators need more control over the CA subject DN,
especially to satisfy expectations of external CAs when the IPA CA
is to be externally signed.

This patch adds full customisability of the CA subject DN.
Specifically:

- Add the --ca-subject option for specifying the full IPA CA subject
  DN.  Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE".

- ipa-ca-install, when installing a CA in a previous CA-less
  topology, updates DS certmap.conf with the new new CA subject DN.

- DsInstance.find_subject_base no longer looks in certmap.conf,
  because the CA subject DN can be unrelated to the subject base.

Fixes: https://fedorahosted.org/freeipa/ticket/2614
Reviewed-By: Jan Cholasta

ipa-ca-install: add missing --subject-base option

2017-01-11T14:26:20+00:00

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

installer: rename --subject to --subject-base

2017-01-11T14:26:20+00:00

The --subject option is actually used to provide the "subject base".
We are also going to add an option for fully specifying the IPA CA
subject DN in a subsequent commit.  So to avoid confusion, rename
--subject to --subject-base, retaining --subject as a deprecated
alias.

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

Clarify meaning of --domain and --realm in installers

2017-01-05T08:47:25+00:00

Man pages need bigger overhaul. Take this as hot-fix for FAQ.

https://fedorahosted.org/freeipa/ticket/6574

Reviewed-By: Fraser Tweedale

Enumerate available options in IPA installer

2017-01-03T12:00:36+00:00

Fix adds enumerated list of available options in IPA server
installer and IPA CA installer help options

Fixes https://fedorahosted.org/freeipa/ticket/5435

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Jan Cholasta

ipactl: pass api as argument to services

2016-12-12T13:19:42+00:00

Commit 6409abf1 removes hard dependency of ipalib in ipalatform to avoid
cyclic dependenies, this commit updates ipactl accordingly

Reviewed-By: Stanislav Laznicka

ipautil: check for open ports on all resolved IPs

2016-12-07T15:32:09+00:00

When a hostname is provided to host_port_open, it should check if
ports are open for ALL IPs that are resolved from the hostname, instead
of checking whether the port is reachable on at least one of the IPs.

https://fedorahosted.org/freeipa/ticket/6522

Reviewed-By: Petr Spacek