freeipa.git/install/updates, branch cakeysfix

compat plugin: Update link to slapi-nis project

2017-04-24T15:11:51+00:00

Reviewed-By: Martin Basti

compat: ignore cn=topology,cn=ipa,cn=etc subtree

2017-04-24T15:11:51+00:00

The entries in cn=topology,cn=ipa,cn=etc should not be taken in
account for the compat plugin.

https://pagure.io/freeipa/issue/6821

Reviewed-By: Martin Basti

Move the compat plugin setup at the end of install

2017-04-24T15:11:51+00:00

The compat plugin was causing deadlocks with the topology plugin. Move
its setup at the end of the installation and remove the
cn=topology,cn=ipa,cn=etc subtree from its scope.

https://pagure.io/freeipa/issue/6821

Reviewed-By: Martin Basti

Upgrade: add gidnumber to trusted domain entry

2017-04-07T10:38:35+00:00

The trusted domain entries created in earlier versions are missing gidnumber.
During upgrade, a new plugin will read the gidnumber of the fallback group
cn=Default SMB Group and add this value to trusted domain entries which do
not have a gidNumber.

https://pagure.io/freeipa/issue/6827

Reviewed-By: Alexander Bokovoy

Add --password-expiration to allow admin to force user password expiration

2017-03-31T10:19:40+00:00

- Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

Short name resolution: introduce the required schema

2017-03-14T17:37:10+00:00

Add ipaDomainResolutionOrder and ipaNameResolutionData to IPAv3 schema.
Extend ipaConfig object with ipaNameResolutionData objectclass during
update.

https://pagure.io/freeipa/issue/6372

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

server upgrade: fix upgrade from pre-4.0

2017-02-20T13:00:50+00:00

update_ca_renewal_master uses ipaCert certmonger tracking information to
decide whether the local server is the CA renewal master or not. The
information is lost when migrating from /etc/httpd/alias to
/var/lib/ipa/radb in update_ra_cert_store.

Make sure update_ra_cert_store is executed after update_ca_renewal_master
so that correct information is used.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Use Anonymous user to obtain FAST armor ccache

2017-02-15T06:13:37+00:00

The anonymous user allows the framework to obtain an armor ccache without
relying on usable credentials, either via a keytab or a pkinit and
public certificates. This will be needed once the HTTP keytab is moved away
for privilege separation.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta