freeipa.git/install/updates, branch ipasam_getkeytab

Convert ipa-sam to use the new getkeytab control

2015-12-03T13:19:14+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5495

Add profiles and default CA ACL on migration

2015-11-24T09:12:24+00:00

Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers.  Update ipa-replica-install to add
these if they are missing.

Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.

To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.

Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.

Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta

custodia: ipa-upgrade failed on replica

2015-11-05T10:46:48+00:00

- Add 73-custodia.update to install/updates/Makefile.am

https://fedorahosted.org/freeipa/ticket/5374

Reviewed-By: Martin Basti

Remove 50-lockout-policy.update file

2015-10-30T13:20:16+00:00

Remove lockout policy update file because all currently supported versions
have krbPwdMaxFailure defaulting to 6 and krbPwdLockoutDuration defaulting to 600.

Keeping lockout policy update file prevents from creating a more scrict policy in
environments subject to regulatory compliance

https://fedorahosted.org/freeipa/ticket/5418

Reviewed-By: Alexander Bokovoy

topology plugin configuration workaround

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

enable topology plugin on upgrade

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

topology: manage ca replication agreements

2015-10-15T12:24:33+00:00

Configure IPA so that topology plugin will manage also CA replication
agreements.

upgrades if CA is congigured:
- ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX
- ipaReplTopoManagedSuffix: o=ipaca is added to master entry
- binddngroup is added to o=ipaca replica entry

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

topology: add realm suffix to master entry on update

2015-10-15T12:08:47+00:00

Realm suffix was set only during installation but not on update.

Reviewed-By: Jan Cholasta

vault: fix private service vault creation

2015-10-13T12:34:00+00:00

https://fedorahosted.org/freeipa/ticket/5361

Reviewed-By: Petr Vobornik