freeipa.git/install/updates, branch review

Convert ipa-sam to use the new getkeytab control

2015-12-09T19:59:12+00:00

Signed-off-by: Simo Sorce 

Ticket: https://fedorahosted.org/freeipa/ticket/5495

aci: allow members of ipaservers to set up replication

2015-12-07T07:14:13+00:00

Add ACIs which allow the members of the ipaservers host group to set up
replication. This allows IPA hosts to perform replica promotion on
themselves.

A number of checks which need read access to certain LDAP entries is done
during replica promotion. Add ACIs to allow these checks to be done using
any valid IPA host credentials.

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: replace per-server ACIs with ipaserver-based ACIs

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

aci: add IPA servers host group 'ipaservers'

2015-12-07T07:13:23+00:00

https://fedorahosted.org/freeipa/ticket/3416

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

rename topology suffixes to "domain" and "ca"

2015-12-04T11:59:21+00:00

https://www.redhat.com/archives/freeipa-devel/2015-November/msg00485.html

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Add profiles and default CA ACL on migration

2015-11-24T09:12:24+00:00

Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers.  Update ipa-replica-install to add
these if they are missing.

Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.

To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.

Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.

Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta

custodia: ipa-upgrade failed on replica

2015-11-05T10:46:48+00:00

- Add 73-custodia.update to install/updates/Makefile.am

https://fedorahosted.org/freeipa/ticket/5374

Reviewed-By: Martin Basti

Remove 50-lockout-policy.update file

2015-10-30T13:20:16+00:00

Remove lockout policy update file because all currently supported versions
have krbPwdMaxFailure defaulting to 6 and krbPwdLockoutDuration defaulting to 600.

Keeping lockout policy update file prevents from creating a more scrict policy in
environments subject to regulatory compliance

https://fedorahosted.org/freeipa/ticket/5418

Reviewed-By: Alexander Bokovoy

topology plugin configuration workaround

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

enable topology plugin on upgrade

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta