freeipa.git/install, branch cachetickets

Add options to allow ticket caching

2017-03-06T18:46:44+00:00

This new option (planned to land in gssproxy 0.7) we cache the ldap
ticket properly and avoid a ticket lookup to the KDC on each and every
ldap connection. (Also requires krb5 libs 1.15.1 to benefit from caching).

Signed-off-by: Simo Sorce

man: update ipa-cacert-manage

2017-03-02T16:02:25+00:00

Make it clear this command is used to only renew certificate for
the CA and provide guidance on how to renew other certificates.

https://pagure.io/freeipa/issue/6648

Reviewed-By: Stanislav Laznicka

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

Update server/replica installer man pages

2017-03-01T14:55:45+00:00

Since AD trust installer is now a part of composite installers, their
man pages were updated with separate section documenting relevant AD
trust-related option descriptions.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Fix erroneous short name options in ipa-adtrust-install man page

2017-03-01T14:55:45+00:00

`--rid-base` and `--secondary-rid-base` had `-U` option assigned
by error in the man page. Remove it as these options have not short
alias.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

print the installation info only in standalone mode

2017-03-01T14:55:45+00:00

There is no point in emitting this message during server/replica
install.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Limit sessions to 30 minutes by default

2017-03-01T12:43:40+00:00

When we changed the session handling code we unintentinally extended
sessions expiraion time to the whole ticket lifetime of 24h.

Related to https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes

Define template version in certmap.conf

2017-03-01T11:46:50+00:00

A previous commit (ffb9a09a0d63f7edae2b647b5c1d503d1d4d7a6e) removed the
definition of VERSION 2 in certmap.conf.template.

ipa-server-upgrade tool compares the template version with the version in
certmap.conf. As VERSION is not defined in either file, it concludes that
version = 0 for both and does not make a backup of certmap.conf even though
it prints that it will.

The fix re-defines VERSION in the template and adapts the code because the
template has changed (it is using $ISSUER_DN instead of
CN=Certificate Authority,$SUBJECT_BASE).

The fix also logs an error when a template file is not versioned.

https://fedorahosted.org/freeipa/ticket/6354

Reviewed-By: Tomas Krizek

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Workaround for certmonger's "Subject" representations

2017-03-01T09:43:41+00:00

If an OpenSSL certificate is requested in Certmonger
(CERT_STORAGE == "FILE") the "Subject" field of such Certificate
is ordered as received. However, when an NSS certificate is
requested, the "Subject" field takes the LDAP order
(components get reversed). This is a workaround so that the behavior
stays the same.

The workaround should be removed when
https://pagure.io/certmonger/issue/62 gets fixed.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta