freeipa.git/install, branch custodia

Allow to install the KRA on a promoted server

2015-10-20T17:22:58+00:00

Signed-off-by: Simo Sorce

Allow ipa-ca-install to use the new promotion code

2015-10-20T17:22:54+00:00

This makes it possible to install a CA after-the-fact on a server
that has been promoted (and has no replica file available).

Signed-off-by: Simo Sorce

Add option to specify LDIF file that contains DS configuration changes

2015-10-15T16:37:52+00:00

This allows to user modify configuration changes of the directory server
instance during installation of DS

https://fedorahosted.org/freeipa/ticket/4949

Also fixes:
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky

Allow to setup the CA when promoting a replica

2015-10-15T12:24:33+00:00

This patch makes --setup-ca work to set upa clone CA while creating
a new replica. The standalone ipa-ca-install script is not converted
yet though.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

handle multiple managed suffixes

2015-10-15T12:24:33+00:00

    trigger topology updaet if suffix entry is added
    trigger topology update if managedSuffix is modified in host entry

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

topology plugin configuration workaround

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

enable topology plugin on upgrade

2015-10-15T12:24:33+00:00

Reviewed-by: Simo Sorce 
Reviewed-By: Jan Cholasta

topology: manage ca replication agreements

2015-10-15T12:24:33+00:00

Configure IPA so that topology plugin will manage also CA replication
agreements.

upgrades if CA is congigured:
- ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX
- ipaReplTopoManagedSuffix: o=ipaca is added to master entry
- binddngroup is added to o=ipaca replica entry

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Allow ipa-replica-conncheck to use default creds

2015-10-15T12:24:33+00:00

If the user has already run kinit try to use those credentials.
The user can always override by explicitly passing the -p flag.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Implement replica promotion functionality

2015-10-15T12:24:33+00:00

This patch implements a new flag --promote for the ipa-replica-install command
that allows an administrative user to 'promote' an already joined client to
become a full ipa server.

The only credentials used are that of an administrator. This code relies on
ipa-custodia being available on the peer master as well as a number of other
patches to allow a computer account to request certificates for its services.

Therefore this feature is marked to work only with domain level 1 and above
servers.

Ticket: https://fedorahosted.org/freeipa/ticket/2888

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta