freeipa.git/install, branch pwdpolicy

Remove deprecated ipa-upgradeconfig command

2017-01-24T08:51:39+00:00

Fixes https://fedorahosted.org/freeipa/ticket/6620

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Martin Babinsky

Coverity: removed useless semicolon which ends statement earlier

2017-01-18T08:15:54+00:00

Reviewed-By: Tomas Krizek

Coverity: Fix possibility of access to attribute of undefined

2017-01-18T08:15:54+00:00

Reviewed-By: Tomas Krizek

renew agent: handle non-replicated certificates

2017-01-16T13:37:25+00:00

In addition to replicated certificates (Dogtag certificates, RA
certificate), handle non-replicated certificates in
dogtag-ipa-ca-renew-agent as well.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Alexander Bokovoy

Add sanity checks for use of --ca-subject and --subject-base

2017-01-11T14:28:50+00:00

Print an error and terminate if --ca-subject or --subject-base are
used when installing a CA-less master or when performing standalone
installation of a CA replica.

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

Indicate that ca subject / subject base uses LDAP RDN order

2017-01-11T14:27:55+00:00

Update man pages and help output to indicate that --subject-base and
--ca-subject options interpret their arguments in LDAP order.

Fixes: https://fedorahosted.org/freeipa/ticket/6455
Reviewed-By: Christian Heimes

Allow full customisability of IPA CA subject DN

2017-01-11T14:26:20+00:00

Currently only the "subject base" of the IPA CA subject DN can be
customised, via the installer's --subject-base option.  The RDN
"CN=Certificate Authority" is appended to form the subject DN, and
this composition is widely assumed.

Some administrators need more control over the CA subject DN,
especially to satisfy expectations of external CAs when the IPA CA
is to be externally signed.

This patch adds full customisability of the CA subject DN.
Specifically:

- Add the --ca-subject option for specifying the full IPA CA subject
  DN.  Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE".

- ipa-ca-install, when installing a CA in a previous CA-less
  topology, updates DS certmap.conf with the new new CA subject DN.

- DsInstance.find_subject_base no longer looks in certmap.conf,
  because the CA subject DN can be unrelated to the subject base.

Fixes: https://fedorahosted.org/freeipa/ticket/2614
Reviewed-By: Jan Cholasta

dsinstance: extract function for writing certmap.conf

2017-01-11T14:26:20+00:00

For full customisability of the IPA CA subject DN, we will need the
ability to update DS `certmap.conf' when upgrading a deployment from
CA-less to CA-ful.

Extract the existing behaviour, which is private to DsInstance, to
the `write_certmap_conf' top-level function.

Also update `certmap.conf.template' for substition of the whole CA
subject DN (not just the subject base).

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

ipa-ca-install: add missing --subject-base option

2017-01-11T14:26:20+00:00

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta

installer: rename --subject to --subject-base

2017-01-11T14:26:20+00:00

The --subject option is actually used to provide the "subject base".
We are also going to add an option for fully specifying the IPA CA
subject DN in a subsequent commit.  So to avoid confusion, rename
--subject to --subject-base, retaining --subject as a deprecated
alias.

Part of: https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Jan Cholasta