freeipa.git/ipaclient/install, branch cakeysfix

ipa-client-install: remove extra space in pkinit_anchors definition

2017-05-02T11:46:55+00:00

ipa-client-install modifies /etc/krb5.conf and defines the following line:
    pkinit_anchors = FILE: /etc/ipa/ca.crt

The extra space between FILE: and /etc/ipa/ca.crt break pkinit.

https://pagure.io/freeipa/issue/6916

Reviewed-By: Alexander Bokovoy

Support certificate login after installation and upgrade

2017-03-14T14:13:43+00:00

Add necessary steps which set SSSD and set SELinux boolean during
installation or upgrade. Also create new endpoint in apache for
login using certificates.

https://pagure.io/freeipa/issue/6225

Reviewed-By: Florence Blanc-Renaud 
Reviewed-By: Petr Vobornik 
Reviewed-By: David Kupka

install: re-introduce option groups

2017-03-13T09:12:40+00:00

Re-introduce option groups in ipa-client-install, ipa-server-install and
ipa-replica-install.

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

client install: split off SSSD options into a separate class

2017-03-13T09:12:40+00:00

Split off SSSD knob definitions from the ClientInstallInterface class into
a new SSSDInstallInterface class.

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

pylint_plugins: add forbidden import checker

2017-03-10T12:04:59+00:00

Add new pylint AST checker plugin which implements a check for imports
forbidden in IPA. Which imports are forbidden is configurable in pylintrc.

Provide default forbidden import configuration and disable the check for
existing forbidden imports in our code base.

Reviewed-By: Martin Basti

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Fix error in ca_cert_files validator

2017-02-21T14:31:54+00:00

ClientInstall expects a single ca_cert_file as a string but the
framework gives it a list.

https://fedorahosted.org/freeipa/ticket/6694

Reviewed-By: Christian Heimes

client install: create /etc/ipa/nssdb with correct mode

2017-02-20T13:00:50+00:00

The NSS database directory is created with mode 640, which causes the IPA
client to fail to connect to any IPA server, because it is unable to read
trusted CA certificates from the NSS database.

Create the directory with mode 644 to fix the issue.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta