freeipa.git/ipaclient/plugins, branch replica_kdc

dns: fix `dnsrecord_add` interactive mode

2017-03-08T14:52:41+00:00

`dnsrecord_add` interactive mode might prompt for value of non-existent
arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This
happens because `dnsrecord_add` extra flags are incorrectly defined as
parts of the respective DNS records.

Remove extra flags from DNS record parts to fix the interactive mode on old
clients talking to new servers. Skip non-existent arguments in the
interactive mode to fix new clients talking to old servers.

https://fedorahosted.org/freeipa/ticket/6457

Reviewed-By: Martin Basti

Vault: port key wrapping to python-cryptography

2017-03-02T13:22:11+00:00

https://fedorahosted.org/freeipa/ticket/6650

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

Remove NSSConnection from otptoken plugin

2017-03-01T09:43:41+00:00

Replace NSSConnection with httplib.HTTPSConenction to be able to remove
NSSConnection for good.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

csrgen: Support encrypted private keys

2017-02-28T09:02:49+00:00

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Allow overriding the CSR generation profile

2017-02-28T09:02:49+00:00

In case users want multiple CSR generation profiles that work with the
same dogtag profile, or in case the profiles are not named the same,
this flag allows specifying an alternative CSR generation profile.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Automate full cert request flow

2017-02-28T09:02:49+00:00

Allows the `ipa cert-request` command to generate its own CSR. It no
longer requires a CSR passed on the command line, instead it creates a
config (bash script) with `cert-get-requestdata`, then runs it to build
a CSR, and submits that CSR.

Example usage (NSS database):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs

Example usage (PEM private key file):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

DNS: dns-update-system-record can create nsupdate file

2017-02-15T11:20:55+00:00

Added option --out  creates a file with IPA DNS data in nsupdate
format.

https://fedorahosted.org/freeipa/ticket/6585

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

tests: Add tests for CSR autogeneration

2017-01-31T09:20:28+00:00

This patch also contains some code changes to make the code easier to
test and to make the tests pass.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Add code to generate scripts that generate CSRs

2017-01-31T09:20:28+00:00

Adds a library that uses jinja2 to format a script that, when run, will
build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses
this library and builds the script for a given principal. The rules are
read from json files in /usr/share/ipa/csr, but the rule provider is a
separate class so that it can be replaced easily.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

py3: decode bytes for json.loads()

2017-01-24T12:25:47+00:00

In py 3.5 json.loads requires to have string as input, all bytes must be
decoded.

Note: python 3.6 supports bytes for json.loads()

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes 
Reviewed-By: Jan Cholasta