freeipa.git/ipaclient, branch cachetickets

Vault: port key wrapping to python-cryptography

2017-03-02T13:22:11+00:00

https://fedorahosted.org/freeipa/ticket/6650

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

Drop in-memory copy of schema zip file

2017-03-01T11:50:43+00:00

The schema cache used a BytesIO buffer to read/write schema cache before
it got flushed to disk. Since the schema cache is now loaded in one go,
the temporary buffer is no longer needed.

File locking has been replaced with a temporary file and atomic rename.

Signed-off-by: Christian Heimes 
Reviewed-By: David Kupka

Speed up client schema cache

2017-03-01T11:50:43+00:00

It's inefficient to open a zip file over and over again. By loading all
members of the schema cache file at once, the ipa CLI script starts
about 25 to 30% faster for simple cases like help and ping.

Before:

$ time for i in {1..20}; do ./ipa ping >/dev/null; done

real    0m13.608s
user    0m10.316s
sys     0m1.121s

After:

$ time for i in {1..20}; do ./ipa ping >/dev/null; done

real    0m9.330s
user    0m7.635s
sys     0m1.146s

https://fedorahosted.org/freeipa/ticket/6690

Signed-off-by: Christian Heimes 
Reviewed-By: David Kupka

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Remove NSSConnection from otptoken plugin

2017-03-01T09:43:41+00:00

Replace NSSConnection with httplib.HTTPSConenction to be able to remove
NSSConnection for good.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

csrgen: Support encrypted private keys

2017-02-28T09:02:49+00:00

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Allow overriding the CSR generation profile

2017-02-28T09:02:49+00:00

In case users want multiple CSR generation profiles that work with the
same dogtag profile, or in case the profiles are not named the same,
this flag allows specifying an alternative CSR generation profile.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Automate full cert request flow

2017-02-28T09:02:49+00:00

Allows the `ipa cert-request` command to generate its own CSR. It no
longer requires a CSR passed on the command line, instead it creates a
config (bash script) with `cert-get-requestdata`, then runs it to build
a CSR, and submits that CSR.

Example usage (NSS database):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs

Example usage (PEM private key file):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

compat: fix `Any` params in `batch` and `dnsrecord`

2017-02-23T17:53:50+00:00

The `methods` argument of `batch` and `dnsrecords` attribute of `dnsrecord`
were incorrectly defined as `Str` instead of `Any`.

https://fedorahosted.org/freeipa/ticket/6647

Reviewed-By: Martin Basti

Fix error in ca_cert_files validator

2017-02-21T14:31:54+00:00

ClientInstall expects a single ca_cert_file as a string but the
framework gives it a list.

https://fedorahosted.org/freeipa/ticket/6694

Reviewed-By: Christian Heimes