freeipa.git/ipaclient, branch ccachesess

Chain CSR generator file loaders

2017-03-08T14:59:26+00:00

First try custom location, then csrgen subdir in confdir and finally
fall back to package data.

Signed-off-by: Christian Heimes 
Reviewed-By: Ben Lipton 
Reviewed-By: Martin Basti

Move csrgen templates into ipaclient package

2017-03-08T14:59:26+00:00

csrgen broke packaging of ipaclient for PyPI. All csrgen related
resources are now package data of ipaclient package. Package data is
accessed with Jinja's PackageLoader() or through pkg_resources.

https://pagure.io/freeipa/issue/6714

Signed-off-by: Christian Heimes 
Reviewed-By: Ben Lipton 
Reviewed-By: Martin Basti

dns: fix `dnsrecord_add` interactive mode

2017-03-08T14:52:41+00:00

`dnsrecord_add` interactive mode might prompt for value of non-existent
arguments `a_part_create_reverse` and `aaaa_part_create_reverse`. This
happens because `dnsrecord_add` extra flags are incorrectly defined as
parts of the respective DNS records.

Remove extra flags from DNS record parts to fix the interactive mode on old
clients talking to new servers. Skip non-existent arguments in the
interactive mode to fix new clients talking to old servers.

https://fedorahosted.org/freeipa/ticket/6457

Reviewed-By: Martin Basti

Vault: port key wrapping to python-cryptography

2017-03-02T13:22:11+00:00

https://fedorahosted.org/freeipa/ticket/6650

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

Drop in-memory copy of schema zip file

2017-03-01T11:50:43+00:00

The schema cache used a BytesIO buffer to read/write schema cache before
it got flushed to disk. Since the schema cache is now loaded in one go,
the temporary buffer is no longer needed.

File locking has been replaced with a temporary file and atomic rename.

Signed-off-by: Christian Heimes 
Reviewed-By: David Kupka

Speed up client schema cache

2017-03-01T11:50:43+00:00

It's inefficient to open a zip file over and over again. By loading all
members of the schema cache file at once, the ipa CLI script starts
about 25 to 30% faster for simple cases like help and ping.

Before:

$ time for i in {1..20}; do ./ipa ping >/dev/null; done

real    0m13.608s
user    0m10.316s
sys     0m1.121s

After:

$ time for i in {1..20}; do ./ipa ping >/dev/null; done

real    0m9.330s
user    0m7.635s
sys     0m1.146s

https://fedorahosted.org/freeipa/ticket/6690

Signed-off-by: Christian Heimes 
Reviewed-By: David Kupka

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Remove NSSConnection from otptoken plugin

2017-03-01T09:43:41+00:00

Replace NSSConnection with httplib.HTTPSConenction to be able to remove
NSSConnection for good.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

csrgen: Support encrypted private keys

2017-02-28T09:02:49+00:00

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta

csrgen: Allow overriding the CSR generation profile

2017-02-28T09:02:49+00:00

In case users want multiple CSR generation profiles that work with the
same dogtag profile, or in case the profiles are not named the same,
this flag allows specifying an alternative CSR generation profile.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta