freeipa.git/ipaclient, branch pwdpolicy

py3: decode bytes for json.loads()

2017-01-24T12:25:47+00:00

In py 3.5 json.loads requires to have string as input, all bytes must be
decoded.

Note: python 3.6 supports bytes for json.loads()

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes 
Reviewed-By: Jan Cholasta

client install: correctly report all failures

2017-01-20T16:34:07+00:00

In commit 5249eb817efbb5708d097173a8d5f1e322fb201e, the client install code
was converted to use exception handling instead of return codes. However,
some return statements were not converted to raise statements and as a
result, ipa-client-install will report success in some error conditions.

Convert the return statements to raise statements to fix the issue.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka

disable hostname canonicalization by Kerberos library

2017-01-11T15:18:24+00:00

By default, Kerberos client library attempts to canonicalize service
hostname in TGS requests. This can fail e.g. if hosts file on the client
machine references short names before FQDNs. In this case the short name
is used in TGS_REQ which KDC fails to resolve.

Since we do not (yet) support referencing hosts by their short names it
is safe to just disable this behavior in krb5.conf and use supplied
FQDNs.

https://fedorahosted.org/freeipa/ticket/6584

Reviewed-By: Tomas Krizek 
Reviewed-By: Simo Sorce

ipaclient: schema cache: Handle malformed server info data gracefully

2017-01-09T08:13:36+00:00

As a part of CLI schema cache some data about each previously contacted server
are stored in simple JSON file. The file may get corrupted and became
undecodable for various reasons (parallel access, file system error,
tampering). Since the data are not necessary we should just warn an continue.

https://fedorahosted.org/freeipa/ticket/6578

Reviewed-By: Jan Cholasta

ipa_generate_password algorithm change

2017-01-06T08:26:56+00:00

A change to the algorithm that generates random passwords
for multiple purposes throught IPA. This spells out the need
to assess password strength by the entropy it contains rather
than its length.

This new password generation should also be compatible with the
NSS implementation of password requirements in FIPS environment
so that newly created databases won't fail with wrong authentication.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Petr Spacek

schema_cache: Make handling of string compatible with python3

2017-01-05T17:30:00+00:00

https://fedorahosted.org/freeipa/ticket/6559

Reviewed-By: Martin Basti

client, platform: Use paths.SSH* instead of get_config_dir().

2017-01-05T16:50:03+00:00

Reviewed-By: Martin Basti

Silence pylint import errors of ipaserver in ipalib and ipaclient

2017-01-05T08:50:28+00:00

In client-only installations the ipaserver package is not available.
Additional guards prevent pylint to complain about missing ipaserver
package.

https://fedorahosted.org/freeipa/ticket/6468

Reviewed-By: Martin Basti

ipaclient.plugins: Use api_version from internally called commands

2016-12-14T10:50:35+00:00

In client plugins make sure the api_version is 'inherited' from server command
that is internally called. Otherwise the api_version is obtained from client
API instance. When calling server command from client command 'version' is
passed in options and it overrides the right one. Server then refuses to handle
such call.

https://fedorahosted.org/freeipa/ticket/6539

Reviewed-By: Martin Basti

Configure Anonymous PKINIT on server install

2016-12-12T12:39:44+00:00

Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST
authentication (necessary for 2FA for example) using an anonymous krbtgt
obtained via Pkinit.

https://fedorahosted.org/freeipa/ticket/5678

Signed-off-by: Simo Sorce 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Babinsky