freeipa.git/ipalib/install, branch cakeysfix

Fixed typo in ipa-client-install output

2017-05-02T11:41:20+00:00

Reviewed-By: Martin Basti

Use only anonymous PKINIT to fetch armor ccache

2017-04-28T08:38:12+00:00

Since the anonymous principal can only use PKINIT to fetch credential
cache it makes no sense to try and use its kerberos key to establish
FAST channel.

We should also be able to use custom PKINIT anchor for the armoring.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

install: re-introduce option groups

2017-03-13T09:12:40+00:00

Re-introduce option groups in ipa-client-install, ipa-server-install and
ipa-replica-install.

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

install: add missing space in realm_name description

2017-03-13T09:12:40+00:00

https://pagure.io/freeipa/issue/6392

Reviewed-By: Stanislav Laznicka

Refactor certmonger for OpenSSL certificates

2017-03-01T09:43:41+00:00

Currently, it was only possible to request an NSS certificate
via certmonger. Merged start_tracking methods and refactored them
to allow for OpenSSL certificates tracking.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Workaround for certmonger's "Subject" representations

2017-03-01T09:43:41+00:00

If an OpenSSL certificate is requested in Certmonger
(CERT_STORAGE == "FILE") the "Subject" field of such Certificate
is ordered as received. However, when an NSS certificate is
requested, the "Subject" field takes the LDAP order
(components get reversed). This is a workaround so that the behavior
stays the same.

The workaround should be removed when
https://pagure.io/certmonger/issue/62 gets fixed.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Use Anonymous user to obtain FAST armor ccache

2017-02-15T06:13:37+00:00

The anonymous user allows the framework to obtain an armor ccache without
relying on usable credentials, either via a keytab or a pkinit and
public certificates. This will be needed once the HTTP keytab is moved away
for privilege separation.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

cryptography has deprecated serial in favor of serial_number

2017-02-10T15:16:44+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Clarify meaning of --domain and --realm in installers

2017-01-05T08:47:25+00:00

Man pages need bigger overhaul. Take this as hot-fix for FAQ.

https://fedorahosted.org/freeipa/ticket/6574

Reviewed-By: Fraser Tweedale

Configure Anonymous PKINIT on server install

2016-12-12T12:39:44+00:00

Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST
authentication (necessary for 2FA for example) using an anonymous krbtgt
obtained via Pkinit.

https://fedorahosted.org/freeipa/ticket/5678

Signed-off-by: Simo Sorce 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Martin Babinsky