freeipa.git/ipalib, branch cakeysfix

Remove the cachedproperty class

2017-05-02T15:33:25+00:00

The cachedproperty class was used in one special use-case where it only
caused issues. Let's get rid of it.

https://pagure.io/freeipa/issue/6878

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Fixed typo in ipa-client-install output

2017-05-02T11:41:20+00:00

Reviewed-By: Martin Basti

Use only anonymous PKINIT to fetch armor ccache

2017-04-28T08:38:12+00:00

Since the anonymous principal can only use PKINIT to fetch credential
cache it makes no sense to try and use its kerberos key to establish
FAST channel.

We should also be able to use custom PKINIT anchor for the armoring.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Fix PKCS11 helper

2017-04-12T07:54:10+00:00

Slots in HSM are not assigned statically, we have to chose proper
slot from token label.

Softhsm i2.2.0 changed this behavior and now slots can change over
time (it is allowed by pkcs11 standard).

Changelog:
* created method get_slot() that returns slot number from
  used label
* replaces usage of slot in __init__ method of P11_Helper
  with label
* slot is dynamically detected from token label before
  session is opened
* pkcs11-util --init-token now uses '--free' instead '--slot'
  which uses first free slot (we don't care about slot numbers
  anymore)

https://pagure.io/freeipa/issue/6692

Reviewed-By: Stanislav Laznicka

setup, pylint, spec file: drop python-nss dependency

2017-03-31T10:20:35+00:00

Remove the unused python-nss dependency.

Reviewed-By: Christian Heimes

certdb: use certutil and match_hostname for cert verification

2017-03-31T10:20:35+00:00

Use certutil and ssl.match_hostname calls instead of python-nss for
certificate verification.

Reviewed-By: Christian Heimes

Add --password-expiration to allow admin to force user password expiration

2017-03-31T10:19:40+00:00

- Allows an admin to easily force a user to expire their password forcing the user to change it immediately or at a specified time in the future

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta

Prevent churn on ccaches

2017-03-28T11:36:30+00:00

We slice down the received cookie so that just the content that matter
is preserved. Thi is ok because servers can't trust anything else anyway
and will accept a cookie with the ancillary data missing.

By removing variable parts like the expiry component added by
mod_session or the Expiration or Max-Age metadata we keep only the part
of the cookie that changes only when a new session is generated.

This way when storing the cookie we actually add a new entry in the
ccache only when the session actually changes, and this prevents churn
on FILE based ccaches.

Related https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Handle failed authentication via cookie

2017-03-28T11:36:30+00:00

If cookie authentication fails and we get back a 401 see if we
tried a SPNEGO auth by checking if we had a GSSAPI context. If not
it means our session cookie was invalid or expired or some other
error happened on the server that requires us to try a full SPNEGO
handshake, so go ahead and try it.

Fixes https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Add debug logging for keep-alive

2017-03-20T18:24:28+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek