freeipa.git/ipalib, branch fixlogout

Add fix for ipa plugins command

2017-02-17T09:22:07+00:00

Fix adds count of plugins loaded to return dict

Fixes https://fedorahosted.org/freeipa/ticket/6513

Signed-off-by: Abhijeet Kasurde 
Reviewed-By: Martin Basti 
Reviewed-By: Martin Babinsky

Explicitly remove support of SSLv2/3

2017-02-17T09:04:00+00:00

It was possible to set tls_version_min/max to 'ssl2' or 'ssl3',
even though newer versions of NSS will fail to set this as a valid
TLS version. This patch explicitly checks for deprecated TLS versions
prior to creating a TLS connection.

Also, we don't allow tls_version_min/max to be set to a random
string anymore.

https://fedorahosted.org/freeipa/ticket/6607

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Explain more performance tricks in doc string

2017-02-15T16:27:56+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Pretty print JSON in debug mode (debug level >= 2)

2017-02-15T16:27:56+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Convert list to tuples

2017-02-15T16:27:56+00:00

Some tests assume that JSON deserializier returns tuples instead of
lists. I don't think it is necessary but let's pass the tests for now.

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Faster JSON encoder/decoder

2017-02-15T16:27:56+00:00

Improve performance of FreeIPA's JSON serializer and deserializer.

* Don't indent and sort keys. Both options trigger a slow path in
  Python's json package. Without indention and sorting, encoding
  mostly happens in optimized C code.
* Replace O(n) type checks with O(1) type lookup and eliminate
  the use of isinstance().
* Check each client capability only once for every conversion.
* Use decoder's obj_hook feature to traverse the object tree once and
  to eliminate calls to isinstance().

Closes: https://fedorahosted.org/freeipa/ticket/6655
Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Insure removal of session on identity change

2017-02-15T06:13:37+00:00

If we are changing identiy (different principal) insure we remove the
session cookie stored on the rpc context so that we do not mistakenly
connect with the previous identity credentials.

https://fedorahosted.org/freeipa/ticket/6543

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Allow rpc callers to pass ccache and service names

2017-02-15T06:13:37+00:00

This allows code to use multiple ccaches without having to muck with the
process global environment variables (KRB5CCNAME).

https://fedorahosted.org/freeipa/ticket/6543

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Add a new user to run the framework code

2017-02-15T06:13:37+00:00

Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Use Anonymous user to obtain FAST armor ccache

2017-02-15T06:13:37+00:00

The anonymous user allows the framework to obtain an armor ccache without
relying on usable credentials, either via a keytab or a pkinit and
public certificates. This will be needed once the HTTP keytab is moved away
for privilege separation.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta