freeipa.git/ipaplatform/base, branch AD-binds

Use 389-ds centralized scripts.

2015-06-11T11:16:06+00:00

Directory server is deprecating use of tools in instance specific paths. Instead
tools in bin/sbin path should be used.

https://fedorahosted.org/freeipa/ticket/4051

Reviewed-By: Martin Basti

vault: Fix ipa-kra-install

2015-06-10T16:17:34+00:00

Use state in LDAP rather than local state to check if KRA is installed.
Use correct log file names.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: David Kupka

vault: Move vaults to cn=vaults,cn=kra

2015-06-10T16:17:34+00:00

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: David Kupka

explicitly destroy httpd service ccache file during httpinstance removal

2015-05-19T12:59:18+00:00

during IPA server uninstall, the httpd service ccache is not removed from
runtime directory. This file then causes server-side client install to fail
when performing subsequent installation without rebooting/recreating runtime
directories.

This patch ensures that the old httpd ccache is explicitly destroyed during
uninstallation.

https://fedorahosted.org/freeipa/ticket/4973

Reviewed-By: David Kupka

Server Upgrade: Verify version and platform

2015-05-04T11:16:26+00:00

Verify version and platform before upgrade or ipactl start|restart

Upgrade:
* do not allow upgrade on different platforms
* do not allow upgrade data with higher version than build has

Start:
* do not start services if platform mismatch
* do not start services if upgrade is needed
* do not start services if data with higher version than build has

New ipactl options:
--skip-version-check: do not validate IPA version
--ignore-service-failures (was --force): ignore if a service start fail
      and continue with starting other services
--force: combine --skip-version-check and --ignore-service-failures

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

DNSSEC CI tests

2015-04-14T17:29:36+00:00

Tests:
* install master, replica, then instal DNSSEC on master
  * test if zone is signed (added on master)
  * test if zone is signed (added on replica)

* install master with DNSSEC, then install replica
  * test if root zone is signed
  * add zone, verify signatures using our root zone

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Milan Kubik

Timeout when performing time sync during client install

2015-03-16T14:55:26+00:00

We use ntpd now to sync time before fetching a TGT during client
install.  Unfortuantely, ntpd will hang forever if it is unable to
reach the NTP server.

This patch adds the ability for commands run via ipautil.run() to
have an optional timeout.  This capability is used by the NTP sync
code that is run during ipa-client-install.

Ticket: https://fedorahosted.org/freeipa/ticket/4842
Reviewed-By: Martin Babinsky

Use 'remove-ds.pl' to remove DS instance

2015-01-27T12:35:06+00:00

The patch adds a function which calls 'remove-ds.pl' during DS instance
removal. This should allow for a more thorough removal of DS related data
during server uninstallation (such as closing custom ports, cleaning up
slapd-* entries etc.)

This patch is related to https://fedorahosted.org/freeipa/ticket/4487.

Reviewed-By: Martin Basti

Make certificate renewal process synchronized

2015-01-13T18:34:59+00:00

Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka

Improve validation of --instance and --backend options in ipa-restore

2014-12-09T13:46:29+00:00

https://fedorahosted.org/freeipa/ticket/4744

Reviewed-By: David Kupka