freeipa.git/ipaplatform, branch kdc-fixes

DNS: check if DNS package is installed

2015-07-21T15:30:10+00:00

Instead of separate checking of DNS required packages, we need just
check if IPA DNS package is installed.

https://fedorahosted.org/freeipa/ticket/4058

Reviewed-By: Martin Babinsky 
Reviewed-By: Petr Spacek 
Reviewed-By: Tomas Babej

ipaplatform: Add constants submodule

2015-07-21T15:29:33+00:00

Introduce a ipaplatform/constants.py file to store platform related
constants, which are not paths.

Reviewed-By: Martin Basti 
Reviewed-By: Petr Spacek

cermonger: Use private unix socket when DBus SystemBus is not available.

2015-07-20T14:28:09+00:00

https://fedorahosted.org/freeipa/ticket/5095

Reviewed-By: Jan Cholasta

DNSSEC: allow to disable/replace DNSSEC key master

2015-07-07T06:37:15+00:00

This commit allows to replace or disable DNSSEC key master

Replacing DNSSEC master requires to copy kasp.db file manually by user

ipa-dns-install:
--disable-dnssec-master  DNSSEC master will be disabled
--dnssec-master --kasp-db=FILE  This configure new DNSSEC master server,  kasp.db from old server is required for sucessful replacement
--force Skip checks

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek

ipaplatform: Remove redundant definitions

2015-07-02T11:04:23+00:00

The variables path_namespace and task_namespace in the base platform
are not used anywhere in the rest of the codebase and are just
debris from previous implementation.

This patch removes them.

Reviewed-By: Tomas Babej

ipaplatform: Do not use MagicDict for KnownServices

2015-07-01T13:05:30+00:00

https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Martin Babinsky

Clear SSSD caches when uninstalling the client

2015-06-30T10:59:19+00:00

https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Jakub Hrozek

Rate-limit while loop in SystemdService.is_active().

2015-06-29T11:39:07+00:00

Previously is_active() was frenetically calling systemctl is_active in
tight loop which in fact made the process slower.

Reviewed-By: Martin Basti

Provide Kerberos over HTTP (MS-KKDCP)

2015-06-24T08:43:58+00:00

Add integration of python-kdcproxy into FreeIPA to support the MS
Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD
client requests over HTTP and HTTPS.

- freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy
  dependencies are already satisfied.
- The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa,
  cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is
  present.
- The installers and update create a new Apache config file
  /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on
  /KdcProxy. The app is run inside its own WSGI daemon group with
  a different uid and gid than the webui.
- A ExecStartPre script in httpd.service symlinks the config file to
  /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present.
- The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf,
  so that an existing config is not used. SetEnv from Apache config does
  not work here, because it doesn't set an OS env var.
- python-kdcproxy is configured to *not* use DNS SRV lookups. The
  location of KDC and KPASSWD servers are read from /etc/krb5.conf.
- The state of the service can be modified with two ldif files for
  ipa-ldap-updater. No CLI script is offered yet.

https://www.freeipa.org/page/V4/KDC_Proxy

https://fedorahosted.org/freeipa/ticket/4801

Reviewed-By: Nathaniel McCallum 
Reviewed-By: Simo Sorce

Use 389-ds centralized scripts.

2015-06-11T11:16:06+00:00

Directory server is deprecating use of tools in instance specific paths. Instead
tools in bin/sbin path should be used.

https://fedorahosted.org/freeipa/ticket/4051

Reviewed-By: Martin Basti