freeipa.git/ipaplatform, branch master

tasks: run `systemctl daemon-reload` after httpd.service.d updates

2017-03-21T15:38:06+00:00

Run `systemctl daemon-reload` after
`/etc/systemd/system/httpd.service.d/ipa.conf` is created or deleted,
otherwise systemd will not merge the file into httpd.service and therefore
required environment variables will not be set for httpd.

This fixes authentication failures ("No valid Negotiate header in server
response") due to missing `GSS_USE_PROXY=yes` in httpd environment.

https://pagure.io/freeipa/issue/6773

Reviewed-By: Martin Babinsky

ipaplatform/debian/paths: Add some missing values.

2017-03-15T08:53:08+00:00

Rename KRA_AGENT_PEM -> OLD_KRA_AGENT_PEM, add CERTMONGER_DOGTAG_SUBMIT.

Reviewed-By: Stanislav Laznicka

httpinstance: disable system trust module in /etc/httpd/alias

2017-03-14T16:12:19+00:00

Currently the NSS database in /etc/httpd/alias is installed with the system
trust module enabled. This is problematic for a number of reasons:

* IPA has its own trust store, which is effectively bypassed when the
  system trust module is enabled in the database. This may cause IPA
  unrelated CAs to be trusted by httpd, or even IPA related CAs not to be
  trusted by httpd.

* On client install, the IPA trust configuration is copied to the system
  trust store for third parties. When this configuration is removed, it may
  cause loss of trust information in /etc/httpd/alias
  (https://bugzilla.redhat.com/show_bug.cgi?id=1427897).

* When a CA certificate provided by the user in CA-less install conflicts
  with a CA certificate in the system trust store, the latter may be used
  by httpd, leading to broken https
  (https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html).

Disable the system trust module on install and upgrade to prevent the
system trust store to be used in /etc/httpd/alias and fix all of the above
issues.

https://pagure.io/freeipa/issue/6132

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Christian Heimes

ipaplatform/debian/paths: Rename IPA_KEYTAB to OLD_IPA_KEYTAB.

2017-03-14T16:09:10+00:00

Reviewed-By: Martin Basti

ipaplatform/debian/paths: Add IPA_HTTPD_KDCPROXY.

2017-03-14T16:09:10+00:00

Reviewed-By: Martin Basti

ipaplatform/debian/services: Fix is_running arguments.

2017-03-14T16:09:10+00:00

Reviewed-By: Martin Basti

Don't allow standalone KRA uninstalls

2017-03-13T15:27:23+00:00

KRA uninstallation is very likely to break the user's setup. Don't
allow it at least till we can be safely sure we are able to remove
it in a standalone manner without breaking anything.

https://pagure.io/freeipa/issue/6538

Reviewed-By: Tomas Krizek

pylint_plugins: add forbidden import checker

2017-03-10T12:04:59+00:00

Add new pylint AST checker plugin which implements a check for imports
forbidden in IPA. Which imports are forbidden is configurable in pylintrc.

Provide default forbidden import configuration and disable the check for
existing forbidden imports in our code base.

Reviewed-By: Martin Basti

server install: require IPv6 stack to be enabled

2017-03-09T15:50:21+00:00

Add checks to install and replica install to verify IPv6 stack
is enabled. IPv6 is required by some IPA parts (AD, conncheck, ...).

https://pagure.io/freeipa/issue/6608

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Move csrgen templates into ipaclient package

2017-03-08T14:59:26+00:00

csrgen broke packaging of ipaclient for PyPI. All csrgen related
resources are now package data of ipaclient package. Package data is
accessed with Jinja's PackageLoader() or through pkg_resources.

https://pagure.io/freeipa/issue/6714

Signed-off-by: Christian Heimes 
Reviewed-By: Ben Lipton 
Reviewed-By: Martin Basti