freeipa.git/ipaplatform, branch master_keytab

install: drop support for Dogtag 9

2015-11-25T08:12:25+00:00

Dogtag 9 CA and CA DS install and uninstall code was removed. Existing
Dogtag 9 CA and CA DS instances are disabled on upgrade.

Creating a replica of a Dogtag 9 IPA master is still supported.

https://fedorahosted.org/freeipa/ticket/5197

Reviewed-By: David Kupka

Drop configure.jar

2015-11-13T13:02:45+00:00

Configure.jar used to be used with firefox version < 10 which is not
supported anymore, thus this can be removed.

https://fedorahosted.org/freeipa/ticket/5144

Reviewed-By: Petr Vobornik

ipaplatform: Add NTPD_OPTS_VAR and NTPD_OPTS_QUOTE to constants

2015-11-04T12:12:12+00:00

https://fedorahosted.org/freeipa/ticket/5343

Reviewed-By: Tomas Babej

ipaplatform: Add SECURE_NFS_VAR to constants

2015-11-04T12:12:12+00:00

https://fedorahosted.org/freeipa/ticket/5343

Reviewed-By: Tomas Babej

ipaplatform: Add NAMED_USER to constants

2015-11-04T12:12:12+00:00

https://fedorahosted.org/freeipa/ticket/5343

Reviewed-By: Tomas Babej

ipaplatform: Add HTTPD_USER to constants, and use it.

2015-11-04T12:12:12+00:00

https://fedorahosted.org/freeipa/ticket/5343

Reviewed-By: Tomas Babej

Handle binascii.Error from base64.b64decode()

2015-10-22T16:34:46+00:00

In Python 3, the base64.b64decode function raises binascii.Error (a ValueError
subclass) when it finds incorrect padding. In Python 2 it raises TypeError.

Callers should usually handle ValueError; unless they are specifically
concerned with handling base64 padding issues).

In some cases, callers should handle ValueError:
- ipalib.pkcs10 (get_friendlyname, load_certificate_request): callers should
  handle ValueError
- ipalib.x509 (load_certificate*, get_*): callers should handle ValueError

In other cases ValueError is handled:
- ipalib.parameters
- ipapython.ssh
- ipalib.rpc (json_decode_binary - callers already expect ValueError)
- ipaserver.install.ldapupdate

Elsewhere no error handling is done, because values come from trusted
sources, or are pre-validated:
- vault plugin
- ipaserver.install.cainstance
- ipaserver.install.certs
- ipaserver.install.ipa_otptoken_import

Reviewed-By: Tomas Babej

topology: manage ca replication agreements

2015-10-15T12:24:33+00:00

Configure IPA so that topology plugin will manage also CA replication
agreements.

upgrades if CA is congigured:
- ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX
- ipaReplTopoManagedSuffix: o=ipaca is added to master entry
- binddngroup is added to o=ipaca replica entry

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Implement replica promotion functionality

2015-10-15T12:24:33+00:00

This patch implements a new flag --promote for the ipa-replica-install command
that allows an administrative user to 'promote' an already joined client to
become a full ipa server.

The only credentials used are that of an administrator. This code relies on
ipa-custodia being available on the peer master as well as a number of other
patches to allow a computer account to request certificates for its services.

Therefore this feature is marked to work only with domain level 1 and above
servers.

Ticket: https://fedorahosted.org/freeipa/ticket/2888

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta