freeipa.git/ipapython/secrets/kem.py, branch webui_isolate

ipapython: move dnssec, p11helper and secrets to ipaserver

2016-11-29T13:50:51+00:00

The dnssec and secrets subpackages and the p11helper module depend on
ipaplatform.

Move them to ipaserver as they are used only on the server.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

pylint: enable the import-error check

2016-10-24T12:11:08+00:00

Check for import errors with pylint to make sure new python package
dependencies are not overlooked.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Petr Spacek 
Reviewed-By: Martin Basti

Secure permissions of Custodia server.keys

2016-08-24T14:59:43+00:00

Custodia's server.keys file contain the private RSA keys for encrypting
and signing Custodia messages. The file was created with permission 644
and is only secured by permission 700 of the directory
/etc/ipa/custodia. The installer and upgrader ensure that the file
has 600.

https://bugzilla.redhat.com/show_bug.cgi?id=1353936
https://fedorahosted.org/freeipa/ticket/6056

Reviewed-By: Martin Basti

Optionally add service name to Custodia key DNs

2016-06-09T07:04:27+00:00

Lightweight CAs support introduces new service principals for
Dogtag, with Custodia keys.  The current Custodia key creation uses
a DN that contains only they key type and the hostname, so keys for
multiple services on the same host cannot be created.

Add the 'generate_keys' method to generate keys for a host or an
arbitrary service.  When a service name is given, add the key
entries in a nested container with RDN 'cn='.  (The
container is assumed to exist).

This change does not affect searching because subtree search is
used, filtering on the ipaKeyUsage and memberPrincipal attributes.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta

ipapython.secrets.kem: Use ConfigParser from six.moves

2016-05-30T14:44:08+00:00

In Python 3, the module name changed from 'ConfigParser' to
'configparser'. Use the appropriate location from six.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti

custodia: do not modify memberPrincipal on key update

2015-12-07T07:14:13+00:00

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta