freeipa.git/ipapython, branch cakeysfix

Correct PyPI package dependencies

2017-04-26T10:31:11+00:00

* Remove unused install requires from ipapython
* Add missing requirements to ipaserver
* Correct dependencies for yubico otptoken
* Add explicit dependency on cffi for csrgen
* Python 2 uses python-ldap, Python 3 pyldap

https://pagure.io/freeipa/issue/6875

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti

Remove publish_ca_cert() method from NSSDatabase

2017-04-03T13:06:29+00:00

NSSDatabase.publish_ca_cert() is not used anymore, remove it.

https://pagure.io/freeipa/issue/6806

Reviewed-By: Jan Cholasta

certdb: fix `AttributeError` in `verify_ca_cert_validity`

2017-04-03T12:40:55+00:00

`NSSDatabase.verify_ca_cert_validity` tries to access a property of basic
constraints extension on the extension object itself rather than its value.

Access the attribute on the correct object to fix the issue.

Reviewed-By: Stanislav Laznicka

setup, pylint, spec file: drop python-nss dependency

2017-03-31T10:20:35+00:00

Remove the unused python-nss dependency.

Reviewed-By: Christian Heimes

certdb: use certutil and match_hostname for cert verification

2017-03-31T10:20:35+00:00

Use certutil and ssl.match_hostname calls instead of python-nss for
certificate verification.

Reviewed-By: Christian Heimes

session storage parameters must be bytes

2017-03-31T10:18:43+00:00

Fixes TypeError: bytes or integer address expected instead of str instance

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti

Use Custodia 0.3.1 features

2017-03-28T13:02:06+00:00

* Use sd-notify in ipa-custodia.service
* Introduce libexec/ipa/ipa-custodia script. It comes with correct
  default setting for IPA's config file. The new file also makes it
  simpler to run IPA's custodia instance with its own SELinux context.
* ipapython no longer depends on custodia

The patch addresses three issues:

* https://bugzilla.redhat.com/show_bug.cgi?id=1430247
  Forward compatibility with Custodia 0.3 in Fedora rawhide
* https://pagure.io/freeipa/issue/5825
  Use sd-notify
* https://pagure.io/freeipa/issue/6788
  Prepare for separate SELinux context

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Work around issues fetching session data

2017-03-28T11:36:30+00:00

Unfortunately the MIT krb5 library has a severe limitation with FILE
ccaches when retrieving config data. It will always only search until
the first entry is found and return that one.

For FILE caches MIT krb5 does not support removing old entries when a
new one is stored, and storage happens only in append mode, so the end
result is that even if an update is stored it is never returned with the
standard krb5_cc_get_config() call.

To work around this issue we simply implement what krb5_cc_get_config()
does under the hood with the difference that we do not stop at the first
match but keep going until all ccache entries have been checked.

Related https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Avoid growing FILE ccaches unnecessarily

2017-03-28T11:36:30+00:00

Related https://pagure.io/freeipa/issue/6775

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes 
Reviewed-By: Alexander Bokovoy

httpinstance: clean up /etc/httpd/alias on uninstall

2017-03-22T13:58:18+00:00

Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias
from backup on uninstall.

Files modified by IPA are kept with .ipasave suffix.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky