freeipa.git/ipapython, branch master_keytab

install: Run all validators at once.

2015-12-08T07:12:22+00:00

Reviewed-By: Jan Cholasta

custodia: do not modify memberPrincipal on key update

2015-12-07T07:14:13+00:00

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

ipautil: use file in a temporary dir as ccache in private_ccache

2015-12-07T07:14:13+00:00

python-gssapi chokes on empty ccache files, so instead of creating an empty
temporary ccache file in private_ccache, create a temporary directory and
use a non-existent file in that directory as the ccache.

https://fedorahosted.org/freeipa/ticket/5401

Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Removed duplicate domain name validating function

2015-12-02T16:26:56+00:00

Reviewed-By: Martin Basti

ipa-client-install: add support for Ed25519 SSH keys (RFC 7479)

2015-12-01T08:41:52+00:00

https://fedorahosted.org/freeipa/ticket/5471

Reviewed-By: Martin Basti

Upgrade: increase time limit for upgrades

2015-12-01T07:51:44+00:00

Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta

Use absolute domain in detection of A/AAAA records

2015-11-25T13:13:26+00:00

Python dns resolver append configured domain to queries which may lead
to false positive answer.

Exmaple: resolving "ipa.example.com" may return records for
"ipa.example.com.example.com" if domain is configured as "example.com"

https://fedorahosted.org/freeipa/ticket/5421

Reviewed-By: Petr Spacek

private_ccache: Harden the removal of KRB5CCNAME env variable

2015-11-25T12:51:10+00:00

If the code within the private_ccache contextmanager does not
set/removes the KRB5CCNAME, the pop method will raise KeyError, which
will cause unnecessary termination of the code flow.

Make sure the KRB5CCNAME is popped out of os.environ only if present.

Reviewed-By: Jan Cholasta

install: drop support for Dogtag 9

2015-11-25T08:12:25+00:00

Dogtag 9 CA and CA DS install and uninstall code was removed. Existing
Dogtag 9 CA and CA DS instances are disabled on upgrade.

Creating a replica of a Dogtag 9 IPA master is still supported.

https://fedorahosted.org/freeipa/ticket/5197

Reviewed-By: David Kupka

Do not erroneously reinit NSS in Dogtag interface

2015-11-24T09:12:24+00:00

The Dogtag interface always attempts to (re)init NSS, which can fail
with SEC_ERROR_BUSY.  Do not reinitialise NSS when it has already
been initialised with the given dbdir.

Part of: https://fedorahosted.org/freeipa/ticket/5459

Reviewed-By: Jan Cholasta