freeipa.git/ipaserver/install/plugins, branch webui_isolate

Add a new user to run the framework code

2017-02-14T22:37:37+00:00

Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce

Simplify NSSDatabase password file handling

2017-02-14T22:37:22+00:00

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce

Separate RA cert store from the HTTP cert store

2017-02-14T22:37:16+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce

add missing attribute to ipaca replica during CA topology update

2016-12-09T14:47:13+00:00

'nsds5replicabinddngroupcheckinterval' attribute was not properly added
to 'o=ipaca' replica attribute during upgrade. The CA topology update
plugin should now add it to the entry if it exists.

https://fedorahosted.org/freeipa/ticket/6508

Reviewed-By: Martin Basti

ipalib: move certstore to the install subpackage

2016-11-29T13:50:51+00:00

The certstore module depends on ipaplatform.

Move it to ipalib.install, as it is used only from installers.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

ipapython: move certmonger and sysrestore to ipalib.install

2016-11-29T13:50:51+00:00

The certmonger and sysrestore modules depend on ipaplatform.

Move them to ipalib.install as they are used only from installers.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka

Moved update of DNA plugin among update plugins

2016-11-11T11:13:56+00:00

To make the code more general, moved the update_dna_shared_config
among other update plugins.

Bugfix: DNA shared config connection protocol was compared to a
method string which would result in a try to always update it
even if there was no need to.

https://fedorahosted.org/389/ticket/48373 causes that two
shared DNA config entries are created instead of one.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Babinsky 
Reviewed-By: Jan Cholasta

Move ds.replica_populate to an update plugin

2016-11-11T11:13:56+00:00

Replica populate can be applied with other update plugins.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Martin Babinsky 
Reviewed-By: Jan Cholasta

ipaldap: merge IPAdmin to LDAPClient

2016-11-07T10:34:03+00:00

* move IPAdmin methods to LDAPClient
* add extra arguments (cacert, sasl_nocanon) to LDAPClient.__init__()
* add host, port, _protocol to LDAPClient (parsed from ldap_uri)
* create get_ldap_uri() method to create ldap_uri from former
    IPAdmin.__init__() arguments
* replace IPAdmin with LDAPClient + get_ldap_uri()
* remove ununsed function argument hostname from
    enable_replication_version_checking()

https://fedorahosted.org/freeipa/ticket/6461

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Pylint: remove unused variables from installers and scripts

2016-10-06T08:43:36+00:00

Reviewed-By: Stanislav Laznicka