freeipa.git/ipaserver/install/server, branch coverity

Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3

2016-07-01T09:09:53+00:00

ipa-server-upgrade from pre-lightweight CAs version fails when
Dogtag is also being upgraded from pre-lightweight CAs version,
because Dogtag needs to be restarted after adding the lightweight
CAs container, before requesting information about the host
authority.

Move the addition of the Dogtag lightweight CAs container entry a
bit earlier in the upgrade procedure, ensuring restart.

Fixes: https://fedorahosted.org/freeipa/ticket/6011
Reviewed-By: Martin Babinsky

Split CA replica installation steps for domain level 0

2016-07-01T06:56:26+00:00

Installation from replica file is broken because lightweight CA
replication setup is attempted before Kerberos is set up.  To fix
the issue, explicitly execute step 1 before Kerberos setup, and
step 2 afterwards.

Part of: https://fedorahosted.org/freeipa/ticket/5963

Reviewed-By: Stanislav Laznicka

replica install: don't allow install against a newer server

2016-06-30T09:54:47+00:00

If the version of the remote server is higher than the local version, don't
allow installing a replica of it.

https://fedorahosted.org/freeipa/ticket/5983

Reviewed-By: Petr Spacek

Do not allow installation in FIPS mode

2016-06-29T14:17:27+00:00

https://fedorahosted.org/freeipa/ticket/5761

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden

Set default OCSP URI on install and upgrade

2016-06-28T17:15:35+00:00

Dogtag has been updated to support a default OCSP URI when the
profile includes AuthInfoAccess with URI method but does not specify
the URI (instead of constructing one based on Dogtag's hostname and
port).

Add the pkispawn config to ensure that the OCSP URI is set before
issuing CA and system certificates, and add the config to existing
CA instances on upgrade.

Fixes: https://fedorahosted.org/freeipa/ticket/5956
Reviewed-By: Martin Basti

DNS Locations: cleanup of bininstance

2016-06-28T13:23:51+00:00

We don't need anymore:
* sample of zone file - list of all records required by IPa will be
provided

* NTP related params - DNS records will be updated automatically,
based on LDAP values

* CA related params - DNS records will be updated automatically based
* on LDAP values

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek

Replica promotion: use the correct IPA domain for replica

2016-06-21T15:09:06+00:00

IPA domain is detected from LDAP for replica promote installation.
If local domain and IPA domain does not match, installer refuses
to install replica.

IPA versions 4.3.0 and 4.3.1 allow to specify different domain for
replica. Only one IPA domain is allowed (domain used with master)
and different domain may cause issues.

This commit prevents to install new replica if multiple domains was
used in past. User action is required to fix this issue and remove
incorrect IPA domains from LDAP.

https://fedorahosted.org/freeipa/ticket/5976

Reviewed-By: Petr Spacek

replica install: fix thin client regression

2016-06-20T16:45:26+00:00

Fix a regression introduced by commit
3157eec28ff35e3c407a9552d6b59bef9891b555.

https://fedorahosted.org/freeipa/ticket/4739
https://fedorahosted.org/freeipa/ticket/5985

Reviewed-By: Martin Basti 
Reviewed-By: David Kupka

remove the master from managed topology during uninstallation

2016-06-17T16:55:19+00:00

In managed topology, calling `ipa-server-install --uninstall` will cause the
master to remove itself from the topology by calling `server_del` behind the
scenes.

https://fedorahosted.org/freeipa/ticket/5588

Reviewed-By: Martin Basti

DNS Locations: dnsserver: put server_id option into named.conf

2016-06-17T13:22:24+00:00

The option server_id is required for DNS location feature, otherwise it
will not work.

https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek 
Reviewed-By: Jan Cholasta