freeipa.git/ipaserver/install/server, branch custodia

Allow to install the KRA on a promoted server

2015-10-20T17:22:58+00:00

Signed-off-by: Simo Sorce

Add option to specify LDIF file that contains DS configuration changes

2015-10-15T16:37:52+00:00

This allows to user modify configuration changes of the directory server
instance during installation of DS

https://fedorahosted.org/freeipa/ticket/4949

Also fixes:
https://fedorahosted.org/freeipa/ticket/4048
https://fedorahosted.org/freeipa/ticket/1930

Reviewed-By: Martin Babinsky

Make checks for existing credentials reusable

2015-10-15T12:24:33+00:00

move the in installutils so they can be reused by multiple scripts

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Allow to setup the CA when promoting a replica

2015-10-15T12:24:33+00:00

This patch makes --setup-ca work to set upa clone CA while creating
a new replica. The standalone ipa-ca-install script is not converted
yet though.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Allow ipa-replica-conncheck to use default creds

2015-10-15T12:24:33+00:00

If the user has already run kinit try to use those credentials.
The user can always override by explicitly passing the -p flag.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Change DNS installer code to use passed in api

2015-10-15T12:24:33+00:00

Fixes a number of places where api was not passed around internally.
Also allows to install dns in replica promotion which requires an
alternative api to be created with the right configuration.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Implement replica promotion functionality

2015-10-15T12:24:33+00:00

This patch implements a new flag --promote for the ipa-replica-install command
that allows an administrative user to 'promote' an already joined client to
become a full ipa server.

The only credentials used are that of an administrator. This code relies on
ipa-custodia being available on the peer master as well as a number of other
patches to allow a computer account to request certificates for its services.

Therefore this feature is marked to work only with domain level 1 and above
servers.

Ticket: https://fedorahosted.org/freeipa/ticket/2888

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Add ipa-custodia service

2015-10-15T12:24:33+00:00

Add a customized Custodia daemon and enable it after installation.
Generates server keys and loads them in LDAP autonomously on install
or update.
Provides client code classes too.

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

upgrade: make sure ldap2 is connected in export_kra_agent_pem

2015-10-12T13:51:14+00:00

https://fedorahosted.org/freeipa/ticket/5360

Reviewed-By: Ales 'alich' Marecek

install: always export KRA agent PEM file

2015-10-08T11:42:58+00:00

Export the file even when KRA is not installed locally so that vault commands
work on all IPA replicas.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti