freeipa.git/ipaserver/install/server, branch fix_ber_scanf

Add container environment check to replicainstall

2019-09-16T07:44:52+00:00

Inside the container environment master's IP address
does not resolve to its name.

Resolves: https://pagure.io/freeipa/issue/6210
Reviewed-By: Rob Crittenden

Move certauth configuration into a server krb5.conf template

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

Move ipachangeconf from ipaclient.install to ipapython

2019-08-29T02:15:50+00:00

This will let us call it from ipaplatform.

Mark the original location as deprecated.

Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden

Fix ca_initialize_hsm_state

2019-08-21T09:48:36+00:00

Fixup for commit eb2313920e20bb4a74fc0abc52c496ccf2822dab.
configparser's set() method does not convert boolean to string
automatically. Use string '"False"', which is then interpreted as
boolean 'False' by getboolean().

Related: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Store HSM token and state

2019-08-19T07:56:08+00:00

The HSM state is stored in fstore, so that CA and KRA installer use the
correct token names for internal certificates. The default token is
"internal", meaning the keys are stored in a NSSDB as usual.

Related: https://pagure.io/freeipa/issue/5608
Co-authored-by: Magnus K Karlsson 
Signed-off-by: Christian Heimes 
Reviewed-By: Fraser Tweedale

Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constants

2019-07-22T03:33:24+00:00

Replace renewal CA and profile name literals with corresponding
symbols from ipalib.constants.

Part of: https://pagure.io/freeipa/issue/7991

Reviewed-By: Rob Crittenden

cainstance: add profile to IPA RA tracking request

2019-07-22T03:33:24+00:00

Profile-based renewal means we should always explicitly specify the
profile in tracking requests that use the dogtag-ipa-ca-renew-agent
renewal helper.  This includes the IPA RA agent certificate.  Update
CAInstance.configure_agent_renewal() to add the profile to the
tracking request.  This also covers the upgrade scenario (because
the same method gets invoked).

Part of: https://pagure.io/freeipa/issue/7991

Reviewed-By: Rob Crittenden

upgrade: fix spurious certmonger re-tracking

2019-07-22T03:33:24+00:00

The search for the HTTP Certmonger tracking request uses an
incorrect parameter ('key-storage'), triggering removal and
recreation of tracking requests on every upgrade.  Replace
'key-storage' with the correct parameter, 'key-file'.

Part of: https://pagure.io/freeipa/issue/7991

Reviewed-By: Rob Crittenden

upgrade: log missing/misconfigured tracking requests

2019-07-22T03:33:24+00:00

For better diagnostics during upgrade, log the Certmonger tracking
requests that were not found (either because they do not exist, or
do not have the expected configuration).

Part of: https://pagure.io/freeipa/issue/7991

Reviewed-By: Rob Crittenden

upgrade: update KRA tracking requests

2019-07-22T03:33:24+00:00

The upgrade routine checks tracking requests for CA system
certificates, IPA RA and HTTP/LDAP/KDC service certificates.  If a
tracking request matching our expectations is not found, we stop
tracking all certificates, then create new tracking requests with
the correct configuration.

But the KRA was left out.  Add checks for KRA certificates, and
remove/recreate KRA tracking requests when appropriate.

Part of: https://pagure.io/freeipa/issue/7991

Reviewed-By: Rob Crittenden