freeipa.git/ipaserver/install/server, branch ipasam_getkeytab

implement domain level 1 specific topology checks into IPA server uninstaller

2015-12-02T13:10:19+00:00

When uninstalling domain level 1 master its removal from topology is checked
on remote masters. The uninstaller also checks whether the uninstallation
disconnects the topology and if yes aborts the procedure. The
'--ignore-disconnected-topology' options skips this check.

https://fedorahosted.org/freeipa/ticket/5377
https://fedorahosted.org/freeipa/ticket/5409

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

replicainstall: Add possiblity to install client in one command

2015-12-01T15:33:13+00:00

https://fedorahosted.org/freeipa/ticket/5310

Reviewed-By: Jan Cholasta

Remove global variable dns_forwarders from ipaserver.install.dns

2015-12-01T09:19:25+00:00

Reviewed-By: Jan Cholasta

ipa-dns-install offer IP addresses from resolv.conf as default forwarders

2015-12-01T09:19:25+00:00

In non-interactive more option --auto-forwarders can be used to do the
same. --forward option can be used to supply additional IP addresses.

https://fedorahosted.org/freeipa/ticket/5438

Reviewed-By: Jan Cholasta

perform IPA client uninstallation as a last step of server uninstall

2015-12-01T08:39:19+00:00

With the ability to promote replicas from an enrolled client the
uninstallation procedure has to be changed slightly. If the client-side
components are not removed last during replica uninstallation, we can end up
with leftover ipa default.conf preventing future client re-enrollment.

https://fedorahosted.org/freeipa/ticket/5410

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

replica promotion: modify default.conf even if DS configuration fails

2015-11-27T09:32:04+00:00

When we promote an IPA client to replica, we need to write master-like
default.conf once we start configuring directory server instance. This way
even if DS configuration fails for some reason the server uninstall code can
work properly and clean up partially configured replica.

https://fedorahosted.org/freeipa/ticket/5417

Reviewed-By: Petr Vobornik

install: drop support for Dogtag 9

2015-11-25T08:12:25+00:00

Dogtag 9 CA and CA DS install and uninstall code was removed. Existing
Dogtag 9 CA and CA DS instances are disabled on upgrade.

Creating a replica of a Dogtag 9 IPA master is still supported.

https://fedorahosted.org/freeipa/ticket/5197

Reviewed-By: David Kupka

Add profiles and default CA ACL on migration

2015-11-24T09:12:24+00:00

Profiles and the default CA ACL were not being added during replica
install from pre-4.2 servers.  Update ipa-replica-install to add
these if they are missing.

Also update the caacl plugin to prevent deletion of the default CA
ACL and instruct the administrator to disable it instead.

To ensure that the cainstance installation can add profiles, supply
the RA certificate as part of the instance configuration.
Certmonger renewal setup is avoided at this point because the NSSDB
gets reinitialised later in installation procedure.

Also move the addition of the default CA ACL from dsinstance
installation to cainstance installation.

Fixes: https://fedorahosted.org/freeipa/ticket/5459
Reviewed-By: Jan Cholasta

cert renewal: make renewal of ipaCert atomic

2015-11-19T12:06:12+00:00

This prevents errors when renewing other certificates during the renewal of
ipaCert.

https://fedorahosted.org/freeipa/ticket/5436

Reviewed-By: David Kupka

Drop configure.jar

2015-11-13T13:02:45+00:00

Configure.jar used to be used with firefox version < 10 which is not
supported anymore, thus this can be removed.

https://fedorahosted.org/freeipa/ticket/5144

Reviewed-By: Petr Vobornik