freeipa.git/ipaserver/install, branch cakeysfix

Make sure remote hosts have our keys

2017-05-03T11:35:53+00:00

In complex replication setups a replica may try to obtain CA keys from a
host that is not the master we initially create the keys against.
In this case race conditions may happen due to replication. So we need
to make sure the server we are contacting to get the CA keys has our
keys in LDAP. We do this by waiting to positively fetch our encryption
public key (the last one we create) from the target host LDAP server.

Fixes: https://pagure.io/freeipa/issue/6838

Signed-off-by: Simo Sorce

Refresh Dogtag RestClient.ca_host property

2017-05-02T15:33:25+00:00

Refresh the ca_host property of the Dogtag's RestClient class when
it's requested as a context manager.

This solves the problem which would occur on DL0 when installing
CA which needs to perform a set of steps against itself accessing
8443 port. This port should however only be available locally so
trying to connect to remote master would fail. We need to make
sure the right CA host is accessed.

https://pagure.io/freeipa/issue/6878

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

restore: restart/reload gssproxy after restore

2017-04-28T12:56:02+00:00

So that gssproxy picks up new configuration and therefore related
usages like authentication of CLI against server works

https://pagure.io/freeipa/issue/6902

Reviewed-By: Tomas Krizek

Do not test anonymous PKINIT after install/upgrade

2017-04-28T08:38:12+00:00

Local FAST armoring will now work regardless of PKINIT status so there
is no need to explicitly test for working PKINIT. If there is, there
should be a test case for that.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Upgrade: configure local/full PKINIT depending on the master status

2017-04-28T08:38:12+00:00

The upgrader has been modified to configure either local or full PKINIT
depending on the CA status. Additionally, the new PKINIT configuration
will be written to the master's KDC entry.

https://pagure.io/freeipa/issue/6830
http://www.freeipa.org/page/V4/Kerberos_PKINIT

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Stop requesting anonymous keytab and purge all references of it

2017-04-28T08:38:12+00:00

anonymous kinit using keytab never worked so we may safely remove all
code that requests/uses it.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

API for retrieval of master's PKINIT status and publishing it in LDAP

2017-04-28T08:38:12+00:00

An API was provided to report whether PKINIT is enabled for clients or
not. If yes, the pkinitEnabled value will be added to the
ipaConfigString attribute of master's KDC entry.

See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for
more details.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Allow for configuration of all three PKINIT variants when deploying KDC

2017-04-28T08:38:12+00:00

The PKINIT setup code now can configure PKINIT using IPA CA signed
certificate, 3rd party certificate and local PKINIT with self-signed
keypair. The local PKINIT is also selected as a fallback mechanism if
the CSR is rejected by CA master or `--no-pkinit` is used.

http://www.freeipa.org/page/V4/Kerberos_PKINIT
https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

separate function to set ipaConfigString values on service entry

2017-04-28T08:38:12+00:00

There is some code duplication regarding setting ipaConfigString values
when:
   * LDAP-enabling a service entry
   * advertising enabled KDCProxy in LDAP

We can delegate the common work to a single re-usable function and thus
expose it to future use-cases (like PKINIT advertising).

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Move the compat plugin setup at the end of install

2017-04-24T15:11:51+00:00

The compat plugin was causing deadlocks with the topology plugin. Move
its setup at the end of the installation and remove the
cn=topology,cn=ipa,cn=etc subtree from its scope.

https://pagure.io/freeipa/issue/6821

Reviewed-By: Martin Basti