freeipa.git/ipaserver/install, branch ccachesess

KRA: add --setup-kra to ipa-server-install

2017-03-08T14:50:30+00:00

This patch allows to install KRA on first IPA server in one step using
ipa-server-install

This option improves containers installation where ipa-server can be
installed with KRA using one call without need to call docker exec.

Please note the the original `kra.install()` calls in
ipaserver/install/server/install.py were empty operations as it did
nothing, so it is safe to move them out from CA block

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Use https to get security domain from Dogtag

2017-03-03T12:33:51+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

Cleanup certdb

2017-03-02T13:45:00+00:00

* use with statement to open/close files
* prefer fchmod/fchown when a file descriptor is available
* set permission before data is written to file

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

server install: do not attempt to issue PKINIT cert in CA-less

2017-03-02T09:10:22+00:00

Require the user to provide the PKINIT cert with --pkinit-cert-file or
disable PKINIT with --no-pkinit in CA-less ipa-server-install,
ipa-replica-prepare and ipa-replica-install.

Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade.

https://pagure.io/freeipa/issue/5678

Reviewed-By: Alexander Bokovoy

Fix CA-less upgrade

2017-03-01T15:38:43+00:00

In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it
does not make sense to try to create a password file for an NSS
database from it (the NSS database does not exist either).

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Merge AD trust configurator into replica installer

2017-03-01T14:55:45+00:00

`ipa-replica-install` is now able to configure Samba and winbind
services in order to manage Active Directory trusts. `--add-agents`
option is exposed in replica installer, while `--add-sids` now defaults
to `False` since adding a first AD trust controller to an existing
sizeable deployment can result in stuck installation as sidgen tasks can
take a long time to complete. That's why adding SIDs should be a
conscious decision in this case.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Merge AD trust configurator into server installer

2017-03-01T14:55:45+00:00

ipa-server-install is now able to configure Samba and winbind services
and manage trusts to Active Directory right off the bat with following
alterations from standalone installer:

   * sidgen task is always triggered since there are only a few entries
     to tag in the beginning

   * the `--add-agents` option is hardcoded to False, as there are no
     potential agents to resolve and addd when setting up the first
     master in topology

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

expose AD trust related knobs in composite installers

2017-03-01T14:55:45+00:00

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Add AD trust installer interface for composite installer

2017-03-01T14:55:45+00:00

This interface is to be used to provide AD trust-related options in
server and replica installer.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta