freeipa.git/ipaserver/install, branch fix_ber_scanf

Add container environment check to replicainstall

2019-09-16T07:44:52+00:00

Inside the container environment master's IP address
does not resolve to its name.

Resolves: https://pagure.io/freeipa/issue/6210
Reviewed-By: Rob Crittenden

adtrust: add default read_keys permission for TDO objects

2019-09-12T14:17:53+00:00

If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys
attribute values, it cannot be used by SSSD to retrieve TDO keys and the
whole communication with Active Directory domain controllers will not be
possible.

This seems to affect trusts which were created before
ipaAllowedToPerform;read_keys permission granting was introduced
(FreeIPA 4.2). Add back the default setting for the permissions which
grants access to trust agents and trust admins.

Resolves: https://pagure.io/freeipa/issue/8067

Signed-off-by: Alexander Bokovoy 
Reviewed-By: Florence Blanc-Renaud

add default access control when migrating trust objects

2019-09-12T14:17:53+00:00

It looks like for some cases we do not have proper set up keytab
retrieval configuration in the old trusted domain object. This mostly
affects two-way trust cases. In such cases, create default configuration
as ipasam would have created when trust was established.

Resolves: https://pagure.io/freeipa/issue/8067

Signed-off-by: Alexander Bokovoy 
Reviewed-By: Florence Blanc-Renaud

Move certauth configuration into a server krb5.conf template

2019-09-10T09:33:21+00:00

Signed-off-by: Robbie Harwood 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Simo Sorce 
Reviewed-By: Robbie Harwood

adtrust: avoid using timestamp in klist output

2019-09-10T09:25:07+00:00

When parsing a keytab to copy keys to a different keytab, we don't need
the timestamp, so don't ask klist to output it. In some locales (en_IN,
for example), the timestamp is output in a single field without a space
between date and time. In other locales it can be represented with date
and time separated by a space.

Fixes: https://pagure.io/freeipa/issue/8066
Reviewed-By: Thomas Woerner

Add missing timeout option to logging statement

2019-09-05T07:15:23+00:00

Reviewed-By: Florence Blanc-Renaud

Log dogtag auth timeout in install, provide hint to increase it

2019-09-04T12:52:14+00:00

There is a loop which keeps trying to bind as the admin user
which will fail until it is replicated.

In the case where there is a lot to replicate the default
5 minute timeout may be insufficient. Provide a hint for
tuning.

Fixes: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud

Log the replication wait timeout for debugging purposes

2019-09-04T12:52:14+00:00

Related: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud

Replace replication_wait_timeout with certmonger_wait_timeout

2019-09-04T12:52:14+00:00

The variable is intended to control the timeout for replication
events. If someone had significantly reduced it via configuration
then it could have caused certmogner requests to fail due to timeouts.

Add replication_wait_timeout, certmonger_wait_timeout and
http_timeout to the default.conf man page.

Related: https://pagure.io/freeipa/issue/7971
Reviewed-By: Florence Blanc-Renaud

Move ipachangeconf from ipaclient.install to ipapython

2019-08-29T02:15:50+00:00

This will let us call it from ipaplatform.

Mark the original location as deprecated.

Reviewed-By: Francois Cami 
Reviewed-By: Rob Crittenden