freeipa.git/ipaserver/install, branch ipasam_getkeytab

Modify error message to install first instance of KRA

2015-12-02T16:21:32+00:00

First instance of KRA should be installed by ipa-kra-install.

https://fedorahosted.org/freeipa/ticket/5460

Reviewed-By: Martin Babinsky

ipa-kra-install: allow to install first KRA on replica

2015-12-02T16:20:19+00:00

https://fedorahosted.org/freeipa/ticket/5460

Reviewed-By: Martin Babinsky

implement domain level 1 specific topology checks into IPA server uninstaller

2015-12-02T13:10:19+00:00

When uninstalling domain level 1 master its removal from topology is checked
on remote masters. The uninstaller also checks whether the uninstallation
disconnects the topology and if yes aborts the procedure. The
'--ignore-disconnected-topology' options skips this check.

https://fedorahosted.org/freeipa/ticket/5377
https://fedorahosted.org/freeipa/ticket/5409

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

extract domain level 1 topology-checking code from ipa-replica-manage

2015-12-02T13:10:19+00:00

This facilitates reusability of this code in other components, e.g. IPA server
uninstallers.

https://fedorahosted.org/freeipa/ticket/5409

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

replicainstall: Add possiblity to install client in one command

2015-12-01T15:33:13+00:00

https://fedorahosted.org/freeipa/ticket/5310

Reviewed-By: Jan Cholasta

Remove global variable dns_forwarders from ipaserver.install.dns

2015-12-01T09:19:25+00:00

Reviewed-By: Jan Cholasta

ipa-dns-install offer IP addresses from resolv.conf as default forwarders

2015-12-01T09:19:25+00:00

In non-interactive more option --auto-forwarders can be used to do the
same. --forward option can be used to supply additional IP addresses.

https://fedorahosted.org/freeipa/ticket/5438

Reviewed-By: Jan Cholasta

perform IPA client uninstallation as a last step of server uninstall

2015-12-01T08:39:19+00:00

With the ability to promote replicas from an enrolled client the
uninstallation procedure has to be changed slightly. If the client-side
components are not removed last during replica uninstallation, we can end up
with leftover ipa default.conf preventing future client re-enrollment.

https://fedorahosted.org/freeipa/ticket/5410

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Upgrade: increase time limit for upgrades

2015-12-01T07:51:44+00:00

Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta

use starttls in CSReplicationManager connection again

2015-11-30T11:26:51+00:00

commit 2606f5aecd6ac0db31abb515b691529bb7eaf14e

has:
-            realm, hostname, dirman_passwd, port, starttls=True)
+            realm, hostname, dirman_passwd, port)

In CSReplicationManager

which causes, e.g.:

ipa-csreplica-manage -p Secret123 list ipa.example.com
cannot connect to 'ldaps://ipa.example.com:389': TLS error -5938:Encountered end of file

Reviewed-By: Tomas Babej