freeipa.git/ipaserver/install, branch master

replica prepare: fix wrong IPA CA nickname in replica file

2017-03-22T14:56:54+00:00

Lookup IPA CA subject and pass it to CertDB when creating dscert.p12 and
httpcert.p12, otherwise a generic nickname will be used for the IPA CA
certificate instead of "$REALM IPA CA".

This fixes replica install on domain level 0 from a replica file created
using ipa-replica-install on IPA 4.5.

https://pagure.io/freeipa/issue/6777

Reviewed-By: Martin Babinsky

Fixing replica install: fix ldap connection in domlvl 0

2017-03-22T14:31:40+00:00

Now, at the domain level 0, the replica install always uses
Directory Manager credentials to create the LDAP connection.
Since ACIs permitting hosts to manage their own services were
added in 4.2 release,  the old master denies this operations.

https://pagure.io/freeipa/issue/6549

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

httpinstance: clean up /etc/httpd/alias on uninstall

2017-03-22T13:58:18+00:00

Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias
from backup on uninstall.

Files modified by IPA are kept with .ipasave suffix.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky

certs: do not implicitly create DS pin.txt

2017-03-22T13:58:18+00:00

Do not implicitly create DS pin.txt in `CertDB.init_from_pkcs12()`, create
it explicitly in `DSInstance.__enable_ssl()`.

This stops the file from being created in /etc/httpd/alias during classic
replica install.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky

Fix Python 3 pylint errors

2017-03-15T18:11:32+00:00

************* Module ipaserver.install.ipa_kra_install
ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse')
************* Module ipapython.install.core
ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member)
************* Module ipatests.test_ipapython.test_dn
ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals())
************* Module ipa-ca-install
install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)
install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)

Signed-off-by: Christian Heimes 
Reviewed-By: Simo Sorce 
Reviewed-By: Stanislav Laznicka

Try out anonymous PKINIT after it is configured

2017-03-15T15:39:39+00:00

After PKINIT certificate is requested and everything is set up, we
should attempt to perform anonymous PKINIT and fail hard if it does not
work for some reason.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

check for replica's KDC entry on master before requesting PKINIT cert

2017-03-15T15:39:39+00:00

This prevents replication-based race conditions to break PKINIT
certificate requests on replica installation.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Make wait_for_entry raise exceptions

2017-03-15T15:39:39+00:00

Instead of only logging errors when timeout is reached or query for the
entry fails for other reasons, `wait_for_entry` should raise exceptions
so that we can handle them in caller or let them propagate and fail
early.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Move PKINIT configuration to a later stage of server/replica install

2017-03-15T15:39:39+00:00

This is to ensure that we can request PKINIT certs once all the
following requirements are in place:

    * CA is configured or PKCS#12 file is provided
    * LDAP, KDC and Apache are configured and the master role is thus
      completed and enabled

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Request PKINIT cert directly from Dogtag API on first master

2017-03-15T15:39:39+00:00

On the first master the framework may not be fully functional to server
certificate requests. It is safer to configure helper that contacts
Dogtag REST API directly.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy