freeipa.git/ipaserver/install, branch replica_kdc

Configure KDC to use certs after they are deployed

2017-03-09T17:49:54+00:00

Certmonger needs to access the KDC when it tries to obtain certs,
so make sure the KDC can run, then reconfigure it to use pkinit anchors
once certs are deployed.

Signed-off-by: Simo Sorce

backup: backup anonymous keytab

2017-03-09T17:22:34+00:00

Freeipa stops working without anon keytab

https://pagure.io/freeipa/issue/5959

Reviewed-By: Martin Babinsky

server install: require IPv6 stack to be enabled

2017-03-09T15:50:21+00:00

Add checks to install and replica install to verify IPv6 stack
is enabled. IPv6 is required by some IPA parts (AD, conncheck, ...).

https://pagure.io/freeipa/issue/6608

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

KRA: add --setup-kra to ipa-server-install

2017-03-08T14:50:30+00:00

This patch allows to install KRA on first IPA server in one step using
ipa-server-install

This option improves containers installation where ipa-server can be
installed with KRA using one call without need to call docker exec.

Please note the the original `kra.install()` calls in
ipaserver/install/server/install.py were empty operations as it did
nothing, so it is safe to move them out from CA block

https://pagure.io/freeipa/issue/6731

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Use https to get security domain from Dogtag

2017-03-03T12:33:51+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

Cleanup certdb

2017-03-02T13:45:00+00:00

* use with statement to open/close files
* prefer fchmod/fchown when a file descriptor is available
* set permission before data is written to file

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

server install: do not attempt to issue PKINIT cert in CA-less

2017-03-02T09:10:22+00:00

Require the user to provide the PKINIT cert with --pkinit-cert-file or
disable PKINIT with --no-pkinit in CA-less ipa-server-install,
ipa-replica-prepare and ipa-replica-install.

Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade.

https://pagure.io/freeipa/issue/5678

Reviewed-By: Alexander Bokovoy

Fix CA-less upgrade

2017-03-01T15:38:43+00:00

In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it
does not make sense to try to create a password file for an NSS
database from it (the NSS database does not exist either).

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Merge AD trust configurator into replica installer

2017-03-01T14:55:45+00:00

`ipa-replica-install` is now able to configure Samba and winbind
services in order to manage Active Directory trusts. `--add-agents`
option is exposed in replica installer, while `--add-sids` now defaults
to `False` since adding a first AD trust controller to an existing
sizeable deployment can result in stuck installation as sidgen tasks can
take a long time to complete. That's why adding SIDs should be a
conscious decision in this case.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta