freeipa.git/ipaserver/plugins, branch cachetickets

Extract method to map principal to princpal type

2017-03-03T11:09:57+00:00

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

Remove redundant principal_type argument

2017-03-03T11:09:57+00:00

Minor refactor to remove the redundant 'principal_type' argument
from 'caacl_check' and associated functions.

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

dogtag: remove redundant property definition

2017-03-01T12:53:18+00:00

The dogtag `ra' backend defines a `ca_host' property, which is also
defined (identically) by the `RestClient' class, which recently
became a superclass of `ra'.  Remove the redundant property
definition.

Part of: https://pagure.io/freeipa/issue/3473

Reviewed-By: Christian Heimes

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Remove NSSConnection from Dogtag

2017-03-01T09:43:41+00:00

Replaced NSSConnection with Python's httplib.HTTPSConnection.
This class is OpenSSL-based.

A client certificate with a private key is required to authenticate
against the certificate server. We facilitate the RA_AGENT_PEM which
already exists.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Move RA agent certificate file export to a different location

2017-03-01T09:43:41+00:00

HTTPS connection to certificate server requires client authentication
so we need a file with client certificate and private key prior to
its first occurence which happens during migration of certificate
profiles to LDAP.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Jan Cholasta

ca: correctly authorise ca-del, ca-enable and ca-disable

2017-02-28T14:30:23+00:00

CAs consist of a FreeIPA and a corresponding Dogtag object.  When
executing ca-del, ca-enable and ca-disable, changes are made to the
Dogtag object.  In the case of ca-del, the corresponding FreeIPA
object is deleted after the Dogtag CA is deleted.

These operations were not correctly authorised; the FreeIPA
permissions are not checked before the Dogtag operations are
executed.  This allows any user to delete, enable or disable a
lightweight CA (except the main IPA CA, for which there are
additional check to prevent deletion or disablement).

Add the proper authorisation checks to the ca-del, ca-enable and
ca-disable commands.

https://pagure.io/freeipa/issue/6713

Reviewed-By: Jan Cholasta

Remove md5_fingerprints from IPA

2017-02-23T17:59:01+00:00

MD5 is a grandpa and FIPS does not like it at all.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden 
Reviewed-By: Tomas Krizek

Fix session logout

2017-02-22T09:15:50+00:00

There were 2 issues with session logouts, one is that the logout_cookie
was checked and acted on in the wrong place, the other is that the wrong
value was set in the IPASESSION header.

Fixes https://fedorahosted.org/freeipa/ticket/6685

Signed-off-by: Simo Sorce 
Reviewed-By: Stanislav Laznicka