freeipa.git/ipaserver/secrets, branch replica_kdc

Fix replica with --setup-ca issues

2017-03-01T13:39:44+00:00

nolog argument of ipautil.run requires tuple, not a string.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Added a PEMFileHandler for Custodia store

2017-03-01T09:43:41+00:00

This is a preparation step to be able to handle sending RA agent
certificate over Custodia during domain level 1 replica installation.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

added ssl verification using IPA trust anchor

2017-02-27T07:53:05+00:00

https://fedorahosted.org/freeipa/ticket/6686

Reviewed-By: Christian Heimes

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

custodia: kem.set_keys: replace too-broad exception

2017-02-10T13:03:04+00:00

Exception is too brod and may hide various issues that show up later. If
the code expects that entry may exist, then ldap.ALREADY_EXISTS
exception should be used

Reviewed-By: Jan Cholasta

py3: kem.py: user bytes with ldap values

2017-02-10T13:03:04+00:00

python ldap requires bytes as values

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: custodia: basedn must be unicode

2017-02-10T13:03:04+00:00

basedn in custodia related modules has type bytes, that causes issues in
Py3 when strings were concatenated with bytes

```
malformed RDN string = "cn=custodia,cn=ipa,cn=etc,b'dc=example,dc=com'"
```

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: configparser: use raw keyword

2017-02-10T13:03:04+00:00

configparser.get() changed in python3 and `raw` is now a keyword attribute.

Also it must be set to True, otherwise InterpolationSyntaxError is raised

'''
InterpolationSyntaxError: '%' must be followed by '%' or '(', found:
'%2fvar%2frun%2fslapd-EXAMPLE-COM.socket'
'''

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: base64 encoding/decoding returns always bytes don't mix it

2017-02-08T07:32:44+00:00

Using unicode(bytes) call causes undesired side effect that is inserting
`b` character to result. This obviously causes issues with binary base64 data

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta