freeipa.git/ipaserver/secrets, branch webui_isolate

Separate RA cert store from the HTTP cert store

2017-02-14T22:37:16+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce

custodia: kem.set_keys: replace too-broad exception

2017-02-10T13:03:04+00:00

Exception is too brod and may hide various issues that show up later. If
the code expects that entry may exist, then ldap.ALREADY_EXISTS
exception should be used

Reviewed-By: Jan Cholasta

py3: kem.py: user bytes with ldap values

2017-02-10T13:03:04+00:00

python ldap requires bytes as values

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: custodia: basedn must be unicode

2017-02-10T13:03:04+00:00

basedn in custodia related modules has type bytes, that causes issues in
Py3 when strings were concatenated with bytes

```
malformed RDN string = "cn=custodia,cn=ipa,cn=etc,b'dc=example,dc=com'"
```

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: configparser: use raw keyword

2017-02-10T13:03:04+00:00

configparser.get() changed in python3 and `raw` is now a keyword attribute.

Also it must be set to True, otherwise InterpolationSyntaxError is raised

'''
InterpolationSyntaxError: '%' must be followed by '%' or '(', found:
'%2fvar%2frun%2fslapd-EXAMPLE-COM.socket'
'''

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

py3: base64 encoding/decoding returns always bytes don't mix it

2017-02-08T07:32:44+00:00

Using unicode(bytes) call causes undesired side effect that is inserting
`b` character to result. This obviously causes issues with binary base64 data

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Jan Cholasta

ipa_generate_password algorithm change

2017-01-06T08:26:56+00:00

A change to the algorithm that generates random passwords
for multiple purposes throught IPA. This spells out the need
to assess password strength by the entropy it contains rather
than its length.

This new password generation should also be compatible with the
NSS implementation of password requirements in FIPS environment
so that newly created databases won't fail with wrong authentication.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Petr Spacek

Unify password generation across FreeIPA

2017-01-06T08:26:56+00:00

Also had to recalculate entropy of the passwords as originally,
probability of generating each character was 1/256, however the
default probability of each character in the ipa_generate_password
is 1/95 (1/94 for first and last character).

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Petr Spacek

ipapython: move dnssec, p11helper and secrets to ipaserver

2016-11-29T13:50:51+00:00

The dnssec and secrets subpackages and the p11helper module depend on
ipaplatform.

Move them to ipaserver as they are used only on the server.

https://fedorahosted.org/freeipa/ticket/6474

Reviewed-By: Stanislav Laznicka