freeipa.git/ipaserver, branch cachetickets

Use https to get security domain from Dogtag

2017-03-03T12:33:51+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek

Extract method to map principal to princpal type

2017-03-03T11:09:57+00:00

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

Remove redundant principal_type argument

2017-03-03T11:09:57+00:00

Minor refactor to remove the redundant 'principal_type' argument
from 'caacl_check' and associated functions.

Part of: https://pagure.io/freeipa/issue/5011

Reviewed-By: Tomas Krizek

Support for Certificate Identity Mapping

2017-03-02T14:09:42+00:00

See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping

https://fedorahosted.org/freeipa/ticket/6542

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta 
Reviewed-By: David Kupka

Cleanup certdb

2017-03-02T13:45:00+00:00

* use with statement to open/close files
* prefer fchmod/fchown when a file descriptor is available
* set permission before data is written to file

Signed-off-by: Christian Heimes 
Reviewed-By: Stanislav Laznicka

server install: do not attempt to issue PKINIT cert in CA-less

2017-03-02T09:10:22+00:00

Require the user to provide the PKINIT cert with --pkinit-cert-file or
disable PKINIT with --no-pkinit in CA-less ipa-server-install,
ipa-replica-prepare and ipa-replica-install.

Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade.

https://pagure.io/freeipa/issue/5678

Reviewed-By: Alexander Bokovoy

Fix CA-less upgrade

2017-03-01T15:38:43+00:00

In CA-less mode there's no /etc/pki/pki-tomcat/password.conf so it
does not make sense to try to create a password file for an NSS
database from it (the NSS database does not exist either).

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta

Merge AD trust configurator into replica installer

2017-03-01T14:55:45+00:00

`ipa-replica-install` is now able to configure Samba and winbind
services in order to manage Active Directory trusts. `--add-agents`
option is exposed in replica installer, while `--add-sids` now defaults
to `False` since adding a first AD trust controller to an existing
sizeable deployment can result in stuck installation as sidgen tasks can
take a long time to complete. That's why adding SIDs should be a
conscious decision in this case.

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Merge AD trust configurator into server installer

2017-03-01T14:55:45+00:00

ipa-server-install is now able to configure Samba and winbind services
and manage trusts to Active Directory right off the bat with following
alterations from standalone installer:

   * sidgen task is always triggered since there are only a few entries
     to tag in the beginning

   * the `--add-agents` option is hardcoded to False, as there are no
     potential agents to resolve and addd when setting up the first
     master in topology

https://fedorahosted.org/freeipa/ticket/6630

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

expose AD trust related knobs in composite installers

2017-03-01T14:55:45+00:00

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta