freeipa.git/ipaserver, branch cakeysfix

Make sure remote hosts have our keys

2017-05-03T11:35:53+00:00

In complex replication setups a replica may try to obtain CA keys from a
host that is not the master we initially create the keys against.
In this case race conditions may happen due to replication. So we need
to make sure the server we are contacting to get the CA keys has our
keys in LDAP. We do this by waiting to positively fetch our encryption
public key (the last one we create) from the target host LDAP server.

Fixes: https://pagure.io/freeipa/issue/6838

Signed-off-by: Simo Sorce

Refresh Dogtag RestClient.ca_host property

2017-05-02T15:33:25+00:00

Refresh the ca_host property of the Dogtag's RestClient class when
it's requested as a context manager.

This solves the problem which would occur on DL0 when installing
CA which needs to perform a set of steps against itself accessing
8443 port. This port should however only be available locally so
trying to connect to remote master would fail. We need to make
sure the right CA host is accessed.

https://pagure.io/freeipa/issue/6878

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

kerberos session: use CA cert with full cert chain for obtaining cookie

2017-05-02T11:42:52+00:00

Http request performed in finalize_kerberos_acquisition doesn't use
CA certificate/certificate store with full certificate chain of IPA server.
So it might happen that in case that IPA is installed with externally signed
CA certificate, the call can fail because of certificate validation
and e.g. prevent session acquisition.

If it will fail for sure is not known - the use case was not discovered,
but it is faster and safer to fix preemptively.

https://pagure.io/freeipa/issue/6876

Reviewed-By: Martin Basti

restore: restart/reload gssproxy after restore

2017-04-28T12:56:02+00:00

So that gssproxy picks up new configuration and therefore related
usages like authentication of CLI against server works

https://pagure.io/freeipa/issue/6902

Reviewed-By: Tomas Krizek

Do not test anonymous PKINIT after install/upgrade

2017-04-28T08:38:12+00:00

Local FAST armoring will now work regardless of PKINIT status so there
is no need to explicitly test for working PKINIT. If there is, there
should be a test case for that.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Upgrade: configure local/full PKINIT depending on the master status

2017-04-28T08:38:12+00:00

The upgrader has been modified to configure either local or full PKINIT
depending on the CA status. Additionally, the new PKINIT configuration
will be written to the master's KDC entry.

https://pagure.io/freeipa/issue/6830
http://www.freeipa.org/page/V4/Kerberos_PKINIT

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Use local anchor when armoring password requests

2017-04-28T08:38:12+00:00

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Stop requesting anonymous keytab and purge all references of it

2017-04-28T08:38:12+00:00

anonymous kinit using keytab never worked so we may safely remove all
code that requests/uses it.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

API for retrieval of master's PKINIT status and publishing it in LDAP

2017-04-28T08:38:12+00:00

An API was provided to report whether PKINIT is enabled for clients or
not. If yes, the pkinitEnabled value will be added to the
ipaConfigString attribute of master's KDC entry.

See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for
more details.

https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce

Allow for configuration of all three PKINIT variants when deploying KDC

2017-04-28T08:38:12+00:00

The PKINIT setup code now can configure PKINIT using IPA CA signed
certificate, 3rd party certificate and local PKINIT with self-signed
keypair. The local PKINIT is also selected as a fallback mechanism if
the CSR is rejected by CA master or `--no-pkinit` is used.

http://www.freeipa.org/page/V4/Kerberos_PKINIT
https://pagure.io/freeipa/issue/6830

Reviewed-By: Alexander Bokovoy 
Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti 
Reviewed-By: Simo Sorce