freeipa.git/ipaserver, branch clisesshandling

ldap2: use LDAP whoami operation to retrieve bind DN for current connection

2017-03-22T16:19:22+00:00

For external users which are mapped to some DN in LDAP server, we
wouldn't neccesary be able to find a kerberos data in their LDAP entry.
Instead of searching for Kerberos principal use actual DN we are bound
to because for get_effective_rights LDAP control we only need the DN
itself.

Fixes https://pagure.io/freeipa/issue/6797

Reviewed-By: Martin Babinsky 
Reviewed-By: Pavel Vomacka

replica prepare: fix wrong IPA CA nickname in replica file

2017-03-22T14:56:54+00:00

Lookup IPA CA subject and pass it to CertDB when creating dscert.p12 and
httpcert.p12, otherwise a generic nickname will be used for the IPA CA
certificate instead of "$REALM IPA CA".

This fixes replica install on domain level 0 from a replica file created
using ipa-replica-install on IPA 4.5.

https://pagure.io/freeipa/issue/6777

Reviewed-By: Martin Babinsky

Fixing replica install: fix ldap connection in domlvl 0

2017-03-22T14:31:40+00:00

Now, at the domain level 0, the replica install always uses
Directory Manager credentials to create the LDAP connection.
Since ACIs permitting hosts to manage their own services were
added in 4.2 release,  the old master denies this operations.

https://pagure.io/freeipa/issue/6549

Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

httpinstance: clean up /etc/httpd/alias on uninstall

2017-03-22T13:58:18+00:00

Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias
from backup on uninstall.

Files modified by IPA are kept with .ipasave suffix.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky

certs: do not implicitly create DS pin.txt

2017-03-22T13:58:18+00:00

Do not implicitly create DS pin.txt in `CertDB.init_from_pkcs12()`, create
it explicitly in `DSInstance.__enable_ssl()`.

This stops the file from being created in /etc/httpd/alias during classic
replica install.

https://pagure.io/freeipa/issue/4639

Reviewed-By: Martin Babinsky

Fix Python 3 pylint errors

2017-03-15T18:11:32+00:00

************* Module ipaserver.install.ipa_kra_install
ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse')
************* Module ipapython.install.core
ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member)
************* Module ipatests.test_ipapython.test_dn
ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals())
************* Module ipa-ca-install
install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)
install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member)

Signed-off-by: Christian Heimes 
Reviewed-By: Simo Sorce 
Reviewed-By: Stanislav Laznicka

Try out anonymous PKINIT after it is configured

2017-03-15T15:39:39+00:00

After PKINIT certificate is requested and everything is set up, we
should attempt to perform anonymous PKINIT and fail hard if it does not
work for some reason.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

check for replica's KDC entry on master before requesting PKINIT cert

2017-03-15T15:39:39+00:00

This prevents replication-based race conditions to break PKINIT
certificate requests on replica installation.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

check that the master requesting PKINIT cert has KDC enabled

2017-03-15T15:39:39+00:00

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy

Make wait_for_entry raise exceptions

2017-03-15T15:39:39+00:00

Instead of only logging errors when timeout is reached or query for the
entry fails for other reasons, `wait_for_entry` should raise exceptions
so that we can handle them in caller or let them propagate and fail
early.

https://pagure.io/freeipa/issue/6739

Reviewed-By: Martin Basti 
Reviewed-By: Alexander Bokovoy