freeipa.git/ipaserver, branch sessionlogout

Change session logout to kill only the cookie

2017-02-16T16:17:42+00:00

Removing the ccache goes to far as it will cause unrelated sessions to
fail as well, this is a problem for accounts used to do unattended
operations and that may operate in parallel.

Fixes https://fedorahosted.org/freeipa/ticket/6682

Signed-off-by: Simo Sorce

pkinit: make sure to have proper dictionary for Kerberos instance on upgrade

2017-02-16T08:51:38+00:00

When running PKINIT upgrade we need to make sure full substitution
dictionary is in place or otherwise executing LDAP updates will fail to
find proper objects because $SUFFIX, $DOMAIN, and other variables
will not be substituted.

Fixes https://fedorahosted.org/freeipa/ticket/6670

Reviewed-By: Simo Sorce

Add FIPS-token password of HTTPD NSS database

2017-02-15T16:54:36+00:00

This change is required for httpd to function properly in FIPS

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

Pretty print JSON in debug mode (debug level >= 2)

2017-02-15T16:27:56+00:00

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Faster JSON encoder/decoder

2017-02-15T16:27:56+00:00

Improve performance of FreeIPA's JSON serializer and deserializer.

* Don't indent and sort keys. Both options trigger a slow path in
  Python's json package. Without indention and sorting, encoding
  mostly happens in optimized C code.
* Replace O(n) type checks with O(1) type lookup and eliminate
  the use of isinstance().
* Check each client capability only once for every conversion.
* Use decoder's obj_hook feature to traverse the object tree once and
  to eliminate calls to isinstance().

Closes: https://fedorahosted.org/freeipa/ticket/6655
Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti 
Reviewed-By: Jan Cholasta

Fix uninstall stopping ipa.service

2017-02-15T06:13:37+00:00

When uninstalling systemd is told to disable the service, but it is not
told to sopt it, so it believes it is still running. This can cause
issues in some cases if a reinstall is performed right after an
uninstall, as systemd may decide to stop the disabled service while we
are reinstalling, causing the new install to fail.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Rationalize creation of RA and HTTPD NSS databases

2017-02-15T06:13:37+00:00

The RA database sould not be created by the HTTP instance,
but in the code path that creates the CA instance.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Add a new user to run the framework code

2017-02-15T06:13:37+00:00

Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Always use /etc/ipa/ca.crt as CA cert file

2017-02-15T06:13:37+00:00

It seem like ALIAS_CACERT_ASC was just a redundant location for the CA
cert file which is always available in /etc/ipa/ca.crt

Just use the canonical CA cert location in /etc/ipa for all cases and
stop creating a separate cacert file.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Simplify NSSDatabase password file handling

2017-02-15T06:13:37+00:00

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta