freeipa.git/ipatests/test_xmlrpc, branch pwdpolicy

User Tracker: Test to create user with minimal values

2017-01-19T16:39:08+00:00

Test to create user with minimal values, where uid is not specified

https://fedorahosted.org/freeipa/ticket/6126

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Milan Kubik 
Reviewed-By: Lenka Doudova

User Tracker: creation of user with minimal values

2017-01-19T16:39:08+00:00

Fix provide possibility to create user-add test with minimal values,
where uid is not specified, to provide better coverage. Also provide
check for non-empty unicode string for attributes required in init method

https://fedorahosted.org/freeipa/ticket/6126

Reviewed-By: Stanislav Laznicka 
Reviewed-By: Milan Kubik 
Reviewed-By: Lenka Doudova

Stage User: Test to create stage user with minimal values

2017-01-19T16:36:46+00:00

Test to create stage user with minimal values, where uid is not specified

https://fedorahosted.org/freeipa/ticket/6448

Reviewed-By: Lenka Doudova 
Reviewed-By: Stanislav Laznicka

Tests: Stage User Tracker implementation

2017-01-19T16:36:46+00:00

Fix provide possibility of creation stage user with minimal values,
with uid not specified and check for non-empty unicode string
for attributes requested in init method

https://fedorahosted.org/freeipa/ticket/6448

Reviewed-By: Lenka Doudova 
Reviewed-By: Stanislav Laznicka

Generate sha256 ssh pubkey fingerprints for hosts

2017-01-12T10:09:46+00:00

Replace md5 with sha256 for host ssh pubkey fingerprints

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Christian Heimes

Remove "Request Certificate with SubjectAltName" permission

2016-12-21T16:04:18+00:00

subjectAltName is required or relevant in most certificate use cases
(esp. TLS, where carrying DNS name in Subject DN CN attribute is
deprecated).  Therefore it does not really make sense to have a
special permission for this, over and above "request certificate"
permission.

Furthermore, we already do rigorously validate SAN contents again
the subject principal, and the permission is waived for self-service
requests or if the operator is a host principal.

So remove the permission, the associated virtual operation, and the
associated code in cert_request.

Fixes: https://fedorahosted.org/freeipa/ticket/6526
Reviewed-By: Martin Babinsky

tests: Expect krbpwdpolicyreference in result of {host,service}-{find,show} --all

2016-12-14T16:46:12+00:00

Result of {host,service}-{find,show} commands with option '--all' always contains
krbpwpolicyreference attributes.

https://fedorahosted.org/freeipa/ticket/6561

Reviewed-By: Pavel Vomacka

Add options to write lightweight CA cert or chain to file

2016-12-12T12:03:15+00:00

Administrators need a way to retrieve the certificate or certificate
chain of an IPA-managed lightweight CA.  Add params to the `ca'
object for carrying the CA certificate and chain (as multiple DER
values).  Add the `--chain' flag for including the chain in the
result (chain is also included with `--all').  Add the
`--certificate-out' option for writing the certificate to a file (or
the chain, if `--chain' was given).

Fixes: https://fedorahosted.org/freeipa/ticket/6178
Reviewed-By: Jan Cholasta 
Reviewed-By: Tomas Krizek

cert-request: match names against principal aliases

2016-12-06T15:13:45+00:00

Currently we do not check Kerberos principal aliases when validating
a CSR.  Enhance cert-request to accept the following scenarios:

- for hosts and services: CN and SAN dnsNames match a principal
  alias (realm and service name must be same as nominated principal)

- for all principal types: UPN or KRB5PrincipalName othername match
  any principal alias.

Fixes: https://fedorahosted.org/freeipa/ticket/6295
Reviewed-By: Martin Babinsky 
Reviewed-By: Milan Kubik

tests: Added basic tests for certs in idoverrides

2016-11-29T17:30:44+00:00

https://fedorahosted.org/freeipa/ticket/6412

Reviewed-By: Martin Basti 
Reviewed-By: Milan Kubik