Martin Babinsky
3d2feac0e4
Adopted kinit_keytab and kinit_password for kerberos auth
...
Calls to ipautil.run using kinit were replaced with calls
kinit_keytab/kinit_password functions implemented in the PATCH 0015.
Reviewed-By: Jan Cholasta <jcholast@redhat.com >
Reviewed-By: Simo Sorce <ssorce@redhat.com >
Reviewed-By: Petr Spacek <pspacek@redhat.com >
2015-04-20 08:27:35 +00:00
Jan Cholasta
572d68b539
client: Fix ca_is_enabled calls
...
The command was added in API version 2.107. Old IPA servers may crash with
NetworkError on ca_is_enabled, handle this case gracefully.
https://fedorahosted.org/freeipa/ticket/4565
Reviewed-By: David Kupka <dkupka@redhat.com >
2015-03-19 14:38:34 +00:00
Jan Cholasta
35947c6e10
Do not wait for new CA certificate to appear in LDAP in ipa-certupdate
...
If new certificate is not available, reuse the old one, instead of waiting
indefinitely for the new certificate to appear.
https://fedorahosted.org/freeipa/ticket/4628
Reviewed-By: David Kupka <dkupka@redhat.com >
2014-10-30 10:51:36 +01:00
Jan Cholasta
608851d3f8
Check LDAP instead of local configuration to see if IPA CA is enabled
...
The check is done using a new hidden command ca_is_enabled.
https://fedorahosted.org/freeipa/ticket/4621
Reviewed-By: David Kupka <dkupka@redhat.com >
2014-10-17 12:53:11 +02:00
Jan Cholasta
da24d8a6e7
Fix certmonger search for the CA cert in ipa-certupdate and ipa-cacert-manage
...
The search criteria did not include the CA agent name.
https://fedorahosted.org/freeipa/ticket/3259
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
Jan Cholasta
4e68046751
Get server hostname from jsonrpc_uri in ipa-certupdate
...
https://fedorahosted.org/freeipa/ticket/3259
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
Jan Cholasta
9ab402c495
Check if IPA client is configured in ipa-certupdate
...
https://fedorahosted.org/freeipa/ticket/4460
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
Jan Cholasta
f40a0ad325
Use /etc/ipa/nssdb to get nicknames of IPA certs installed in /etc/pki/nssdb
...
Previously a list of nicknames was kept in /etc/pki/nssdb/ipa.txt. The file
is removed now.
https://fedorahosted.org/freeipa/ticket/3259
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
Jan Cholasta
bbf962299d
Use NSSDatabase instead of direct certutil calls in client code
...
https://fedorahosted.org/freeipa/ticket/4416
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
Jan Cholasta
231f57cedb
Introduce NSS database /etc/ipa/nssdb
...
This is the new default NSS database for IPA.
/etc/pki/nssdb is still maintained for backward compatibility.
https://fedorahosted.org/freeipa/ticket/3259
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-09-30 10:01:38 +02:00
David Kupka
6d94cdf250
Use certmonger D-Bus API instead of messing with its files.
...
FreeIPA certmonger module changed to use D-Bus to communicate with certmonger.
Using the D-Bus API should be more stable and supported way of using cermonger than
tampering with its files.
>=certmonger-0.75.13 is needed for this to work.
https://fedorahosted.org/freeipa/ticket/4280
Reviewed-By: Jan Cholasta <jcholast@redhat.com >
2014-09-05 10:51:42 +02:00
Jan Cholasta
60e19b585c
Add client certificate update tool ipa-certupdate.
...
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520
Reviewed-By: Rob Crittenden <rcritten@redhat.com >
2014-07-30 16:04:21 +02:00
Martin Babinsky
Jan Cholasta
David Kupka