Christian Heimes
02986ff42b
Add ipaplatform for Fedora and RHEL container
...
Container platforms for Fedora and RHEL simplify FreeIPA container
effort. Paths are based on patches from
https://github.com/freeipa/freeipa-container
Fixes: https://pagure.io/freeipa/issue/8401
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
Reviewed-By: Francois Cami <fcami@redhat.com >
2020-07-30 11:38:25 +02:00
Alexander Scheel
3ecea7800a
Configure PKI AJP Secret with 256-bit secret
...
By default, PKI's AJP secret is generated as a 75-bit password. By
generating it in IPA, we can guarantee the strength of the AJP secret.
It makes sense to use a stronger AJP secret because it typically
isn't rotated; access to AJP allows an attacker to impersonate an admin
while talking to PKI.
Fixes: https://pagure.io/freeipa/issue/8372
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1849146
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1845447
Related: https://github.com/dogtagpki/pki/pull/437
Signed-off-by: Alexander Scheel <ascheel@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2020-06-23 09:20:24 +02:00
Fraser Tweedale
21a9a7107a
install: fix --external-ca-profile option
...
Commit dd47cfc75ahttps://pagure.io/freeipa/issue/7548
Related: https://pagure.io/freeipa/issue/5608
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com >
2019-07-17 17:58:58 +03:00
Christian Heimes
94937424b1
Simplify and consolidate ipaca.ini
...
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
dd47cfc75a
Add pki.ini override option
...
Allow to specify a pki.ini overlay file on the command line. The override
file can be used to override pkispawn settings.
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
f847d7756f
Use new pki_ipaca.ini to spawn instances
...
Note: Some configuration stanzas are deprecated and have been replaced
with new stanzas, e.g. pki_cert_chain_path instead of
pki_external_ca_cert_chain_path.
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
70beccada2
Add IPA specific vars to ipaca_default.ini
...
Common settings like "pki_*_signing_key_algorithm" now use an IPA
specific template variable. The approach makes it easier to change all
signing parameters to use a different algorithm.
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
0a2b02fc62
Simplify and slim down ipaca_default.ini
...
* Remove internal stuff from DEFAULT section
* Remove all non-user modifiable paths
* Remove OCSP, RA, TKS, TPS sections
* Remove deprecated options and replace them with current options
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
8c4d75fd2e
Add current default.cfg from Dogtag
...
base/server/etc/default.cfg from commit
https://github.com/dogtagpki/pki/commit/b93183406c0be6ce233eb4ed4c116aa858635cdf
Fixes: https://pagure.io/freeipa/issue/5608
Signed-off-by: Christian Heimes <cheimes@redhat.com >
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com >
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com >
2019-04-10 13:43:23 +02:00
Christian Heimes
Alexander Scheel
Fraser Tweedale