freeipa/install/share/profiles/Makefile.am

NULL =

appdir = $(IPA_DATA_DIR)/profiles
app_DATA =				\
	README				\
	caIPAserviceCert.cfg		\
	caIPAserviceCert.UPGRADE.cfg	\
	IECUserRoles.cfg		\
	KDCs_PKINIT_Certs.cfg		\
	acmeIPAServerCert.cfg		\
	$(NULL)

EXTRA_DIST =				\
	$(app_DATA)			\
	$(NULL)
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`NULL =`

			`appdir = $(IPA_DATA_DIR)/profiles`
			`app_DATA = \`
Add a README to certificate profile templates directory There have been several instances of people using the profile configuration template files as actual profile configurations, resulting in failures and support load. Add a README to the profile template directory to explain that these files should not be used and advise of the recommend procedure. Fixes: https://pagure.io/freeipa/issue/7014 Reviewed-By: Martin Basti <mbasti@redhat.com> 2017-06-11 21:49:51 -05:00			`README \`
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`caIPAserviceCert.cfg \`
Restore old version of caIPAserviceCert for upgrade only The latest version of caIPAserviceCert profile includes a feature that is not available before Dogtag 10.4, and this version of the profile is intended for new installs only (otherwise, problems will arise in topologies containing CA replicas at an earlier version). But IPA versions before v4.2 did not use LDAP-based profiles, so the new version of the profile gets imported when upgrading from pre-v4.2 to v4.5 or later. We do not yet have a proper version- and topology-aware profile update mechanism, so to resolve this issue, ship the older version of the profile alongside the newer version, and make sure we use the older version when importing the profile in an upgrade context. https://pagure.io/freeipa/issue/7097 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> 2017-08-08 21:55:57 -05:00			`caIPAserviceCert.UPGRADE.cfg \`
Add profile for DNP3 / IEC 62351-8 certificates The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2015-07-24 08:32:51 -05:00			`IECUserRoles.cfg \`
Configure Anonymous PKINIT on server install Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2016-07-26 10:19:01 -05:00			`KDCs_PKINIT_Certs.cfg \`
Centralize enable/disable of the ACME service The initial implementation of ACME in dogtag and IPA required that ACME be manually enabled on each CA. dogtag added a REST API that can be access directly or through the `pki acme` CLI tool to enable or disable the service. It also abstracted the database connection and introduced the concept of a realm which defines the DIT for ACME users and groups, the URL and the identity. This is configured in realm.conf. A new group was created, Enterprise ACME Administrators, that controls the users allowed to modify ACME configuration. The IPA RA is added to this group for the ipa-acme-manage tool to authenticate to the API to enable/disable ACME. Related dogtag installation documentation: https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Database.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Configuring_ACME_Realm.md https://github.com/dogtagpki/pki/blob/master/docs/installation/acme/Installing_PKI_ACME_Responder.md ACME REST API: https://github.com/dogtagpki/pki/wiki/PKI-ACME-Enable-REST-API https://pagure.io/freeipa/issue/8524 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Mohammad Rizwan <myusuf@redhat.com> 2020-10-06 14:17:15 -05:00			`acmeIPAServerCert.cfg \`
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`$(NULL)`

			`EXTRA_DIST = \`
			`$(app_DATA) \`
			`$(NULL)`