freeipa/install/share/profiles/Makefile.am

NULL =

appdir = $(IPA_DATA_DIR)/profiles
app_DATA =				\
	README				\
	caIPAserviceCert.cfg		\
	caIPAserviceCert.UPGRADE.cfg	\
	IECUserRoles.cfg		\
	KDCs_PKINIT_Certs.cfg		\
	acmeServerCert.cfg		\
	$(NULL)

EXTRA_DIST =				\
	$(app_DATA)			\
	$(NULL)
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`NULL =`

			`appdir = $(IPA_DATA_DIR)/profiles`
			`app_DATA = \`
Add a README to certificate profile templates directory There have been several instances of people using the profile configuration template files as actual profile configurations, resulting in failures and support load. Add a README to the profile template directory to explain that these files should not be used and advise of the recommend procedure. Fixes: https://pagure.io/freeipa/issue/7014 Reviewed-By: Martin Basti <mbasti@redhat.com> 2017-06-11 21:49:51 -05:00			`README \`
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`caIPAserviceCert.cfg \`
Restore old version of caIPAserviceCert for upgrade only The latest version of caIPAserviceCert profile includes a feature that is not available before Dogtag 10.4, and this version of the profile is intended for new installs only (otherwise, problems will arise in topologies containing CA replicas at an earlier version). But IPA versions before v4.2 did not use LDAP-based profiles, so the new version of the profile gets imported when upgrading from pre-v4.2 to v4.5 or later. We do not yet have a proper version- and topology-aware profile update mechanism, so to resolve this issue, ship the older version of the profile alongside the newer version, and make sure we use the older version when importing the profile in an upgrade context. https://pagure.io/freeipa/issue/7097 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> 2017-08-08 21:55:57 -05:00			`caIPAserviceCert.UPGRADE.cfg \`
Add profile for DNP3 / IEC 62351-8 certificates The DNP3 smart-grid standard uses certificate with the IEC 62351-8 IECUserRoles extension. Add a profile for DNP3 certificates which copies the IECUserRoles extension from the CSR, if present. Also update cert-request to accept CSRs containing this extension. Fixes: https://fedorahosted.org/freeipa/ticket/4752 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2015-07-24 08:32:51 -05:00			`IECUserRoles.cfg \`
Configure Anonymous PKINIT on server install Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2016-07-26 10:19:01 -05:00			`KDCs_PKINIT_Certs.cfg \`
acme: add certificate profile Add a default certificate profile to be used with the ACME service. The profile requires the (Dogtag) user interacting with the CA to be a member of the (Dogtag) "ACME Agents" group. For each CA server we create a dedicated ACME agent account, make it a member of this group, and configure the ACME issuer component to use that account. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com> 2020-03-25 00:41:56 -05:00			`acmeServerCert.cfg \`
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com> 2015-05-11 20:17:48 -05:00			`$(NULL)`

			`EXTRA_DIST = \`
			`$(app_DATA) \`
			`$(NULL)`