freeipa/ipapython
Rob Crittenden 03837bfd6d Use certmonger to renew CA subsystem certificates
Certificate renewal can be done only one one CA as the certificates need
to be shared amongst them. certmonger has been trained to communicate
directly with dogtag to perform the renewals. The initial CA installation
is the defacto certificate renewal master.

A copy of the certificate is stored in the IPA LDAP tree in
cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the
certificate, when a certificate is renewed. Only the most current
certificate is stored. It is valid to have no certificates there, it means
that no renewals have taken place.

The clones are configured with a new certmonger CA type that polls this
location in the IPA tree looking for an updated certificate. If one is
not found then certmonger is put into the CA_WORKING state and will poll
every 8 hours until an updated certificate is available.

The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case.
When this certificate is updated we also need to update its entry in
the dogtag tree, adding the updated certificate and telling dogtag which
certificate to use. This is the certificate that lets IPA issue
certificates.

On upgrades we check to see if the certificate tracking is already in
place. If not then we need to determine if this is the master that will
do the renewals or not. This decision is made based on whether it was
the first master installed. It is concievable that this master is no
longer available meaning that none are actually tracking renewal. We
will need to document this.

https://fedorahosted.org/freeipa/ticket/2803
2012-07-30 13:39:08 +02:00
..
platform Use certmonger to renew CA subsystem certificates 2012-07-30 13:39:08 +02:00
py_default_encoding Check for Python.h during build of py_default_encoding extension 2011-11-16 18:34:16 -05:00
test Fix failed tests. API for utcoffset changed and strings are more robust. 2011-01-24 14:34:38 -05:00
__init__.py Rename ipa-python directory to ipapython so it is a real python library 2009-02-09 14:35:15 -05:00
admintool.py Framework for admin/install tools, with ipa-ldap-updater 2012-07-22 23:17:56 -04:00
certdb.py Move the compat module from ipalib to ipapython. 2012-02-13 22:22:49 -05:00
certmonger.py Use certmonger to renew CA subsystem certificates 2012-07-30 13:39:08 +02:00
compat.py Move the compat module from ipalib to ipapython. 2012-02-13 22:22:49 -05:00
config.py Fix default_server configuration in ipapython.config 2012-05-24 13:59:23 +02:00
dogtag.py Add the -v option to sslget to provide more verbose errors 2012-02-23 11:26:06 +01:00
entity.py Remove duplicate and unused utility code 2012-05-09 11:54:20 +02:00
ipa_log_manager.py Improve ipa-client-install debug output 2012-06-17 21:47:06 -04:00
ipa.conf Rename ipa-python directory to ipapython so it is a real python library 2009-02-09 14:35:15 -05:00
ipautil.py Use certmonger to renew CA subsystem certificates 2012-07-30 13:39:08 +02:00
ipavalidate.py Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
kernel_keyring.py Store session cookie in ccache for cli users 2012-06-14 14:02:26 +02:00
log_manager.py Restore default log level in server to INFO 2011-12-01 08:34:02 +01:00
Makefile Introduce platform-specific adaptation for services used by FreeIPA. 2011-09-13 11:25:58 +02:00
MANIFEST.in Rename ipa-python directory to ipapython so it is a real python library 2009-02-09 14:35:15 -05:00
nsslib.py Improve address family handling in sockets 2012-07-13 14:25:18 +02:00
README Replace DNS client based on acutil with python-dns 2012-05-24 13:55:56 +02:00
services.py.in If SELinux is enabled ensure we also have restorecon. 2012-05-31 14:07:05 +02:00
setup.py.in Introduce platform-specific adaptation for services used by FreeIPA. 2011-09-13 11:25:58 +02:00
sysrestore.py Add sysupgrade state file 2012-06-10 21:23:10 -04:00
version.py.in Add API version and have server reject incompatible clients. 2011-01-14 14:26:22 -05:00

This is a set of libraries common to IPA clients and servers though mostly
geared currently towards command-line tools.

A brief overview:

config.py - identify the IPA server domain and realm. It uses python-dns to
            try to detect this information first and will fall back to
            /etc/ipa/default.conf if that fails.

ipautil.py - helper functions

entity.py - entity is the main data type. User and Group extend this class
            (but don't add anything currently).

ipavalidate.py - basic data validation routines