Fraser Tweedale b0d9a4728f Setup lightweight CA key retrieval on install/upgrade ...

Add the ipa-pki-retrieve-key helper program and configure
lightweight CA key replication on installation and upgrade.  The
specific configuration steps are:

- Add the 'dogtag/$HOSTNAME' service principal
- Create the pricipal's Custodia keys
- Retrieve the principal's keytab
- Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever
  to invoke ipa-pki-retrieve-key for key retrieval

Also bump the minimum version of Dogtag to 10.3.2.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>

2016-06-09 09:04:27 +02:00

..

advise

Add ipa-advise plugins for nss-pam-ldapd legacy clients

2013-10-18 16:15:12 +02:00

profiles

Add profile for DNP3 / IEC 62351-8 certificates

2015-08-11 14:57:41 +02:00

05rfc2247.ldif

Remove references to GPL v2.0 license

2015-02-20 15:40:42 +01:00

15rfc2307bis.ldif

Add formerly update-only schema

2013-11-18 16:54:21 +01:00

15rfc4876.ldif

Add formerly update-only schema

2013-11-18 16:54:21 +01:00

60basev2.ldif

idviews: Add necessary schema for the ID views

2014-09-30 10:42:06 +02:00

60basev3.ldif

Allow to specify Kerberos authz data type per user

2016-03-09 19:00:43 +01:00

60certificate-profiles.ldif

Add CA ACL plugin

2015-06-11 10:50:31 +00:00

60ipaconfig.ldif

Unify capitalization of attribute names in schema files

2013-11-18 16:54:22 +01:00

60ipadns.ldif

DNS Locations: add new attributes and objectclasses

2016-06-03 15:58:21 +02:00

60ipapk11.ldif

DNSSEC: schema

2014-10-21 12:23:03 +02:00

60kerberos.ldif

ipa_kdb: add krbPrincipalAuthInd handling

2016-05-02 19:15:45 +02:00

60samba.ldif

Make schema files conform to new updater

2013-11-18 16:54:21 +01:00

61kerberos-ipav3.ldif

Perform case-insensitive searches for principals on TGS requests

2012-06-07 09:39:10 +02:00

65ipacertstore.ldif

Add LDAP schema for certificate store.

2014-07-30 16:04:21 +02:00

65ipasudo.ldif

Update X-ORIGIN for 4.0

2014-07-01 13:57:06 +02:00

70ipaotp.ldif

Revert "Make all ipatokenTOTP attributes mandatory"

2015-01-21 09:20:15 +01:00

70topology.ldif

handle multiple managed suffixes

2015-10-15 14:24:33 +02:00

71idviews.ldif

idviews: Add user certificate attribute to user ID overrides

2016-05-06 07:12:01 +02:00

72domainlevels.ldif

Add Domain Level feature

2015-05-26 11:59:47 +00:00

anonymous-vlv.ldif

Let anonymous users browse the VLV index

2009-07-10 16:45:45 -04:00

automember.ldif

34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin

2011-08-31 09:49:43 +02:00

bind.named.conf.template

Extend installers with --forward-policy option

2016-04-28 18:46:06 +02:00

bind.zone.db.template

Fix: DNS installer adds invalid zonemgr email

2014-11-13 10:36:28 +00:00

bootstrap-template.ldif

Setup lightweight CA key retrieval on install/upgrade

2016-06-09 09:04:27 +02:00

ca-topology.uldif

aci: merge domain and CA suffix replication agreement ACIs

2015-12-14 14:40:17 +01:00

caJarSigningCert.cfg.template

Add signing profile to CA installation so we can sign the firefox jar file.

2009-05-04 16:54:42 -04:00

certmap.conf.template

Remove references to GPL v2.0 license

2015-02-20 15:40:42 +01:00

copy-schema-to-ca.py

Move user/group constants for PKI and DS into ipaplatform

2016-03-22 10:40:44 +01:00

custodia.conf.template

Look up HTTPD_USER's UID and GID during installation.

2016-03-23 17:15:25 +01:00

default-aci.ldif

aci: replace per-server ACIs with ipaserver-based ACIs

2015-12-07 08:13:23 +01:00

default-hbac.ldif

Remove sourcehostcategory from the default HBAC rule.

2014-02-06 16:46:24 +01:00

default-smb-group.ldif

Change DNA magic value to -1 to make UID 999 usable

2013-03-11 17:07:07 +01:00

default-trust-view.ldif

idviews: Add Default Trust View as part of adtrustinstall

2014-09-30 10:42:06 +02:00

delegation.ldif

DNS Locations: Always create DNS related privileges

2016-06-03 15:58:21 +02:00

dna.ldif

Change DNA magic value to -1 to make UID 999 usable

2013-03-11 17:07:07 +01:00

dns.ldif

DNS Locations: Always create DNS related privileges

2016-06-03 15:58:21 +02:00

dnssec.ldif

DNSSEC: DNS key synchronization daemon

2014-10-21 12:23:03 +02:00

domainlevel.ldif

Add Domain Level feature

2015-05-26 11:59:47 +00:00

ds-nfiles.ldif

Autotune directory server to use a greater number of files

2010-11-22 12:42:16 -05:00

encrypted_attribute.ldif

Mass tree reorganization for IPAv2. To view previous history of files use:

2009-02-03 15:27:14 -05:00

entryusn.ldif

Address entryusn initialization on replica installation

2011-01-28 13:58:43 -05:00

host_nis_groups.ldif

Move Managed Entries into their own container in the replicated space.

2011-09-12 16:28:27 -04:00

indices.ldif

Fix indicies ntUserDomainId, ntUniqueId

2015-06-29 13:40:29 +02:00

ipa-httpd.conf.template

Configure httpd service from installer instead of directly from RPM

2016-04-22 10:19:25 +02:00

kdc_extensions.template

Add support for configuring KDC certs for PKINIT

2010-11-18 15:09:36 -05:00

kdc_req.conf.template

Add support for configuring KDC certs for PKINIT

2010-11-18 15:09:36 -05:00

kdc.conf.template

Fix kdc.conf.template to use ipaplatform.paths.

2016-03-23 13:35:29 +01:00

kdcproxy-disable.uldif

Provide Kerberos over HTTP (MS-KKDCP)

2015-06-24 10:43:58 +02:00

kdcproxy-enable.uldif

Provide Kerberos over HTTP (MS-KKDCP)

2015-06-24 10:43:58 +02:00

kdcproxy.conf

Provide Kerberos over HTTP (MS-KKDCP)

2015-06-24 10:43:58 +02:00

kerberos.ldif

Use only AES enctypes by default

2016-01-13 15:24:53 +01:00

key_escrow_schema.ldif

Re-number some attributes to compress our usage to be contiguous

2010-05-27 10:50:49 -04:00

krb5.conf.template

Added krb5.conf.d/ to included dirs in krb5.conf

2016-06-05 09:47:13 +02:00

krb5.ini.template

Set master_kdc and dns_lookup_kdc to true

2012-09-19 20:47:12 -04:00

krb.con.template

Mass tree reorganization for IPAv2. To view previous history of files use:

2009-02-03 15:27:14 -05:00

krb.js.template

Build and installation of Kerberos authentication extension

2012-10-04 18:08:04 -04:00

krbrealm.con.template

Mass tree reorganization for IPAv2. To view previous history of files use:

2009-02-03 15:27:14 -05:00

ldapi.ldif

Enable ldapi connections in the management framework.

2009-08-27 13:36:58 -04:00

Makefile.am

Configure httpd service from installer instead of directly from RPM

2016-04-22 10:19:25 +02:00

managed-entries.ldif

Move Managed Entries into their own container in the replicated space.

2011-09-12 16:28:27 -04:00

master-entry.ldif

Add Domain Level feature

2015-05-26 11:59:47 +00:00

memberof-conf.ldif

Display user and host membership in netgroups.

2010-11-24 08:38:41 -05:00

memberof-task.ldif

Wait for memberof task and DS to start before proceeding in installation.

2011-04-22 11:43:50 +02:00

modrdn-krbprinc.ldif

The precendence on the modrdn plugin was set in the wrong location.

2011-09-13 17:36:59 +02:00

nis-update.uldif

Upgrade: Fix upgrade of NIS Server configuration

2016-01-11 09:45:54 +01:00

nis.uldif

Enable transactions by default, make password and modrdn TXN-aware

2012-11-21 14:55:12 +01:00

opendnssec_conf.template

Use ODS_USER/ODS_GROUP in opendnssec_conf.template

2016-03-23 13:32:55 +01:00

opendnssec_kasp.template

DNSSEC: update OpenDNSSEC KASP configuration

2015-05-19 12:50:56 +00:00

referint-conf.ldif

Update referential integrity config for DS 1.3.3

2014-09-12 17:42:08 +02:00

replica-acis.ldif

fix permission: Read Replication Agreements

2016-02-25 14:30:01 +01:00

replica-automember.ldif

34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin

2011-08-31 09:49:43 +02:00

replica-s4u2proxy.ldif

Add cifs principal to S4U2Proxy targets only when running ipa-adtrust-install

2012-10-09 18:15:01 -04:00

repoint-managed-entries.ldif

Move Managed Entries into their own container in the replicated space.

2011-09-12 16:28:27 -04:00

root-autobind.ldif

Remove root autobind search restriction, fix upgrade logging & error handling.

2011-06-13 09:51:05 +02:00

sasl-mapping-fallback.ldif

Enable SASL mapping fallback.

2013-06-27 17:06:51 +02:00

schema_compat.uldif

Server Upgrade: remove CSV from upgrade files

2015-05-11 16:08:01 +00:00

schema-update.ldif

Fix nsslapdPlugin object class after initial replication.

2013-09-10 09:49:43 +02:00

smb.conf.empty

Add trust management for Active Directory trusts

2012-06-07 09:39:09 +02:00

smb.conf.template

ipa-adtrust-install: configure host netbios name by default

2014-01-20 10:35:03 +01:00

sudobind.ldif

Create default disabled sudo bind user

2011-02-23 15:32:24 -05:00

topology-entries.ldif

rename topology suffixes to "domain" and "ca"

2015-12-04 12:59:21 +01:00

unique-attributes.ldif

Server Upgrade: Fix uniqueness plugins

2015-05-19 12:45:41 +00:00

user_private_groups.ldif

Move Managed Entries into their own container in the replicated space.

2011-09-12 16:28:27 -04:00

uuid.ldif

DNSSEC: DNS key synchronization daemon

2014-10-21 12:23:03 +02:00

vault.ldif

install: support KRA update

2015-09-17 14:55:54 +02:00

wsgi.py

Replace StandardError with Exception

2015-09-30 10:51:36 +02:00