Go to file
Fraser Tweedale f94ccca676 Allow CustodiaClient to be used by arbitrary principals
Currently CustodiaClient assumes that the client is the host
principal, and it is hard-coded to read the host keytab and server
keys.

For the Lightweight CAs feature, Dogtag on CA replicas will use
CustodiaClient to retrieve signing keys from the originating
replica.  Because this process runs as 'pkiuser', the host keys
cannot be used; instead, each Dogtag replica will have a service
principal to use for Custodia authentication.

Update CustodiaClient to require specifying the client keytab and
Custodia keyfile to use, and change the client argument to be a full
GSS service name (instead of hard-coding host service) to load from
the keytab.  Update call sites accordingly.

Also pass the given 'ldap_uri' argument through to IPAKEMKeys
because without it, the client tries to use LDAPI, but may not have
access.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-08 10:16:28 +02:00
asn1 Migrate from #ifndef guards to #pragma once 2016-05-29 14:04:45 +02:00
checks Remove unused imports 2015-12-23 07:59:22 +01:00
client Added krb5.conf.d/ to included dirs in krb5.conf 2016-06-05 09:47:13 +02:00
contrib Modernize mod_nss's cipher suites 2016-02-11 10:44:29 +01:00
daemons Migrate from #ifndef guards to #pragma once 2016-05-29 14:04:45 +02:00
doc Use print_function future definition wherever print() is used 2016-01-20 11:59:21 +01:00
init Configure httpd service from installer instead of directly from RPM 2016-04-22 10:19:25 +02:00
install Auth Indicators WebUI part 2016-06-07 19:30:07 +02:00
ipaclient Add the culprit line when a configuration file has an incorrect format 2016-06-06 19:06:32 +02:00
ipalib Remove service and host cert issuer validation 2016-06-06 08:58:01 +02:00
ipaplatform Added krb5.conf.d/ to included dirs in krb5.conf 2016-06-05 09:47:13 +02:00
ipapython Allow CustodiaClient to be used by arbitrary principals 2016-06-08 10:16:28 +02:00
ipaserver Allow CustodiaClient to be used by arbitrary principals 2016-06-08 10:16:28 +02:00
ipatests test: test_cli: Do not expect defaults in kwargs. 2016-06-06 19:53:59 +02:00
util Migrate from #ifndef guards to #pragma once 2016-05-29 14:04:45 +02:00
.gitignore Split ipa-client/ into ipaclient/ (Python library) and client/ (C, scripts) 2016-01-27 12:09:02 +01:00
.mailmap Update Contributors.txt 2015-12-02 12:31:54 +01:00
ACI.txt DNS Location: location-show: return list of servers in location 2016-06-03 15:58:21 +02:00
API.txt DNS Location: location-show: return list of servers in location 2016-06-03 15:58:21 +02:00
autogen.sh build tweaks - use automake's foreign mode, avoid creating empty files to satisfy gnu mode - run autoreconf -f to ensure that everything matches 2010-11-29 11:39:55 -05:00
BUILD.txt BUILD: Remove detection of libcheck 2016-04-22 13:21:26 +02:00
Contributors.txt Update Contributors.txt 2015-12-02 12:31:54 +01:00
COPYING Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
COPYING.openssl Add a clear OpenSSL exception. 2015-02-23 16:25:54 +01:00
freeipa.spec.in Remove dangling RUVs even if replicas are offline 2016-06-03 15:22:00 +02:00
ipa Switch /usr/bin/ipa to Python 3 2016-05-06 16:17:28 +02:00
ipa.1 Updated ipa command man page 2016-05-03 17:41:19 +02:00
lite-server.py Port from python-krbV to python-gssapi 2015-08-26 09:41:36 +02:00
make-doc Make an ipa-tests package 2013-06-17 19:22:50 +02:00
make-test Switch make-test to pytest 2014-11-21 12:14:44 +01:00
makeaci ipaclient: implement thin client 2016-06-03 09:00:34 +02:00
makeapi ipaclient: implement thin client 2016-06-03 09:00:34 +02:00
Makefile Exclude unneeded dirs and files from pylint check 2016-06-07 13:49:06 +02:00
MANIFEST.in Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
pylint_plugins.py ipalib: move server-side plugins to ipaserver 2016-06-03 09:00:34 +02:00
pylintrc pylint: replace Refactor category with individual check names 2016-05-20 14:39:05 +02:00
pytest.ini Configure pytest to run doctests 2014-11-21 12:14:44 +01:00
README Update README and BUILD 2014-02-12 14:04:07 +01:00
setup.py build: fix client-only build 2016-05-19 15:52:06 +02:00
VERSION DNS Location: location-show: return list of servers in location 2016-06-03 15:58:21 +02:00
version.m4.in Mass tree reorganization for IPAv2. To view previous history of files use: 2009-02-03 15:27:14 -05:00
zanata.xml Translations: remove deprecated locale configuration 2016-05-31 13:50:07 +02:00

                               IPA Server

  Overview
  --------

  FreeIPA allows Linux administrators to centrally manage identity,
  authentication and access control aspects of Linux and UNIX systems
  by providing simple to install and use command line and web based
  managment tools.
  FreeIPA is built on top of well known Open Source components and standard
  protocols with a very strong focus on ease of management and automation
  of installation and configuration tasks.
  FreeIPA can seamlessly integrate into an Active Directory environment via
  cross-realm Kerberos trust or user synchronization.

  Benefits
  --------

  FreeIPA:
  * Allows all your users to access all the machines with the same credentials
    and security settings
  * Allows users to access personal files transparently from any machine in
    an authenticated and secure way
  * Uses an advanced grouping mechanism to restrict network access to services
    and files only to specific users
  * Allows central management of security mechanisms like passwords,
    SSH Public Keys, SUDO rules, Keytabs, Access Control Rules
  * Enables delegation of selected administrative tasks to other power users
  * Integrates into Active Directory environments

  Components
  ----------

  The FreeIPA project provides unified installation and management
  tools for the following components:

  * LDAP Server - based on the 389 project (LDAP)
    http://directory.fedoraproject.org/wiki/Main_Page

  * KDC - based on MIT Kerberos implementation
    http://k5wiki.kerberos.org/wiki/Main_Page

  * PKI based on Dogtag project
    http://pki.fedoraproject.org/wiki/PKI_Main_Page

  * Samba libraries for Active Directory integration
    http://www.samba.org/

  * DNS Server based on BIND and the Bind-DynDB-LDAP plugin
    https://www.isc.org/software/bind
    https://fedorahosted.org/bind-dyndb-ldap


  Project Website
  ---------------

  Releases, announcements and other information can be found on the IPA
  server project page at <http://www.freeipa.org/>.

  Documentation
  -------------

  The most up-to-date documentation can be found at
  <http://freeipa.org/page/Documentation>.

  Quick Start
  -----------

  To get started quickly, start here:
  <http://www.freeipa.org/page/Quick_Start_Guide>

  Licensing
  ---------

  Please see the file called COPYING.

  Contacts
  --------

     * If you want to be informed about new code releases, bug fixes,
       security fixes, general news and information about the IPA server
       subscribe to the freeipa-announce mailing list at
       <https://www.redhat.com/mailman/listinfo/freeipa-interest/>.

     * If you have a bug report please submit it at:
       <https://bugzilla.redhat.com>

     * If you want to participate in actively developing IPA please
       subscribe to the freeipa-devel mailing list at
       <https://www.redhat.com/mailman/listinfo/freeipa-devel/> or join
       us in IRC at irc://irc.freenode.net/freeipa