Skip to content

Commits

Permalink
local-cert-bui…
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Commits on Feb 28, 2017

  1. csrgen: Support encrypted private keys 

    https://fedorahosted.org/freeipa/ticket/4899
    @LiptonB
    LiptonB committed Feb 28, 2017
    Copy the full SHA
    83f4e89 View commit details
    Browse the repository at this point in the history

  2. csrgen: Allow overriding the CSR generation profile 

    In case users want multiple CSR generation profiles that work with the
same dogtag profile, or in case the profiles are not named the same,
this flag allows specifying an alternative CSR generation profile.

https://fedorahosted.org/freeipa/ticket/4899
    @LiptonB
    LiptonB committed Feb 28, 2017
    Copy the full SHA
    acedefa View commit details
    Browse the repository at this point in the history

  3. csrgen: Automate full cert request flow 

    Allows the `ipa cert-request` command to generate its own CSR. It no
longer requires a CSR passed on the command line, instead it creates a
config (bash script) with `cert-get-requestdata`, then runs it to build
a CSR, and submits that CSR.

Example usage (NSS database):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --database /tmp/certs

Example usage (PEM private key file):
$ ipa cert-request --principal host/test.example.com --profile-id caIPAserviceCert --private-key /tmp/key.pem

https://fedorahosted.org/freeipa/ticket/4899
    @LiptonB
    LiptonB committed Feb 28, 2017
    Copy the full SHA
    81be8bb View commit details
    Browse the repository at this point in the history

Commits on Feb 2, 2017

  1. ipa-kra-install must create directory if it does not exist 

    ipa-kra-install creates an admin cert file in
/root/.dogtag/pki-tomcat/ca_admin.cert but does not check that the
parent directory exists. This situation can happen when uninstall + restore
has been run.

The fix creates the directory if not present.

https://fedorahosted.org/freeipa/ticket/6606

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @flo-renaud @MartinBasti
    flo-renaud authored and MartinBasti committed Feb 2, 2017
    Copy the full SHA
    066f5b7 View commit details
    Browse the repository at this point in the history

  2. py3: tests_xmlrpc: do not call str() on bytes 

    Calling str() on bytes causes undesired side effect: it adds prefix "b"
to the result of conversion. The method decode() should be used instead.

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Feb 2, 2017
    Copy the full SHA
    5de70e3 View commit details
    Browse the repository at this point in the history

Commits on Jan 31, 2017

  1. private_ccache: yield ccache name 

    When using private_ccache, yield 'path' from the context manager.
This is cleaner than inspecting 'os.environ['KRB5CCNAME']' within
the context.

Part of: https://fedorahosted.org/freeipa/ticket/5011

Reviewed-By: Martin Basti <mbasti@redhat.com>
    @frasertweedale @MartinBasti
    frasertweedale authored and MartinBasti committed Jan 31, 2017
    Copy the full SHA
    caca181 View commit details
    Browse the repository at this point in the history

  2. py3: normalize_certificate: support both bytes and unicode 

    https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    980c8a5 View commit details
    Browse the repository at this point in the history

  3. py3: strip_header: support both bytes and unicode 

    Various method passed various bytes or unicode as parameter

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    b8d6524 View commit details
    Browse the repository at this point in the history

  4. py3: fingerprint_hex_sha256: fix encoding/decoding 

    https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    47e76e1 View commit details
    Browse the repository at this point in the history

  5. py3: fix CSR encoding inside framework 

    csr must be in string because framework excpects only strings, so we
have to decode it back

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    d5ab063 View commit details
    Browse the repository at this point in the history

  6. Principal: validate type of input parameter 

    Bytes are unsupported and we should raise a TypeError from Principal
__init__ method otherwise we get hard to debug result

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    1023cfe View commit details
    Browse the repository at this point in the history

  7. Use dict comprehension 

    Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    deaf9ae View commit details
    Browse the repository at this point in the history

  8. py3: can_read: attributelevelrights is already string 

    Remove decode() as it causes error in py3 because the attribute is
already string not bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    b37d182 View commit details
    Browse the repository at this point in the history

  9. py3: get_effective_rights: values passed to ldap must be bytes 

    Values passed to LDAP must be bytes

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    4933305 View commit details
    Browse the repository at this point in the history

  10. py3: ipaldap: update encode/decode methods 

    Update encoding/decoding accordingly to work under Py3

Removing functions that were used only once in code and give no real
improvements

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    dd3d9f1 View commit details
    Browse the repository at this point in the history

  11. py3: rpcserver fix undefined variable 

    variable 'e' is valid only in except block in py3, so it must be
assigned to different variable for further usage

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    aa036e5 View commit details
    Browse the repository at this point in the history

  12. py3: WSGI executioners must return bytes in list 

    WSGI prints TypeError into error log when IPA doesn't return bytes in
list as result

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    cca9aa4 View commit details
    Browse the repository at this point in the history

  13. py3: session: fix r/w ccache data 

    ccache contains binary data, so it should be read and write in binary
mode

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    35e135c View commit details
    Browse the repository at this point in the history

  14. Py3: Fix undefined variable 

    Variable 'e' has only local scope in except block in Py3

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    7e8eb53 View commit details
    Browse the repository at this point in the history

  15. py3: rpcserver: decode input because json requires string 

    json library parses string so input must be decoded

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    9739d03 View commit details
    Browse the repository at this point in the history

  16. py3: session.py decode server name to str 

    This fix is temporal because Memcache will be removed soon, so it is
more workaround than fix

https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Christian Heimes <cheimes@redhat.com>
    @MartinBasti
    MartinBasti committed Jan 31, 2017
    Copy the full SHA
    a9fec1d View commit details
    Browse the repository at this point in the history

  17. Use proper logging for error messages 

    https://fedorahosted.org/freeipa/ticket/6588r

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    @MartinBasti
    MartinBasti authored and David Kupka committed Jan 31, 2017
    Copy the full SHA
    f2ec44f View commit details
    Browse the repository at this point in the history

  18. wait_for_entry: use only DN as parameter 

    Using the whole entry is not needed as parameter because only DN is used
and it prevents easier usage of this function

https://fedorahosted.org/freeipa/ticket/6588

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    @MartinBasti
    MartinBasti authored and David Kupka committed Jan 31, 2017
    Copy the full SHA
    38fd8b3 View commit details
    Browse the repository at this point in the history

  19. tests: Add tests for CSR autogeneration 

    This patch also contains some code changes to make the code easier to
test and to make the tests pass.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    @LiptonB
    LiptonB authored and Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    a26cf0d View commit details
    Browse the repository at this point in the history

  20. csrgen: Use data_sources option to define which fields are rendered 

    This removes the ipa.syntaxrule and ipa.datarule macros in favor of
simple 'if' statements based on the data referenced in the rules. The
'if' statement for a syntax rule is generated based on the data rules it
contains.

The Subject DN should not be generated unless all data rules are in
place, so the ability to override the logical operator that combines
data_sources (from 'or' to 'and') is added.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    @LiptonB
    LiptonB authored and Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    afd7c05 View commit details
    Browse the repository at this point in the history

  21. csrgen: Add a CSR generation profile for user certificates 

    https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    @LiptonB
    LiptonB authored and Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    f1a1c6e View commit details
    Browse the repository at this point in the history

  22. csrgen: Add CSR generation profile for caIPAserviceCert 

    https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    @LiptonB
    LiptonB authored and Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    fc58eff View commit details
    Browse the repository at this point in the history

  23. csrgen: Add code to generate scripts that generate CSRs 

    Adds a library that uses jinja2 to format a script that, when run, will
build a CSR. Also adds a CLI command, 'cert-get-requestdata', that uses
this library and builds the script for a given principal. The rules are
read from json files in /usr/share/ipa/csr, but the rule provider is a
separate class so that it can be replaced easily.

https://fedorahosted.org/freeipa/ticket/4899

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    @LiptonB
    LiptonB authored and Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    10ef594 View commit details
    Browse the repository at this point in the history

  24. ipa-ca-install: do not fail without --subject-base and --ca-subject 

    When --subject-base and --ca-subject are not specified in ipa-ca-install,
default values are used. DN objects are used as the default values in
ipa-ca-install, but the CA installer expects the values to be strings. This
causes ipa-ca-install to fail unless both --subject-base and --ca-subject
are specified.

Convert the DN objects to strings to fix the issue.

https://fedorahosted.org/freeipa/ticket/2614

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
    Jan Cholasta committed Jan 31, 2017
    Copy the full SHA
    87400cd View commit details
    Browse the repository at this point in the history

Commits on Jan 25, 2017

  1. Explicitly handle quoting/unquoting of NSSNickname directive 

    Improve the single/double quote handling during parsing/unparsing of
nss.conf's NSSNickname directive. Single quotes are now added/stripped
explicitly when handling the certificate nickname.

https://fedorahosted.org/freeipa/ticket/6460

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
    Martin Babinsky committed Jan 25, 2017
    Copy the full SHA
    86f4a93 View commit details
    Browse the repository at this point in the history

  2. Delegate directive value quoting/unquoting to separate functions 

    Separate functions were added to installutils module to quote/unquote a
string in arbitrary characters.

`installutils.get/set_directive` functions will use them to enclose
the directive values in double quotes/strip the double quotes from
retrieved values to maintain the original behavior.

These functions can be used also for custom quoting/unquoting of
retrieved values when desired.

https://fedorahosted.org/freeipa/ticket/6460

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
    Martin Babinsky committed Jan 25, 2017
    Copy the full SHA
    2831b30 View commit details
    Browse the repository at this point in the history

  3. installutils: improve directive value parsing in get_directive 

    `get_directive` value parsing was improved in order to bring its logic
more in-line to changes in `set_directive`: a specified quoting
character is now unquoted and stripped from the retrieved value. The
function will now also error out when malformed directive is
encountered.

https://fedorahosted.org/freeipa/ticket/6460

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
    Martin Babinsky committed Jan 25, 2017
    Copy the full SHA
    517d43e View commit details
    Browse the repository at this point in the history

  4. Fix the installutils.set_directive docstring 

    Add missing parameter descriptions and fix incorrect indentation

https://fedorahosted.org/freeipa/ticket/6460

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
    Martin Babinsky committed Jan 25, 2017
    Copy the full SHA
    e1ed8b5 View commit details
    Browse the repository at this point in the history

Commits on Jan 24, 2017

  1. cert: fix search limit handling in cert-find 

    If search limits are not specified in cert-find, use the configured limits.
This applies to the certificate search in the CA as well.

Detect and report if size limit was exceeded in the certificate search in
the CA.

Do not apply limits to the internal ca-find call.

https://fedorahosted.org/freeipa/ticket/6564

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
    Jan Cholasta committed Jan 24, 2017
    Copy the full SHA
    85834ab View commit details
    Browse the repository at this point in the history

  2. dogtag: search past the first 100 certificates 

    Dogtag requires a size limit to be specified when searching for
certificates. When no limit is specified in the dogtag plugin, a limit of
100 entries is assumed. As a result, an unlimited certificate search
returns data only for a maximum of 100 certificates.

Raise the "unlimited" limit to the maximum value Dogtag accepts.

https://fedorahosted.org/freeipa/ticket/6564

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
    Jan Cholasta committed Jan 24, 2017
    Copy the full SHA
    d84edc4 View commit details
    Browse the repository at this point in the history
Older