Announcing FreeIPA 4.6.1
by Tomas Krizek
The FreeIPA team would like to announce FreeIPA 4.6.1 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 26 and 27 are available in the official @freeipa/freeipa-4-6 COPR
repository [1].
== Highlights in 4.6.1 ==
=== Known Issues ===
* PyPI packages are broken since 4.6.0 #7132
=== Bug fixes ===
FreeIPA 4.6.1 is a stabilization release for the features delivered as a
part of 4.6.0.
There are more than 10 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on Upgrade page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users
mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7157 [tracker] pyasn1 fails to parse kerberos principal name
* 7150 Ipa-server-install update dse.ldif with wrong SELinux context
* 7143 "unknown command 'undefined'" error when changing user's password
via the web UI
* 7135 Server deployment still sets up Firefox extension, this is no
longer necessary and broken on F27+
* 7129 ipa-server/replica-install fails with: "exception: BytesWarning:
Comparison between bytes and string" when using '--dirsrv-config-file'
parameter
* 7119 kdc_proxy: kinit admin fails with "Cannot contact any KDC for
realm 'IPA.TEST' while getting initial credentials"
* 7115 ipa-pki-retrieve-key: failure results in crash report
* 7081 [ipatests] - installutils.is_ipa_configured() - users other then
root cannot check if IPA is configured
* 7027 Use TLS for cert-find
* 6874 pylint 1.7.1 fails
* 6848 Test IPA with OpenSSL-base libcurl for Fedora 27
* 6566 [py3] session cookie not found with py3
* 5121 [py3] Remove unnecessary calls to dict.keys()
== Detailed changelog since 4.6.0 ==
=== Alexander Bokovoy (3) ===
* Make sure upgrade also checks for IPv6 stack
* OTP import: support hash names with HMAC- prefix
* dsinstance: Restore context after changing dse.ldif
=== Felipe Volpone (2) ===
* Changing idoverrideuser-* to treat objectClass case insensitively
* Fixing how sssd.conf is updated when promoting a client to replica
=== Florence Blanc-Renaud (3) ===
* Fix ipa-server-upgrade with server cert tracking
* Python3: Fix winsync replication agreement
* Fix ipa config-mod --ca-renewal-master
=== Fraser Tweedale (2) ===
* ipa-pki-retrieve-key: ensure we do not crash
* issue_server_cert: avoid application of str to bytes
=== Martin Basti (1) ===
* py3: set samba dependencies
=== Petr Vobornik (1) ===
* browser config: cleanup after removal of Firefox extension
=== Pavel Vomacka (3) ===
* WebUI: Fix calling undefined method during reset passwords
* WebUI: remove unused parameter from get_whoami_command
* Adds whoami DS plugin in case that plugin is missing
=== Rob Crittenden (2) ===
* Add exec to /var/lib/ipa/sysrestore for install status inquiries
* Use TLS for the cert-find operation
=== Stanislav Laznicka (28) ===
* Don't write p11-kit EKU extension object if no EKU
* pylint: fix missing module
* travis: run the same tests in python2/3
* certmap testing: fix wrong cert construction
* ldap2: don't use decode() on str instance
* client: fix retrieving certs from HTTP
* uninstall: remove deprecation warning
* ldif: handle attribute names as strings
* pkinit: fix sorting dictionaries
* pkinit: don't fail when no pkinit servers found
* travis: remove "fast" from "makecache fast"
* Change Travis CI container to FreeIPA-owned
* Change the requirements for pylint in wheel
* rpcserver: don't call xmlserver.Command
* secrets: disable relative-imports for custodia
* pylint: disable __hash__ for some classes
* install.util: disable no-value-for-parameter
* pylint: make unsupported-assignment-operation check local
* sudocmd: fix unsupported assignment
* pylint: Iterate through dictionaries
* parameters: convert Decimal.precision to int
* dcerpc: disable unbalanced-tuple-unpacking
* dcerpc: refactor assess_dcerpc_exception
* pylint: fix no-member in schema plugin
* csrgen: fix incorrect codec for pyasn BitString
* pylint: fix not-context-manager false positives
* Travis: archive logs of py3 jobs
* travis: temporary workaround for Travis CI
=== Tomas Krizek (6) ===
* Become IPA 4.6.1
* Update contributors
* Update translations
* spec: bump python-pyasn1 to 0.3.2-2
* prci: use f26 template for master
* VERSION: set back to git snapshot
[1] - https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
6 years, 7 months
[freeipa PR#1034][opened] browser config: cleanup after removal of Firefox extension
by pvoborni
URL: https://github.com/freeipa/freeipa/pull/1034
Author: pvoborni
Title: #1034: browser config: cleanup after removal of Firefox extension
Action: opened
PR body:
"""
Firefox extension which served for configuring Kerberos auth in Firefox
until version which banned self-signed extensions was removed in commit
6c53765ac1746ea3cb82554775a37fe43af062e8.
Given that configure.jar, even older Firefox config tool, was removed
sometime before that, there is no use for signtool tool. It is good
because it is removed from Fedora 27 anyway. So removing last unused
function which calls it.
The removal of FF extension was not exactly clean so removing also
browserconfig.html which only purpose was to use the extension. Therefore
also related JS files are removed. This removal requires unauthorized.html
to be updated so that it doesn't point to non-existing page. And given that
it now points only to single config page, we can change link in UI login page
to this page (ssbrowser.html). While at it, improving buttons in ssbrowser.html.
Btw, commit 6c53765ac1746ea3cb82554775a37fe43af062e8 removed also generation of
krb.js. It had one perk - with that info ssbrowser.html could display real
Kerberos domain instead of only 'example.com'. I don't have time to revert this
change so removing traces of krb.js as well.
https://pagure.io/freeipa/issue/7135
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/1034/head:pr1034
git checkout pr1034
6 years, 7 months
pytest_multihost problems on f27
by Fraser Tweedale
Just a heads up that running tests on f27 is a bit of a problem
right now, due to a bug in paramiko that gets triggered when
importing pytest_multihost.transport.
Relevant upstream issues:
- https://github.com/paramiko/paramiko/issues/1069
- https://github.com/paramiko/paramiko/pull/861
A quick workaround:
--- /usr/lib/python2.7/site-packages/paramiko/ssh_gss.py.orig
+++ /usr/lib/python2.7/site-packages/paramiko/ssh_gss.py
@@ -52,7 +52,7 @@
try:
import gssapi
GSS_EXCEPTIONS = (gssapi.GSSException,)
-except (ImportError, OSError):
+except (ImportError, OSError, AttributeError):
try:
import pywintypes
import sspicon
Cheers,
Fraser
6 years, 7 months