[freeipa PR#2618][opened] ipa upgrade: handle double-encoded certificates
by flo-renaud
URL: https://github.com/freeipa/freeipa/pull/2618
Author: flo-renaud
Title: #2618: ipa upgrade: handle double-encoded certificates
Action: opened
PR body:
"""
## ipa upgrade: handle double-encoded certificates
Issue is linked to the ticket #3477 LDAP upload CA cert sometimes double-encodes the value
In old FreeIPA releases (< 3.2), the upgrade plugin was encoding twice the value of the certificate in `cn=cacert,cn=ipa,cn=etc,$BASEDN`.
The fix for 3477 is only partial as it prevents double-encoding when a new cert is uploaded but does not fix wrong values already present in LDAP.
With this commit, the code first tries to read a der cert. If it fails, it logs a debug message and re-writes the value caCertificate;binary to repair the entry.
Fixes https://pagure.io/freeipa/issue/7775
## ipatests: add upgrade test for double-encoded cacert
Create a test for upgrade with the following scenario:
- install master
- write a double-encoded cert in the entry `cn=cacert,,cn=ipa,cn=etc,$basedn` to simulate bug 7775
- call ipa-server-upgrade
- check that the upgrade fixed the value
The upgrade should finish successfully and repair the double-encoded cert.
Related to https://pagure.io/freeipa/issue/7775
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2618/head:pr2618
git checkout pr2618
5 years, 4 months
[freeipa PR#2610][opened] Fix authselect invocations to work with 1.0.2
by AdamWill
URL: https://github.com/freeipa/freeipa/pull/2610
Author: AdamWill
Title: #2610: Fix authselect invocations to work with 1.0.2
Action: opened
PR body:
"""
Since authselect 1.0.2, invoking an authselect command sequence
like this:
['authselect', 'sssd', '', '--force']
does not work: authselect barfs on the empty string arg and
errors out. We must only pass a features arg if we actually have
some text to go in it.
This broke uninstallation.
I don't know for sure whether the fix in `restore` is needed -
it may be that `cfg[1]` is never an empty sequence - but it
seems sensible to do it just in case.
Signed-off-by: Adam Williamson <awilliam(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2610/head:pr2610
git checkout pr2610
5 years, 4 months