May 2018 - FreeIPA-devel - Fedora mailing-lists

Announcing FreeIPA v4.6.90.pre2 release
by Rob Crittenden 16 May '18

16 May '18

The FreeIPA team would like to announce FreeIPA 4.6.90.pre2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 28 and rawhide will be available in the Fedora repositories. == Highlights in 4.6.90.pre2 == The major new features of this release are: * Switch from using mod_nss for the Apache TLS engine to using mod_ssl. Upgrading will move the certificates and keys from /etc/httpd/alias to /var/lib/ipa/certs/. * Switch time client and server from ntp to chrony. * Switch from using authconfig to authselect to configure the PAM stack. * Kerberos clients can now use SPAKE to strengthen their handshake with a FreeIPA KDC based on elliptic curve cryptography. See IETF draft draft-ietf-kitten-krb-spake-preauth-05 and relevant portions of krb5.conf(5) and kdc.conf(5) for details. SPAKE is enabled for new IPA servers and clients by default. * Thanks to our translation volunteers, FreeIPA 4.6.90.pre2 sees a major update for Chinese, French, Russian, and Ukrainian languages. === Known Issues === === Bug fixes === FreeIPA 4.6.90.pre2 is a preview release for the features delivered as a part of 4.7.0. There are more than 70 bug-fixes details of which can be seen ina the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 7530 external CA replica installation fails with CA_UNREACHABLE * 7529 AVC denials and errors for IPA server installed on Fedora28 * 7524 ipa-client-install fails because of missing file /usr/share/ipa/freeipa.template * 7523 external CA installation: step two reports self-signed configuration * 7520 ipa certmap-match throwing "ipa: ERROR: an internal error has occurred" * 7519 Adding SSH keys for AD users as I created overrides * 7518 Improve Custodia client and key distribution handling * 7515 ipa-advise config-server-for-smart-card-auth refers to nss.conf despite the migration to ssl.conf * 7514 Allow to create Kerberos services without a corresponding host object * 7513 Allow Kerberos services to be members of IPA groups * 7512 Missing dependency for freeipa-client: python3-augeas * 7510 validate_selinuxuser does not allow a period in selinux user identifier * 7508 Trust tests for Posix support are failing with Assertion Error None on Windows Server 2016 * 7507 ui_tests: extend test_user suite * 7505 WebUI tests: Extend netgroup tests * 7503 multiple occurrences of profileId in certprofile causes incorrect behaviour * 7499 Integration tests dns_location in regards of check NTP records failing * 7498 [F28] CA replica fails with could not find certificate named "caSigningCert cert-pki-ca" * 7496 csrgen fails if subject base contains lower-case attribute names * 7490 installutils.set_directive doesn't handle debian ssl.conf properly * 7489 Test test_caless_TestCertInstall is failing in nightly * 7488 Set nsds5ReplicaReleaseTimeout on all replicas and databases * 7486 Allow hosts to delete their own services * 7485 Extending webui user group test * 7484 Load ipaclient.csrgen on demand to speed up CLI * 7478 [F28] ipa-backup fails with "Failed to execute authconfig command" * 7474 ipa-server-install --uninstall on replica fails with "NoOptionError: No option 'ldap_uri' in section: 'global'" * 7473 ERROR: No valid Negotiate header in server response * 7470 TestBasicADTrust.test_ipauser_authentication is failing with error "Confidentiality required" * 7469 ipa-replica-prepare fail with "stat: path should be string, bytes, os.PathLike or integer, not NoneType" * 7468 test_host.py::test_host::test_crud is failing in nightly tests * 7466 [F28] Replica installs fails with CA_REJECTED caused by ACIError * 7463 test_webui: add user life-cycles tests * 7461 Hardening of topology plugin to prevent erronous deletion of a replica agreement * 7459 [RFE] replica-install: warn when only one CA exists in topology * 7458 ui_tests: extend test_hostgroup.py suite * 7456 ipa otptoken-add should use LDAP Whoami call * 7454 Upgrade from F27 to F28 produces an error while updating ipa.conf.template * 7450 "This entry already exists" error when upgrading on IPA 4.5 * 7442 Replication agreement status incorrectly checked * 7441 ui_tests: extend test_service.py suite * 7436 ipa: Please log something after restarting the KDC * 7427 User Administrator doesn't have enough privileges to edit homeDirectory attribute * 7426 DogtagInstance.backup_config creates backup with wrong owner * 7425 ipa-server-install with different IP fails on /usr/sbin/pkispawn -s CA * 7424 Improve Realm Domains doc text * 7421 Store HTTPD private keys encrypted * 7415 CA installer need to check availability of port 8080 * 7410 ipa-replica-install --add-agents option doesn't install trust-agent on replica * 7377 Investigate and define plan of authconfig replacement in FreeIPA * 7376 clear sssd cache when uninstalling client * 7366 RFE: ipa client should setup openldap for GSSAPI * 7330 ipa-server-install --uninstall does not return error code on error * 7183 /etc/gssproxy/10-ipa.conf not removed on uninstall * 7095 [tracker] please rotate & compress /var/lib/pki/pki-tomcat/logs/ca/debug * 7041 [ipa-replica-install] - KDC has no support for encryption type - reoccurence in multireplica scenario * 7024 freeipa depends on ntp * 6884 ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group * 6843 ipa-backup does not create log file at /var/log/ * 5776 webui: some data disappear from user details page after the save action is performed * 5673 contrib/nssciphersuite/nssciphersuite.py raising error in tests * 4853 Utilize system-wide crypto-policies == Detailed changelog since 4.6.90.pre1 == === Alexander Bokovoy (13) === * group: allow services as members of groups * service: allow creating services without a host to manage them * group-del: add a warning to logs when password policy could not be removed * idoverrideuser-add: allow adding ssh key in web ui * ACL: Allow hosts to remove services they manage * install: validate AD trust-related options in installers * replication: support error messages from 389-ds 1.3.5 or later * upgrade: treat duplicate entry when updating as not an error * Allow anonymous access to parentID attribute * upgrade: Run configuration upgrade under empty ccache collection * use LDAP Whoami command when creating an OTP token * Update template directory with new variables when upgrading ipa.conf.template * Processing of server roles should ignore errors.EmptyResult === Alexey Slaykovsky (1) === * Make tox tests to generate results in JUnit XML === amitkuma (5) === * RFE: ipa client should setup openldap for GSSAPI * Correcting detect typo in server.m4 * Correction of management spelling. * clear sssd cache when uninstalling client * clear sssd cache when uninstalling client === Anuja More (2) === * Adding test-cases for ipa-cacert-manage * Adding test-cases for ipa-cacert-manage === Christian Heimes (32) === * Revert "Validate the Directory Manager password" * Create missing /etc/httpd/alias for ipasession.key * Only run subset of external CA tests * Require Dogtag 10.6.1 * Require nss with fix for nickname bug * ipa-client package needs sssd-tool * Make ipatests' create_external_ca a script * Load certificate files as binary data * Remove contrib/nssciphersuite * Compatibility with pytest 3.4 * Use shutil to copy file * Use single Custodia instance in installers * Add augeas dependency to client package * Create users in server-common pre hook * Require 389-ds-base >= 1.4.0.8-1 * CA replica PKCS12 workaround for SQL NSSDB * Add nsds5ReplicaReleaseTimeout to replica config * Fix Python dependencies * Remove os.chdir() from test_ipap11helper * certdb: Move chdir into subprocess call * Provide ldap_uri in Custodia uninstaller * Defer import of ipaclient.csrgen * Require more recent glibc on F27 * Load librpm on demand for IPAVersion * Fix installer CA port check for port 8080 * Temporarily disable authconfig backup and restore * Cleanup and remove more files on uninstall * Fix compatibility with latest pytest * More cleanup after uninstall * Require Dogtag PKI >= 10.6 * Keep owner when backing up CA.cfg * Pylint 1.8.3 fixes === Felipe Barreto (10) === * Fixing tests on TestReplicaManageDel * Fixing TestCASpecificRUVs::test_replica_uninstall_deletes_ruvs * Fixing TestBackupAndRestore::test_full_backup_and_restore_with_removed_users * Adding GSSPROXY_CONF to be backed up on ipa-backup * Reverting commit 6b145bf3e696e6d40b74055ccdf8d14da7828a09 * Fix TestSubCAkeyReplication providing the right path to pki log * temp commit: adding test to PR CI run * Adding right parameters to install IPA in TestInstallMasterReservedIPasForwarder * Changing Django's CoC to reflect FreeIPA CoC * Adding Django's Code of Conduct === Florence Blanc-Renaud (8) === * authselect migration: use stable interface to query current config * authselect test: skip test if authselect is not available * ipa-advise: adapt config-client-for-smart-card-auth to authselect * Revert commit d705320ec136abc2fcf524f2b63a76d3fc0ba97a * New tests for authselect migration * Migration from authconfig to authselect * ipa-advise config-server-for-smart-card-auth: use mod-ssl * ipa-replica-install: make sure that certmonger picks the right master === Fraser Tweedale (12) === * install: fix reported external CA configuration * csrgen: fix when attribute shortname is lower case * csrgen: drive-by docstring * csrgen: support initialising OpenSSL adaptor with key object * py3: fix csrgen error handling * certprofile: add tests for config profileId scenarios * certprofile: reject config with multiple profileIds * Fix upgrade (update_replica_config) in single master mode * Add commentary about PKI admin password * Fix upgrade when named.conf does not exist * replica-install: warn when there is only one CA in topology * install: configure dogtag status request timeout === Ganna Kaihorodova (5) === * Fix trust tests for Posix Support * Fix for integration tests dns_locations * Fix in IPA's multihost fixture * TestBasicADTrust.test_ipauser_authentication * Fix for test TestInstallMasterReservedIPasForwarder === Takeshi MIZUTA (1) === * Fix some typos in man page === Michal Reznik (18) === * ui_tests: introduce new test_misc cases file * ui_driver: extension and modifications related to test_user * ui_tests: extend test_user suite * test_web_ui: extend ui_driver methods * test_webui: add user life-cycles tests * ui_tests: run ipa-get/rmkeytab command on UI host * ui_tests: select_combobox() fixes * ui_tests: test cancel and delete without button * ui_tests: make associations cancelable * ui_tests: add function to run cmd on UI host * ui_tests: add funcs to add/remove users public SSH key * ui_tests: add assert_field_required() * ui_tests: add assert_notification() * ui_tests: add more test cases * ui_tests: add more test cases to test_certification * ui_tests: add_service() support func in test_service * ui_tests: add_host() support func in test_service * ui_tests: change get_http_pkey() function === Varun Mylaraiah (3) === * WebUI tests: Extend netgroup tests with more scenarios * Fixed improper clean-up in test_host::test_kerberos_flags added closing the notification in kerberos flags * WebUI tests: Extend user group tests with more scenarios === Pavel Picka (1) === * WebUI Hostgroups tests cases added === Petr Vobornik (4) === * webui: refresh complex pages after modification * Fix order of commands in test for removing topology segments * webui tests: fix test_host:test_crud failure * realm domains: improve doc text === Rob Crittenden (16) === * Fix certificate retrieval in ipa-replica-prepare for DL0 * Disable message about log in ipa-backup if IPA is not configured * Use a regex in installutils.get_directive instead of line splitting * Handle whitespace, add separator to regex in set_directive_lines * Validate the Directory Manager password before starting restore * Log service start/stop/restart message * Update project metadata in ipasetup.py.in * Allow dot as a valid character in an selinux identity name * Remove xfail from CALes test test_http_intermediate_ca * Some PKCS#12 errors are reported with full path names * ipa-server-certinstall failing, unknown option realm * Revert run_pk12util part of 807a5cbe7cc52690336c5095ec6aeeb0a4e8483c * Break out of teardown in test_replica_promotion.py if no config * Remove the Continuous installer class, it is unused * Return a value if exceptions are raised in server uninstall * VERSION.m4: Set back to git snapshot === Robbie Harwood (2) === * Move krb5 snippet into freeipa-client-common * Enable SPAKE support using krb5.conf.d snippet === Stanislav Laznicka (11) === * Allow user administrator to change user homedir * mod_ssl: add SSLVerifyDepth for external CA installs * Add absolute_import to test_authselect * Fix typo in ipa-getkeytab --help * Add absolute_import future imports * replica-install: pass --ip-address to client install * ipa_backup: Backup the password to HTTPD priv key * Fix upgrading of FreeIPA HTTPD * Remove py35 env from tox testing * Encrypt httpd key stored on disk * Dogtag configs: rename deprecated options === Thierry Bordaz (1) === * Hardening of topology plugin to prevent erronous deletion of a replica agreement === Tibor Dudlák (14) === * Use temporary pid file for chronyd -q task * Fix format string passed to pytest-multihost * Configure chrony with pool when server not set * Add enabling chrony daemon when not configured * Remove unnecessary option --force-chrony * Remove NTP server role while upgrading * Removes NTP server role from servroles and description * Update man pages for FreeIPA client, replica and server install * Adding method to ipa-server-upgrade to cleanup ntpd * Add --ntp-pool option to installers * FreeIPA server is time synchronization client only * Replace ntpd with chronyd in installation * Add dependency and paths for chrony * Removes ntp from dependencies and behave as there is always -N option

1 0

[freeipa PR#1924][opened] tests: Fix on test_sudo_rule_restricted_to_one_hostmask_negative
by celestian 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/1924 Author: celestian Title: #1924: tests: Fix on test_sudo_rule_restricted_to_one_hostmask_negative Action: opened PR body: """ The error message was changed. This patch fix the test to current situation. https://pagure.io/freeipa/issue/7543 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1924/head:pr1924 git checkout pr1924

1 1

[freeipa PR#1913][opened] Fix test_server_del::TestLastServices
by pvoborni 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/1913 Author: pvoborni Title: #1913: Fix test_server_del::TestLastServices Action: opened PR body: """ this is just a quick check of theory outlined in PR #1809 Commit details: The reason why the test started to fail is probably commit be3ad1e where the checks were reordered. TestLastServices relies on execution of tests in a specific order. So it fails given that checks were changed but tests weren't. Given that master is installed with DNS and CA and replica with anything and given that checks in server-del command are in order: DNS, DNSSec, CA, KRA then the test should be something like: * install master (with DNS, CA) * install replica * test test_removal_of_master_raises_error_about_last_dns * test_install_dns_on_replica1_and_dnssec_on_master (installing DNS and DNSSec will allow DNSSec check) * test_removal_of_master_raises_error_about_dnssec * test_install_dnssec_on_replica (will allow CA check) * test_removal_of_master_raises_error_about_last_ca * test_forced_removal_of_master https://pagure.io/freeipa/issue/7517 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1913/head:pr1913 git checkout pr1913

2 1

[freeipa PR#1926][opened] Update 4.7 translations
by rcritten 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/1926 Author: rcritten Title: #1926: Update 4.7 translations Action: opened PR body: """ Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1926/head:pr1926 git checkout pr1926

1 1

Candidate PRs to close
by Rob Crittenden 16 May '18

16 May '18

There are a lot of old, outdated PRs. I think we need to close them and strive hard to keep the list of PRs very low so for this round, against my usual instincts, I propose we act on the harsher side. Note that I did __not__ review the patches in detail, I'm mostly look at at last touch and relevance. If we don't close them outright then some pushing on the contributor will be needed including a timeframe to respond. I think that for any closed PRs we attach a copy of the patches to the associated ticket (and mention the remote branch) so we don't lose anything. Here is my list of PRs to close and the reasoning: https://github.com/freeipa/freeipa/pull/1793 - needs rebase (2 weeks), failing test needs investigation. https://github.com/freeipa/freeipa/pull/1559 appears to be a duplicate of this. https://github.com/freeipa/freeipa/pull/1809 - Needs response to reviewers, including, and most importantly, showing that the test succeeds by a temporary patch to execute it. https://github.com/freeipa/freeipa/pull/1724 - There is confusion over what branch this needs to land in. https://github.com/freeipa/freeipa/pull/1650 - Doesn't seem to have agreement that this is needed https://github.com/freeipa/freeipa/pull/1563 - Was a good, forwarding-looking change but given William's departure are we likely to see this fixed anytime soon? https://github.com/freeipa/freeipa/pull/1515 - been waiting weeks for contributor to address comments of reviewer https://github.com/freeipa/freeipa/pull/1460 - been waiting months for contributor to address comments of reviewers https://github.com/freeipa/freeipa/pull/1430 - been waiting weeks for reviewer comments to be addressed https://github.com/freeipa/freeipa/pull/1421 - still waiting on contributor to update https://github.com/freeipa/freeipa/pull/1378 - been waiting months for contributor to address comments of reviewers https://github.com/freeipa/freeipa/pull/1353 - WIP patch. Is it still needed? https://github.com/freeipa/freeipa/pull/1188 - been waiting months for rebase https://github.com/freeipa/freeipa/pull/920 - reviewer restarted work a month ago, do we want to keep this open? What to do with the 2 postponed PRs? Will we ever get to them? https://github.com/freeipa/freeipa/pull/717 - I don't think we will ever finish this https://github.com/freeipa/freeipa/pull/433 - same as above And then there are these two which are planned changes that have been lost to the depths of time: https://github.com/freeipa/freeipa/pull/117 - What is the priority of this? It is in the 4.7 milestone. https://github.com/freeipa/freeipa/pull/23 - What to do with this, it was planned for 4.5? Does it need coordination with SSSD to do the time enforcement? rob

5 6

[freeipa PR#117][closed] Make ipa-replica-install run in interactive mode
by rcritten 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/117 Author: stlaz Title: #117: Make ipa-replica-install run in interactive mode Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/117/head:pr117 git checkout pr117

1 0

[freeipa PR#433][closed] csrgen: Allow some certificate fields to be specified by the user
by rcritten 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/433 Author: LiptonB Title: #433: csrgen: Allow some certificate fields to be specified by the user Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/433/head:pr433 git checkout pr433

1 0

[freeipa PR#717][closed] csrgen: Finish NSS support
by rcritten 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/717 Author: LiptonB Title: #717: csrgen: Finish NSS support Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/717/head:pr717 git checkout pr717

1 0

[freeipa PR#920][opened] fix ods-ksmutil for 2.0.x
by tduehr 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/920 Author: tduehr Title: #920: fix ods-ksmutil for 2.0.x Action: opened PR body: """ It became ods-enforcer and its behavior changed. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/920/head:pr920 git checkout pr920

2 3

[freeipa PR#1188][closed] ipatests: SSSD Subdomain RFE automation
by rcritten 16 May '18

16 May '18

URL: https://github.com/freeipa/freeipa/pull/1188 Author: Akasurde Title: #1188: ipatests: SSSD Subdomain RFE automation Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1188/head:pr1188 git checkout pr1188

1 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel May 2018