URL: https://github.com/freeipa/freeipa/pull/3275
Author: marcus2376
Title: #3275: Issue 7975 - Accept 389-ds JSON replication status messages
Action: opened
PR body:
"""
Description:
389-ds now stores a replication agreement status message in a JSON string in a new attribute:
replicaLastInitStatusJSON
replicaLastUpdateStatusJSON
The original status attributes' values are not changing at this time, but there are plans to do so eventually as the old status format is confusing.
http://www.port389.org/docs/389ds/design/repl-agmt-status-design.htmlhttps://pagure.io/freeipa/issue/7975
Reviewed by: ?
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3275/head:pr3275
git checkout pr3275
URL: https://github.com/freeipa/freeipa/pull/3774
Author: stanislavlevin
Title: #3774: [DNSSEC] WIP Allow using of a custom OpenSSL engine for BIND
Action: opened
PR body:
"""
For now Debian, Fedora, RHEL, etc. build BIND with 'native PKCS11'
support. Till recently, that was the strict requirement of DNSSEC.
The problem is that this restricts cross-platform features of FreeIPA.
With the help of libp11, which provides `pkcs11` engine plugin for
the OpenSSL library for accessing PKCS11 modules in a semi-
transparent way, FreeIPA could utilize OpenSSL version of BIND.
BIND in turn provides ability to specify the OpenSSL engine on the
command line of `named` and all the BIND `dnssec-*` tools by using
the `-E engine_name`.
Currently, this PR implements just an abstract ability.
Actual configuration and tests results could be seen in my fork Azure Pipelines:
https://dev.azure.com/slev0400/slev/_build/results?buildId=627&view=logs&j=…https://dev.azure.com/slev0400/slev/_build/results?buildId=627&view=logs&j=…
Related: https://pagure.io/freeipa/issue/8094
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3774/head:pr3774
git checkout pr3774
URL: https://github.com/freeipa/freeipa/pull/3544
Author: mulatinho
Title: #3544: [WIP] ipa-join: allowing call with jsonrpc into freeipa API
Action: opened
PR body:
"""
- Adding JSON-C and LibCURL library into configure.ac and Makefile.am
- Creating a API call with option '-j' or '--jsonrpc' to make host join on FreeIPA with JSONRPC and libCURL.
TODO: unenroll process with JSONRPC.
To test the call:
# kinit admin
# ipa-join -s server.freeipa.ipadomain -j
Debug:
# ipa-join -s server.freeipa.ipadomain -j -d
Related: https://pagure.io/freeipa/issue/7966
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3544/head:pr3544
git checkout pr3544
URL: https://github.com/freeipa/freeipa/pull/2106
Author: abbra
Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
Action: opened
PR body:
"""
Password changes performed by cn=Directory Manager are excluded from
password policy checks according to [1]. This is correctly handled by
ipa-pwd-extop in case of a normal Kerberos principal in IPA. However,
non-kerberos accounts were not excluded from the check.
As result, password updates for PKI CA admin account in o=ipaca were
failing if a password policy does not allow a password reuse. We are
re-setting the password for PKI CA admin in ipa-replica-prepare in case
the original directory manager's password was updated since creation of
`cacert.p12`.
Do password policy check for non-Kerberos accounts only if it was set by
a regular user or admin. Changes performed by a cn=Directory Manager and
passsync managers should be excluded from the policy check.
Fixes: https://pagure.io/freeipa/issue/7181
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
[1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h…
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2106/head:pr2106
git checkout pr2106
URL: https://github.com/freeipa/freeipa/pull/3509
Author: frasertweedale
Title: #3509: [Backport][ipa-4-7] Profile-based system cert renewal
Action: opened
PR body:
"""
Manual backport of #3316 to ipa-4-7. We
may need to backport this change all the way to ipa-4-6 to allow us to change
the IPA RA certificate profile on older releases.
See also https://github.com/freeipa/freeipa/pull/3508 which is the ipa-4-7 backport PR.
There were some trivial conflicts. There were substantive conflicts for two patches,
but these were due to the switch from mod_nss to mod_ssl, and from NSSDB-based
IPA RA cert to PEM files. Those patches were not relevant, and were dropped.
https://pagure.io/freeipa/issue/7991
Do not rely on CI only; I will have to test this change myself so I'll add WIP
label, and remove it when I'm satisfied.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3509/head:pr3509
git checkout pr3509
URL: https://github.com/freeipa/freeipa/pull/3508
Author: frasertweedale
Title: #3508: [Backport][ipa-4-7] Profile-based system cert renewal
Action: opened
PR body:
"""
Manual backport of https://github.com/freeipa/freeipa/pull/3316 to ipa-4-7. We
may need to backport this change all the way to ipa-4-6 to allow us to change
the IPA RA certificate profile on older releases. Currently this change is on
master and ipa-4-8, so ipa-4-7 is the next step.
There were some trivial conflicts. The only substantive conflicts were in
`dogtaginstance.py`. These were resolved by cherry-picking
8686cd3b4b69f725aee05c9cdd3034d7436055d3 ahead of the original patchset.
https://pagure.io/freeipa/issue/7991
Do not rely on CI only; I will have to test this change myself so I'll add WIP
label, and remove it when I'm satisfied.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3508/head:pr3508
git checkout pr3508
URL: https://github.com/freeipa/freeipa/pull/3783
Author: stanislavlevin
Title: #3783: Migrate xunit-style setups to fixtures
Action: opened
PR body:
"""
This converts `setup*`/`teardown*` functions/methods to the
powerfull pytest fixtures:
```
The purpose of test fixtures is to provide a fixed baseline upon
which tests can reliably and repeatedly execute. pytest fixtures
offer dramatic improvements over the classic xUnit style of
setup/teardown functions:
- fixtures have explicit names and are activated by declaring their
use from test functions, modules, classes or whole projects.
- fixtures are implemented in a modular manner, as each fixture name
triggers a fixture function which can itself use other fixtures.
- fixture management scales from simple unit to complex functional
testing, allowing to parametrize fixtures and tests according to
configuration and component options, or to re-use fixtures across
function, class, module or whole test session scopes.
```
One of the transition patterns is as follows:
```diff
class TestFooBar(XMLRPC_test):
- @classmethod
- def setup_class(cls):
- super(TestFooBar, cls).setup_class()
+ @pytest.fixture(autouse=True, scope="class")
+ def foo_bar_setup(self, request, xmlrpc_setup):
+ cls = request.cls
cls.beforemethod()
- @classmethod
- def teardown_class(cls):
- cls.aftermethod()
- super(TestFooBar, cls).teardown_class()
+ def fin():
+ cls.aftermethod()
+ request.addfinalizer(fin)
```
To achieve predictable results for initialization and destroy of
Pytest fixtures, ones have to employ the fixtures' interdependencies.
This is the first part of the work to remove the mixing of test idioms in the
IPA test suite.
Related: https://pagure.io/freeipa/issue/7989
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3783/head:pr3783
git checkout pr3783
URL: https://github.com/freeipa/freeipa/pull/3349
Author: amore17
Title: #3349: ipatests: filter_users should be applied correctly if SSSD starts offline
Action: opened
PR body:
"""
Added tests which validates that filter_users is applied correctly
when SSSD starts in offline mode, which checks that no look up
should be in data provider and NCE/USER/ipa_domain/user should be
added to negative cache.
Related Tickets:
https://pagure.io/SSSD/sssd/issue/3983https://pagure.io/SSSD/sssd/issue/3978
Signed-off-by: Anuja More <amore(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3349/head:pr3349
git checkout pr3349
URL: https://github.com/freeipa/freeipa/pull/3811
Author: amore17
Title: #3811: ipatests: 'sss_ssh_authorizedkeys user' should return ssh key
Action: opened
PR body:
"""
Added regression tests which validates that when there is ssh key and certificate is added for IPA user then 'sss_ssh_authorizedkeys user' should return ssh key.
Related Ticket:
https://pagure.io/SSSD/sssd/issue/3937
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3811/head:pr3811
git checkout pr3811
URL: https://github.com/freeipa/freeipa/pull/3183
Author: tiran
Title: #3183: Require a SASL SSF of >= 56 on client side
Action: opened
PR body:
"""
SSF_MINX 56 level ensures data integrity and confidentiality for SASL
GSSAPI and SASL GSS SPNEGO connections. Although at least AES128 is enforced
pretty much everywhere, 56 is required.
The origianl commit 350954589774499d99bf87cb5631c664bb0707c4 added minimum
SSF on LDAP client and LDAP server. Some LDAP consumers like realmd are
not compatible with strong SSF yet.
Related: https://pagure.io/freeipa/issue/7140
Related: https://pagure.io/freeipa/issue/4580
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3183/head:pr3183
git checkout pr3183
URL: https://github.com/freeipa/freeipa/pull/2812
Author: tiran
Title: #2812: Require secure-binds for password login
Action: opened
PR body:
"""
nsslapd-require-secure-binds restricts password based simple binds to
secure connections. It does not prevent a careless user from
transmitting a password in plain text. But it makes it obvious that he
did something bad. Password based bind attempts over an insecure
connections are refused with:
Confidentiality required: Operation requires a secure connection
Secure connections are:
* LDAP connections on port 389 with STARTTLS
* LDAPS connections in port 636
* LDAPI connections to a local Unix sockets
Anonymous bind (simple_bind with empty DN and password) and GSSAPI
bind operations are not affected.
nsslapd-require-secure-binds is enabled after 389-DS is configured for
TLS/SSL.
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
**NOTE** The change may cause compatibility issues with applications that don't perform secure binds.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2812/head:pr2812
git checkout pr2812
URL: https://github.com/freeipa/freeipa/pull/3672
Author: simo5
Title: #3672: Make sure to have storage space for tag
Action: opened
PR body:
"""
ber_scanf expects a pointer to a ber_tag_t to return the tag pointed at
by "t", if that is not provided the pointer will be store in whatever
memory location is pointed by the stack at that time causeing a crash.
Note that this is effectively unused code because in ipa-kdb the only
party that can write a key_data structure to be stored is te kdb_driver
itself and we never encode these s2kparam data.
But we need to handle this for future proofing.
Fixes #8071
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3672/head:pr3672
git checkout pr3672
URL: https://github.com/freeipa/freeipa/pull/3039
Author: tiran
Title: #3039: Add temporary directory manager
Action: opened
PR body:
"""
The temporary directory manager simplifies the handling of temporary
files that are shared with other processes or kept through out the life
time of the current process. It should only be used in case
tempfile.NamedTemporaryFile is not up for the task.
The manager creates a new temporary directory for each user. The
directory and all its files are accessible by the target user and the
root group ($uid:root / 0o770 / 0o660) to avoid DAC override capability.
The temporary directory is automatically removed on process exit.
Related: https://pagure.io/freeipa/issue/7911
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3039/head:pr3039
git checkout pr3039
URL: https://github.com/freeipa/freeipa/pull/3102
Author: tiran
Title: #3102: Workaround for AJP to bind on IPv6 localhost
Action: opened
PR body:
"""
Tomcat's AJP connector binds to IPv4 localhost only. This causes issues
with IPv6-only environment. The installer now detects if localhost6 is
available and working, then configures Dogtag's Tomcat to use
localhost6.
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3102/head:pr3102
git checkout pr3102
URL: https://github.com/freeipa/freeipa/pull/3826
Author: rcritten
Title: #3826: conditionally restart certmonger during ipa-client-install
Action: opened
PR body:
"""
Conditionally restart certmonger after client installation
If certmonger is running prior to client installation then its
IPA CA configuration will be incomplete and missing the CA chain.
If a certificate is subsequently requested with -F to store the
CA chain in a file or NSS db it may not be available yet. A
conditional restart of certmonger will pick up the new IPA
configuration and complete the IPA CA configuration in certmonger.
A pure restart and service activation is not done since certmonger
is not required unless --request-cert was passed ipa-client-install.
https://pagure.io/freeipa/issue/8105
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3826/head:pr3826
git checkout pr3826
URL: https://github.com/freeipa/freeipa/pull/3835
Author: frozencemetery
Title: #3835: Provide modern example enctypes in ipa-getkeytab(1)
Action: opened
PR body:
"""
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3835/head:pr3835
git checkout pr3835
URL: https://github.com/freeipa/freeipa/pull/3823
Author: olsonse
Title: #3823: Fixes debian path for IPA_CUSTODIA_HANDLER
Action: opened
PR body:
"""
Debian installs into a different directory for libexec files. This patch
fixes the path to the custodia files for debian.
Signed-off-by: Spencer E. Olson <olsonse(a)umich.edu>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3823/head:pr3823
git checkout pr3823
URL: https://github.com/freeipa/freeipa/pull/3815
Author: stanislavlevin
Title: #3815: Pylint 243
Action: opened
PR body:
"""
New Pylint (2.4.3) catches several new 'true problems'. At the same
time, it warns about things that are massively and reasonably
employed in FreeIPA.
list of fixed:
- no-else-continue
- redeclared-assigned-name
- no-else-break
- unnecessary-comprehension
- using-constant-test (false positive)
list of ignored (responsibility of contributors and reviewers):
- import-outside-toplevel
Fixes: https://pagure.io/freeipa/issue/8102
Signed-off-by: Stanislav Levin <slev(a)altlinux.org>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3815/head:pr3815
git checkout pr3815
URL: https://github.com/freeipa/freeipa/pull/3810
Author: netoarmando
Title: #3810: [ipa-4-7] prci: increase timeout argument for test_sssd.py
Action: opened
PR body:
"""
Follow-up for commit a4ca34261a55af96e3428822f08f8b2292e6234a.
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after freeipa/freeipa-pr-ci@380c8b8.
This takes time, some jobs are killed during test execution, so this
adds 20 minutes more to `test_sssd.py` test suite.
This also adds a missing but available topologies to `temp_commit.yaml`.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3810/head:pr3810
git checkout pr3810
URL: https://github.com/freeipa/freeipa/pull/3809
Author: netoarmando
Title: #3809: [ipa-4-8] prci: increase timeout argument for test_sssd.py
Action: opened
PR body:
"""
Follow-up for commit a4ca34261a55af96e3428822f08f8b2292e6234a.
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after freeipa/freeipa-pr-ci@380c8b8.
This takes time, some jobs are killed during test execution, so this
adds 20 minutes more to `test_sssd.py` test suite.
This also adds a missing but available topology to `temp_commit.yaml`.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3809/head:pr3809
git checkout pr3809
URL: https://github.com/freeipa/freeipa/pull/3808
Author: netoarmando
Title: #3808: prci: increase timeout argument for test_sssd.py
Action: opened
PR body:
"""
Follow-up for commit a4ca34261a55af96e3428822f08f8b2292e6234a.
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after freeipa/freeipa-pr-ci@380c8b8.
This takes time, some jobs are killed during test execution, so this
adds 20 minutes more to test_sssd.py test suite.
This also adds a missing but available topology to `temp_commit.yaml`.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3808/head:pr3808
git checkout pr3808
URL: https://github.com/freeipa/freeipa/pull/3776
Author: tiran
Title: #3776: [Backport][ipa-4-8] Don't install a preexec_fn by default
Action: opened
PR body:
"""
This PR was opened automatically because PR #3769 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3776/head:pr3776
git checkout pr3776
URL: https://github.com/freeipa/freeipa/pull/3800
Author: flo-renaud
Title: #3800: [Backport][ipa-4-8] Restore running of 'test_ipaserver' tests on Azure
Action: opened
PR body:
"""
This PR was opened automatically because PR #3784 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3800/head:pr3800
git checkout pr3800
URL: https://github.com/freeipa/freeipa/pull/3801
Author: flo-renaud
Title: #3801: [Backport][ipa-4-6] ipa-backup: fix python2 issue with os.mkdir
Action: opened
PR body:
"""
This PR was opened automatically because PR #3794 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3801/head:pr3801
git checkout pr3801
URL: https://github.com/freeipa/freeipa/pull/3802
Author: flo-renaud
Title: #3802: [Backport][ipa-4-7] ipa-backup: fix python2 issue with os.mkdir
Action: opened
PR body:
"""
This PR was opened automatically because PR #3794 was pushed to master and backport to ipa-4-7 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3802/head:pr3802
git checkout pr3802
URL: https://github.com/freeipa/freeipa/pull/3803
Author: flo-renaud
Title: #3803: [Backport][ipa-4-8] ipa-backup: fix python2 issue with os.mkdir
Action: opened
PR body:
"""
This PR was opened automatically because PR #3794 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3803/head:pr3803
git checkout pr3803
URL: https://github.com/freeipa/freeipa/pull/3797
Author: flo-renaud
Title: #3797: [Backport][ipa-4-6] ipa-server-certinstall manpage: add missing options
Action: opened
PR body:
"""
This PR was opened automatically because PR #3790 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3797/head:pr3797
git checkout pr3797
URL: https://github.com/freeipa/freeipa/pull/3799
Author: flo-renaud
Title: #3799: [Backport][ipa-4-7] ipa-server-certinstall manpage: add missing options
Action: opened
PR body:
"""
This PR was opened automatically because PR #3790 was pushed to master and backport to ipa-4-7 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3799/head:pr3799
git checkout pr3799
URL: https://github.com/freeipa/freeipa/pull/3798
Author: flo-renaud
Title: #3798: [Backport][ipa-4-8] ipa-server-certinstall manpage: add missing options
Action: opened
PR body:
"""
This PR was opened automatically because PR #3790 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3798/head:pr3798
git checkout pr3798
URL: https://github.com/freeipa/freeipa/pull/3794
Author: flo-renaud
Title: #3794: ipa-backup: fix python2 issue with os.mkdir
Action: opened
PR body:
"""
Python2 and python3 have different interfaces for os.mkdir:
python2: os.mkdir(path[, mode])
python3: os.mkdir(path, mode=0o777, *, dir_fd=None)
ipa-backup is using the python3 format, which breaks deployments using
python2. The fix consists in using os.mkdir(path, 0o700) instead of
os.mkdir(path, mode=0o700).
Fixes: https://pagure.io/freeipa/issue/8099
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3794/head:pr3794
git checkout pr3794
URL: https://github.com/freeipa/freeipa/pull/3793
Author: fcami
Title: #3793: [Backport][ipa-4-8] ipatests: temporarily remove test_smb from gating
Action: opened
PR body:
"""
This PR was opened automatically because PR #3792 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3793/head:pr3793
git checkout pr3793
URL: https://github.com/freeipa/freeipa/pull/3764
Author: frasertweedale
Title: #3764: krainstance: set correct issuer DN in uid=ipakra entry
Action: opened
PR body:
"""
If IPA CA has custom subject DN (not "CN=Certificate
Authority,{subject_base}"), the uid=ipakra people entry gets an
incorrect 'description' attribute. The issuer DN in the
'description' attribute is based on the aforementioned pattern,
instead of the actual IPA CA subject DN.
Update KRAInstance.configure_instance() to require the CA subject DN
argument. Update ipaserver.install.kra.install() to pass the CA
subject DN.
Fixes: https://pagure.io/freeipa/issue/8084
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3764/head:pr3764
git checkout pr3764
URL: https://github.com/freeipa/freeipa/pull/3790
Author: flo-renaud
Title: #3790: ipa-server-certinstall manpage: add missing options
Action: opened
PR body:
"""
Some options were not documented in the man page:
--version
-h, --help
-p DIRMAN_PASSWD (but the long name --dirman-password is in the man page)
-v, --verbose
-q, --quiet
--log-file=FILE
Fixes: https://pagure.io/freeipa/issue/8086
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3790/head:pr3790
git checkout pr3790
Hi list,
we'll be migrating a FreeIPA wiki and planet to a different OpenShift.
With that FreeIPA PR-CI dashboard which is currently running at URL
https://pr-ci-dashboard-freeipa.b9ad.pro-us-east-1.openshiftapps.com
will be migrated as well.
The DNS name of the dashboard is not nice and it will change with the
migration (doesn't apply for wiki and planet). Thus it is a good
opportunity to get a proper DNS name for the PR-CI dashboard.
I'd be for choosing something short which is easy to type e.g.:
ci.freeipa.org
Writing this mail to get other suggestions if this one is not good or
+1 to the above.
Ideally, I'd like to close the discussion at the end of the week to
make the changes happen.
Thank you
--
Petr Vobornik
URL: https://github.com/freeipa/freeipa/pull/3788
Author: fcami
Title: #3788: [Backport][ipa-4-8] ipa_client_automount.py: fix typo (idmap.conf => idmapd.conf)
Action: opened
PR body:
"""
This PR was opened automatically because PR #3781 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3788/head:pr3788
git checkout pr3788
URL: https://github.com/freeipa/freeipa/pull/3792
Author: fcami
Title: #3792: ipatests: temporarily remove test_smb from gating
Action: opened
PR body:
"""
test_smb is now failing in a repeatable way due to CI infrastructure
issues. Temporarily remove it until this is fixed.
Signed-off-by: François Cami <fcami(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3792/head:pr3792
git checkout pr3792
URL: https://github.com/freeipa/freeipa/pull/3773
Author: mrizwan93
Title: #3773: [backport][ipa-4-6] Installation of replica against a specific server
Action: opened
PR body:
"""
Test to check replica install against specific server. It uses master and
replica1 without CA and having custodia service stopped. Then try to
install replica2 from replica1 and expect it to get fail as specified server
is not providing all the services.
related ticket: https://pagure.io/freeipa/issue/7566
Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
Reviewed-By: Rob Crittenden <rcritten(a)redhat.com>
Conflicts:
ipatests/test_integration/test_installation.py
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3773/head:pr3773
git checkout pr3773
URL: https://github.com/freeipa/freeipa/pull/3781
Author: fcami
Title: #3781: ipa_client_automount.py: fix typo (idmap.conf => idmapd.conf)
Action: opened
PR body:
"""
660c49 introduced --idmap-domain which sets the Domain option in
idmapd.conf. However the help message for that knob mentioned
idmap.conf which is wrong. Fix that.
Reported by Marc Muehlfeld <mmuehlfe(a)redhat.com>.
Signed-off-by: François Cami <fcami(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3781/head:pr3781
git checkout pr3781
URL: https://github.com/freeipa/freeipa/pull/3772
Author: mrizwan93
Title: #3772: [backport][ipa-4-7] Installation of replica against a specific server
Action: opened
PR body:
"""
Test to check replica install against specific server. It uses master and
replica1 without CA and having custodia service stopped. Then try to
install replica2 from replica1 and expect it to get fail as specified server
is not providing all the services.
related ticket: https://pagure.io/freeipa/issue/7566
Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
Reviewed-By: Rob Crittenden <rcritten(a)redhat.com>
Conflicts:
ipatests/test_integration/test_installation.py
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3772/head:pr3772
git checkout pr3772
URL: https://github.com/freeipa/freeipa/pull/3771
Author: mrizwan93
Title: #3771: [backport] [ipa-4-8] Installation of replica against a specific server
Action: opened
PR body:
"""
Test to check replica install against specific server. It uses master and
replica1 without CA and having custodia service stopped. Then try to
install replica2 from replica1 and expect it to get fail as specified server
is not providing all the services.
related ticket: https://pagure.io/freeipa/issue/7566
Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com>
Reviewed-By: Rob Crittenden <rcritten(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3771/head:pr3771
git checkout pr3771
URL: https://github.com/freeipa/freeipa/pull/3777
Author: wladich
Title: #3777: [Backport][ipa-4-8] ipatests: fix DNS forwarders setup for AD trust tests with non-root domains
Action: opened
PR body:
"""
This is a manual backport of #3765
The tests are failing to establish trust with AD subdomain and tree domain
controllers. This happens because IPA server needs to contact root domain
controller to fetch domain-wide UPN suffixes but can not do it because we
setup DNS forwarding only for the domains with which we try to establish
trust.
To establish trust with AD subdomain we now setup forwarder for root AD
domain, and to establish trust with AD treedomain -- two forwarders:
one for root domain and another one for treedomain.
Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3777/head:pr3777
git checkout pr3777
URL: https://github.com/freeipa/freeipa/pull/3757
Author: rcritten
Title: #3757: [Backport][ipa-4-6] ipatests: File ownership and permission for dirsrv log instance after restore
Action: opened
PR body:
"""
This PR was opened automatically because PR #3732 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3757/head:pr3757
git checkout pr3757
URL: https://github.com/freeipa/freeipa/pull/3756
Author: rcritten
Title: #3756: [Backport][ipa-4-7] ipatests: File ownership and permission for dirsrv log instance after restore
Action: opened
PR body:
"""
This PR was opened automatically because PR #3732 was pushed to master and backport to ipa-4-7 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3756/head:pr3756
git checkout pr3756
URL: https://github.com/freeipa/freeipa/pull/3779
Author: wladich
Title: #3779: [Backport][ipa-4-7] ipatests: fix DNS forwarders setup for AD trust tests with non-root domains
Action: opened
PR body:
"""
This is a manual backport of #3765
The tests are failing to establish trust with AD subdomain and tree domain
controllers. This happens because IPA server needs to contact root domain
controller to fetch domain-wide UPN suffixes but can not do it because we
setup DNS forwarding only for the domains with which we try to establish
trust.
To establish trust with AD subdomain we now setup forwarder for root AD
domain, and to establish trust with AD treedomain -- two forwarders:
one for root domain and another one for treedomain.
Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3779/head:pr3779
git checkout pr3779
URL: https://github.com/freeipa/freeipa/pull/3778
Author: wladich
Title: #3778: [Backport][ipa-4-7] ipatests: fix DNS forwarders setup for AD trust tests with non-root domains
Action: opened
PR body:
"""
This is a manual backport of #3765
The tests are failing to establish trust with AD subdomain and tree domain
controllers. This happens because IPA server needs to contact root domain
controller to fetch domain-wide UPN suffixes but can not do it because we
setup DNS forwarding only for the domains with which we try to establish
trust.
To establish trust with AD subdomain we now setup forwarder for root AD
domain, and to establish trust with AD treedomain -- two forwarders:
one for root domain and another one for treedomain.
Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3778/head:pr3778
git checkout pr3778
URL: https://github.com/freeipa/freeipa/pull/3765
Author: wladich
Title: #3765: ipatests: fix DNS forwarders setup for AD trust tests with non-root domains
Action: opened
PR body:
"""
The tests are failing to establish trust with AD subdomain and tree domain
controllers. This happens because IPA server needs to contact root domain
controller to fetch domain-wide UPN suffixes but can not do it because we
setup DNS forwarding only for the domains with which we try to establish
trust.
To establish trust with AD subdomain we now setup forwarder for root AD
domain, and to establish trust with AD treedomain -- two forwarders:
one for root domain and another one for treedomain.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3765/head:pr3765
git checkout pr3765
URL: https://github.com/freeipa/freeipa/pull/3769
Author: tiran
Title: #3769: Don't install a preexec_fn by default
Action: opened
PR body:
"""
ipautil.run() now only installs a preexec_fn when it is actually needed.
This addresses a compatibility issue with mod_wsgi subinterpreters under
Python 3.8.
See: https://bugs.python.org/issue37951
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3769/head:pr3769
git checkout pr3769
URL: https://github.com/freeipa/freeipa/pull/3767
Author: rcritten
Title: #3767: [Backport][ipa-4-8] Modify the way replication timeout is handled, logged
Action: opened
PR body:
"""
This PR was opened automatically because PR #3374 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3767/head:pr3767
git checkout pr3767
URL: https://github.com/freeipa/freeipa/pull/2331
Author: mrizwan93
Title: #2331: Installation of replica against a specific server
Action: opened
PR body:
"""
Test to check replica install against specific server. It uses master and
replica1 without CA and having custodia service stopped. Then try to
install replica2 from replica1 so that replica2 will fetch secrets from
master as custodia service is not running on replica1.
related ticket: https://pagure.io/freeipa/issue/7566
Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2331/head:pr2331
git checkout pr2331
Hello,
we got to a point when we have Travis CI tests pass both with FreeIPA
containers under docker, and under podman:
https://travis-ci.org/freeipa/freeipa-container/branches
I'm now trying to decide which setup we should run in CI going
forward.
Each test takes about 30 minutes and while we run 8 of them lately,
at least two more are turned off (rawhide due to
https://bugzilla.redhat.com/show_bug.cgi?id=1747901 and read-write
Fedora 30 due to https://bugzilla.redhat.com/show_bug.cgi?id=1755643)
and we will want to add CentOS 8 to the mix once the base container
images are out. So we are close to a dozen of tests. We run
internal + external CA at least for one stable Fedora release, and
I like to keep the read-write setup in the mix if possible, as it
allows us to find new stuff that should go to persistent storage
with docker diff (which would obviously not work on read-only container).
Multiplying that by two, testing both docker and podman, does not
seem practical.
We could save some time by running tests/run-master-and-replica.sh
first and only running tests/run-partial-tests.sh when the first one
fails. On the other hand, we currently do not run cross version
upgrades in CI, we just force the upgrade code path but with the
same image. So if we added that, we'd increase the needed runtime
again.
Docker seems dead on Fedoras as the moby-engine's maintenance stopped
in the middle of July:
https://bugzilla.redhat.com/buglist.cgi?classification=Fedora&component=mob…
On the other hand, judging by the issues that we've seen reported,
people run the FreeIPA server containers on other OSes and there
dockers in various versions are still more common than podman.
We could save on the running time by moving some of the tests
to other CI like CircleCI but I like having overview of all CI tests
on one place, and another CI system would break that. On the other
hand, for ARM we will likely need to add Shippable to the mix anyway.
I'd appreciate your opinions and suggestions about testing the
FreeIPA container upstream going forward.
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat
URL: https://github.com/freeipa/freeipa/pull/3760
Author: netoarmando
Title: #3760: [ipa-4-8] prci: increase timeout for jobs that required AD
Action: opened
PR body:
"""
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after https://github.com/freeipa/freeipa-pr-ci/commit/380c8b8c78a1ce277b7c1a327bd….
This takes time, some jobs are killed during test execution, so this
increases the time-out parameter from 1 hour and 20 minutes to 2 hours.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3760/head:pr3760
git checkout pr3760
URL: https://github.com/freeipa/freeipa/pull/3759
Author: netoarmando
Title: #3759: prci: increase timeout for jobs that required AD
Action: opened
PR body:
"""
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after https://github.com/freeipa/freeipa-pr-ci/commit/380c8b8c78a1ce277b7c1a327bd….
This takes time, some jobs are killed during test execution, so this
increases the time-out parameter from 1 hour and 20 minutes to 2 hours.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3759/head:pr3759
git checkout pr3759
URL: https://github.com/freeipa/freeipa/pull/3761
Author: netoarmando
Title: #3761: [ipa-4-7] prci: increase timeout for jobs that required AD
Action: opened
PR body:
"""
Vagrant retries to provision hosts if something happens, it was introduced
in PR-CI after https://github.com/freeipa/freeipa-pr-ci/commit/380c8b8c78a1ce277b7c1a327bd….
This takes time, some jobs are killed during test execution, so this
increases the time-out parameter from 1 hour to 2 hours.
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3761/head:pr3761
git checkout pr3761
URL: https://github.com/freeipa/freeipa/pull/3755
Author: rcritten
Title: #3755: [Backport][ipa-4-8] ipatests: File ownership and permission for dirsrv log instance after restore
Action: opened
PR body:
"""
This PR was opened automatically because PR #3732 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3755/head:pr3755
git checkout pr3755
URL: https://github.com/freeipa/freeipa/pull/3754
Author: Tiboris
Title: #3754: [Backport][ipa-4-6] ipatests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
Action: opened
PR body:
"""
This PR was opened automatically because PR #3742 was pushed to master and backport to ipa-4-6 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3754/head:pr3754
git checkout pr3754
URL: https://github.com/freeipa/freeipa/pull/3753
Author: Tiboris
Title: #3753: [Backport][ipa-4-7] ipatests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
Action: opened
PR body:
"""
This PR was opened automatically because PR #3742 was pushed to master and backport to ipa-4-7 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3753/head:pr3753
git checkout pr3753
URL: https://github.com/freeipa/freeipa/pull/3752
Author: Tiboris
Title: #3752: [Backport][ipa-4-8] ipatests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
Action: opened
PR body:
"""
This PR was opened automatically because PR #3742 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3752/head:pr3752
git checkout pr3752
URL: https://github.com/freeipa/freeipa/pull/3758
Author: rcritten
Title: #3758: [Backport][ipa-4-8] Add local helpers to handle unixid structure
Action: opened
PR body:
"""
This PR was opened automatically because PR #3751 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3758/head:pr3758
git checkout pr3758
URL: https://github.com/freeipa/freeipa/pull/3751
Author: abbra
Title: #3751: Add local helpers to handle unixid structure
Action: opened
PR body:
"""
Samba did remove unixid_from_*() helpers in the upstream commit
c906153cc7af21abe508ddd30c447642327d6a5d (Samba 4.11). Since they are
very simple, make a local copy instead.
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1757089
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3751/head:pr3751
git checkout pr3751
URL: https://github.com/freeipa/freeipa/pull/3741
Author: tiran
Title: #3741: [Backport][ipa-4-8] Reduce check warnings
Action: opened
PR body:
"""
This PR was opened automatically because PR #3722 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3741/head:pr3741
git checkout pr3741
URL: https://github.com/freeipa/freeipa/pull/3745
Author: flo-renaud
Title: #3745: [Backport][ipa-4-6] ipa user_add: do not check group if UPG is disabled
Action: opened
PR body:
"""
This is manual backport of PR #3744 to ipa-4-6.
Cherry-pick created a conflict in the test, related to imports.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3745/head:pr3745
git checkout pr3745
URL: https://github.com/freeipa/freeipa/pull/3744
Author: flo-renaud
Title: #3744: [Backport][ipa-4-7] ipa user_add: do not check group if UPG is disabled
Action: opened
PR body:
"""
This is a manual backport of PR #3739 to ipa-4-7 branch.
Cherry-pick created a conflict in the test, related to imports.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3744/head:pr3744
git checkout pr3744
URL: https://github.com/freeipa/freeipa/pull/3743
Author: flo-renaud
Title: #3743: [Backport][ipa-4-8] ipa user_add: do not check group if UPG is disabled
Action: opened
PR body:
"""
This PR was opened automatically because PR #3739 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3743/head:pr3743
git checkout pr3743
URL: https://github.com/freeipa/freeipa/pull/3732
Author: mrizwan93
Title: #3732: ipatests: File ownership and permission for dirsrv log instance after restore
Action: opened
PR body:
"""
Check if file ownership and permission is set to dirsrv:dirsrv
and 770 on /var/log/dirsrv/slapd-<instance> after ipa-restore.
related ticket : https://pagure.io/freeipa/issue/7725
Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3732/head:pr3732
git checkout pr3732
URL: https://github.com/freeipa/freeipa/pull/3742
Author: flo-renaud
Title: #3742: iptests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
Action: opened
PR body:
"""
The test test_replica_promotion.py::TestHiddenReplicaPromotion randomly fails in nightly_f29.
The test is checking that a given IP address is not in the DNS records for the domain. When we are unlucky, we may come up with the following situation:
- IP address that is unexpected: 192.168.121.25
- IP address that is found for the DNS record: 192.168.121.254
As 192.168.121.25 is a substring of 192.168.121.254, the test wrongly considers that the unexpected address was found.
Extract of the log:
```
for host in hosts_unexpected:
value = host.hostname if rtype == 'SRV' else host.ip
> assert value not in txt
E AssertionError: assert '192.168.121.25' not in 'ipa-ca.ipa.test. 1 IN A 192.168.121.254'
E '192.168.121.25' is contained here:
E ipa-ca.ipa.test. 1 IN A 192.168.121.254
E ? ++++++++++++++
```
This happens because the test is comparing the content of the output as a string. The fix is extracting the exact hostname/IP address from the record instead.
Fixes: https://pagure.io/freeipa/issue/8070
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3742/head:pr3742
git checkout pr3742