URL: https://github.com/freeipa/freeipa/pull/5355
Author: abbra
Title: #5355: [Backport][ipa-4-9] ipa-kdb: use predefined filters for a wild-card searches
Action: opened
PR body:
"""
This PR was opened automatically because PR #5351 was pushed to master and backport to ipa-4-9 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5355/head:pr5355
git checkout pr5355
URL: https://github.com/freeipa/freeipa/pull/5360
Author: abbra
Title: #5360: [Backport][ipa-4-9] ipa-client-install: unilaterally set dns_lookup_kdc to True
Action: opened
PR body:
"""
This PR was opened automatically because PR #5341 was pushed to master and backport to ipa-4-9 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5360/head:pr5360
git checkout pr5360
URL: https://github.com/freeipa/freeipa/pull/5359
Author: abbra
Title: #5359: [Backport][ipa-4-8] ipa-client-install: unilaterally set dns_lookup_kdc to True
Action: opened
PR body:
"""
This PR was opened automatically because PR #5341 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5359/head:pr5359
git checkout pr5359
URL: https://github.com/freeipa/freeipa/pull/5302
Author: antoniotorresm
Title: #5302: Allow leading/trailing whitespaces in passwords
Action: opened
PR body:
"""
Since PR #4709 was stale and closed, this PR fixes the issue taking into account comments from that PR.
kwargs is redefined to Data.kwargs, which doesn't contain the restriction of no leading/trailing whitespaces from the Str class.
Fixes: https://pagure.io/freeipa/issue/7599
Signed-off-by: Antonio Torres Moríñigo <atorresm(a)protonmail.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5302/head:pr5302
git checkout pr5302
URL: https://github.com/freeipa/freeipa/pull/5358
Author: abbra
Title: #5358: [Backport][ipa-4-8] Fix configured service
Action: opened
PR body:
"""
This PR was opened automatically because PR #5354 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5358/head:pr5358
git checkout pr5358
URL: https://github.com/freeipa/freeipa/pull/5356
Author: abbra
Title: #5356: [Backport][ipa-4-8] ipa-kdb: use predefined filters for a wild-card searches
Action: opened
PR body:
"""
This PR was opened automatically because PR #5351 was pushed to master and backport to ipa-4-8 is required.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5356/head:pr5356
git checkout pr5356
URL: https://github.com/freeipa/freeipa/pull/5341
Author: fcami
Title: #5341: ipa-client-install: unilaterally set dns_lookup_kdc to True
Action: opened
PR body:
"""
Previously, dns_lookup_kdc was only set to True if DNS
discovery worked or if the KDC was not specified on the
command-line.
Setting dns_lookup_kdc to False would result in a hardcoded
configuration which is less reliable in the long run.
For instance, adding a trust to an Active Directory forest
after clients are enrolled would result in clients not being
able to authenticate AD users. Recycling FreeIPA servers
could prove problematic if the original hostnames are not
reused too.
Change summary:
Always set dns_lookup_kdc to True on client enrollment.
With this change, DNS SRV search will always be performed
before looking into /etc/krb5.conf realm entries.
Fixes: https://pagure.io/freeipa/issue/6523
Signed-off-by: François Cami <fcami(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5341/head:pr5341
git checkout pr5341
URL: https://github.com/freeipa/freeipa/pull/5354
Author: abbra
Title: #5354: Fix configured service
Action: opened
PR body:
"""
Convert configuredService to either enabledService or hiddenService
depending on the state of the server role. This is to fix situations
when deployment has happened before introduction of hidden replicas
as those services will stay as configuredService and will not get
started after upgrade, rendering the system non-functioning.
Fixes: https://pagure.io/freeipa/issue/8623
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5354/head:pr5354
git checkout pr5354
URL: https://github.com/freeipa/freeipa/pull/5351
Author: abbra
Title: #5351: ipa-kdb: use predefined filters for a wild-card searches
Action: opened
PR body:
"""
In case we've got a principal name as '*', we don't need to specify
the principal itself, use pre-defined filter for a wild-card search.
Previously, we had to escape the '*' as specifying it with an explicit
matching rule would have violated RFC 4515 section 3. However, since we
don't really need to specify a different matching rule for a wild-card
search, we can remove this part completely.
Fixes: https://pagure.io/freeipa/issue/8624
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5351/head:pr5351
git checkout pr5351
Hi,
we are close to get FreeIPA 4.9.0 release candidate out.
Draft release notes: https://vda.li/drafts/freeipa-4.9.0-release-notes.html
They include difference between 4.8.10 and current git master. Note that
since many things were backported to 4.8 in separate commits that
referenced the same FreeIPA tickets, they appear in the release notes
too even though you might have seen them in release notes for FreeIPA
4.8 releases.
Currently, in nightly tests
https://github.com/freeipa-pr-ci2/freeipa/pull/525 we have 126
successful testsuites and 6 failures, out of which four have known
failures:
- test_adtrust_install, test_cert, test_ipahealthcheck_nodns_extca_file
failure already reported in FreeIPA#8533
- test_installation_TestInstallWithCA2 failure already reported in
FreeIPA#8477
- test_webui_general failure already reported in FreeIPA#8570
- test_webui_users failure already reported in FreeIPA#8569
The latter two issues will most likely be irrelevant for FreeIPA release
as they track behavior change in Fedora FAS plugin and we simply need to
install that plugin in a confined environment, to avoid overlapping with
our tests. FAS behavior is specific to Fedora/CentOS AAA deployment and
should not be a problem for anything else, it is simply a design choice
in FAS plugin.
This makes us down to two known and two not-yet-investigated failures.
On top of that we have a worrying behavior of the Azure CI with regards
to DNSSEC that waits for investigation.
One major part not exercised in the nightlies is an upgrade code.
My plan is to do FreeIPA 4.9.0 release candidate this week -- I planned
it to do last week but things slipped due to various failures and
load at other projects. I think for a release candidate this state is
quite good.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland