[freeipa PR#5531][opened] Set the ACME baseURL in order to pin a client to a single IPA server
by rcritten
URL: https://github.com/freeipa/freeipa/pull/5531
Author: rcritten
Title: #5531: Set the ACME baseURL in order to pin a client to a single IPA server
Action: opened
PR body:
"""
ACME uses nonce values to prevent replay attacks. Since the
ipa-ca name can go to any of the IPA servers in order to verify the
nonce the servers need to know the value that was set which
relies on replication. Sometimes the client is faster than
replication so a request can fail.
This change returns the baseURL to the client as the name of the
ACME server during discovery which should pin all requests to this
one IPA server and alleviate the replication issue.
Signed-off-by: Rob Crittenden <rcritten(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5531/head:pr5531
git checkout pr5531
2 years, 7 months
[freeipa PR#5486][opened] [ipatests][Azure Pipelines] Populate containers with self-AAAA records
by stanislavlevin
URL: https://github.com/freeipa/freeipa/pull/5486
Author: stanislavlevin
Title: #5486: [ipatests][Azure Pipelines] Populate containers with self-AAAA records
Action: opened
PR body:
"""
- IPA server's AAAA records at embedded DNS mode depend on result of `get_server_ip_address` function(`ipaserver.install.installutils`), which in turn, relies on NSS. In case of Azure Pipelines, there are neither IPv6 records in '/etc/hosts' nor external DNS, which may provide such. This leads to the missing AAAA records for master and missing AAAA records for `ipa-ca` pointing to master in embedded DNS. In particular, tests `test_ipa_healthcheck_no_errors`, `test_ipa_dns_systemrecords_check` fail with:
```
[
{
"source": "ipahealthcheck.ipa.idns",
"check": "IPADNSSystemRecordsCheck",
"result": "WARNING",
"uuid": "b979a88a-6373-4990-bc83-ce724e9730b4",
"when": "20210120055054Z",
"duration": "0.032740",
"kw": {
"msg": "Got {count} ipa-ca AAAA records, expected {expected}",
"count": 1,
"expected": 2
}
}
]
```
where `ipa-ca` record exists only for replica.
Note: since the most of the code in setup_containers was touched it has been reformatted.
- Handle AAAA records in test_ipa_dns_systemrecords_check
Fixes: https://pagure.io/freeipa/issue/8683
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5486/head:pr5486
git checkout pr5486
2 years, 7 months