[freeipa PR#4909][opened] Add unauthenticated nsupdate
by fcami
URL: https://github.com/freeipa/freeipa/pull/4909
Author: fcami
Title: #4909: Add unauthenticated nsupdate
Action: opened
PR body:
"""
ipa-client-install: update sssd.conf if nsupdate requires -g
If dynamic DNS updates are selected, sssd will use GSS-TSIG
by default for nsupdate.
When ipa-client-install notices that plain nsupdate is required,
switch sssd to use no authentication for dynamic updates too.
Fixes: https://pagure.io/freeipa/issue/8402
+
ipa-client-install: invoke nsupdate twice (GSS-TSIG, plain)
ipa-client-install invokes nsupdate with GSS-TSIG at client
enrollment time. If that fails, no retry is done.
Change that behavior to try again without GSS-TSIG.
Fixes: https://pagure.io/freeipa/issue/8402
####
This is purely WIP:
- it needs a proper test
- there are more nsupdate calls that should be adapted.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/4909/head:pr4909
git checkout pr4909
1 year, 11 months
[freeipa PR#5605][opened] Add ACME profile on replica install in non-ACME environment
by rcritten
URL: https://github.com/freeipa/freeipa/pull/5605
Author: rcritten
Title: #5605: Add ACME profile on replica install in non-ACME environment
Action: opened
PR body:
"""
Always import the default certificate profiles
The default certificate profiles were not imported for
in a promoted client installation.
This could lead to missing profiles, as was seen in the ACME
case, while upgrading from older versions.
The sequence was:
1. Install a non-ACME IPA server
2. Install an ipa client
3. On the client promote to a server with a build that supports
ACME.
The resulting installation is missing the acmeIPAServerCert
profile because it is provided in INCLUDED_PROFILES which isn't
loaded during promotions.
There is already handling to handle issues if the profile already
exists so it is safe to call this on every installation.
https://pagure.io/freeipa/issue/8738
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5605/head:pr5605
git checkout pr5605
2 years