June 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5845][opened] component: Fix installation on hosts withouc /proc/1/sched.
by pfandl 09 Nov '21

09 Nov '21

URL: https://github.com/freeipa/freeipa/pull/5845 Author: pfandl Title: #5845: component: Fix installation on hosts withouc /proc/1/sched. Action: opened PR body: """ My host does not have `/proc/1/sched` and this patch fixes the installation exception. I have not tested the other code path where `ìs_hidepid` is `True`. best regards """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5845/head:pr5845 git checkout pr5845

1 1

[freeipa PR#5724][opened] [Backport][ipa-4-9] ipatests: test to renew certs on replica using ipa-cert-fix
by flo-renaud 20 Aug '21

20 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5724 Author: flo-renaud Title: #5724: [Backport][ipa-4-9] ipatests: test to renew certs on replica using ipa-cert-fix Action: opened PR body: """ This PR was opened automatically because PR #5653 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5724/head:pr5724 git checkout pr5724

1 1

[freeipa PR#5738][opened] ipatests: wait while http/ldap/pkinit cert get renew on replica
by mrizwan93 19 Aug '21

19 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5738 Author: mrizwan93 Title: #5738: ipatests: wait while http/ldap/pkinit cert get renew on replica Action: opened PR body: """ LDAP/HTTP/PKINIT certificates should be renewed on replica after moving system date. Test was failing because ipa-cert-fix ran while these cert was not renewed and it tried to fix it. Fixes: https://pagure.io/freeipa/issue/8815 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5738/head:pr5738 git checkout pr5738

2 1

[freeipa PR#5829][opened] WSGI: Control passed environment variables
by stanislavlevin 16 Aug '21

16 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5829 Author: stanislavlevin Title: #5829: WSGI: Control passed environment variables Action: opened PR body: """ It's common practice to care about input environment variables and to produce a minimal and safe set of such. Fixes: https://pagure.io/freeipa/issue/8881 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5829/head:pr5829 git checkout pr5829

1 1

[freeipa PR#5841][opened] dnszone-add: deprecate option for setting SOA serial
by antoniotorresm 04 Aug '21

04 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5841 Author: antoniotorresm Title: #5841: dnszone-add: deprecate option for setting SOA serial Action: opened PR body: """ Since IPA 3 [1] SOA serial is managed automatically via autoincrement, and the option of disabling this behavior was deprecated in IPA 3.3.3 [2]. As a result, the option `--serial` during DNS zone addition would be ignored as it is set during the creation. This commit adds a deprecation warning if this option is used. Setting the SOA serial manually would still be useful in certain scenarios, so the option of doing it with dnszone-mod is kept. [1] https://www.freeipa.org/page/V3/DNS_SOA_serial_auto-incrementation [2] https://www.freeipa.org/page/Releases/3.3.3 Fixes: https://pagure.io/freeipa/issue/8227 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5841/head:pr5841 git checkout pr5841

1 1

[freeipa PR#5613][opened] ipa-kra-install: exit if ca_host is overriden
by antoniotorresm 27 Jul '21

27 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5613 Author: antoniotorresm Title: #5613: ipa-kra-install: exit if ca_host is overriden Action: opened PR body: """ `ipa-kra-install` should exit if `ca_host` line is present in `/etc/ipa/default.conf`, as it may lead to a misconfigured setup. Fixes: https://pagure.io/freeipa/issue/8245 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5613/head:pr5613 git checkout pr5613

1 1

[freeipa PR#5733][opened] Revert the way hosts/services certs are searched for
by rcritten 20 Jul '21

20 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5733 Author: rcritten Title: #5733: Revert the way hosts/services certs are searched for Action: opened PR body: """ Revert the way hosts/services certs are searched for This reverts a change that caused all service certs to be revoked if any other service was deleted. There is special handling when passing in host, service or user into cert_find. The _ldap_search method creates filters for the object which later in cert_find removes unrelated certificates. https://pagure.io/freeipa/issue/7835 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5733/head:pr5733 git checkout pr5733

1 1

[freeipa PR#5799][opened] ipatests: test_installation: Skip KRA test if lib389 cannot be imported
by miskopo 13 Jul '21

13 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5799 Author: miskopo Title: #5799: ipatests: test_installation: Skip KRA test if lib389 cannot be imported Action: opened PR body: """ KRA instance import depends on lib389 package, which is not always installed and that results in failure. This fix skips relevant test if thei mport is not possible. Signed-off-by: Michal Polovka <mpolovka(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5799/head:pr5799 git checkout pr5799

1 1

[freeipa PR#5847][opened] [Backport][ipa-4-9] ipatest: Test ipa-cert-fix fails when startup directive is missing from CS.cfg
by rcritten 13 Jul '21

13 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5847 Author: rcritten Title: #5847: [Backport][ipa-4-9] ipatest: Test ipa-cert-fix fails when startup directive is missing from CS.cfg Action: opened PR body: """ This PR was opened automatically because PR #5821 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5847/head:pr5847 git checkout pr5847

2 1

[freeipa PR#5853][opened] ipatests: test_ipahealthcheck: print a message if a system is healthy
by miskopo 12 Jul '21

12 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5853 Author: miskopo Title: #5853: ipatests: test_ipahealthcheck: print a message if a system is healthy Action: opened PR body: """ Test if when the system is completely healthy, informative message is returned and not only empty output (list or json). Related: https://pagure.io/freeipa/issue/8892 Signed-off-by: Michal Polovka <mpolovka(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5853/head:pr5853 git checkout pr5853

2 1

[freeipa PR#5855][opened] ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg
by mrizwan93 12 Jul '21

12 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5855 Author: mrizwan93 Title: #5855: ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg Action: opened PR body: """ Earlier it used to fail when startup directive missing from CS.cfg. With https://github.com/dogtagpki/pki/pull/3466, it changed to display a warning than failing. related: https://pagure.io/freeipa/issue/8721 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5855/head:pr5855 git checkout pr5855

2 1

[freeipa PR#5868][opened] Add SHA384withRSA as a certificate signing algorithm
by rcritten 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5868 Author: rcritten Title: #5868: Add SHA384withRSA as a certificate signing algorithm Action: opened PR body: """ It required support in dogtag which was added in 10.5.0. This is only easily configurable during installation because it will set ca.signing.defaultSigningAlgorithm to the selected algorithm in CS.cfg The certificate profiles will generally by default set default.params.signingAlg=- which means use the CA default. So while an existing installation will technically allow SHA384withRSA it will require profile changes and/or changing the defaultSigningAlgorithm in CS.cfg and restarting (completely untested). And that won't affect already issued-certificates. https://pagure.io/freeipa/issue/8906 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5868/head:pr5868 git checkout pr5868

1 1

[freeipa PR#5713][opened] Add support subordinate user/group ids as separate entries
by tiran 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5713 Author: tiran Title: #5713: Add support subordinate user/group ids as separate entries Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5713/head:pr5713 git checkout pr5713

2 1

[freeipa PR#5863][opened] [Backport][ipa-4-8] plugins: Don't treat keys of API as bytes
by abbra 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5863 Author: abbra Title: #5863: [Backport][ipa-4-8] plugins: Don't treat keys of API as bytes Action: opened PR body: """ This PR was opened automatically because PR #5857 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5863/head:pr5863 git checkout pr5863

2 1

[freeipa PR#5858][opened] [Backport][ipa-4-8] WebUI: Fix certificate serial number representation
by serg-cymbaluk 07 Jul '21

07 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5858 Author: serg-cymbaluk Title: #5858: [Backport][ipa-4-8] WebUI: Fix certificate serial number representation Action: opened PR body: """ This PR was opened automatically because PR #5844 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5858/head:pr5858 git checkout pr5858

2 1

[freeipa PR#5391][opened] Translations update from Weblate
by weblate 07 Jul '21

07 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5391 Author: weblate Title: #5391: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/freeipa/ipa-4-8/) for freeipa/ipa-4-8. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/freeipa/-/ipa-4-8/horiz… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5391/head:pr5391 git checkout pr5391

2 1

[freeipa PR#5867][opened] Remove unneeded dependency on python-coverage
by flo-renaud 05 Jul '21

05 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5867 Author: flo-renaud Title: #5867: Remove unneeded dependency on python-coverage Action: opened PR body: """ The spec file requires python3-coverage although it is not used in the project. Fixes: https://pagure.io/freeipa/issue/8905 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5867/head:pr5867 git checkout pr5867

1 1

[freeipa PR#5617][opened] Add checks to prevent adding auth indicators to internal IPA services
by antoniotorresm 05 Jul '21

05 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5617 Author: antoniotorresm Title: #5617: Add checks to prevent adding auth indicators to internal IPA services Action: opened PR body: """ Authentication indicators should not be enforced against internal IPA services, since not all users of those servers are able to produce Kerberos tickets with all the auth indicator options. This includes `host`, `ldap`, `HTTP` and `cifs` in IPA server and `host` and `cifs` in IPA clients. Fixes: https://pagure.io/freeipa/issue/8206 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5617/head:pr5617 git checkout pr5617

2 1

[freeipa PR#5852][opened] rpcserver.py: perf_counter_ns is Python 3.7+
by fcami 01 Jul '21

01 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5852 Author: fcami Title: #5852: rpcserver.py: perf_counter_ns is Python 3.7+ Action: opened PR body: """ perf_counter_ns is only available in Python 3.7 and later. Define a lambda for 3.6 and lower. Fixes: TBD Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5852/head:pr5852 git checkout pr5852

2 1

FreeIPA 4.9.6 released
by Alexander Bokovoy 29 Jun '21

29 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.6 * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. === Enhancements === Known Issues * FreeIPA 4.9.4 contains a new LDAP caching layer that might incorrectly return data in certain cases. This is known to affect ansible-freeipa operations with automember rules. FreeIPA 4.9.6 addresses this issue. === Bug fixes FreeIPA 4.9.6 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are more than 10 bug-fixes since FreeIPA 4.9.5 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/7752[#7752] ipa client throws http.client.ResponseNotReady error * https://pagure.io/freeipa/issue/8402[#8402] (https://bugzilla.redhat.com/show_bug.cgi?id=1854557[rhbz#1854557]) [RFE] ipa-client-install forces nsupdate to bind with gssapi * https://pagure.io/freeipa/issue/8532[#8532] (https://bugzilla.redhat.com/show_bug.cgi?id=1886837[rhbz#1886837]) Revise PKINIT upgrade code * https://pagure.io/freeipa/issue/8726[#8726] Provide a better error message with updatedns and FQDN Is not provided * https://pagure.io/freeipa/issue/8754[#8754] (https://bugzilla.redhat.com/show_bug.cgi?id=1919384[rhbz#1919384]) Certificate Serial Number issue * https://pagure.io/freeipa/issue/8817[#8817] Running ipa-server-certinstall with v1 certificate fails with Attempted "__iter__" operation on ASN.1 schema object * https://pagure.io/freeipa/issue/8880[#8880] (https://bugzilla.redhat.com/show_bug.cgi?id=1973023[rhbz#1973023]) CA_less ipa-server-install fails if CA cert subject contains non ascii chars * https://pagure.io/freeipa/issue/8882[#8882] Directly integrate custodia * https://pagure.io/freeipa/issue/8884[#8884] (https://bugzilla.redhat.com/show_bug.cgi?id=1967325[rhbz#1967325]) API returns the misleading error "Insufficient Access" if run as non-admin * https://pagure.io/freeipa/issue/8885[#8885] (https://bugzilla.redhat.com/show_bug.cgi?id=1975139[rhbz#1975139]) Upgrade error: Add failure missing required attribute "objectclass" * https://pagure.io/freeipa/issue/8889[#8889] [tests] healthcheck 0.9 * https://pagure.io/freeipa/issue/8897[#8897] (https://bugzilla.redhat.com/show_bug.cgi?id=1976286[rhbz#1976286]) ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache * https://pagure.io/freeipa/issue/8898[#8898] plugin `plugins` doesn't work -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

[freeipa PR#5865][closed] [Backport][ipa-4-8] ds: Support renaming of a replication plugin in 389-ds
by flo-renaud 29 Jun '21

29 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5865 Author: flo-renaud Title: #5865: [Backport][ipa-4-8] ds: Support renaming of a replication plugin in 389-ds Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5865/head:pr5865 git checkout pr5865

1 0

[freeipa PR#5866][opened] [Backport][ipa-4-9] Don't return more attributes than requested from LDAP cache
by abbra 29 Jun '21

29 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5866 Author: abbra Title: #5866: [Backport][ipa-4-9] Don't return more attributes than requested from LDAP cache Action: opened PR body: """ This PR was opened automatically because PR #5860 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5866/head:pr5866 git checkout pr5866

1 0

[freeipa PR#5860][opened] Don't return more attributes than requested from LDAP cache
by rcritten 29 Jun '21

29 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5860 Author: rcritten Title: #5860: Don't return more attributes than requested from LDAP cache Action: opened PR body: """ On a hit in the LDAP cache the entire cached entry was returned. This caused problems because more attributes could be returned than requested. The automember condition add/remove calls only request the inclusive/exclusive rule attributes and loop over the returned values to look for duplicates. This was failing because the queried entry contains attributes that the candidate entry does not contain. The automember code is: old_entry = ldap.get_entry(dn, [attr]) for regex in old_entry.keys(): if not isinstance(entry_attrs[regex], (list, tuple)): old_entry, returned from the cache, contained objectclass, cn, description, etc. which don't exist in the candidate entry so entry_attrs[regex] threw a KeyError. Instead generate a new entry from the cache consisting of the requested attributes only if all of the requested attributes are cached. Also be more careful when storing the attribbutes in the cache entry. The returned attributes may not match the requested. So store the attributes we actually have. This issue was exposed by Ansible which maintains a larger and longer-lived cache because commands are executed in the server context one after another, giving the cache a chance to build up. https://pagure.io/freeipa/issue/8897 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5860/head:pr5860 git checkout pr5860

2 1

[freeipa PR#5864][opened] [Backport][ipa-4-9]: Increase timeout for test_commands.py #5856
by menonsudhir 29 Jun '21

29 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5864 Author: menonsudhir Title: #5864: [Backport][ipa-4-9]: Increase timeout for test_commands.py #5856 Action: opened PR body: """ test_commands.py testsuite is failing due to 'RunPytest timed out after 4800s' Hence the timeout has been increased from 4800 to 5400 Signed-off-by: Sudhir Menon <sumenon(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5864/head:pr5864 git checkout pr5864

2 1

[freeipa PR#5861][opened] [Backport][ipa-4-9] Add unauthenticated nsupdate
by abbra 29 Jun '21

29 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5861 Author: abbra Title: #5861: [Backport][ipa-4-9] Add unauthenticated nsupdate Action: opened PR body: """ This PR was opened automatically because PR #4909 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5861/head:pr5861 git checkout pr5861

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel June 2021