June 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5855][opened] ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg
by mrizwan93 12 Jul '21

12 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5855 Author: mrizwan93 Title: #5855: ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg Action: opened PR body: """ Earlier it used to fail when startup directive missing from CS.cfg. With https://github.com/dogtagpki/pki/pull/3466, it changed to display a warning than failing. related: https://pagure.io/freeipa/issue/8721 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5855/head:pr5855 git checkout pr5855

2 1

[freeipa PR#5868][opened] Add SHA384withRSA as a certificate signing algorithm
by rcritten 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5868 Author: rcritten Title: #5868: Add SHA384withRSA as a certificate signing algorithm Action: opened PR body: """ It required support in dogtag which was added in 10.5.0. This is only easily configurable during installation because it will set ca.signing.defaultSigningAlgorithm to the selected algorithm in CS.cfg The certificate profiles will generally by default set default.params.signingAlg=- which means use the CA default. So while an existing installation will technically allow SHA384withRSA it will require profile changes and/or changing the defaultSigningAlgorithm in CS.cfg and restarting (completely untested). And that won't affect already issued-certificates. https://pagure.io/freeipa/issue/8906 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5868/head:pr5868 git checkout pr5868

1 1

[freeipa PR#5713][opened] Add support subordinate user/group ids as separate entries
by tiran 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5713 Author: tiran Title: #5713: Add support subordinate user/group ids as separate entries Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5713/head:pr5713 git checkout pr5713

2 1

[freeipa PR#5863][opened] [Backport][ipa-4-8] plugins: Don't treat keys of API as bytes
by abbra 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5863 Author: abbra Title: #5863: [Backport][ipa-4-8] plugins: Don't treat keys of API as bytes Action: opened PR body: """ This PR was opened automatically because PR #5857 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5863/head:pr5863 git checkout pr5863

2 1

[freeipa PR#5858][opened] [Backport][ipa-4-8] WebUI: Fix certificate serial number representation
by serg-cymbaluk 07 Jul '21

07 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5858 Author: serg-cymbaluk Title: #5858: [Backport][ipa-4-8] WebUI: Fix certificate serial number representation Action: opened PR body: """ This PR was opened automatically because PR #5844 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5858/head:pr5858 git checkout pr5858

2 1

[freeipa PR#5391][opened] Translations update from Weblate
by weblate 07 Jul '21

07 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5391 Author: weblate Title: #5391: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/freeipa/ipa-4-8/) for freeipa/ipa-4-8. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/freeipa/-/ipa-4-8/horiz… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5391/head:pr5391 git checkout pr5391

2 1

[freeipa PR#5867][opened] Remove unneeded dependency on python-coverage
by flo-renaud 05 Jul '21

05 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5867 Author: flo-renaud Title: #5867: Remove unneeded dependency on python-coverage Action: opened PR body: """ The spec file requires python3-coverage although it is not used in the project. Fixes: https://pagure.io/freeipa/issue/8905 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5867/head:pr5867 git checkout pr5867

1 1

[freeipa PR#5617][opened] Add checks to prevent adding auth indicators to internal IPA services
by antoniotorresm 05 Jul '21

05 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5617 Author: antoniotorresm Title: #5617: Add checks to prevent adding auth indicators to internal IPA services Action: opened PR body: """ Authentication indicators should not be enforced against internal IPA services, since not all users of those servers are able to produce Kerberos tickets with all the auth indicator options. This includes `host`, `ldap`, `HTTP` and `cifs` in IPA server and `host` and `cifs` in IPA clients. Fixes: https://pagure.io/freeipa/issue/8206 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5617/head:pr5617 git checkout pr5617

2 1

[freeipa PR#5852][opened] rpcserver.py: perf_counter_ns is Python 3.7+
by fcami 01 Jul '21

01 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5852 Author: fcami Title: #5852: rpcserver.py: perf_counter_ns is Python 3.7+ Action: opened PR body: """ perf_counter_ns is only available in Python 3.7 and later. Define a lambda for 3.6 and lower. Fixes: TBD Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5852/head:pr5852 git checkout pr5852

2 1

FreeIPA 4.9.6 released
by Alexander Bokovoy 29 Jun '21

29 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.6 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.6 * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. === Enhancements === Known Issues * FreeIPA 4.9.4 contains a new LDAP caching layer that might incorrectly return data in certain cases. This is known to affect ansible-freeipa operations with automember rules. FreeIPA 4.9.6 addresses this issue. === Bug fixes FreeIPA 4.9.6 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are more than 10 bug-fixes since FreeIPA 4.9.5 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/7752[#7752] ipa client throws http.client.ResponseNotReady error * https://pagure.io/freeipa/issue/8402[#8402] (https://bugzilla.redhat.com/show_bug.cgi?id=1854557[rhbz#1854557]) [RFE] ipa-client-install forces nsupdate to bind with gssapi * https://pagure.io/freeipa/issue/8532[#8532] (https://bugzilla.redhat.com/show_bug.cgi?id=1886837[rhbz#1886837]) Revise PKINIT upgrade code * https://pagure.io/freeipa/issue/8726[#8726] Provide a better error message with updatedns and FQDN Is not provided * https://pagure.io/freeipa/issue/8754[#8754] (https://bugzilla.redhat.com/show_bug.cgi?id=1919384[rhbz#1919384]) Certificate Serial Number issue * https://pagure.io/freeipa/issue/8817[#8817] Running ipa-server-certinstall with v1 certificate fails with Attempted "__iter__" operation on ASN.1 schema object * https://pagure.io/freeipa/issue/8880[#8880] (https://bugzilla.redhat.com/show_bug.cgi?id=1973023[rhbz#1973023]) CA_less ipa-server-install fails if CA cert subject contains non ascii chars * https://pagure.io/freeipa/issue/8882[#8882] Directly integrate custodia * https://pagure.io/freeipa/issue/8884[#8884] (https://bugzilla.redhat.com/show_bug.cgi?id=1967325[rhbz#1967325]) API returns the misleading error "Insufficient Access" if run as non-admin * https://pagure.io/freeipa/issue/8885[#8885] (https://bugzilla.redhat.com/show_bug.cgi?id=1975139[rhbz#1975139]) Upgrade error: Add failure missing required attribute "objectclass" * https://pagure.io/freeipa/issue/8889[#8889] [tests] healthcheck 0.9 * https://pagure.io/freeipa/issue/8897[#8897] (https://bugzilla.redhat.com/show_bug.cgi?id=1976286[rhbz#1976286]) ansible-freeipa automember test fails with `automember_add_condition: testgroup: 'objectclass'` due to ldap cache * https://pagure.io/freeipa/issue/8898[#8898] plugin `plugins` doesn't work -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel June 2021