June 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5325][opened] LDAP autobind authenticateAsDN for BIND named
by tiran 15 Jun '21

15 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5325 Author: tiran Title: #5325: LDAP autobind authenticateAsDN for BIND named Action: opened PR body: """ Use new nsslapd-ldapiautoauthdnattr feature to switch BIND named from GSSAPI bind to EXTERNAL LDAPI bind. Requires 389-DS build https://copr.fedorainfracloud.org/coprs/build/1811023 - [ ] Requires new build of 389-DS - [ ] Add new OIDs to FreeIPA's OID registry Fixes: https://pagure.io/freeipa/issue/8544 See: https://github.com/389ds/389-ds-base/issues/4381 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5325/head:pr5325 git checkout pr5325

2 1

[freeipa PR#5822][opened] [ipa-4-6] CA less installation: non ASCII chars in CA subject
by flo-renaud 15 Jun '21

15 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5822 Author: flo-renaud Title: #5822: [ipa-4-6] CA less installation: non ASCII chars in CA subject Action: opened PR body: """ ### CA less installation: non ASCII chars in CA subject In CA-less installation, ipa-server-install fails when the CA certificate contains a subject with non ASCII characters. ipa-server-install is internally calling ipautil.run(...) to launch a certutil -n nickname command, and the nickname is provided as a unicode instead of a string. The fix makes sure the nickname is provided as a utf-8 encoded string. Fixes: https://pagure.io/freeipa/issue/8879 ### ipatests: use non-ascii chars in CA-less install The CA-less installation creates an external CA with the subject CN=CA,O=Example Organization. In order to test non-ascii subjects, use CN=CA,O=Example Organization España instead. Related: https://pagure.io/freeipa/issue/8879 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5822/head:pr5822 git checkout pr5822

1 1

[freeipa PR#5833][opened] When loading certificates verify that it is X.509 v3
by rcritten 14 Jun '21

14 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5833 Author: rcritten Title: #5833: When loading certificates verify that it is X.509 v3 Action: opened PR body: """ Simple version enforcement. A v1 certificate won't have the extensions that are assumed available later during the validation process. https://pagure.io/freeipa/issue/8817 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5833/head:pr5833 git checkout pr5833

1 1

FreeIPA 4.9.4 and 4.9.5 released
by Alexander Bokovoy 14 Jun '21

14 Jun '21

The FreeIPA team would like to announce FreeIPA 4.9.4 and 4.9.5 releases! Yes, this is not a mistake. First we created FreeIPA 4.9.4 on June 4th but then found a late time regression that took us more than ten days to sort out, thus going with the FreeIPA 4.9.5 release. This regression concerns an edge case of an unauthenticated or almost expired user credential's run of 'ipa' command line tool returning a non-processed Python exception instead of a human-readable error message. This, in turn uncovered a bit of a misconfiguration on the IPA server side which could trigger this behavior. In a process of investigating it we also found a bug in GSS-Proxy tool. FreeIPA 4.9.4 release notes are large and can be found at https://www.freeipa.org/page/Releases/4.9.4 FreeIPA 4.9.5 is released and can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. FreeIPA installation is currently broken in Fedora Rawhide due to an ongoing migration to Python 3.10 in Fedora where mod_wsgi does not yet support Python 3.10. == Highlights in 4.9.5 === Bug fixes FreeIPA 4.9.5 is a stabilization release for the features delivered as a part of 4.9.0 version series. There are 7 bug-fixes since FreeIPA 4.9.4 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/8691[#8691] [Tracker] Nightly failure (fc33) in test_winsyncmigrate.py: ipa-replica-manage connect --winsync error * https://pagure.io/freeipa/issue/8702[#8702] (https://bugzilla.redhat.com/show_bug.cgi?id=1780317[rhbz#1780317]) ipa-cert-fix: False Positive Status for cert renewal. * https://pagure.io/freeipa/issue/8756[#8756] [Tracker] 389ds coredump in test_caless.py::TestReplicaInstall::test_wildcard_http * https://pagure.io/freeipa/issue/8868[#8868] Nightly test failure in test_integration/test_fips.py::TestInstallFIPS * https://pagure.io/freeipa/issue/8873[#8873] Missing credential cache can raise 500 when authenticating instead of 401 * https://pagure.io/freeipa/issue/8876[#8876] Nightly failure in test_installation.py::TestInstallWithCA1::test_install_with_bad_ldap_conf * https://pagure.io/freeipa/issue/8877[#8877] Nightly test failure in test_nfs.py: runner VM runs out of disk space due to huge sssd log file == Detailed changelog since 4.9.4 === Armando Neto (1) * ipatests: Bump PR-CI boxes https://pagure.io/freeipa/c/79e0919132adf0df764400f9c27268cbadd2578b[commit] === Alexander Bokovoy (3) * Become FreeIPA 4.9.5 https://pagure.io/freeipa/c/e045f118c87346bfab5b5634fd23f3054f082f7f[commit] * get_credentials: return ValueError for missing creds https://pagure.io/freeipa/c/5238651da06547bb004de2434ae7d357422ba735[commit] https://pagure.io/freeipa/issue/8873[#8873] * Back to git snapshots https://pagure.io/freeipa/c/b25f5bd9109b87916e097dd8353ea5f0dc49e398[commit] === Florence Blanc-Renaud (4) * ipa-cert-fix man page: add note about certmonger renewal https://pagure.io/freeipa/c/06a445aff10c1ab84e8784ab41b0a838e500e617[commit] https://pagure.io/freeipa/issue/8702[#8702] * freeipa.spec: bump 389-ds version https://pagure.io/freeipa/c/6eb535334d33f8f375b856e3a2d0b8853b318b4d[commit] https://pagure.io/freeipa/issue/8691[#8691], https://pagure.io/freeipa/issue/8756[#8756] * ipatests: delete the replica before uninstallation https://pagure.io/freeipa/c/2b22450dfdc1657b463683b09b9c69816f9152d9[commit] https://pagure.io/freeipa/issue/8876[#8876] * ipatests: set selinux context for fips mode https://pagure.io/freeipa/c/13b257d7a05fd255df472144712edb34604dbe06[commit] https://pagure.io/freeipa/issue/8868[#8868] === Stanislav Levin (2) * gssproxy: Don't refresh expired delegated credentials https://pagure.io/freeipa/c/0fd06f33b83aec19a88c594d3750bc476157ab83[commit] * krb_utils: Simplify get_credentials https://pagure.io/freeipa/c/700be74975cad998e7dbcc4fb437e6b0bbd77305[commit] https://pagure.io/freeipa/issue/8873[#8873] === Sergey Orlov (2) * ipatests: disable test_nfs.py::TestNFS in nightly runs on Fedora 33 https://pagure.io/freeipa/c/c9f5acc0d281f1a27471091648c36f94528c5a29[commit] https://pagure.io/freeipa/issue/8877[#8877] * ipatests: temporary disable execution of test_nfs.py::TestNFS in nightly runs https://pagure.io/freeipa/c/6ee14f513711ae9be799cfa2bd009f13c5248932[commit] https://pagure.io/freeipa/issue/8877[#8877] -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland _______________________________________________ FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

1 0

[freeipa PR#5835][opened] run test_kdc_proxy to test cygwin installation
by wladich 14 Jun '21

14 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5835 Author: wladich Title: #5835: run test_kdc_proxy to test cygwin installation Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5835/head:pr5835 git checkout pr5835

1 1

[freeipa PR#5834][opened] [Backport][ipa-4-9] krb_utils: Simplify get_credentials
by abbra 14 Jun '21

14 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5834 Author: abbra Title: #5834: [Backport][ipa-4-9] krb_utils: Simplify get_credentials Action: opened PR body: """ This PR was opened automatically because PR #5813 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5834/head:pr5834 git checkout pr5834

1 1

[freeipa PR#5830][opened] [Backport][ipa-4-9] ipa-cert-fix man page: add note about certmonger renewal
by flo-renaud 12 Jun '21

12 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5830 Author: flo-renaud Title: #5830: [Backport][ipa-4-9] ipa-cert-fix man page: add note about certmonger renewal Action: opened PR body: """ This PR was opened automatically because PR #5825 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5830/head:pr5830 git checkout pr5830

2 1

[freeipa PR#5813][opened] krb_utils: Simplify get_credentials
by stanislavlevin 12 Jun '21

12 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5813 Author: stanislavlevin Title: #5813: krb_utils: Simplify get_credentials Action: opened PR body: """ Previously, `get_credentials` raises either `ValueError` or re-raises `GSSError`. The former makes the handling of this function more difficult without a good reason. With this change: - `get_credentials` no longer handles exceptions by itself, but delegates this to the callers (which already process GSS errors). - `get_credentials_if_valid` doesn't raise any expected exceptions, but return valid credentials (on the moment of calling) or None. This makes it consistent with docs. Related: https://pagure.io/freeipa/issue/8873 tested scenarios: 1. missing creds && ipa user-find xxx 2. expired creds && ipa user-find xxx 3. https://pagure.io/freeipa/issue/7752 (removed ccache on server + ipa user-find xxx) 4. ccache sweeper """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5813/head:pr5813 git checkout pr5813

2 1

[freeipa PR#5734][opened] Design doc to allow LDAP bind using the RADIUS auth type
by rcritten 11 Jun '21

11 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5734 Author: rcritten Title: #5734: Design doc to allow LDAP bind using the RADIUS auth type Action: opened PR body: """ The RADIUS auth type is only supported with Kerberos currently. This design proposes a way to make it work with LDAP binds as well without relying ok workarounds. Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5734/head:pr5734 git checkout pr5734

1 1

[freeipa PR#5825][opened] ipa-cert-fix man page: add note about certmonger renewal
by flo-renaud 10 Jun '21

10 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5825 Author: flo-renaud Title: #5825: ipa-cert-fix man page: add note about certmonger renewal Action: opened PR body: """ ipa-cert-fix man page needs to explain that certmonger may trigger a renewal right after ipa-cert-fix completes because certmonger does not notice the updated certificates. Fixes: https://pagure.io/freeipa/issue/8702 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5825/head:pr5825 git checkout pr5825

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel June 2021