[freeipa PR#5805][opened] service: enforce keytab user when retrieving the keytab
by abbra
URL: https://github.com/freeipa/freeipa/pull/5805
Author: abbra
Title: #5805: service: enforce keytab user when retrieving the keytab
Action: opened
PR body:
"""
HTTP service uses different user for keytab ownership than the service
user. On Fedora this leads to http.keytab being owned by 'apache' user
after IPA deployment while it should be owned by 'root' to allow
GSSPROXY configuration to work correctly.
The situation is fixed during upgrade (ipa-server-upgrade) but it means
for new deployments there might be a period of unexplained Web UI
authentication failures.
Fixes: https://pagure.io/freeipa/issue/8872
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5805/head:pr5805
git checkout pr5805
2 years, 10 months
Preparing for FreeIPA 4.9.4 release
by Alexander Bokovoy
Hi,
I am planning to do FreeIPA 4.9.4 release, hopefully, this week.
As usual, current release notes draft is at
https://vda.li/drafts/freeipa-4.9.4-release-notes-final.html
We have around 30 tickets resolved:
#2575 (rhbz#952756) [RFE] Installer wizard should prompt for DNS
#2692 (rhbz#817071) ipa-server-install ignores --hostname
#4011 (rhbz#1026434) ipa-server-install crashes when AD subpackage is not installed
#4166 (rhbz#1059135) Backup CS.cfg before modifying it
#4751 (rhbz#1851835) Implement ACME certificate enrolment
#6587 ipa-otpd: systemctl reports "degraded" for "is-system-running" after todays CentOS updates
#7835 (rhbz#1658280) Cert revocation for services and hosts is inefficient
#8203 (rhbz#1835853) User page on WebUi only has half the information in CA-less install
#8361 Add support for managing subuids and subgids in FreeIPA
#8534 Nightly test failure in test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion::test_hidden_replica_promote
#8582 Nightly test failure in test_replica_promotion.py::TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica - ClonesConnectivyAndDataCheck
#8632 [CA-less] user fails to login via WebUI in case of `--no-pkinit`
#8641 Random failure in test_webui/test_user.py::TestLifeCycles::test_life_cycles
#8676 (rhbz#1955440) [Tracker] Multiple nightly test failure in test_integration/test_ntp_options/TestNTPoptions
#8738 (rhbz#1934991) ACME fails to generate a cert on migrated RHEL8.4 server
#8767 (rhbz#1943151) ipa-server-install displays debug output when --debug output is not specified.
#8784 RFE: Reduce number of LDAP operations during hbacrule-del
#8785 Nightly test failure in test_integration/test_commands.py/TestIPACommand/test_proxycommand_invalid_shell
#8787 Add pkey_only to the service_find calls in the host plugin
#8792 Random nightly test failure in test_replica_promotion.py::TestRenewalMaster::test_automatic_renewal_master_transfer_ondelete
#8794 (rhbz#1948034) Failure to deploy FreeIPA domain controller in Rawhide with systemd-resolved 248-1.fc35
#8797 Cache the value of ca_is_enabled in the request context
#8798 (rhbz#1953656) RFE: Cache LDAP data within a request
#8801 user-mod requires two searches for a user entry
#8802 IPA test failing with long serial numbers
#8807 (rhbz#1688267) [RFE] IPA to allow setting a new range type.
#8809 RFE: A tool to collect and analyze etimes from IPA logs
#8814 Use Dogtag's CryptographyCryptoProvider instead of NSSCryptoProvider for KRAClient()
#8818 new pylint 2.8 and astroid 2.5.5
#8830 [azure] performance instability
#8831 update_dna_shared_config may not update all entries
#8832 (rhbz#1957768) ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4
I would wait for F34 Azure CI patches but this is not strictly necessary, we can
do another release once they are ready.
We need to figure out what else is worth waiting for. Right now
following PRs have ipa-4-9 label:
5769 WebUI: Add support of 'ipaautoprivategroups' LDAP WebUI ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5769
5749 pkispawn: override the AJP address ipa-4-9 https://github.com/freeipa/freeipa/pull/5749
5733 Revert the way hosts/services certs are searched f WIP ipa-4-9 needs rebase https://github.com/freeipa/freeipa/pull/5733
5662 ipatests: add test for login with FAST armoring en ipa-4-8 ipa-4-9 https://github.com/freeipa/freeipa/pull/5662
5656 [ipatests] Add basic support for remote ipaplatfor ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5656
5637 ipatests: Test to check that ResponseNotReady erro ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5637
5617 Add checks to prevent adding auth indicators to in ipa-4-9 https://github.com/freeipa/freeipa/pull/5617
5387 Raise RuntimeError when kinit_armor fails ipa-4-9 stale https://github.com/freeipa/freeipa/pull/5387
4909 Add unauthenticated nsupdate ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/4909
389-ds did rename Multimaster replication plugin to Multisupplier and we
need to be able to install with both old and new plugin names. May be
someone could pick up the work Mark Reynolds did in
https://github.com/freeipa/freeipa/pull/5739 and add support for both
ways?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
2 years, 10 months