August 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5987][opened] [Backport][ipa-4-9] freeipa.spec.in: update 389-DS version
by fcami 20 Aug '21

20 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5987 Author: fcami Title: #5987: [Backport][ipa-4-9] freeipa.spec.in: update 389-DS version Action: opened PR body: """ This PR was opened automatically because PR #5986 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5987/head:pr5987 git checkout pr5987

2 1

FreeIPA 4.9.7
by François Cami 20 Aug '21

20 Aug '21

The FreeIPA team would like to announce the FreeIPA 4.9.7 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 35 and 36 will be available from the official repository soon. The release notes can be read online: https://www.freeipa.org/page/Releases/4.9.7 or below. == Highlights in 4.9.7 == * 3226: [RFE] ipa sudorule-add-user should accept more types of characters * 8402: [RFE] ipa-client-install forces nsupdate to bind with gssapi: Invoke nsupdate without authentication if the GSS-TSIG attempt fails at install time ; configure SSSD to use nsupdate without GSS-TSIG in this case. * 8528: Use separate logs for AD Trust and DNS installer: ipa-adtrust-install and ipa-dns-install commands now log their activity into separate log files. * 8655: Allow to establish trust to Active Directory in FIPS mode: When IPA is deployed in FIPS mode, it is now possible to establish trust to Active Directory forest. * 8892: [RFE] When IPA system is healthy, ipa-healthcheck --failures-only should display proper message instead of empty list === Enhancements === * FreeIPA now provides centrally-managed allocation of ID sub-ranges for users and groups, for use in podman and runc. * ipa-getkeytab now has an option to discover servers using DNS SRV. * ipa-client-install now gracefully switches to using no authentication when updating its own DNS record if GSS-TSIG fails. It also configures SSSD to do the same. === Known Issues === * ipa-server-install --auto-reverse does not create a reverse DNS zone even when needed on systems using systemd-resolved. === Bug fixes === FreeIPA 4.9.7 is a stabilization release for the features delivered as a part of 4.9 version series. There are more than 50 bug-fixes since the 4.9.5 release, details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on the Upgrade page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * [https://pagure.io/freeipa/issue/3226 #3226] [RFE] ipa sudorule-add-user should accept more types of characters * [https://pagure.io/freeipa/issue/6587 #6587] ipa-otpd: systemctl reports "degraded" for "is-system-running" after todays CentOS updates * [https://pagure.io/freeipa/issue/7814 #7814] fix automountlocation-tofiles output * [https://pagure.io/freeipa/issue/8206 #8206] Add checks to prevent assigning authentication indicators to internal IPA services * [https://pagure.io/freeipa/issue/8227 #8227] dnszone-add: ignores given SOA serial * [https://pagure.io/freeipa/issue/8245 #8245] ipa-kra-install should exit if ca_host is overriden. * [https://pagure.io/freeipa/issue/8257 #8257] ipa-certupdate sets temporary ccache in the wrong place * [https://pagure.io/freeipa/issue/8361 #8361] Add support for managing subuids and subgids in FreeIPA * [https://pagure.io/freeipa/issue/8397 #8397] Cannot remove First master server with KRA after the server hard disk failed ( destructed) * [https://pagure.io/freeipa/issue/8402 #8402] [RFE] ipa-client-install forces nsupdate to bind with gssapi * [https://pagure.io/freeipa/issue/8415 #8415] Ignore case when evaluating attributes and objectclasses in config plugin * [https://pagure.io/freeipa/issue/8452 #8452] update samba configuration on IPA master to explicitly use 'server role' setting * [https://pagure.io/freeipa/issue/8478 #8478] Do SRV discovery in ipa-getkeytab if -s and -H aren't provided * [https://pagure.io/freeipa/issue/8501 #8501] Unify how FreeIPA gets FQDN of current host * [https://pagure.io/freeipa/issue/8519 #8519] Fedora container platform is incomplete * [https://pagure.io/freeipa/issue/8524 #8524] Deploy & manage the ACME service topology wide from a single system * [https://pagure.io/freeipa/issue/8528 #8528] Use separate logs for AD Trust and DNS installer * [https://pagure.io/freeipa/issue/8584 #8584] ACME communication with dogtag REST endpoints should be using the cookie it creates * [https://pagure.io/freeipa/issue/8647 #8647] Incorrect DNSKEY created when DNSSEC enabled for zone * [https://pagure.io/freeipa/issue/8655 #8655] Allow to establish trust to Active Directory in FIPS mode * [https://pagure.io/freeipa/issue/8676 #8676] [Tracker] Multiple nightly test failure in test_integration/test_ntp_options/TestNTPoptions * [https://pagure.io/freeipa/issue/8795 #8795] Remove dependency from tests on ipaserver package/modules * [https://pagure.io/freeipa/issue/8810 #8810] Nightly test failure (rawhide/f34) in test_ipahealthcheck.py::TestIpaHealthCheck: missing AAAA record for ipa-ca * [https://pagure.io/freeipa/issue/8832 #8832] ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4 * [https://pagure.io/freeipa/issue/8864 #8864] azure: dnf sometimes fails * [https://pagure.io/freeipa/issue/8889 #8889] [tests] healthcheck 0.9 * [https://pagure.io/freeipa/issue/8890 #8890] Nightly test failure (rawhide) in test_ipa_cert_fix.py::TestIpaCertFix::test_missing_startup * [https://pagure.io/freeipa/issue/8891 #8891] FreeIPA server in debug mode fails to run because time.perf_counter_ns is Python 3.7+ * [https://pagure.io/freeipa/issue/8892 #8892] [RFE] When IPA system is healthy, ipa-healthcheck --failures-only should display proper message instead of empty list * [https://pagure.io/freeipa/issue/8905 #8905] Package python3-ipatests (from CRB repo) Requires python3-coverage * [https://pagure.io/freeipa/issue/8906 #8906] support for SHA384withRSA signing algo missing * [https://pagure.io/freeipa/issue/8909 #8909] Unable to set ipaUserAuthType with stageuser-add * [https://pagure.io/freeipa/issue/8911 #8911] Nightly test failure in pki-fedora/test_webui_cert. * [https://pagure.io/freeipa/issue/8913 #8913] [man page] contradiction in ipa-server-upgrade command's man page and usage * [https://pagure.io/freeipa/issue/8918 #8918] Nightly failure in test_external_ca.py::TestSelfExternalSelf::test_switch_back_to_self_signed * [https://pagure.io/freeipa/issue/8919 #8919] Nightly test failure in test_webui/test_range.py::test_range::test_crud * [https://pagure.io/freeipa/issue/8920 #8920] ipa-healthcheck reports RIPluginCheck CRITICAL error for DSRILE0002 * [https://pagure.io/freeipa/issue/8923 #8923] Trust controller role should pull sssd-winbind-idmap package * [https://pagure.io/freeipa/issue/8925 #8925] ipatests: NAMED_CRYPTO_POLICY_FILE not defined for RHEL * [https://pagure.io/freeipa/issue/8926 #8926] Nightly test failure (rawhide) in test_smb * [https://pagure.io/freeipa/issue/8929 #8929] Nightly test failure in test_integration//test_acme.py/TestACMERenew/test_renew - kinit admin: Password change failed while getting initial credentials * [https://pagure.io/freeipa/issue/8930 #8930] IdM should call into Dogtag to dynamically update the security domain info * [https://pagure.io/freeipa/issue/8931 #8931] flake8 report for tasks.py * [https://pagure.io/freeipa/issue/8934 #8934] ipa-advise unconditionally uses modutil to load opensc module * [https://pagure.io/freeipa/issue/8935 #8935] [tracker] Update boxes for PR-CI nightly runs * [https://pagure.io/freeipa/issue/8936 #8936] ipa-server install failure without DNS * [https://pagure.io/freeipa/issue/8937 #8937] Multiple issues in tasks's install/uninstall helpers * [https://pagure.io/freeipa/issue/8938 #8938] Remove python3-pexpect as dependency for ipatests pkg * [https://pagure.io/freeipa/issue/8939 #8939] Add index for sudoorder * [https://pagure.io/freeipa/issue/8942 #8942] TestAJPSecretUpgrade tests fail on system without pkiuser * [https://pagure.io/freeipa/issue/8944 #8944] TestIpaAdTrustInstall::test_ipa_user_s4u2self_pac failed at create_active_user * [https://pagure.io/freeipa/issue/8949 #8949] Test for RFE ipa-healthcheck should verify owner/perms for important logs in "/var/log" in the ipahealthcheck.ipa.files source * [https://pagure.io/freeipa/issue/8956 #8956] Nightly failure in test_caless.py::TestIPACommands::test_invoke_upgrader == Detailed changelog since 4.9.6 == === Armando Neto (1) === * ipatests: bump prci boxes + move gating to f34 [https://pagure.io/freeipa/c/02447762a3f62383313f0b8cd7c5d129dc2c6213 commit] [https://pagure.io/freeipa/issue/8935 #8935] === Alexander Bokovoy (2) === * rhel platform: add a named crypto-policy support [https://pagure.io/freeipa/c/1a5159b216455070eb51b6a11ceaf0033fc8ce4c commit] [https://pagure.io/freeipa/issue/8925 #8925] * Back to git snapshots [https://pagure.io/freeipa/c/2b7e8841824b44fc41581717c51ccd4b0fc553ff commit] === Anuja More (5) === * ipatests: Test unsecure nsupdate. [https://pagure.io/freeipa/c/4fdab0c94c4e17e42e5f38a0e671bea39bcc9b74 commit] [https://pagure.io/freeipa/issue/8402 #8402] * ipatests: Refactor test_check_otpd_after_idle_timeout [https://pagure.io/freeipa/c/eac03d6828d0bac1925c897090fc77e250eaee04 commit] [https://pagure.io/freeipa/issue/6587 #6587] * ipatests: skip test_basesearch_compat_tree on fedora. [https://pagure.io/freeipa/c/d4062e407d242a72b9d4e32f4fdd6aed086ce005 commit] * ipatests: Test ldapsearch with base scope works with compat tree. [https://pagure.io/freeipa/c/a3d71eb72a6125a80a9d7b698f34dcb95dc25184 commit] * ipatests: Test for OTP when the LDAP connection timed out. [https://pagure.io/freeipa/c/25a4acf3ad5964eacddbcb83ddf9f84432968918 commit] [https://pagure.io/freeipa/issue/6587 #6587] === Antonio Torres (6) === * ipatests: expect SOA serial option deprecation warning [https://pagure.io/freeipa/c/1d7512495d3e7f933d95707f74a6b6f0aeecd00f commit] [https://pagure.io/freeipa/issue/8227 #8227] * dnszone: deprecate option for setting SOA serial [https://pagure.io/freeipa/c/4c0dcabd6e2163dfa80a4d2a18064824934274fa commit] [https://pagure.io/freeipa/issue/8227 #8227] * ipatests: test if KRA install fails when ca_host is overriden [https://pagure.io/freeipa/c/a4e13a33247fb14145c632fb53b4480fc5fb10ea commit] [https://pagure.io/freeipa/issue/8245 #8245] * ipa-kra-install: exit if ca_host is overriden [https://pagure.io/freeipa/c/ab4720d9c2bae059e8f622cd4a331510fefe27ae commit] [https://pagure.io/freeipa/issue/8245 #8245] * ipatests: ensure auth indicators can't be added to internal IPA services [https://pagure.io/freeipa/c/28484c3dee225662e41acc691bfe6b1c1cee99c8 commit] [https://pagure.io/freeipa/issue/8206 #8206] * Add checks to prevent adding auth indicators to internal IPA services [https://pagure.io/freeipa/c/a5d2857297cfcf87ed8973df96e89ebcef22850d commit] [https://pagure.io/freeipa/issue/8206 #8206] === Christian Heimes (8) === * Fix string check in uninstall helper [https://pagure.io/freeipa/c/c5b5bc9099fc26b863d7c964e47dbdcd0ff008c8 commit] [https://pagure.io/freeipa/issue/8937 #8937] * Fix ldapupdate.get_sub_dict() for missing named user [https://pagure.io/freeipa/c/a1eb13cdbc109da8c028bb886a1207ea2cc23cee commit] [https://pagure.io/freeipa/issue/8936 #8936] * Test DNA plugin configuration [https://pagure.io/freeipa/c/b53a52a1fafa94e0129e6e3e55fddd59909f0f0a commit] * Fix oid of ipaUserDefaultSubordinateId [https://pagure.io/freeipa/c/44ccc0f64bac9fc2e7e3264984af26635bb34742 commit] * Fix ipa-server-upgrade [https://pagure.io/freeipa/c/e6e3fb606d08b0dc57bfa360a0f0082052441db6 commit] * Use 389-DS' dnaInterval setting to assign intervals [https://pagure.io/freeipa/c/ef115b04182d572bf61e32e2405bbb68ff65e928 commit] * Redesign subid feature [https://pagure.io/freeipa/c/5d4fe06663c3e66b1da73c01ce022790634a3e3b commit] * Add basic support for subordinate user/group ids [https://pagure.io/freeipa/c/3540986a11d4f3401ba4918f25229a79283d9dbd commit] [https://pagure.io/freeipa/issue/8361 #8361] === Chris Kelley (2) === * Parse cert chain as JSON not XML [https://pagure.io/freeipa/c/40f76a53f78267b4d2b890defa3e4f7d27fdfb7a commit] * Parse getStatus as JSON not XML [https://pagure.io/freeipa/c/7fb95cc638b1c9b7f2e9a67dba859ef8126f2c5f commit] === François Cami (13) === * Update list of contributors [https://pagure.io/freeipa/c/3cb6b5c801b04922c3a23070e79aab20399d033b commit] * ipatests: use krb5_trace in TestIpaAdTrustInstall [https://pagure.io/freeipa/c/9ae23e1257478bfee04b08b54f36dda7f5850348 commit] [https://pagure.io/freeipa/issue/8944 #8944] * freeipa.spec.in: remove python3-pexpect from Requires [https://pagure.io/freeipa/c/e0e1d6f94dd16c8066be8ce3c75ef306890a3e2b commit] [https://pagure.io/freeipa/issue/8938 #8938] * gating.yaml: Fix TestInstallMaster timeout [https://pagure.io/freeipa/c/33c561dcd30dc346ccbaa00933bcd1cac5e994b6 commit] * Azure: temporarily disable problematic tests, #2 [https://pagure.io/freeipa/c/18ccaea7cb36b3d1069f0d12a15b06357b3f94f0 commit] [https://pagure.io/freeipa/issue/8864 #8864] * Azure: temporarily disable problematic tests, #1 [https://pagure.io/freeipa/c/eb1d509fd5271d39cc899838b57e5398683401f7 commit] [https://pagure.io/freeipa/issue/8864 #8864] * tasks.py: fix flake8-reported issues [https://pagure.io/freeipa/c/5b826ab3582566b15a618f57cb2e002a9c16ef64 commit] [https://pagure.io/freeipa/issue/8931 #8931] * test_acme: make password renewal more robust [https://pagure.io/freeipa/c/701adb9185c77194ba1ad0c5fd2f13484417ef6f commit] [https://pagure.io/freeipa/issue/8929 #8929] * test_acme: refactor with tasks [https://pagure.io/freeipa/c/86869364a30f071ee79974b301ff68e80c0950ba commit] * ipatests: smbclient "-k" => "--use-kerberos=desired" [https://pagure.io/freeipa/c/161d5844eb1214e60c636bdb73713c6a43f1e75c commit] [https://pagure.io/freeipa/issue/8926 #8926] * rpcserver.py: perf_counter_ns is Python 3.7+ [https://pagure.io/freeipa/c/1539c7383116647ad9c5b125b343f972e9c9653b commit] [https://pagure.io/freeipa/issue/8891 #8891] * ipatests: smoke test for server debug mode. [https://pagure.io/freeipa/c/ee4be290e1583834a573c3896ee1d97b3fbb6c24 commit] [https://pagure.io/freeipa/issue/8891 #8891] * paths: add IPA_SERVER_CONF [https://pagure.io/freeipa/c/e713c227bb420a841ce3ae146bca55a84a1b0dbf commit] [https://pagure.io/freeipa/issue/8891 #8891] === Florence Blanc-Renaud (12) === * webui tests: fix algo for finding available idrange [https://pagure.io/freeipa/c/f7997ed0b7d5b915c0184bf8e8864ff935cd6232 commit] [https://pagure.io/freeipa/issue/8919 #8919] * Index: Fix definition for memberOf [https://pagure.io/freeipa/c/b132956e42a88ab39bb8d6a854e7c5d28d544a11 commit] [https://pagure.io/freeipa/issue/8920 #8920] * spec file: Trust controller role should pull sssd-winbind-idmap package [https://pagure.io/freeipa/c/1a4f459b81bc77cdf233b65f41d0f76dbb5f2fce commit] [https://pagure.io/freeipa/issue/8923 #8923] * webui tests: close notification when revoking cert [https://pagure.io/freeipa/c/40e4ccf1ea943aba4d10e8126ffa49feddd2e683 commit] [https://pagure.io/freeipa/issue/8911 #8911] * pr-ci definitions: add subid-related jobs [https://pagure.io/freeipa/c/d456649feb40d462f73321a4a220b4aff7adb443 commit] [https://pagure.io/freeipa/issue/8361 #8361] * ipatests: use whole date when calling journalctl --since [https://pagure.io/freeipa/c/b2e6292337c6f7f68ac383db8aa54a1abfa3f6b4 commit] [https://pagure.io/freeipa/issue/8918 #8918] * Server install: do not use unchecked ip addr for ipa-ca record [https://pagure.io/freeipa/c/2c0a123e99d943f115cc726e391f5d79b5bfb70e commit] [https://pagure.io/freeipa/issue/8810 #8810] * man page: update ipa-server-upgrade.1 [https://pagure.io/freeipa/c/195035cef51a132b2b80df57ed50f2fe620244e6 commit] [https://pagure.io/freeipa/issue/8913 #8913] * augeas: bump version for rhel9 [https://pagure.io/freeipa/c/076e499f6f1223458cb896f1e90296e511c922d7 commit] [https://pagure.io/freeipa/issue/8676 #8676] * XMLRPC test: add a test for stageuser-add --user-auth-type [https://pagure.io/freeipa/c/4a5a0fe7d25209a41a2eadd159f7f4c771e5d7fc commit] [https://pagure.io/freeipa/issue/8909 #8909] * stageuser: add ipauserauthtypeclass when required [https://pagure.io/freeipa/c/06468b2f604c56b02231904072cb57412966a701 commit] [https://pagure.io/freeipa/issue/8909 #8909] * Remove unneeded dependency on python-coverage [https://pagure.io/freeipa/c/9cfae2623420356fd99e09bf8559b11da66e2ccd commit] [https://pagure.io/freeipa/issue/8905 #8905] === Michal Polovka (3) === * ipatests: test_ipahealthcheck: Verify permissions for /var/log/ files [https://pagure.io/freeipa/c/488ac7e3ba9f36d6b187687d120920d2d80d8b7f commit] [https://pagure.io/freeipa/issue/8949 #8949] * ipatests: test_installation: move tracking_reqs dependency to ipalib constants ipaserver: krainstance: utilize moved tracking_reqs dependency [https://pagure.io/freeipa/c/e5df4dc4884f1a66ccbca79b9a0d83874c996d1d commit] [https://pagure.io/freeipa/issue/8795 #8795] * ipatests: test_ipahealthcheck: print a message if a system is healthy [https://pagure.io/freeipa/c/7f910eb2dda8595da435b4aed6e759a2916df813 commit] [https://pagure.io/freeipa/issue/8892 #8892] === Mohammad Rizwan (2) === * ipatests: Look for warning into stderr instead of stdout [https://pagure.io/freeipa/c/96dd8ac1cd2e7fb8177d83e7ba5c6d79f4216ea3 commit] [https://pagure.io/freeipa/issue/8890 #8890] * ipatests: Test ipa-cert-fix warns when startup directive is missing from CS.cfg [https://pagure.io/freeipa/c/02c0da3ef74948579106aab4b669f6e64dd60b24 commit] [https://pagure.io/freeipa/issue/8890 #8890] === Rob Crittenden (21) === * Only call add_agent_to_security_domain_admins() when CA is installed [https://pagure.io/freeipa/c/da1d543c2bfa9e4acb6fde170e66c88e521ac232 commit] [https://pagure.io/freeipa/issue/8956 #8956] * ipatests: Verify that securitydomain is updated on server-del [https://pagure.io/freeipa/c/a417810df5500b5780396ab88d53eaea74f74ccc commit] [https://pagure.io/freeipa/issue/8930 #8930] * Clean up the PKI securitydomain when removing a server [https://pagure.io/freeipa/c/be3a0f3201bbb060a9d53fb65cbbccf6c7bf9bb4 commit] [https://pagure.io/freeipa/issue/8930 #8930] * pr-ci definitions: add custom plugin-related jobs [https://pagure.io/freeipa/c/78c48199782743e619463cefa7411817f4fe4a14 commit] [https://pagure.io/freeipa/issue/8415 #8415] * ipatests: add suite for testing custom plugins [https://pagure.io/freeipa/c/e28e45402c7edb007e356a59cf09ed8e10cd14d9 commit] [https://pagure.io/freeipa/issue/8415 #8415] * Don't assume that plugin attributes and objectclasses are lowercase [https://pagure.io/freeipa/c/97a2a925348d3bd732e582108feb02d644ba011a commit] [https://pagure.io/freeipa/issue/8415 #8415] * Add index for sudoorder [https://pagure.io/freeipa/c/0526174971017aebfb9d9fcb29c6dde6e67438fe commit] [https://pagure.io/freeipa/issue/8939 #8939] * ipatests: verify that getcert output includes the issued date [https://pagure.io/freeipa/c/826b5825bd644fc69a9bee17626d71fe03cc0190 commit] * ipa-advise: Define the domain used when looking up ipa-ca [https://pagure.io/freeipa/c/9a4a6cdd27781573351595e38d38eeadc8ab090d commit] [https://pagure.io/freeipa/issue/8934 #8934] * ipa-advise: if p11-kit provides opensc, don't add to NSS db [https://pagure.io/freeipa/c/018ee09ccbe7fc0a5b0909592eadd168224b2409 commit] [https://pagure.io/freeipa/issue/8934 #8934] * ipatests: test ipa-getkeytab server option [https://pagure.io/freeipa/c/7a13200fd8b92dd90ebc4b6416ef25659df8aa71 commit] [https://pagure.io/freeipa/issue/8478 #8478] * ipa-getkeytab: fix compiler warnings [https://pagure.io/freeipa/c/0114d24ea160676b784ef7010c19bbacc67ceea0 commit] [https://pagure.io/freeipa/issue/8478 #8478] * ipa-getkeytab: add option to discover servers using DNS SRV [https://pagure.io/freeipa/c/42206df69adc9c1eefa3ee576891b2ae3ac269e0 commit] [https://pagure.io/freeipa/issue/8478 #8478] * Provide more information in ipa-certupdate on ccache failure [https://pagure.io/freeipa/c/fbbff3edc0fcc8bf2624283ccd88848eedaac8d7 commit] [https://pagure.io/freeipa/issue/8257 #8257] * Fix automountlocation-tofiles expected output in xmlrpc test [https://pagure.io/freeipa/c/ded3cd3fc8490561e44310e8f89efc3e13e82884 commit] [https://pagure.io/freeipa/issue/7814 #7814] * ipatests: Add test for ipa automountlocation-tofiles [https://pagure.io/freeipa/c/dbe4159e27d44550085cb3ce0629d1e525c9b30e commit] [https://pagure.io/freeipa/issue/7814 #7814] * Display all orphaned keys in automountlocation-tofiles [https://pagure.io/freeipa/c/89ca5c8836333aece9caf2ac433ccab1140f909a commit] [https://pagure.io/freeipa/issue/7814 #7814] * ipatests: test removing last KRA when it is not running [https://pagure.io/freeipa/c/8ea8f8b68b5a7217518f68065a5fc1df16126314 commit] [https://pagure.io/freeipa/issue/8397 #8397] * Use new method in check to prevent removal of last KRA [https://pagure.io/freeipa/c/0b9adf1d8d5efb48e734650e4101e8816b01e1d3 commit] [https://pagure.io/freeipa/issue/8397 #8397] * Fall back to krbprincipalname when validating host auth indicators [https://pagure.io/freeipa/c/8ad535b618d60fa016061212ff85d0ad28ccae59 commit] [https://pagure.io/freeipa/issue/8206 #8206] * Add SHA384withRSA as a certificate signing algorithm [https://pagure.io/freeipa/c/ca8c7010e8aa0f87bde11c36947fefd549bae8fd commit] [https://pagure.io/freeipa/issue/8906 #8906] === Stanislav Levin (1) === * ipatests: Fix TestAJPSecretUpgrade tests on systems without pkiuser [https://pagure.io/freeipa/c/c9bc471e063f2865d6423e4f1c9b81e73a45e43f commit] [https://pagure.io/freeipa/issue/8942 #8942] === Serhii Tsymbaliuk (1) === * WebUI: Improve subordinate ids user workflow [https://pagure.io/freeipa/c/9f4b8982cd06011df8daac480a726637fc52649e commit] [https://pagure.io/freeipa/issue/8361 #8361] === Sudhir Menon (1) === * ipatests: Fix for test_source_ipahealthcheck_iptest_source_ipahealthcheck_ipa_host_check_ipahostkeytab [https://pagure.io/freeipa/c/26be7ffdba87e0e6294ea035ab3dc9bd933fba43 commit] [https://pagure.io/freeipa/issue/8889 #8889]

1 0

[freeipa PR#5986][opened] freeipa.spec.in: update 389-DS version
by fcami 20 Aug '21

20 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5986 Author: fcami Title: #5986: freeipa.spec.in: update 389-DS version Action: opened PR body: """ Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5986/head:pr5986 git checkout pr5986

1 1

[freeipa PR#5738][opened] ipatests: wait while http/ldap/pkinit cert get renew on replica
by mrizwan93 19 Aug '21

19 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5738 Author: mrizwan93 Title: #5738: ipatests: wait while http/ldap/pkinit cert get renew on replica Action: opened PR body: """ LDAP/HTTP/PKINIT certificates should be renewed on replica after moving system date. Test was failing because ipa-cert-fix ran while these cert was not renewed and it tried to fix it. Fixes: https://pagure.io/freeipa/issue/8815 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5738/head:pr5738 git checkout pr5738

2 1

[freeipa PR#5979][opened] schema plugin: Generate stable fingerprint
by stanislavlevin 19 Aug '21

19 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5979 Author: stanislavlevin Title: #5979: schema plugin: Generate stable fingerprint Action: opened PR body: """ If some Param defines several values for `exclude` or `include` attributes then API schema hash will be unstable. First, these Param's attributes are converted to frozenset (`ipalib.parameters`), then `ipaserver.plugins.schema` plugin converts `exclude` and `include` attrs to list. Set/frozenset in turn, is unordered collection \[0\]. So, the end order of values is undefined. But due to the nature of sets: > two sets are equal if and only if every element of each set is contained in the other (each is a subset of the other) the order of values can be ignored. Note: other Param's attrs with type frozenset are not affected because they are not processed by the schema plugin. \[0\]: https://docs.python.org/3/library/stdtypes.html#set-types-set-frozenset Fixes: https://pagure.io/freeipa/issue/8955 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5979/head:pr5979 git checkout pr5979

2 1

[freeipa PR#5981][opened] [Backport][ipa-4-9] Only call add_agent_to_security_domain_admins() when CA is installed
by rcritten 18 Aug '21

18 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5981 Author: rcritten Title: #5981: [Backport][ipa-4-9] Only call add_agent_to_security_domain_admins() when CA is installed Action: opened PR body: """ This PR was opened automatically because PR #5980 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5981/head:pr5981 git checkout pr5981

1 1

[freeipa PR#5977][opened] [Backport][ipa-4-9] Clean up the PKI securitydomain when removing a server
by flo-renaud 17 Aug '21

17 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5977 Author: flo-renaud Title: #5977: [Backport][ipa-4-9] Clean up the PKI securitydomain when removing a server Action: opened PR body: """ This PR was opened automatically because PR #5915 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5977/head:pr5977 git checkout pr5977

2 1

[freeipa PR#5980][opened] Only call add_agent_to_security_domain_admins() when CA is installed
by rcritten 17 Aug '21

17 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5980 Author: rcritten Title: #5980: Only call add_agent_to_security_domain_admins() when CA is installed Action: opened PR body: """ Only call add_agent_to_security_domain_admins() when CA is installed This allows the RA agent to manage the pki security domain and is only needed if a CA has been configured. Only call it in a CA-ful installation. https://pagure.io/freeipa/issue/8956 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5980/head:pr5980 git checkout pr5980

1 1

[freeipa PR#5829][opened] WSGI: Control passed environment variables
by stanislavlevin 16 Aug '21

16 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5829 Author: stanislavlevin Title: #5829: WSGI: Control passed environment variables Action: opened PR body: """ It's common practice to care about input environment variables and to produce a minimal and safe set of such. Fixes: https://pagure.io/freeipa/issue/8881 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5829/head:pr5829 git checkout pr5829

1 1

[freeipa PR#5978][opened] ipatests: Additional tests for ipa subordinate ids
by menonsudhir 16 Aug '21

16 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5978 Author: menonsudhir Title: #5978: ipatests: Additional tests for ipa subordinate ids Action: opened PR body: """ 1. Test check that when no subid is provided in ipa subid-show command error message is displayed on the console. 2. Test check that when regular ipa user tries to generate subid an error is displayed """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5978/head:pr5978 git checkout pr5978

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel August 2021