September 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5976][opened] Translations update from Weblate
by weblate 07 Dec '21

07 Dec '21

URL: https://github.com/freeipa/freeipa/pull/5976 Author: weblate Title: #5976: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/freeipa/ipa-4-8/) for freeipa/ipa-4-8. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/freeipa/-/ipa-4-8/horiz… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5976/head:pr5976 git checkout pr5976

2 1

[freeipa PR#6023][opened] ipatests: fix TestInstallWithCA_DNS3's resolv.conf
by fcami 23 Nov '21

23 Nov '21

URL: https://github.com/freeipa/freeipa/pull/6023 Author: fcami Title: #6023: ipatests: fix TestInstallWithCA_DNS3's resolv.conf Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6023/head:pr6023 git checkout pr6023

1 1

[freeipa PR#5939][opened] ipaserver: disable resolved' stub resolver
by fcami 23 Nov '21

23 Nov '21

URL: https://github.com/freeipa/freeipa/pull/5939 Author: fcami Title: #5939: ipaserver: disable resolved' stub resolver Action: opened PR body: """ Disable systemd-resolved stub resolver at install time. Use systemd-resolved' maintained list of upstream DNS servers instead. Rationale: systemd-resolved always resolves the FQDN to the local IP and vice-versa. This breaks DNS zone detection and especially reverse zone detection. This results in --auto-reverse being broken. On systemd-resolved enabled systems, there are four ways to configure resolv.conf: * a symlink to /run/systemd/resolve/stub-resolv.conf This is the default and uses both the 127.0.0.53 DNS stub plus the search domains. * a symlink to /usr/lib/systemd/resolv.conf This only contains the 127.0.0.53 DNS stub. * a symlink to /run/systemd/resolve/resolv.conf This contains the upstream DNS IPs and bypasses systemd-resolved. * Create and maintain /etc/resolv.conf directly. Solutions #1 and #2 break DNS zone detection. Solution #4 is not straightforward. Combine Solution3 and 4: copy the file containing the upstream DNS IPs so that it is properly maintained by NetworkManager after installation. Fixes: https://pagure.io/freeipa/issue/8700 Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5939/head:pr5939 git checkout pr5939

1 1

[freeipa PR#5845][opened] component: Fix installation on hosts withouc /proc/1/sched.
by pfandl 09 Nov '21

09 Nov '21

URL: https://github.com/freeipa/freeipa/pull/5845 Author: pfandl Title: #5845: component: Fix installation on hosts withouc /proc/1/sched. Action: opened PR body: """ My host does not have `/proc/1/sched` and this patch fixes the installation exception. I have not tested the other code path where `ìs_hidepid` is `True`. best regards """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5845/head:pr5845 git checkout pr5845

1 1

[freeipa PR#6033][opened] Design: Integrate SID configuration into base IPA installers
by flo-renaud 28 Oct '21

28 Oct '21

URL: https://github.com/freeipa/freeipa/pull/6033 Author: flo-renaud Title: #6033: Design: Integrate SID configuration into base IPA installers Action: opened PR body: """ Add design doc for the feature. Related: https://pagure.io/freeipa/issue/8995 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6033/head:pr6033 git checkout pr6033

2 1

[freeipa PR#6031][opened] Improve sudooption docs, make the option multi-value
by rcritten 08 Oct '21

08 Oct '21

URL: https://github.com/freeipa/freeipa/pull/6031 Author: rcritten Title: #6031: Improve sudooption docs, make the option multi-value Action: opened PR body: """ I don't know why this wasn't always multi-value but if one wanted to set multiple options they needed to call add-option multiple times. The LDAP attribute is already multi-value. This shouldn't cause API issues as it understood the attribute as multi-value just didn't expose it. Client output on the CLI will look a bit different: Added option "('one', 'two')" to Sudo Rule "test" or Added option "(u'one', u'Two')" to Sudo Rule "test" instead of with this change: Added option "one,two" to Sudo Rule "test" https://pagure.io/freeipa/issue/2278 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6031/head:pr6031 git checkout pr6031

2 1

[freeipa PR#6022][opened] WIP: fix failure in test_extdom_plugin
by wladich 05 Oct '21

05 Oct '21

URL: https://github.com/freeipa/freeipa/pull/6022 Author: wladich Title: #6022: WIP: fix failure in test_extdom_plugin Action: opened PR body: """ https://pagure.io/freeipa/issue/8987 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6022/head:pr6022 git checkout pr6022

1 1

[freeipa PR#6034][opened] [Backport][ipa-4-9] ipatests: increase sosreport verbosity
by flo-renaud 30 Sep '21

30 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6034 Author: flo-renaud Title: #6034: [Backport][ipa-4-9] ipatests: increase sosreport verbosity Action: opened PR body: """ This PR was opened automatically because PR #6032 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6034/head:pr6034 git checkout pr6034

1 1

[freeipa PR#6035][opened] [Backport][ipa-4-9] ipatests: update expected error message for openssl verify
by flo-renaud 29 Sep '21

29 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6035 Author: flo-renaud Title: #6035: [Backport][ipa-4-9] ipatests: update expected error message for openssl verify Action: opened PR body: """ This PR was opened automatically because PR #6030 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6035/head:pr6035 git checkout pr6035

1 1

[freeipa PR#6030][opened] ipatests: update expected error message for openssl verify
by flo-renaud 29 Sep '21

29 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6030 Author: flo-renaud Title: #6030: ipatests: update expected error message for openssl verify Action: opened PR body: """ The test TestIpaHealthCheckWithExternalCA::test_ipahealthcheck_ipaopensslchainvalidation needs to be adapted with the new error message returned by openssl verify when the provided certificate file does not exist. The message changed with openssl3. Fixes: https://pagure.io/freeipa/issue/8999 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6030/head:pr6030 git checkout pr6030

1 1

[freeipa PR#6032][opened] ipatests: increase sosreport verbosity
by flo-renaud 29 Sep '21

29 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6032 Author: flo-renaud Title: #6032: ipatests: increase sosreport verbosity Action: opened PR body: """ With the new version sos-4.2-1, sos report -v prints the debug messages into sos.log only. In order to see the debug messages in the console, -vv is needed. For more info refer to sos report commit sosreport/sos@1d0729a Since the test is looking for messages in stdout, use -vv to make sure the expected messages are printed in the console. Fixes: https://pagure.io/freeipa/issue/9000 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6032/head:pr6032 git checkout pr6032

1 1

[freeipa PR#6029][opened] [Backport][ipa-4-9] selinux: Fix file context definition for /var/run
by rcritten 27 Sep '21

27 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6029 Author: rcritten Title: #6029: [Backport][ipa-4-9] selinux: Fix file context definition for /var/run Action: opened PR body: """ This PR was opened automatically because PR #6028 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6029/head:pr6029 git checkout pr6029

1 1

[freeipa PR#6028][opened] selinux: Fix file context definition for /var/run
by vmojzis 27 Sep '21

27 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6028 Author: vmojzis Title: #6028: selinux: Fix file context definition for /var/run Action: opened PR body: """ There is a file context equivalence rule assigning /run the same contexts as /var/run. Because of it it's necessary to use /var/run instead of /run in file context definitions. See: https://fedoraproject.org/wiki/SELinux/IndependentPolicy#File_contexts_and_… Signed-off-by: Vit Mojzis <vmojzis(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6028/head:pr6028 git checkout pr6028

2 1

Request for promotion to rank of "editor"
by Dylan Boyd 27 Sep '21

27 Sep '21

Good day, lovely folk here at FreeIPA I'm getting started with FreeIPA, and spent the better part of an hour figuring out why the firewalld rules "freeipa-ldap" and "freeipa-ldaps" weren't having the desired effect. Digging into the firewalld rule XML files, I found that they're deprecated, yet are cited in the documentation. Would you be so kind as to add me to the editor group such that I might correct this?

2 1

[freeipa PR#6027][opened] [Backport][ipa-4-9] kdb: fix typo in ipa_kdcpolicy_check_as
by flo-renaud 22 Sep '21

22 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6027 Author: flo-renaud Title: #6027: [Backport][ipa-4-9] kdb: fix typo in ipa_kdcpolicy_check_as Action: opened PR body: """ This PR was opened automatically because PR #6026 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6027/head:pr6027 git checkout pr6027

1 1

[freeipa PR#6026][opened] kdb: fix typo in ipa_kdcpolicy_check_as
by pbrezina 22 Sep '21

22 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6026 Author: pbrezina Title: #6026: kdb: fix typo in ipa_kdcpolicy_check_as Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6026/head:pr6026 git checkout pr6026

2 1

[freeipa PR#6025][opened] [Backport][ipa-4-9] schema plugin: Fix commands without metaobject argument
by flo-renaud 21 Sep '21

21 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6025 Author: flo-renaud Title: #6025: [Backport][ipa-4-9] schema plugin: Fix commands without metaobject argument Action: opened PR body: """ This PR was opened automatically because PR #5975 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6025/head:pr6025 git checkout pr6025

1 1

[freeipa PR#5975][opened] schema plugin: Fix commands without metaobject argument
by stanislavlevin 20 Sep '21

20 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5975 Author: stanislavlevin Title: #5975: schema plugin: Fix commands without metaobject argument Action: opened PR body: """ - schema plugin: fix commands without metaobject arg - command_defaults: don't crash on nonexistent command - test_schema_plugin: drop dependency on Tracker - test_schema_plugin: add missing tests for command, class and topic commands Fixes: https://pagure.io/freeipa/issue/8954 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5975/head:pr5975 git checkout pr5975

2 1

[freeipa PR#6024][opened] [Backport][ipa-4-9] Don't store entries with a usercertificate in the LDAP cache
by rcritten 16 Sep '21

16 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6024 Author: rcritten Title: #6024: [Backport][ipa-4-9] Don't store entries with a usercertificate in the LDAP cache Action: opened PR body: """ This PR was opened automatically because PR #6015 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6024/head:pr6024 git checkout pr6024

1 1

[freeipa PR#6015][opened] Don't store entries with a usercertificate in the LDAP cache
by rcritten 16 Sep '21

16 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6015 Author: rcritten Title: #6015: Don't store entries with a usercertificate in the LDAP cache Action: opened PR body: """ Don't store entries with a usercertificate in the LDAP cache usercertificate often has a subclass and both the plain and subclassed (binary) values are queried. I'm concerned that they are used more or less interchangably in places so not caching these entries is the safest path forward for now until we can dedicate the time to find all usages, determine their safety and/or perhaps handle this gracefully within the cache now. What we see in this bug is that usercertificate;binary holds the first certificate value but a user-mod is done with setattr usercertificate=<new_cert>. Since there is no usercertificate value (remember, it's usercertificate;binary) a replace is done and 389-ds wipes the existing value as we've asked it to. I'm not comfortable with simply treating them the same because in LDAP they are not. https://pagure.io/freeipa/issue/8986 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6015/head:pr6015 git checkout pr6015

1 1

[freeipa PR#6021][opened] [Backport][ipa-4-9] krb5: Pin kpasswd server to a primary one
by flo-renaud 15 Sep '21

15 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6021 Author: flo-renaud Title: #6021: [Backport][ipa-4-9] krb5: Pin kpasswd server to a primary one Action: opened PR body: """ This PR was opened automatically because PR #6017 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6021/head:pr6021 git checkout pr6021

1 1

[freeipa PR#6020][opened] [Backport][ipa-4-9] azure: Ignore tar errors
by flo-renaud 15 Sep '21

15 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6020 Author: flo-renaud Title: #6020: [Backport][ipa-4-9] azure: Ignore tar errors Action: opened PR body: """ This PR was opened automatically because PR #6007 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6020/head:pr6020 git checkout pr6020

1 1

[freeipa PR#6017][opened] krb5: Pin kpasswd server to a primary one
by stanislavlevin 15 Sep '21

15 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6017 Author: stanislavlevin Title: #6017: krb5: Pin kpasswd server to a primary one Action: opened PR body: """ There are time gaps in which kpasswd requests may fail due to offlined SSSD's locator and replication delays. This results in a password was changed on replica but was not replicated to master (kinit(master)->master(initial)->replica(kpasswd)->master(initial)). - added `kpasswd_server` serves as a fallback for the offlined locator - added debugging of locator plugin Fixes: https://pagure.io/freeipa/issue/8353 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6017/head:pr6017 git checkout pr6017

2 1

[freeipa PR#6019][opened] [Backport][ipa-4-9] ipatests: fix expected msg in tasks.run_ssh_cmd
by rcritten 15 Sep '21

15 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6019 Author: rcritten Title: #6019: [Backport][ipa-4-9] ipatests: fix expected msg in tasks.run_ssh_cmd Action: opened PR body: """ This PR was opened automatically because PR #6016 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6019/head:pr6019 git checkout pr6019

2 1

[freeipa PR#6007][opened] azure: Ignore tar errors
by stanislavlevin 15 Sep '21

15 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6007 Author: stanislavlevin Title: #6007: azure: Ignore tar errors Action: opened PR body: """ Sometimes tar fails on changed in process files: ``` [2021-09-07 11:03:33] + tar --ignore-failed-read -czf ipaserver_install_logs.tar.gz --warning=no-failed-read /var/log/dirsrv /var/log/httpd2 /var/log/ipa /var/log/ipaclient-install.log /var/log/ipa-custodia.audit.log /var/log/ipaserver-install.log /var/log/krb5kdc.log /var/log/pki /var/log/samba /var/lib/bind/data systemd_journal.log [2021-09-07 11:03:33] tar: Removing leading `/' from member names [2021-09-07 11:03:33] tar: Removing leading `/' from hard link targets [2021-09-07 11:03:33] tar: /var/log/dirsrv/slapd-IPA-TEST/access: file changed as we read it [2021-09-07 11:03:33] + tests_result=1 ``` This is expected failure since processes are not stopped during logs collection and can flush their logs. Fixes: https://pagure.io/freeipa/issue/8983 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6007/head:pr6007 git checkout pr6007

2 1

[freeipa PR#6018][opened] Doc: add a design template
by flo-renaud 14 Sep '21

14 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6018 Author: flo-renaud Title: #6018: Doc: add a design template Action: opened PR body: """ Add a template for new features in doc/designs/template.md The template is excluded from automatic doc generation. Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6018/head:pr6018 git checkout pr6018

2 1

[freeipa PR#6016][opened] ipatests: fix expected msg in tasks.run_ssh_cmd
by flo-renaud 14 Sep '21

14 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6016 Author: flo-renaud Title: #6016: ipatests: fix expected msg in tasks.run_ssh_cmd Action: opened PR body: """ OpenSSH 8.7p1 changed the message logged on successful authentication (see commit [9e1882ef6489a7dd16b6d7794af96629cae61a53](https://github.com/openssh/openss…) As a result, the method run_ssh_cmd is failing and needs to be adapted in order to be compatible with old and new openssh versions. Fixes: https://pagure.io/freeipa/issue/8989 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6016/head:pr6016 git checkout pr6016

2 1

[freeipa PR#6014][opened] Make Dogtag return XML for ipa cert-find
by ckelleyRH 10 Sep '21

10 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6014 Author: ckelleyRH Title: #6014: Make Dogtag return XML for ipa cert-find Action: opened PR body: """ Using JSON by default within Dogtag appears to cause `ipa cert-find` to return JSON, when the request was made with XML. We can request that XML is returned as before by specifying so in the request header. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6014/head:pr6014 git checkout pr6014

2 1

[freeipa PR#6012][opened] [Backport][ipa-4-9] docs: Make use of `text` highlighting
by flo-renaud 09 Sep '21

09 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6012 Author: flo-renaud Title: #6012: [Backport][ipa-4-9] docs: Make use of `text` highlighting Action: opened PR body: """ This PR was opened automatically because PR #6010 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6012/head:pr6012 git checkout pr6012

1 1

[freeipa PR#6013][opened] [Backport][ipa-4-9] ipatests: fix logic waiting for repl in TestIPACommand
by flo-renaud 09 Sep '21

09 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6013 Author: flo-renaud Title: #6013: [Backport][ipa-4-9] ipatests: fix logic waiting for repl in TestIPACommand Action: opened PR body: """ This PR was opened automatically because PR #6006 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6013/head:pr6013 git checkout pr6013

1 1

[freeipa PR#6006][opened] ipatests: fix logic waiting for repl in TestIPACommand
by flo-renaud 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6006 Author: flo-renaud Title: #6006: ipatests: fix logic waiting for repl in TestIPACommand Action: opened PR body: """ The logic of test_reset_password_unlock is twisted. Currently it's doing: - reset password on replicas[0] - wait for replication on master - kinit on master The call to wait_for_replication should be done on replicas[0], not on master, according to the method doc: Note that this waits for updates originating on this host, not those coming from other hosts. Fixes: https://pagure.io/freeipa/issue/8975 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6006/head:pr6006 git checkout pr6006

1 1

[freeipa PR#6010][opened] docs: Make use of `text` highlighting
by stanislavlevin 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6010 Author: stanislavlevin Title: #6010: docs: Make use of `text` highlighting Action: opened PR body: """ As of 4.9.7 FreeIPA makes use of raw lexer in doc/designs/subordinate-ids.md. raw alias has been removed in Pygments 2.8.0: https://pygments.org/docs/changelog/#version-2-8-0 https://github.com/pygments/pygments/pull/1643 This causes the failure of Azure Docs job. I think that the original goal of `raw` was the disabling of block highlighting, which can be done with `text` lexer: https://pygments.org/docs/lexers/#pygments.lexers.special.TextLexer Fixes: https://pagure.io/freeipa/issue/8985 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6010/head:pr6010 git checkout pr6010

2 1

[freeipa PR#6011][opened] [Backport][ipa-4-9] migrate-ds: workaround to detect compat tree
by flo-renaud 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6011 Author: flo-renaud Title: #6011: [Backport][ipa-4-9] migrate-ds: workaround to detect compat tree Action: opened PR body: """ This PR was opened automatically because PR #6008 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6011/head:pr6011 git checkout pr6011

1 1

[freeipa PR#6009][opened] [Backport][ipa-4-9] ipatests: rpcclient now uses --use-kerberos=desired
by flo-renaud 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6009 Author: flo-renaud Title: #6009: [Backport][ipa-4-9] ipatests: rpcclient now uses --use-kerberos=desired Action: opened PR body: """ This PR was opened automatically because PR #6005 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6009/head:pr6009 git checkout pr6009

1 1

[freeipa PR#6008][opened] migrate-ds: workaround to detect compat tree
by flo-renaud 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6008 Author: flo-renaud Title: #6008: migrate-ds: workaround to detect compat tree Action: opened PR body: """ Migrate-ds needs to check if compat tree is enabled before migrating users and groups. The check is doing a base search on cn=compat,$SUFFIX and considers the compat tree enabled when the entry exists. Due to a bug in slapi-nis, the base search may return NotFound even though the compat tree is enabled. The workaround is to perform a base search on cn=users,cn=compat,$SUFFIX instead. Fixes: https://pagure.io/freeipa/issue/8984 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6008/head:pr6008 git checkout pr6008

1 1

[freeipa PR#6005][opened] ipatests: rpcclient now uses --use-kerberos=desired
by flo-renaud 08 Sep '21

08 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6005 Author: flo-renaud Title: #6005: ipatests: rpcclient now uses --use-kerberos=desired Action: opened PR body: """ The integration tests are using rpcclient delivered by samba package. With samba 4.15, the options have been renamed and "--use-kerberos=desired" must be used instead of "-k". (see https://download.samba.org/pub/samba/rc/samba-4.15.0rc4.WHATSNEW.txt) Adapt the test to be compatible with both old and new versions. Fixes: https://pagure.io/freeipa/issue/8979 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6005/head:pr6005 git checkout pr6005

1 1

[freeipa PR#6004][opened] [Backport][ipa-4-9] Increase default limit on LDAP searches to 100k
by rcritten 05 Sep '21

05 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6004 Author: rcritten Title: #6004: [Backport][ipa-4-9] Increase default limit on LDAP searches to 100k Action: opened PR body: """ This PR was opened manually because PR #5985 was pushed to master and backport to ipa-4-9 is required. There was a merge conflict in the attribute overrides in ipapython/ipaldap.py but the resulting change, plus or minus a few line numbers, is identical to the change in master. Adding the ack flag. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6004/head:pr6004 git checkout pr6004

2 1

[freeipa PR#5985][opened] Increase default limit on LDAP searches to 100k
by rcritten 03 Sep '21

03 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5985 Author: rcritten Title: #5985: Increase default limit on LDAP searches to 100k Action: opened PR body: """ A similar change was attempted years ago in commit 9724251292e4c0797367fcc351a9f16f30c6aefe but it was never applied because it used the wrong DN and because nsslapd-timelimit is already present in the entry the default keyword won't trigger. Use replace instead to increase the value to 100k from the default as originally intended. https://pagure.io/freeipa/issue/8962 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5985/head:pr5985 git checkout pr5985

1 1

[freeipa PR#6003][opened] [Backport][ipa-4-9] subid: subid-match: display the owner's ID not DN
by flo-renaud 03 Sep '21

03 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6003 Author: flo-renaud Title: #6003: [Backport][ipa-4-9] subid: subid-match: display the owner's ID not DN Action: opened PR body: """ This PR was opened automatically because PR #6001 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6003/head:pr6003 git checkout pr6003

1 1

[freeipa PR#6002][opened] [Backport][ipa-4-9] Catch and log errors when adding CA profiles
by rcritten 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6002 Author: rcritten Title: #6002: [Backport][ipa-4-9] Catch and log errors when adding CA profiles Action: opened PR body: """ This PR was opened automatically because PR #5995 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6002/head:pr6002 git checkout pr6002

2 1

[freeipa PR#6001][opened] subid: update subid-match
by fcami 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6001 Author: fcami Title: #6001: subid: update subid-match Action: opened PR body: """ Previously, the subid-match command would output the full DN of the owner of the matched range. With this change, the UID of the owner is displayed, just like for other subid- commands. Fixes: Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6001/head:pr6001 git checkout pr6001

2 1

[freeipa PR#6000][opened] [Backport][ipa-4-9] extdom: return LDAP_NO_SUCH_OBJECT if domains differ
by rcritten 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/6000 Author: rcritten Title: #6000: [Backport][ipa-4-9] extdom: return LDAP_NO_SUCH_OBJECT if domains differ Action: opened PR body: """ This PR was opened automatically because PR #5991 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6000/head:pr6000 git checkout pr6000

2 1

[freeipa PR#5999][opened] [Backport][ipa-4-8] extdom: return LDAP_NO_SUCH_OBJECT if domains differ
by rcritten 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5999 Author: rcritten Title: #5999: [Backport][ipa-4-8] extdom: return LDAP_NO_SUCH_OBJECT if domains differ Action: opened PR body: """ This PR was opened automatically because PR #5991 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5999/head:pr5999 git checkout pr5999

2 1

[freeipa PR#5998][opened] [Backport][ipa-4-6] extdom: return LDAP_NO_SUCH_OBJECT if domains differ
by rcritten 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5998 Author: rcritten Title: #5998: [Backport][ipa-4-6] extdom: return LDAP_NO_SUCH_OBJECT if domains differ Action: opened PR body: """ This PR was opened automatically because PR #5991 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5998/head:pr5998 git checkout pr5998

2 1

[freeipa PR#5995][opened] Catch and log errors when adding CA profiles
by rcritten 02 Sep '21

02 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5995 Author: rcritten Title: #5995: Catch and log errors when adding CA profiles Action: opened PR body: """ Rather than stopping the installer entirely, catch and report errors adding new certificate profiles. It was discovered that installing a newer IPA that has the ACME profile which requires sanToCNDefault will fail when installing a new server against a very old one that lacks this class. Deleting the LDAP profile in cn=certprofiles,cn=ca,$SUFFIX and then running ipa-server-install on the newer server will add the missing profile. https://pagure.io/freeipa/issue/8974 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5995/head:pr5995 git checkout pr5995

1 1

[freeipa PR#5991][opened] extdom: return LDAP_NO_SUCH_OBJECT if domains differ
by sumit-bose 01 Sep '21

01 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5991 Author: sumit-bose Title: #5991: extdom: return LDAP_NO_SUCH_OBJECT if domains differ Action: opened PR body: """ If a client sends a request to lookup an object from a given trusted domain by UID or GID and an object with matching ID is only found in a different domain the extdom should return LDAP_NO_SUCH_OBJECT to indicate to the client that the requested ID does not exists in the given domain. Resolves: https://pagure.io/freeipa/issue/8965 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5991/head:pr5991 git checkout pr5991

2 1

Can bind/named 'notifies' be disabled in freeipa?
by Harry G. Coin 01 Sep '21

01 Sep '21

In a master/replica freeipa setup with DNS, if we know there will never be any other systems running bind/named for the freeipa managed domains, can we safely add an option to the named options ext file to disable the log-jamming frequent transmission of 'named ... sending notifies...'? As I understood it, the bind-dyn-ldap and the ldap master/replica update process accomplishes sending changes to the other name servers what the notifies are all about as well. So is there any benefit to the named/bind daemons logging and swapping notify packets when there are no slave named resolvers and never will be except as freeipa replicas? Thanks Harry

1 0

[freeipa PR#5997][opened] [Backport][ipa-4-9] Add URI system records for KDC
by rcritten 01 Sep '21

01 Sep '21

URL: https://github.com/freeipa/freeipa/pull/5997 Author: rcritten Title: #5997: [Backport][ipa-4-9] Add URI system records for KDC Action: opened PR body: """ This PR was opened automatically because PR #5990 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5997/head:pr5997 git checkout pr5997

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel September 2021