API schema
by Yann Soubeyrand
Hello,
There’s an attempt to autogenerate a Go package to interact with the API of FreeIPA, based on the schema returned by the API: https://github.com/ccin2p3/go-freeipa. However, the schema seems to be inexact in several places and the generation process have to use some dirty workarounds. For example, it seems that the managedby_host field returned in a host_show result is multi-valued, whereas it’s not stated in the schema. I was wondering how I could help fix this schema and I’d like to confirm that the line to modify in this case would be https://github.com/freeipa/freeipa/blob/7060e3a031fb4e4cdf85f616f1e1a3435... (to replace managedby_host with managedby_host*)? Also, is there something else to do in addition to this modification?
Regards
Yann
2 months, 4 weeks
debian/ubuntu client support
by sv savage
I have tried to compile FreeIPA inDebian, but there are enough differences
in existing libraries to make it very painful. But using Ubuntu/Debian as a
client should be straight forward. both distros support SSSD but there is
no doc describing how-to.
3 months, 3 weeks
FreeIPA 4.10.2
by Antonio Torres
The FreeIPA team would like to announce FreeIPA 4.10.2 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
for Fedora distributions will be available from the official repository
soon.
== Highlights in 4.10.2
* 5444: [RFE] Support Resource based kerberos constrained delegation
* 9287: [RFE] makeapi should validate the generated API doc vs stored
doc
* 9294: Enable the certificate pruning job in PKI
Removing (pruning) expired certificates is supported when Random
Serial Numbers are enabled. One cannot upgrade from sequential
serial numbers to random. This feature is enabled using the
ipa-acme-manage(1) command.
* 9331: Better handling of the command line and web UI cert search
and/or list features
cert-find performance was improved dramatically when a large number
of certificates are returned by changing the method IPA uses
internally to parse results from the CA.
* 9354: Implement resource-based constrained delegation
FreeIPA provides initial implementation of resource-based
constrained delegation (RBCD) for Kerberos services. RBCD and other
Kerberos delegation services described in the design document:
https://freeipa.readthedocs.io/en/latest/designs/rbcd.html. The
initial implementation works for FreeIPA services, work on
supporting cross-realm RBCD continues.
* 9373: Make sign_authdata() generate extended KDC signature
FreeIPA KDCs will automatically start requiring two new Kebreros
ticket signatures when the whole realm is running on MIT Kerberos
1.21 or later. On older MIT Kerberos versions, the lack of the new
ticket signature will be tolerated to allow gradual upgrades. More
details are available at
https://pagure.io/freeipa/c/3f1b373cb2028416e40a26e3dd99b0f4c82525c7.
In addition, a 'full PAC' signature type was added to MIT Kerberos
1.21. FreeIPA will support the new signature when running against
newer MIT Kerberos version. For older versions, please see
https://pagure.io/freeipa/c/9cd5f49c74f28dbe070b072b394747a039cef463.
This new PAC signature will be required by default by Active
Directory in July 2023 for S4U requests, and opt-out will no longer
be possible after October 2023. We recommend upgrading to newer
versions of FreeIPA-based distributions to avoid interoperability
break.
=== Known Issues
* 9298: [Tracker] Nightly test failure (updates-testing) in
test_acme.py::TestACME::test_certbot_certonly_standalone
With Certbot update to 2.0.0, Certbot defaults to ECDSA certificate
private keys for all new certificates. PKI ACME cert profile
supports only rsa private keys, meaning that the key type needs to
be forced to rsa when requesting an ACME certificate, using certbot
--key-type rsa [...]
=== Bug fixes
FreeIPA 4.10.2 is a stabilization release for the features delivered as
a part of 4.10 version series.
There are more than 60 bug-fixes since FreeIPA 4.10.1 release. Details
of the bug-fixes can be seen in the list of resolved tickets below.
== Upgrading
Upgrade instructions are available on Upgrade page.
== Feedback
Please provide comments, bugs and other feedback via the freeipa-users
mailing list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on libera.chat.
== Resolved tickets
* https://pagure.io/freeipa/issue/5130[#5130]
(https://bugzilla.redhat.com/show_bug.cgi?id=1243261[rhbz#1243261])
non-admin users cannot search hbac rules
* https://pagure.io/freeipa/issue/5444[#5444] [RFE] Support Resource
based kerberos constrained delegation
* https://pagure.io/freeipa/issue/6044[#6044]
(https://bugzilla.redhat.com/show_bug.cgi?id=1353899[rhbz#1353899])
ipa-advise: object of type 'type' has no len()
* https://pagure.io/freeipa/issue/8941[#8941] Usage of `/usr/bin/env` in
Python scripts
* https://pagure.io/freeipa/issue/8990[#8990] ipa group-mod should fail
properly with --posix and --external options
* https://pagure.io/freeipa/issue/9086[#9086] Have ipa-client-install
additionally disable the unscd service if using SSSD
* https://pagure.io/freeipa/issue/9124[#9124] Nightly test failure in
test_smb.py::TestSMB::test_smb_service_s4u2self
* https://pagure.io/freeipa/issue/9164[#9164] Cross realm
s4u2self/s4u2proxy fails
* https://pagure.io/freeipa/issue/9195[#9195]
(https://bugzilla.redhat.com/show_bug.cgi?id=2158775[rhbz#2158775])
Hiding a server does not completely clean up DNS records
* https://pagure.io/freeipa/issue/9226[#9226]
(https://bugzilla.redhat.com/show_bug.cgi?id=2124547[rhbz#2124547])
Infinite redirect loop in the WebUI for user root
* https://pagure.io/freeipa/issue/9232[#9232] ipaserver circular import
* https://pagure.io/freeipa/issue/9249[#9249]
(https://bugzilla.redhat.com/show_bug.cgi?id=2108630[rhbz#2108630])
Deprecated feature idnssoaserial in IdM appears when creating reverse
dns zones
* https://pagure.io/freeipa/issue/9259[#9259]
(https://bugzilla.redhat.com/show_bug.cgi?id=2144737[rhbz#2144737])
vault interoperability with older RHEL systems is broken
* https://pagure.io/freeipa/issue/9264[#9264] Nightly failure in
test_integration/test_sso.py::TestSsoBridge::test_ipa_login_with_sso_user
* https://pagure.io/freeipa/issue/9267[#9267]
(https://bugzilla.redhat.com/show_bug.cgi?id=2188567[rhbz#2188567])
Unconditionally adding 'includedir /var/lib/sss/pubconf/krb5.include.d'
to /etc/krb5.conf break Java's ability to parse krb5.conf
* https://pagure.io/freeipa/issue/9278[#9278] Pylint 2.15 issues
* https://pagure.io/freeipa/issue/9279[#9279] ipa-otpd@.service:
deprecated syslog setting
* https://pagure.io/freeipa/issue/9282[#9282] Nightly test failure in
test_webui/test_subid.py/test_subid/test_subid_range_deletion_not_allowed
* https://pagure.io/freeipa/issue/9285[#9285] ipa-certupdate restarts
HTTPd too early
* https://pagure.io/freeipa/issue/9286[#9286]
(https://bugzilla.redhat.com/show_bug.cgi?id=2056009[rhbz#2056009])
memberManager ACIs aren't allowing group-based manager access due to
missing upgrade code
* https://pagure.io/freeipa/issue/9287[#9287] [RFE] makeapi should
validate the generated API doc vs stored doc
* https://pagure.io/freeipa/issue/9290[#9290]
(https://bugzilla.redhat.com/show_bug.cgi?id=2149889[rhbz#2149889])
idm:client is missing dependency on krb5-pkinit.
* https://pagure.io/freeipa/issue/9291[#9291] Nightly test failure
(rawhide) in test_ipa_dns_systemrecords_check
* https://pagure.io/freeipa/issue/9294[#9294]
(https://bugzilla.redhat.com/show_bug.cgi?id=2162677[rhbz#2162677])
Enable the certificate pruning job in PKI
* https://pagure.io/freeipa/issue/9295[#9295] Nightly test failure
(sssd) in test_trust.py::TestNonPosixAutoPrivateGroup and
test_trust.py::TestPosixAutoPrivateGroup
* https://pagure.io/freeipa/issue/9298[#9298] [Tracker] Nightly test
failure (updates-testing) in
test_acme.py::TestACME::test_certbot_certonly_standalone
* https://pagure.io/freeipa/issue/9299[#9299] NixOS support for freeipa
in ipaplatform
* https://pagure.io/freeipa/issue/9306[#9306]
(https://bugzilla.redhat.com/show_bug.cgi?id=2160389[rhbz#2160389])
'ERROR Could not remove /tmp/tmpbkw6hawo.ipabkp' can be seen prior to
'ipa-client-install' command was successful.
* https://pagure.io/freeipa/issue/9309[#9309]
(https://bugzilla.redhat.com/show_bug.cgi?id=2160399[rhbz#2160399])
get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert
LDAP entry to range struct
* https://pagure.io/freeipa/issue/9310[#9310]
(https://bugzilla.redhat.com/show_bug.cgi?id=2162335[rhbz#2162335])
ipa-trust-add with --range-type=ipa-ad-trust-posix fails while creating
an ID range
* https://pagure.io/freeipa/issue/9313[#9313] Nightly test failure
(rawhide): automember-rebuild test
* https://pagure.io/freeipa/issue/9314[#9314] Redundant build dependency
on python3-paste (if with lint)
* https://pagure.io/freeipa/issue/9315[#9315] [tests]
test_ipa_healthcheck_fips_enabled fails on system without
fips-mode-setup
* https://pagure.io/freeipa/issue/9316[#9316]
(https://bugzilla.redhat.com/show_bug.cgi?id=2166324[rhbz#2166324])
Passwordless (GSSAPI) SSH login with AD user
* https://pagure.io/freeipa/issue/9318[#9318] Incomplete fast
lint/codestyle check if both Python template files and Python modules
were changed
* https://pagure.io/freeipa/issue/9319[#9319] [tests] TestDNSResolver
failures on systems without or empty /etc/resolv.conf
* https://pagure.io/freeipa/issue/9320[#9320]
(https://bugzilla.redhat.com/show_bug.cgi?id=2018198[rhbz#2018198]) RFE
- Add a warning note about possible performance impact of the Auto
Member rebuild task.
* https://pagure.io/freeipa/issue/9322[#9322]
(https://bugzilla.redhat.com/show_bug.cgi?id=2162677[rhbz#2162677])
Nightly test failure in test_integration/test_acme.py::TestACME
* https://pagure.io/freeipa/issue/9323[#9323] Update the design doc for
certificate pruning
* https://pagure.io/freeipa/issue/9324[#9324] ipatests: Frequent timeout
of test_acme
* https://pagure.io/freeipa/issue/9325[#9325]
(https://bugzilla.redhat.com/show_bug.cgi?id=2168244[rhbz#2168244])
requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage
pruning command
* https://pagure.io/freeipa/issue/9326[#9326] ipatests: timeout of
test_trust
* https://pagure.io/freeipa/issue/9329[#9329] Azure test:
WebUI_Unit_Tests are failing
* https://pagure.io/freeipa/issue/9331[#9331]
(https://bugzilla.redhat.com/show_bug.cgi?id=2164349[rhbz#2164349])
Better handling of the command line and web UI cert search and/or list
features
* https://pagure.io/freeipa/issue/9332[#9332] Extend negative test
coverage for automember
* https://pagure.io/freeipa/issue/9333[#9333] ipa-client-install
--pkinit-identity can block in unattended mode
* https://pagure.io/freeipa/issue/9338[#9338] Update 'Auth indicators'
doc string to show 'ipd' usage
* https://pagure.io/freeipa/issue/9339[#9339] Broken support for
dnspython < 2
* https://pagure.io/freeipa/issue/9342[#9342] Fedora trasiition license
from short names to SPDX license expression
* https://pagure.io/freeipa/issue/9344[#9344] ipa-server-install fails
when the named keytab location is overridden in ipaplatform/paths.py
* https://pagure.io/freeipa/issue/9347[#9347] Azure Ci does not work
with Fedora Rawhide
* https://pagure.io/freeipa/issue/9349[#9349]
(https://bugzilla.redhat.com/show_bug.cgi?id=2180914[rhbz#2180914])
Sequence processing failures for group_add using server context
* https://pagure.io/freeipa/issue/9354[#9354] Implement resource-based
constrained delegation
* https://pagure.io/freeipa/issue/9355[#9355] support python
cryptography 40.0
* https://pagure.io/freeipa/issue/9358[#9358] update_dna_shared_config
sometimes blocks installation for 2 minutes
* https://pagure.io/freeipa/issue/9361[#9361] [ipasphinx] deprecated
sphinx.util.progress_message
* https://pagure.io/freeipa/issue/9362[#9362] ipatests: Frequent timeout
of test_ipahealthcheck
* https://pagure.io/freeipa/issue/9368[#9368] Test wrong variable in
ipadb_get_pac()
* https://pagure.io/freeipa/issue/9369[#9369]
(https://bugzilla.redhat.com/show_bug.cgi?id=2164348[rhbz#2164348])
Better catch of the IPA web UI event "IPA Error
4301:CertificateOperationError", and IPA httpd error
CertificateOperationError
* https://pagure.io/freeipa/issue/9371[#9371]
(https://bugzilla.redhat.com/show_bug.cgi?id=2182683[rhbz#2182683])
Tolerate absence of PAC ticket signature depending of domain and servers
capabilities
* https://pagure.io/freeipa/issue/9372[#9372]
(https://bugzilla.redhat.com/show_bug.cgi?id=2172107[rhbz#2172107]) 'ipa
idview-show idviewname' & IPA WebUI takes longer time to return the
results in RHEL 8.5
* https://pagure.io/freeipa/issue/9373[#9373]
(https://bugzilla.redhat.com/show_bug.cgi?id=2176406[rhbz#2176406]) Make
sign_authdata() generate extended KDC signature
* https://pagure.io/freeipa/issue/9374[#9374] freeipa fails to build
with updates-testing repo on f37 and f38
* https://pagure.io/freeipa/issue/9377[#9377] test_commands:
pseudo-random failure in test_ssh_key_connection
* https://pagure.io/freeipa/issue/9383[#9383] Random nightly test
failure in test_acme.py::TestACMEPrune::test_prune_cert_manual
== Detailed changelog since 4.10.1
=== Alexander Bokovoy (23)
* ipa-kdb: be compatible with krb5 1.19 when checking for server
referral
https://pagure.io/freeipa/c/f2b821abca72e0d444c96598799c4947e2173d3f[commit]
https://pagure.io/freeipa/issue/9164[#9164]
* ipalib/x509.py: Add signature_algorithm_parameters
https://pagure.io/freeipa/c/11ce2b2133364916de06f4c42d8a19ce438bd41c[commit]
* ipa-kdb: skip verification of PAC full checksum
https://pagure.io/freeipa/c/1b55e9b1cb4f192635878b0b7242104d58a37d2b[commit]
https://pagure.io/freeipa/issue/9371[#9371]
* ipa-kdb: process out of realm server lookup during S4U
https://pagure.io/freeipa/c/bd8fcd6f5bc62a4bfc544b69c0d960291be05d37[commit]
https://pagure.io/freeipa/issue/9164[#9164]
* ipa-kdb: postpone ticket checksum configuration
https://pagure.io/freeipa/c/fefa0248296413b6ee5ad2543d8feb1b31840aee[commit]
* ipa-kdb: protect against context corruption
https://pagure.io/freeipa/c/803a44777f901217d634f8fd7feed8b66ece352a[commit]
* ipa-kdb: hint KDC to use aes256-sha1 for forest trust TGT
https://pagure.io/freeipa/c/3d0decd9efc4883328e95f9ff89002aec32462ec[commit]
https://pagure.io/freeipa/issue/9124[#9124]
* Change doc theme to 'book'
https://pagure.io/freeipa/c/1c43d914d9a365097a80c5c2278017b91c619266[commit]
* doc/designs/rbcd.md: document use of S-1-18-* SIDs
https://pagure.io/freeipa/c/cb18ca31697320a58ae23a67afbfe7a0ff9a55a5[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* doc/designs/rbcd.md: add usage examples
https://pagure.io/freeipa/c/b63e6a257006e846ef5d0a008d9c3c0f935c09bb[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* RBCD: add basic test for RBCD handling
https://pagure.io/freeipa/c/7d68f4f08361760adab90ad4b44c6da2c4ea664d[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* kdb: implement RBCD handling in KDB driver
https://pagure.io/freeipa/c/7ac6adfaac30473b14b589a71fac42fe147bc0d9[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* IPA API changes to support RBCD
https://pagure.io/freeipa/c/5b6ad0e65600a96bb4d6f3b1acf4e16773a03493[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* doc: add design document for Kerberos constrained delegation
https://pagure.io/freeipa/c/18cd909b4ad854147008a1010c97c75640a54177[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* ipa-kdb: search S4U2Proxy ACLs in cn=s4u2proxy,cn=etc,$BASEDN subtree
only
https://pagure.io/freeipa/c/7a7ba45c10a6da4f9e110f6cc57cfc47e0a16a16[commit]
https://pagure.io/freeipa/issue/5444[#5444]
* test_xmlrpc: adopt to automember plugin message changes in 389-ds
https://pagure.io/freeipa/c/52e6da9056697e2210736d5528826ae424fec9b1[commit]
* Ignore empty modification error in case cifs/.. principal already
added
https://pagure.io/freeipa/c/e7506403a988b98cc3381d2d986b53aee48448cb[commit]
https://pagure.io/freeipa/issue/9354[#9354]
* ipalib/x509: Implement abstract method
Certificate.verify_directly_issued_by
https://pagure.io/freeipa/c/e07ead943abf070107a9669fc4564c9dc7518832[commit]
https://pagure.io/freeipa/issue/9355[#9355]
* Fix tox in Azure CI
https://pagure.io/freeipa/c/aacaafce9d074342e383ad7007dee1b0e09d9b12[commit]
https://pagure.io/freeipa/issue/9347[#9347]
* Use system-wide chromium for webui tests
https://pagure.io/freeipa/c/84f5f87b1f77267aa4c6c13fbc2496793d06a3c7[commit]
https://pagure.io/freeipa/issue/9347[#9347]
* Don't fail if optional RPM macros file is missing
https://pagure.io/freeipa/c/b93f6b52a29659663fae65be51dafe350606eb6d[commit]
https://pagure.io/freeipa/issue/9347[#9347]
* ipa-kdb: PAC consistency checker needs to handle child domains as well
https://pagure.io/freeipa/c/0206369eec8530e96c66986c4ca501d8962193ce[commit]
https://pagure.io/freeipa/issue/9316[#9316]
* updates: fix memberManager ACI to allow managers from a specified
group
https://pagure.io/freeipa/c/42be04fe4ff317efe599dcbc2637f94ecc6fa220[commit]
https://pagure.io/freeipa/issue/9286[#9286]
=== Anuja More (4)
* ipatests: Test that non admin user can search hbac rule.
https://pagure.io/freeipa/c/051bbe36dce57837bd1769aa4a88569e39565774[commit]
https://pagure.io/freeipa/issue/5130[#5130]
* ipatests: Test ipa-advise is not failing with error.
https://pagure.io/freeipa/c/983a6516f147ae95a512435cd05d237233d0b5fc[commit]
https://pagure.io/freeipa/issue/6044[#6044]
* PRCI: update test_trust.py for nightly pipelines.
https://pagure.io/freeipa/c/2a2132ccfd3cfb26f5da550a829b267ca0a4f6ae[commit]
https://pagure.io/freeipa/issue/9326[#9326]
* Add test for SSH with GSSAPI auth.
https://pagure.io/freeipa/c/a6cb905de74da38d62f9c3bd7957018924282521[commit]
https://pagure.io/freeipa/issue/9316[#9316]
=== Antonio Torres (10)
* Update list of contributors
https://pagure.io/freeipa/c/03b92fb42f173e9ba26d6d19f0d6f35f6c5f38b2[commit]
* Update translations to FreeIPA ipa-4-10 state
https://pagure.io/freeipa/c/e3797ca2e03097a36bd3795fc1687a2ed4922e59[commit]
* Extend API documentation
https://pagure.io/freeipa/c/9c6b4f4445dbd1eefffbfff191063980a2f3a342[commit]
* doc: allow notes on Param API Reference pages
https://pagure.io/freeipa/c/3eed25e92f951689658f6bbd178a5baca37442c6[commit]
* ipaserver: deepcopy objectclasses list from IPA config
https://pagure.io/freeipa/c/b1b7cbc08d96e125ce21113ba1793a592d0ba35a[commit]
https://pagure.io/freeipa/issue/9349[#9349]
* API doc: add usage guides for groups, HBAC and sudo rules
https://pagure.io/freeipa/c/649c35aa3b46e6d2f034d9afdc4c7ae1542630da[commit]
* API doc: add note about ipa show-mappings to usage guide
https://pagure.io/freeipa/c/a20acb6f833a22baad214a466848cb5833954532[commit]
* API doc: validate generated reference
https://pagure.io/freeipa/c/364116c25f68b6b21c0a64466bda09c70cf146ec[commit]
https://pagure.io/freeipa/issue/9287[#9287]
* API doc: add basic user management guide
https://pagure.io/freeipa/c/a10627bdb90bb6eeaf6a156476253edc503c72df[commit]
* Back to git snapshots
https://pagure.io/freeipa/c/657a7b2556e22b70802809dd784fe576d3edea95[commit]
=== Carla Martinez (1)
* Update 'Auth indicators' doc string
https://pagure.io/freeipa/c/6a4d34fba90ede0a9d600daa24a8d95190a42495[commit]
https://pagure.io/freeipa/issue/9338[#9338]
=== Christian Heimes (3)
* Speed up installer by restarting DS after DNA plugin
https://pagure.io/freeipa/c/d63756eb08759740fe8b03f48d0a240f9935e6aa[commit]
https://pagure.io/freeipa/issue/9358[#9358]
* Don't block when kinit_pkinit() fails
https://pagure.io/freeipa/c/8803938570dfb70586fa89d2d2d7aad4b0965305[commit]
https://pagure.io/freeipa/issue/9333[#9333]
* ipa-certupdate: Update client certs before KDC/HTTPd restart
https://pagure.io/freeipa/c/8e7d1ac4e4779cc15b39a9901bb26c5f5997eb5b[commit]
https://pagure.io/freeipa/issue/9285[#9285]
=== Chris Kelley (1)
* Check that CADogtagCertsConfigCheck can handle cert renewal
https://pagure.io/freeipa/c/a786d3d584c8696df3b18858df1c429cba03721f[commit]
=== David Pascual (2)
* doc: Use case examples for PR-CI checker tool
https://pagure.io/freeipa/c/41c32174b2b3cf71474ea74df32f1f763f4a2c5b[commit]
* ipatests: fix (prci_checker) duplicated check & error return code
https://pagure.io/freeipa/c/1a965a3a6304607eb5acbdfee45843ebe8746c67[commit]
=== Erik Belko (1)
* ipatests: Test MemberManager ACI to allow managers from a specified
group after upgrade scenario
https://pagure.io/freeipa/c/e1f4f655a65777f5096e65b8e5c3e079f77f6ecc[commit]
https://pagure.io/freeipa/issue/9286[#9286]
=== Filip Dvorak (1)
* ipa tests: Add LANG before kinit command to fix issue with locale
settings
https://pagure.io/freeipa/c/2520a7adff7a49ddcddaaf19f0e586425dc0d878[commit]
=== Florence Blanc-Renaud (55)
* ipatest: remove xfail from test_smb
https://pagure.io/freeipa/c/283f5463f091ac9fcc733092fc6becff586ae97f[commit]
https://pagure.io/freeipa/issue/9124[#9124]
* ACME tests: fix issue_and_expire_acme_cert method
https://pagure.io/freeipa/c/a6f485fcade619980f6538edadf115dca69e1314[commit]
https://pagure.io/freeipa/issue/9383[#9383]
* user or group name: explain the supported format
https://pagure.io/freeipa/c/7830ab96cc295e4151ad3d86cbbaf400a7ab2016[commit]
* azure tests: move to fedora 38
https://pagure.io/freeipa/c/627c1101a08a281d07cd930193232e434a0cd9a0[commit]
* Tests: test on f37 and f38
https://pagure.io/freeipa/c/12d1aafe60de457815adb822bbef466926626d6f[commit]
* idview: improve performance of idview-show
https://pagure.io/freeipa/c/3a9a5bdae7cb3dee65ba74b00169badb72fe6dda[commit]
https://pagure.io/freeipa/issue/9372[#9372]
* spec file: force nodejs < 20 on fedora < 39
https://pagure.io/freeipa/c/d95c4cf137574ffa79a191cbe5f6d0687b53cdc1[commit]
https://pagure.io/freeipa/issue/9374[#9374]
* Nightly test: add +15min for test_ipahealthcheck
https://pagure.io/freeipa/c/717228c908816c72b98cee86abfe7c22cb07c44e[commit]
https://pagure.io/freeipa/issue/9362[#9362]
* cert_find: fix call with --all
https://pagure.io/freeipa/c/918b6e011795ba4854d178d18c86ad54f3cf75ab[commit]
https://pagure.io/freeipa/issue/9331[#9331]
* ipatests: mark known failures for autoprivategroup
https://pagure.io/freeipa/c/e2b08433cf7cf74dea81b88953a4b8daa4c38614[commit]
https://pagure.io/freeipa/issue/9295[#9295]
* ipatests: fix test definition for test_trust
https://pagure.io/freeipa/c/def07260da883b1d27330b308bd0337205bf53a8[commit]
https://pagure.io/freeipa/issue/9326[#9326]
* ipatests: increase timeout for test_trust
https://pagure.io/freeipa/c/ae014c6a3e17da7b0775be79a425d769a2717243[commit]
https://pagure.io/freeipa/issue/9326[#9326]
* ipatests: adapt for new automembership fixup behavior
https://pagure.io/freeipa/c/34d048ede0c439b3a53e02f8ace96ff91aa1609d[commit]
https://pagure.io/freeipa/issue/9313[#9313]
* ipatests: increase timeout for test_acme
https://pagure.io/freeipa/c/0a8a3922487b8029c509635c85b533474008bb9d[commit]
https://pagure.io/freeipa/issue/9324[#9324]
* automember-rebuild: add a notice about high CPU usage
https://pagure.io/freeipa/c/2857bc69957bde7e59fff1c66c5a83c7f560616b[commit]
https://pagure.io/freeipa/issue/9320[#9320]
* trust-add: handle missing msSFU30MaxGidNumber
https://pagure.io/freeipa/c/97fc368df2db3b559a9def236d3c3e0a12bcdd0a[commit]
https://pagure.io/freeipa/issue/9310[#9310]
* Spec file: use %autosetup instead of %setup
https://pagure.io/freeipa/c/2a69d056176edd4ef0b1f4e59eb0548a483bc6e5[commit]
* Spec file: unify with RHEL9 spec
https://pagure.io/freeipa/c/0e06786a44f8d12b08961fe0720a1b712e82c5cf[commit]
* Installer: create RID base before domain object
https://pagure.io/freeipa/c/7d1a35852fa53bcf3b88a8a80a2e86ef88a75795[commit]
https://pagure.io/freeipa/issue/9309[#9309]
* Tests: force key type in ACME tests
https://pagure.io/freeipa/c/0fa95852c935c7b079f8ed966d4f194099217038[commit]
https://pagure.io/freeipa/issue/9298[#9298]
* server install: remove error log about missing bkup file
https://pagure.io/freeipa/c/894dca12c120f0bfa705307a0609da47326b8fb2[commit]
https://pagure.io/freeipa/issue/9306[#9306]
* ipatests: mark test_smb as xfail
https://pagure.io/freeipa/c/b5f2b0b1b213149b5bfe2653c9e40de98249dc73[commit]
https://pagure.io/freeipa/issue/9124[#9124]
* pylint: disable deprecated-module message
https://pagure.io/freeipa/c/85037db2e1927c76fba963c6fde4ce17d2b95929[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: fix comparison-of-constants
https://pagure.io/freeipa/c/62e2d111fc3113aa5c9f22ae75068094403d1d39[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable comparison-of-constants
https://pagure.io/freeipa/c/015e25a581353aaf628f9e2ea8306fda89842cd5[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: fix consider-iterating-dictionary
https://pagure.io/freeipa/c/3d211b4f9f6950a2810496f30e57a421eeb31e85[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: globally disable useless-object-inheritance
https://pagure.io/freeipa/c/4e998848f08b52760225c5bcb1afa9a6b2f6361b[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable unhashable-member
https://pagure.io/freeipa/c/07111438389fde4a74845f9f797656712335795f[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable invalid-sequence-index
https://pagure.io/freeipa/c/a95e11dbbff58804c5b85acaa4d70b72ce750ae0[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: fix deprecated-class SafeConfigParser
https://pagure.io/freeipa/c/433599fdef1bf0608991d25ddbe6c891ae382ae0[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: fix duplicate-value
https://pagure.io/freeipa/c/b9ea3fcbdb9ab07153873aeea7d3e1bd69e0d065[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: fix implicit-str-concat
https://pagure.io/freeipa/c/71496be75f6523b51f9316d3dcf7e0662d2cb606[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable missing-timeout message
https://pagure.io/freeipa/c/84c4792bdbf82108771d796ae317e2cb1f1d2100[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: globally disable unnecessary-lambda-assignment message
https://pagure.io/freeipa/c/2b97c8caad267f97780d7ee8d940577c17ef1499[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable unnecessary-dunder-call message
https://pagure.io/freeipa/c/3336236ff1133ae86a5c9e2caeb90db7169fa454[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable using-constant-test
https://pagure.io/freeipa/c/5434c12b6012f035528f0b137c1af5c1be113542[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: remove arguments-renamed warnings
https://pagure.io/freeipa/c/22f182ee9203be5e014d438f2a27b8721dd0c3ae[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable modified-iterating-list
https://pagure.io/freeipa/c/ac69ad4ba5ec644fbb1b2768237fd2412d7e3101[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: replace deprecated distutils module
https://pagure.io/freeipa/c/328fb642f6aba1a15040b7374a59cb6f7679f8f5[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable used-before-assignment
https://pagure.io/freeipa/c/081dd26376b8ff704a83e1c783d97c40951c43b3[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: disable redefined-slots-in-subclass
https://pagure.io/freeipa/c/240b46db1451b8fed5f04244e9927b8fc03f10c0[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: remove useless suppression
https://pagure.io/freeipa/c/51e0f751e9c3b5cade75360d24ba64c75ec926ba[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: remove unneeded disable=unused-private-member
https://pagure.io/freeipa/c/fd21204559bd8fcac6a1b321adda163cd88aa149[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* azure tests: move to fedora 37
https://pagure.io/freeipa/c/782873a2277ca7defa5554d2b7859f1c14767d68[commit]
* ipatests: update the xfail annotation for test_number_of_zones
https://pagure.io/freeipa/c/304978924a09677805fd3b73614aad6a2de232a2[commit]
https://pagure.io/freeipa/issue/9135[#9135]
* Spec file: bump krb5_kdb_version on rawhide
https://pagure.io/freeipa/c/2904b15a94eebbb37ca6a289eccd6b95f063d7ca[commit]
* FIPS setup: fix typo filtering camellia encryption
https://pagure.io/freeipa/c/dfba6ebf9ab7b7d17e65f928c90ae63b31d9cae7[commit]
* cert utilities: MAC verification is incompatible with FIPS mode
https://pagure.io/freeipa/c/c853cfde56fb56798424bd402012d78ed47647c0[commit]
* ipatests: update the fake fips mode expected message
https://pagure.io/freeipa/c/68f6574cb2bcf0b04840b4f62a8ac70b4d45cb1a[commit]
https://pagure.io/freeipa/issue/9002[#9002]
* ipatests: xfail on all fedora for test_ipa_login_with_sso_user
https://pagure.io/freeipa/c/9599e975bcdc0a58a32ccee6ad531c7298661a1d[commit]
https://pagure.io/freeipa/issue/9264[#9264]
* Spec file: ipa-client depends on krb5-pkinit-openssl
https://pagure.io/freeipa/c/2d0a0cc40fb8674f30ba62980b1953cef840009e[commit]
https://pagure.io/freeipa/issue/9290[#9290]
* webui tests: fix assertion in test_subid.py
https://pagure.io/freeipa/c/c411c2e7b2e400829ffac250db81609ef3c56faa[commit]
https://pagure.io/freeipa/issue/9282[#9282]
* PRCI: update memory reqs for each topology
https://pagure.io/freeipa/c/aeb9cc9b622d3d4a40a7eb3fe5800649c68c3b96[commit]
* API reference: update dnszone_add generated doc
https://pagure.io/freeipa/c/660da9ab1d93fd8e561643728ae3821193953433[commit]
https://pagure.io/freeipa/issue/9249[#9249]
* API reference: update vault doc
https://pagure.io/freeipa/c/42957f9e7819ad76394b20337e65c7bee828dd8f[commit]
https://pagure.io/freeipa/issue/9259[#9259]
=== s1341 (1)
* ipaplatform: add initial nixos support
https://pagure.io/freeipa/c/16a81062ba1c92773eb6206d68af6a2b3ba1d54d[commit]
https://pagure.io/freeipa/issue/9299[#9299]
=== Jarl Gullberg (2)
* install: Fix missing dyndb keytab directive
https://pagure.io/freeipa/c/1b38ab1771944b51ddaeea972ea92a8e8ee5b92b[commit]
https://pagure.io/freeipa/issue/9344[#9344]
* ipaplatform/debian: fix path to ldap.so
https://pagure.io/freeipa/c/03180bedcf99075d98f206d271a31ae7ceddc50d[commit]
=== Julien Rische (3)
* Filter out constrained delegation ACL from KDB entry
https://pagure.io/freeipa/c/7ea3b86696f5451f1d227d365018ab7dc53024af[commit]
* Tolerate absence of PAC ticket signature depending of server
capabilities
https://pagure.io/freeipa/c/bbe545ff9feb972e549c743025e4a26b14ef8f89[commit]
https://pagure.io/freeipa/issue/9371[#9371]
* kdb: Use krb5_pac_full_sign_compat() when available
https://pagure.io/freeipa/c/630cda5c06428825dd5604493621b9cbdab70073[commit]
https://pagure.io/freeipa/issue/9373[#9373]
=== Jerry James (1)
* Change fontawesome-fonts requires to match fontawesome 4.x
https://pagure.io/freeipa/c/58173c021388dd31b4501d1c7bc1e6747cea8bb8[commit]
=== mbhalodi (5)
* ipatests: add remove automember condition tests
https://pagure.io/freeipa/c/846c267f58ecfa4fc1a1a3be91c404e58074b1b3[commit]
https://pagure.io/freeipa/issue/9332[#9332]
* ipatests: Test for sequence processing failures with server context
https://pagure.io/freeipa/c/304fd550613e83d120c72f0dad89f6a89d31231c[commit]
https://pagure.io/freeipa/issue/9349[#9349]
* ipatests: add missing automember-cli tests
https://pagure.io/freeipa/c/6db9bbd85a837950d9244502507535c1f79ab64a[commit]
https://pagure.io/freeipa/issue/9332[#9332]
* ipatests: WebUI - ensure that ipa automember-rebuild prints a warning
https://pagure.io/freeipa/c/cd07413cba37150b12d6b279510941aad49b5afb[commit]
https://pagure.io/freeipa/issue/9320[#9320]
* ipatests: ensure that ipa automember-rebuild prints a warning
https://pagure.io/freeipa/c/88b9be29036a3580a8bccd31986fc30faa9852df[commit]
https://pagure.io/freeipa/issue/9320[#9320]
=== Michal Polovka (2)
* ipatests: commands: Wait for the SSSD to become available
https://pagure.io/freeipa/c/bc39443211e998d7088571f0ef70233b6e456e1d[commit]
https://pagure.io/freeipa/issue/9377[#9377]
* ipatest: loginscreen: do not use hardcoded password
https://pagure.io/freeipa/c/1f10aebcc5b3568a9992111e377c5caecc1e035f[commit]
https://pagure.io/freeipa/issue/9226[#9226]
=== Mohammad Rizwan (3)
* ipatests: wait for sssd-kcm to settle after date change
https://pagure.io/freeipa/c/edcdcf83452dce837c1522c353c4a80c967ea57b[commit]
* ipatests: fix tests in TestACMEPrune
https://pagure.io/freeipa/c/e7c642bafcead5ce344f3b129d916045b00d0c1e[commit]
https://pagure.io/freeipa/issue/9294[#9294]
* ipatests: tests for certificate pruning
https://pagure.io/freeipa/c/0f77b359e241fc4055fb8d785e18f96338451ebf[commit]
https://pagure.io/freeipa/issue/9294[#9294]
=== Rob Crittenden (15)
* Don't allow a group to be converted to POSIX and external
https://pagure.io/freeipa/c/58017abeb88b2f2c8ee2e4f5a6ed808d28c672a4[commit]
https://pagure.io/freeipa/issue/8990[#8990]
* Replace usage of #!/usr/bin/env python3 with #!/usr/bin/python3
https://pagure.io/freeipa/c/325a13196b32c627854c8d7594e23b58167499f0[commit]
https://pagure.io/freeipa/issue/8941[#8941]
* Mention in ipa-client-install that nscd is disabled
https://pagure.io/freeipa/c/abe71fe145a3d16257043ccfbb43002607458cee[commit]
https://pagure.io/freeipa/issue/9086[#9086]
* Return the value cert-find failures from the CA
https://pagure.io/freeipa/c/81a6b9ad2d42fecdd94e17fa7c888bbdea2daf3c[commit]
https://pagure.io/freeipa/issue/9369[#9369]
* Use the OpenSSL certificate parser in cert-find
https://pagure.io/freeipa/c/50dd79d1a35549034bc281fbdffea4399baed3c7[commit]
https://pagure.io/freeipa/issue/9331[#9331]
* Enforce sizelimit in cert-find
https://pagure.io/freeipa/c/e2576670e692117c11987118abd5e9381bb90b1f[commit]
https://pagure.io/freeipa/issue/9331[#9331]
* doc: Update pruning design with implement enable/disable options
https://pagure.io/freeipa/c/fe13baa0acdb885dd981cbd8fdf6cee5e5ef22e3[commit]
https://pagure.io/freeipa/issue/9323[#9323]
* Wipe the ipa-ca DNS record when updating system records
https://pagure.io/freeipa/c/4e0ad96fbd9f438c884eeeaa60c2fb0c910a2b61[commit]
https://pagure.io/freeipa/issue/9195[#9195]
* Fix setting values of 0 in ACME pruning
https://pagure.io/freeipa/c/20ff7c16022793c707f6c2b8fb38a801870bc0e2[commit]
https://pagure.io/freeipa/issue/9325[#9325]
* tests: add wrapper around ACME RSNv3 test
https://pagure.io/freeipa/c/d24b69981d94fce7b1e1aa4a5c1ab88a123f96b5[commit]
https://pagure.io/freeipa/issue/9322[#9322]
* doc: add the --run command for manual job execution
https://pagure.io/freeipa/c/f10d1a0f84ed0f16ab4a1469f16ffadb3e79e59e[commit]
https://pagure.io/freeipa/issue/9294[#9294]
* ipa-acme-manage: add certificate/request pruning management
https://pagure.io/freeipa/c/9246a8a003b2b0062e07c289cd7cde8fe902b16f[commit]
https://pagure.io/freeipa/issue/9294[#9294]
* tests: Add new ipa-ca error messages to IPADNSSystemRecordsCheck
https://pagure.io/freeipa/c/6ca119686aadfa72c0474f72758b63cd671952d4[commit]
https://pagure.io/freeipa/issue/9291[#9291]
* tests: Add ipa_ca_name checking to DNS system records
https://pagure.io/freeipa/c/ff31b0c40cc5e046f839b98b80bd16bb649205ac[commit]
https://pagure.io/freeipa/issue/9291[#9291]
* doc: Design for certificate pruning
https://pagure.io/freeipa/c/51b1c22d025bf40e9ef488bb0faf0c8dff303ccd[commit]
https://pagure.io/freeipa/issue/9294[#9294]
=== Rafael Guterres Jeffman (2)
* Fix "no entry" condition when searching PAC info
https://pagure.io/freeipa/c/8a7c068300a80f14b4b2fa4d63b0512768d326ad[commit]
https://pagure.io/freeipa/issue/9368[#9368]
* Migrated to SPDX license.
https://pagure.io/freeipa/c/e3507563877f1d64567f24b7f2e33ade8c310f86[commit]
https://pagure.io/freeipa/issue/9342[#9342]
=== Stanislav Levin (21)
* ipasphinx: Correct import of progress_message for Sphinx 6.1.0+
https://pagure.io/freeipa/c/3d787c2107ca10de15602afc757fc9b24fdd89bf[commit]
https://pagure.io/freeipa/issue/9361[#9361]
* fastlint: Correct concatenation of file lists
https://pagure.io/freeipa/c/540262700d73b701b0fd5dd3b79e5b20f0fc84c3[commit]
https://pagure.io/freeipa/issue/9318[#9318]
* dns: Fix support for dnspython 1.1x
https://pagure.io/freeipa/c/b152e8c3aea9f2c3ade319934fd7c81cb5432407[commit]
https://pagure.io/freeipa/issue/9339[#9339]
* tests: webui: Update vendored qunit
https://pagure.io/freeipa/c/9b8e8edc22ade3027a5c3da487783f598e0732fd[commit]
https://pagure.io/freeipa/issue/9329[#9329]
* AP: webui: List installed nodejs packages
https://pagure.io/freeipa/c/8fe8b262232ce65dddea8c92838200a1c5121f13[commit]
https://pagure.io/freeipa/issue/9329[#9329]
* tests: webui: Load qunit only once
https://pagure.io/freeipa/c/425cad6f114c981bfe41a30c7ad626164ac29be4[commit]
https://pagure.io/freeipa/issue/9329[#9329]
* tests: webui: Allow file access from files in tests
https://pagure.io/freeipa/c/450e78f5f3be3064d7ee1c6be5103dfae2ebaf87[commit]
https://pagure.io/freeipa/issue/9329[#9329]
* tests: Configure DNSResolver as platform agnostic resolver
https://pagure.io/freeipa/c/d662b125985369181a3ebcbad82a4a43215282f6[commit]
https://pagure.io/freeipa/issue/9319[#9319]
* spec: Drop no longer used build dependency on paste
https://pagure.io/freeipa/c/fb22c8e5bf9432b4a7c2866d5d210c353985ea50[commit]
https://pagure.io/freeipa/issue/9314[#9314]
* ipatests: healthcheck: Handle missing fips-mode-setup
https://pagure.io/freeipa/c/1be3188e3168e7a097e44a97f86e29b7e42fcae6[commit]
https://pagure.io/freeipa/issue/9315[#9315]
* pylint: Replace deprecated cgi module
https://pagure.io/freeipa/c/2009889d763ccc26479c966931ca1b60378496fd[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix useless-object-inheritance
https://pagure.io/freeipa/c/bccd3c942084c753543d63b4d409ac46f819d314[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix unhashable-member
https://pagure.io/freeipa/c/bd7b5bf71c443daa3ac12ff194748845a84b08f0[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix unnecessary-lambda-assignment
https://pagure.io/freeipa/c/dc8c8a7824565178333ef7ae8ac7934467424691[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix modified-iterating-list
https://pagure.io/freeipa/c/acc2daf25f5c12ef1d9a823de15df080ba42d059[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix used-before-assignment
https://pagure.io/freeipa/c/b12376560da944b0845b9ac0d424adaf5435670f[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Replace deprecated pipes
https://pagure.io/freeipa/c/1261bbf0016d4824f908a589d4943513e98f8b01[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Fix cyclic-import
https://pagure.io/freeipa/c/c48c76e9d34bae09dc4eac1f3b33f7cb72355c25[commit]
https://pagure.io/freeipa/issue/9232[#9232],
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Replace deprecated extension-pkg-whitelist
https://pagure.io/freeipa/c/68ab438f5c2250d96733a0c1b47cbb3a1c518bed[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: More allowed C extensions
https://pagure.io/freeipa/c/f9822697659f134146e1dcfce0c48e2279a8becb[commit]
https://pagure.io/freeipa/issue/9278[#9278]
* pylint: Lint in single process mode
https://pagure.io/freeipa/c/d673fdab6097ae783bd0075c0e990e42bc24f833[commit]
https://pagure.io/freeipa/issue/9278[#9278]
=== Sudhir Menon (2)
* ipatests: ipa-adtrust-install command test scenarios
https://pagure.io/freeipa/c/76c788274a2ee3993ee36d12d91e22200817dfc9[commit]
* Fixes: ipa-otpd@.service: deprecated syslog setting
https://pagure.io/freeipa/c/65a14a36936b8ebfdb17560d5976447c6f4cdf7e[commit]
https://pagure.io/freeipa/issue/9279[#9279]
=== Timo Aaltonen (1)
* Drop duplicate includedir from krb5.conf
https://pagure.io/freeipa/c/bdb77a3d810837e3e349ce6b5625662be281f2cd[commit]
https://pagure.io/freeipa/issue/9267[#9267]
=== Todd Zullinger (2)
* spec: silence krb5 pkgconf errors in %krb5_base_version
https://pagure.io/freeipa/c/90d0f04987b5477efa64d64416d89890e6bcda75[commit]
* spec: verify upstream source signature
https://pagure.io/freeipa/c/3b64eaa153d89920cbb0be87e5c2b512c4bf2008[commit]
=== Thorsten Scherf (1)
* external-idp: change idp server name to reference name
https://pagure.io/freeipa/c/9323bafb645a377192efe17b489124a440c055c3[commit]
3 months, 3 weeks