Alexander Bokovoy via FreeIPA-devel wrote:
> Hi,
>
> below is the draft for the release notes for upcoming FreeIPA 4.8.2
> release. I'm intending to release it tomorrow, so please add your
> comments today.
Looks good.
rob
>
>
> {{ReleaseDate|2019-11-12}}
> The FreeIPA team would like to announce FreeIPA 4.8.2 release!
>
> It can be downloaded from
http://www.freeipa.org/page/Downloads. Builds for
> Fedora 31 will be available in the official
> [
https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-8/ COPR
> repository].
>
> == Highlights in 4.8.2 ==
>
> --------
> * 5608: [RFE] Add Dogtag configuration extensions
>
> Dogtag CA allows to specify additional options in the configuration file
> used
> to deploy CA. FreeIPA installers can now pass through an overlay
> configuration
> file to fine-tune the CA.
>
> --------
> * 7971: [RFE] Include hint for replication_wait_timeout if timeout fails
>
> In case replica set up times out, suggest increasing
> replication_wait_timeout
> option before running the replica installation.
>
> --------
>
> === Enhancements ===
>
> * 8001 Need default authentication indicators for SPAKE, PKINIT and
> encrypted challenge preauth
>
> When Kerberos authentication is performed with the help of SPAKE or PKINIT
> pre-authentication methods, add authentication indicator to resulting
> tickets.
> This allows filtering access to resources by a wider variety of
> pre-authentication methods.
>
> --------
> * 8110 Enable AES SHA 256 and 384 Kerberos enctypes
>
> Allow use of AES SHA 256 and 384 Kerberos encryption types by default
> for new Kerberos principals.
>
> --------
> * 8111 [FIPS] Don't add camellia KRB5 encsalttypes in FIPS mode
>
> Expose only encryption types allowed in FIPS mode when creating a master
> in FIPS mode.
>
> --------
> * 8020 support AES in LWCA key replication
>
> Sub-CA key replication between CA replicas now can use AES encryption to
> wrap the secrets.
>
> --------
> * 8044 Extdom plugin should not return LDAP_NO_SUCH_OBJECT if there are
> timeout or other errors
>
> An LDAP control used by SSSD for retrieval of information about AD users
> and
> groups was extended to properly differentiate lack of information and its
> unavailability.
>
>
> --------
> === Known Issues ===
>
> === Bug fixes ===
> FreeIPA 4.8.2 is a stabilization release for the features delivered as a
> part of 4.8.0.
> There are more than 40 bug-fixes details of which can be seen in
> the list of resolved tickets below.
>
> == Upgrading ==
> Upgrade instructions are available on [[Upgrade]] page.
>
> == Feedback ==
> Please provide comments, bugs and other feedback via the freeipa-users
> mailing
> list
>
(
https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
>
> or #freeipa channel on Freenode.
>
>
> == Resolved tickets ==
> * 2018 Change hostname length limit to 64
> * 3999 [RFE] Fix and Document how to set up Samba File Server with IPA
> * 4972 check for existence of private group is done even if UPG
> definition is disabled
> * 5062 [WebUI] Unlock option is enabled for all user.
> * 5608 [RFE] Add Dogtag configuration extensions
> * 5879 Attempt to fix capitalization fails with ipa: ERROR: Type or
> value exists:
> * 6210 When master's IP address does not resolve to its name,
> ipa-replica-install fails
> * 6843 ipa-backup does not create log file at /var/log/
> * 7307 RFE: Extend IPA to support unadvertised replicas
> * 7522 Disable cert publishing in dogtag
> * 7566 Installation of replica against a specific master
> * 7725 ipa-restore set wrong file permissions and ownership for
> /var/log/dirsrv/slapd-<instance> directory
> * 7870 [certmonger][upgrade] "Failed to get request: bus, object_path
> and dbus_interface must not be None."
> * 7961 [WebUI] Identity Manager WebUI requires you to save changes after
> changing specifications before making other change
> * 7971 [RFE] Include hint for replication_wait_timeout if timeout fails
> * 7987 Python shebang: Use isolated mode
> * 7995 Removing TLSv1.0, TLSv1.1 from nss.conf
> * 8001 Need default authentication indicators for SPAKE, PKINIT and
> encrypted challenge preauth
> * 8017 host-add --password logs cleartext userpassword to Apache error log
> * 8020 support AES in LWCA key replication
> * 8031 HBAC Test Validation error when running the HBAC test the second
> time round via the IPA Web GUI
> * 8034 Existing p11-kit config file is not restored on uninstall
> * 8038 ipa-client-automount --uninstall is not restoring nsswitch.conf
> * 8044 Extdom plugin should not return LDAP_NO_SUCH_OBJECT if there are
> timeout or other errors
> * 8048 Travis-CI sometimes fails at dnf
> * 8052 test failure in
> test_integration/test_sudo.py::TestSudo::()::test_domain_resolution_order on
> fedora29
> * 8053 [WebUI] Fix login screen loading issue in test_loginscreen
> * 8054 ipa-client-install calls "authselect select sssd --force" at
> uninstall time before restoring user-nsswitch.conf
> * 8055 Test for PG6843: ipa-backup does not create log file at /var/log
> is failing
> * 8056 BuildRequires is not compatible with %{_libdir}
> * 8057 Running ipa-server-install produces SyntaxWarning: "is not" with
> a literal. Did you mean "!="?
> * 8062 Re-add configure_nsswitch_database, configure_nsswitch, ... to
> ipaclient.install
> * 8066 Don't use -t option to klist in adtrust code when timestamp is
> not needed
> * 8067 add default access control configuration to trusted domain objects
> * 8070 Test failure in
>
test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion::()::test_hidden_replica_install
>
> * 8073 Backup/restore does not restore /etc/pkcs11/modules/softhsm2.module
> * 8075 Don't create log file for helper scripts
> * 8077 New pylint 2.4.0 errors
> * 8084 KRA authentication fails when IPA CA has custom Subject DN
> * 8086 ipa-server-certinstall man page does not match built-in help.
> * 8099 ipa-backup command is failing on rhel-7.8
> * 8102 Pylint 2.4.3 + Astroid 2.3.2 errors
> * 8105 getcert with -F option returns before cacert file is created
> * 8110 Enable AES SHA 256 and 384 Kerberos enctypes
> * 8111 [FIPS] Don't add camellia KRB5 encsalttypes in FIPS mode
>
> == Detailed changelog since 4.8.1 ==
> === Armando Neto (3) ===
> * prci: increase timeout argument for test_sssd.py
> * prci: increase timeout for jobs that required AD
> * prci: Update box used in branch ipa-4-8
>
> === Alexander Bokovoy (6) ===
> * Add local helpers to handle unixid structure
> * adtrust: add default read_keys permission for TDO objects
> * add default access control when migrating trust objects
> * adtrust: avoid using timestamp in klist output
> * Mark failing test as xfail for use of python-dns make_ds method
> * ipa-extdom-extop: test timed out getgrgid_r
>
> === Alexandre Mulatinho (1) ===
> * ipa-scripts: fix all ipa command line scripts to operate with -I
>
> === Anuja More (1) ===
> * Extdom plugin should not return error (32)/'No such object'
>
> === Christian Heimes (10) ===
> * Skip commented lines after substitution
> * Block camellia in krbenctypes update in FIPS
> * Don't install a preexec_fn by default
> * Don't create log files from help scripts
> * Fix ca_initialize_hsm_state
> * Add new env vars to pylint plugin
> * Fix wrong use of identity operation
> * Enable literal-comparison linter again
> * Replace %{_libdir} macro in BuildRequires
> * Store HSM token and state
>
> === Changmin Teng (5) ===
> * Add design document
> * Modify webUI to adhere to new IPA server API
> * Implement user pre-authentication control with kdcpolicy plugin
> * Extend the list of supported pre-auth mechanisms in IPA server API
> * Add new authentication indicators in kdc.conf.template
>
> === François Cami (8) ===
> * ipatests: temporarily remove test_smb from gating
> * ipa_client_automount.py: fix typo (idmap.conf => idmapd.conf)
> * ipapython/ipachangeconf.py: change "is not 0" for "!= 0"
> * travis-ci: make dnf invocations more resilient
> * authconfig.py: restore user-nsswitch.conf at uninstall time
> * ipatests: remove xfail in TestIpaClientAutomountFileRestore
> * ipa-client-automount: always restore nsswitch.conf at uninstall time
> * ipatests: check that ipa-client-automount restores nsswitch.conf at
> uninstall time
>
> === Florence Blanc-Renaud (10) ===
> * ipa-backup: fix python2 issue with os.mkdir
> * ipa-server-certinstall manpage: add missing options
> * ipatests: fix test_replica_promotion.py::TestHiddenReplicaPromotion
> * ipatests: add XMLRPC test for user-add when UPG plugin is disabled
> * ipa user_add: do not check group if UPG is disabled
> * replica install: enforce --server arg
> * ipatests: ensure that backup/restore restores pkcs 11 modules config file
> * ipa-backup: backup the PKCS module config files setup by IPA
> * config plugin: replace 'is 0' with '== 0'
> * ipatests: fix wrong xfail in test_domain_resolution_order
>
> === Francisco Trivino (1) ===
> * prci: increase gating tasks priority
>
> === Fraser Tweedale (7) ===
> * test_integration: add tests for custom CA subject DN
> * upgrade: fix ipakra people entry 'description' attribute
> * krainstance: set correct issuer DN in uid=ipakra entry
> * Bump Dogtag min version to 10.7.3
> * ipa-pki-retrieve-key: request AES encryption (with fallback)
> * NSSWrappedCertDB: accept optional symmetric algorithm
> * IPASecStore: support extra key arguments
>
> === Michal Polovka (3) ===
> * ipatests: add tests for ipa host-add with non-default maxhostnamelength
> * ipatests: fix topology for TestIpaNotConfigured in PR-CI nightly
> definitions
> * ipatests: Test for ipa-backup with ipa not configured
>
> === Mohammad Rizwan Yusuf (3) ===
> * Add test to nightly yamls.
> * Installation of replica against a specific server
> * Check file ownership and permission for dirsrv log instance
>
> === ndehadra (1) ===
> * Hidden Replica: Add a test for Automatic CRL configuration
>
> === Spencer E. Olson (1) ===
> * Fixes debian path for IPA_CUSTODIA_HANDLER
>
> === Rob Crittenden (16) ===
> * Conditionally restart certmonger after client installation
> * Add conditional restart (try-restart) capability to services
> * Enable AES SHA 256 and 384-bit enctypes in Kerberos
> * Add missing timeout option to logging statement
> * Log dogtag auth timeout in install, provide hint to increase it
> * Log the replication wait timeout for debugging purposes
> * Replace replication_wait_timeout with certmonger_wait_timeout
> * Disable dogtag cert publishing
> * ipa-restore: Restore ownership and perms on 389-ds log directory
> * Report if a certmonger CA is missing
> * Re-order tasks.restore_pkcs11_modules() to run earlier
> * Don't log host passwords when they are set/modified
> * Skip lock and fork in ipa-server-guard on unsupported ops
> * Defer initializing the API in dogtag-ipa-ca-renew-agent-submit
> * Use tasks to configure automount nsswitch settings
> * Move ipachangeconf from ipaclient.install to ipapython
>
> === Robbie Harwood (7) ===
> * Provide modern example enctypes in ipa-getkeytab(1)
> * Fix segfault in ipadb_parse_ldap_entry()
> * Add a skeleton kdcpolicy plugin
> * Move certauth configuration into a server krb5.conf template
> * Enable krb5 snippet updates on client update
> * Fix NULL pointer dereference in maybe_require_preauth()
> * Log INFO message when LDAP connection fails on startup
>
> === Rafael Guterres Jeffman (1) ===
> * Fixes pylint errors introduced by version 2.4.0.
>
> === Rafael Guterres Jeffman (6) ===
> * Removed unnecessary imports after code review.
> * Removes several pylint warnings.
> * Removed unnecessary imports after code review.
> * Removes several pylint warnings.
> * Removes rpmlint warning on freeipa.spec.
> * Re-add function façades removed by commit 2da9088.
>
> === Sumit Bose (1) ===
> * extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
>
> === Stanislav Levin (5) ===
> * Fix errors found by Pylint-2.4.3
> * Install language packs for tests
> * Restore running of 'test_ipaserver' tests on Azure
> * Setup DNS for AP Docker container
> * Fixed errors newly exposed by pylint 2.4.0
>
> === Sergey Orlov (11) ===
> * ipatests: in DNS zone file add A record for name server
> * ipatests: strip newline character when getting name of temp file
> * ipatests: add test to check that only TLS 1.2 is enabled in Apache
> * ipatests: fix DNS forwarders setup for AD trust tests with non-root
> domains
> * ipatests: add tests for cached_auth_timeout in sssd.conf
> * ipatests: refactoring: use library function to check if selinux is
> enabled
> * ipatests: add new utilities for file management
> * ipatests: refactor and extend tests for IPA-Samba integration
> * ipatests: modify run_command to allow specify successful return codes
> * ipatests: add utility functions related to using and managing user
> accounts
> * ipatests: allow to pass additional options for clients installation
>
> === Serhii Tsymbaliuk (4) ===
> * WebUI: Fix new test initialization on "HBAC Test" page
> * WebUI: Fix changing category on HBAC/Sudo/etc Rule pages
> * WebUI: Make 'Unlock' option is available only on locked user page
> * WebUI tests: Fix login screen loading issue
>
> === sumenon (1) ===
> * Added testcase to check capitalization fix while running ipa user-mod
>
> === Tibor Dudlák (1) ===
> * Add container environment check to replicainstall
>
> === Tomas Halman (4) ===
> * extdom: add extdom protocol documentation
> * extdom: use sss_nss_*_timeout calls
> * extdom: plugin doesn't use timeout in blocking call
> * extdom: plugin doesn't allow @ in group name
>
>
_______________________________________________
FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedoraho...