The FreeIPA team would like to announce FreeIPA 4.6.0 release!

It can be downloaded from https://releases.pagure.org/freeipa/. Builds for Fedora 25 and 26 will be available in the officialCOPR repository https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-6/ .

== Highlights in 4.6.0 ==

=== Enhancements ===

* Python 3 is now supported.

=== Known Issues ===

* WebUI doesn't work [#7126, #7127] * Attempting un-installation if IPA isn't installed prints confusing strings [#7063]

=== Bug fixes === Contains all bugfixes and enhancements of 4.5.1, 4.5.2 and 4.5.3 releases.

== Upgrading == Upgrade instructions are available on [[Upgrade]] page.

== Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahost...) or #freeipa channel on Freenode.

== Resolved tickets == * 7123 External CA renewal fails when IPA CA subject DN does not match "CN=Certificate Authority, {subject-base}" * 7116 dnssec: fix localhsm.py with openhsm >= 2.2.0 * 7108 ipa-backup broken because of cyclic import * 7086 [ipatests] - add caless to cafull tests * 7066 WebUI: All columns of user in group table are clickable * 7035 ipa-otptoken-import - XML file is missing PBKDF2 parameters! * 7017 NULL LDAP context in call to ldap_search_ext_s during search in cn=ad,cn=trusts,dc=example,dc=com * 6605 make lint + make modifies PO files in place * 6582 Web UI: Change "Host Based" and "Role Based" to "Host-Based" and "Role-Based" * 6447 [WebUI] Remove offline version of WebUI * 6261 Replace ERROR: cannot connect to 'http://localhost:8888/ipa/json': [Errno 111] Connection refused with 'IPA is not configured on this system' * 6176 Updating of dns system records rapidly slowdown uninstallation * 7121 ipa otptoken-add-yubikey fails with python3 * 7118 Fix CA-less installation due to incorrect with statement * 7110 Missing requirement in freeipa 4.5.90.dev201708161122+git799551892-0 * 7100 test_caless: add SAN dNSName extensions for wildcard tests * 7088 Use X509v3 Basic Constraints "CA:TRUE" instead of "CA:FALSE" IPA CA CSR * 7076 Adjust to CURL whichs started to use OpenSSL - ipa-server-install fails to obtain RA certificate from CA (CA_UNREACHABLE) * 7053 Replica install fails to configure IPA-specific temporary files/directories * 7052 WebUI: search facet spec actions contains 'undefined' item * 7051 ipapython/graph.py complexity optimization * 7050 Type error when running tests for whoami command. * 7046 missing default basedn causes failure during initialization of multi host tests * 7030 tests: CA-less test suite broken due to missing subject key identifier extension * 7011 --force-join option is not mentioned in ipa-replica-install man page * 7010 ipa-backup fails silently * 7002 adtrustinstance: broken ID range assessment * 6987 ca-add: invalid X.509 DN fails ungracefully * 6986 make pylint is not working on F26 * 6980 Pagination Size under Customization in IPA WebUI accepts negative values * 6976 External CA: check that IPA CA certificate contains Subject Key Identifier * 6974 WebUI: Fix unit webUI tests * 6971 ipatests: collect systemd journal * 6956 Backup and restore tests faliling * 6946 ipa-replica-manage del (dl 0) doesn't remove server from defaultServerList * 6945 Bring back error messages from certificate validation * 6943 server-del doesn't remove server from defaultServerList in cn=default,ou=profile,$BASE * 6940 installer should indicate that it is waiting for keys * 6939 ipaserver.plugins.host.get_dn timeout due to unindexed search * 6928 ipa-managed-entries incorrectly states server not installed * 6865 minor spelling mistake in ipa-adtrust-install.1 * 6863 minor spelling mistake * 6852 [RFE] Create client enrollment role * 6849 Priority field missing in required field incicator - * * 6845 ipa-otpd.socket.in has wrong kdc service name for Debian * 6834 ipa-kdc-proxy.conf.template hardcodes python module directory * 6822 git-commit-template: update ticket URL to use pagure.io instead of fedorahosted.org * 6818 Update asn1c code in /asn1/asn1c * 6809 Failed to write schema: b'sudo/1' is not JSON serializable * 6745 [test] ipa whoami command * 6725 No page for information on build from source * 6642 Py3: test_serverroles: use ldap2/ldapclient instead of MockLDAP * 6591 pytest 3.0: yield tests are deprecated * 5990 Py3: zonemgr_callback: expected unicode, got bytes * 5919 cert-request rfc822Name check compares whole email address case-sensitively * 4985 [RFE] Support Python 3

== Detailed changelog since 4.5.3 == === Alexander Bokovoy (13) === * csrgen: support openssl 1.0 and 1.1 * dcerpc: support Python 3 * ipa-sam: use smbldap_set_bind_callback for Samba 4.7 or later * ipa-sam: use own private structure, not ldapsam_privates * trust-mod: allow modifying list of UPNs of a trusted forest * ipa-kdb: add pkinit authentication indicator in case of a successful certauth * Fix index definition for ipaAnchorUUID * krb5: make sure KDC certificate is readable * trust: always use oddjobd helper for fetching trust information * ipaserver/dcerpc: unify error processing * adtrust: make sure that runtime hostname result is consistent with the configuration * server: make sure we test for sss_nss_getlistbycert * ldap2: use LDAP whoami operation to retrieve bind DN for current connection

=== Abhijeet Kasurde (6) === * Vault testcase improvement * Minor typo fixes * Minor typo in details.js * Hide request_type doc string in cert-request help * Hide PKI Client database password in log file * Use with statement for opening file

=== Alex Zeleznikov (1) === * Sort SRV records by priority

=== Aleksei Slaikovskii (3) === * ipapython/graph.py redundant variable fix * ipapython/graph.py String formatting * ipapython/graph.py complexity optimization

=== Ben Lipton (4) === * csrgen: Beginnings of NSS database support * csrgen: Modify cert_get_requestdata to return a CertificationRequestInfo * csrgen: Change to pure openssl config format (no script) * csrgen: Remove helper abstraction

=== Christian Heimes (40) === * Misc Python 3 fixes for ipaserver.secrets * Reimplement yield tests are parametrized tests * Silence pytest.yield_fixture deprecation warning * Slim down dependencies * Vault: Explicitly default to 3DES CBC * Band-aid for pip dependency bug * Correct PyPI package dependencies * tox: use pylint 1.6.x for now * Replace _BSD_SOURCE with _DEFAULT_SOURCE * Regenerate ASN.1 code with asn1c 0.9.28 * tox testing support for client wheel packages * Stabilize make pypi_packages * Replace hard-coded kdcproxy path with WSGI script * Use entry_points for ipa CLI * Don't hard-code with_wheels * Add an option to build ipaserver wheels * Add extra_requires for additional dependencies * Conditionally import pyhbac * Skip test_session_storage in ipaclient unittest mode * Add make devcheck for developers * session storage parameters must be bytes * Fix ipatests.util doc tests * Use Custodia 0.3.1 features * Simplify KRA transport cert cache * pytest 3.x compatibility * Constrain wheel package versions * Move remaining util functions to tasks module * Ship ipatests.pytest_plugins.integration * Move function run_repeatedly to tasks module * Move hosts module to ipatests.pytest_plugins.integration.hosts * Move tasks module to ipatests.pytest_plugins.integration.tasks * Move env_config module to ipatests.pytest_plugins.integration.env_config * Move config module to ipatests.pytest_plugins.integration.config * Move helper code for integration plugin * Increase Apache HTTPD's default keep alive timeout * Add debug logging for keep-alive * Use connection keep-alive * Add options to run only ipaclient unittests * Python 3: Fix session storage * Fix Python 3 pylint errors

=== David Kreitschmann (4) === * Disable pylint in get_help function because of type confusion. * Store help in Schema before writing to disk * Use os.fsync instead of os.fdatasync because macOS doesn't support fdatasync * Fix libkrb5 filename for macOS

=== David Kupka (22) === * tests: certmap: Add test for user-{add,remove}-certmap * tests: tracker: Add CertmapdataMixin tracker * tests: certmap: Add test for certmapconfig-{mod,show} * tests: tracker: Add CertmapconfigTracker to tests certmapconfig-* commands * tests: certmap: Test permissions for certmap * tests: certmap: Add basic tests for certmaprule commands * tests: tracker: Add CertmapTracker for testing certmap-* commands * tests: tracker: Add ConfigurationTracker to test *config-{mod,show} commands * tests: tracker: Add EnableTracker to test *-{enable,disable} commands * tests: tracker: Split Tracker into one-purpose Trackers * install: replica: Show message about key synchronization * kra: promote: Get ticket before calling custodia * ipapython.ipautil.run: Add option to set umask before executing command * otptoken-add-yubikey: When --digits not provided use default value * Bump version of ipa.conf file * Create system users for FreeIPA services during package installation * WebUI: cert login: Configure name of parameter used to pass username * httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not available * spec file: Bump requires to make Certificate Login in WebUI work * rpcserver.login_x509: Actually return reply from __call__ method * Create temporaty directories at the begining of uninstall * ipapython.ipautil.nolog_replace: Do not replace empty value

=== felipe (1) === * Fixing replica install: fix ldap connection in domlvl 0

=== Felipe Volpone (3) === * Removing part of circular dependency of ipalib in ipaplaform * Changing how commands handles error when it can't connect to IPA server * py3: fixing zonemgr_callback

=== Felipe Volpone (5) === * Adding section "Building FreeIPA from source" on README * Changing cert-find to go through the proxy instead of using the port 8080 * Changing cert-find to do not use only primary key to search in LDAP. * Fixing adding authenticator indicators to host * Fixing the cert-request comparing whole email address case-sensitively.

=== Fabiano Fidêncio (1) === * Allow erasing ipaDomainResolutionOrder attribute

=== Florence Blanc-Renaud (22) === * Fix Certificate renewal (with ext ca) * Fix ipa-server-upgrade: This entry already exists * ipa-replica-conncheck: handle ssh not installed * ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt * ipa-replica-manage del (dl 0): remove server from defaultServerList * server-del: update defaultServerList in cn=default,ou=profile,$BASE * ipa-kra-install: fix pkispawn setting for pki_security_domain_hostname * ipa-server-install: fix uninstall * ipa-kra-install manpage: document domain-level 1 * ipa-kra-install: fix check_host_keys * ipa-server-install with external CA: fix pkinit cert issuance * ipa-client-install: remove extra space in pkinit_anchors definition * vault: piped input for ipa vault-add fails * upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is installed * tests: add non-reg for idrange-add * Upgrade: add gidnumber to trusted domain entry * ipa-sam: create the gidNumber attribute in the trusted domain entry * idrange-add: properly handle empty --dom-name option * ipa-ca-install man page: Add domain level 1 help * git-commit-template: update ticket url to use pagure.io instead of fedorahosted.org * dogtag-ipa-ca-renew-agent-submit: fix the is_replicated() function * man ipa-cacert-manage install needs clarification

=== Fraser Tweedale (14) === * Fix external renewal for CA with non-default subject DN * py3: handle bytes in schema response * py3: fix vault public key decoding * cert: fix application of 'str' to bytes when formatting otherName * py3: fix schema response for py2 server with py3 client * Fix incorrect 'with' statement in CA-less installation * Restore old version of caIPAserviceCert for upgrade only * cert-request: simplify request processing * Add CommonNameToSANDefault to default cert profile * Add a README to certificate profile templates directory * py3: fix regression in schemaupdate * ca-add: validate Subject DN name attributes * Add Subject Key Identifier to CA cert validity check * Support 8192-bit RSA keys in default cert profile

=== Jan Cholasta (61) === * pylint: enable logging checks * logging: do not use `ipa_log_manager` to create module-level loggers * logging: do not log into the root logger * logging: do not reference loggers in arguments and attributes * doc: sync guide.org with cli.py * logging: remove object-specific loggers * logging: use the actual root logger as the root logger * logging: port to standard Python logging * logging: do not configure any handlers by default * wsgi, oddjob: remove needless uses of Env * config: provide defaults for `xmlrpc_uri`, `ldap_uri` and `basedn` * ldap2: remove URI argument from ldap2 constructor * test_ldap: drop redundant URI argument * {ca,kra}instance: drop redundant URI argument from ad-hoc ldap2 connections * user, migration: use LDAPClient for ad-hoc LDAP connections * install: do not assume /etc/krb5.conf.d exists * server upgrade: do not enable PKINIT by default * pkinit manage: introduce ipa-pkinit-manage * server certinstall: update KDC master entry * httpinstance: wait until the service entry is replicated * server certinstall: support PKINIT * cacert manage: support PKINIT * replica install: respect --pkinit-cert-file * server install: fix KDC certificate validation in CA-less * certs: do not export CA certs in install_pem_from_p12 * certs: do not export keys world-readable in install_key_from_p12 * server install: fix KDC PKINIT configuration * install: introduce generic Kerberos Augeas lens * client install: fix client PKINIT configuration * install: trust IPA CA for PKINIT * certdb: use custom object for trust flags * certdb, certs: make trust flags argument mandatory * certdb: add named trust flag constants * ipa-cacert-manage: add --external-ca-type * renew agent: get rid of virtual profiles * renew agent: always export CSR on IPA CA certificate renewal * renew agent: allow reusing existing certs * cainstance: use correct profile for lightweight CA certificates * server upgrade: always fix certmonger tracking request * renew agent: respect CA renewal master setting * spec file: bump krb5 Requires for certauth fixes * spec file: bump python-netaddr Requires * configure: fix AC_CHECK_LIB usage * cert: defer cert-find result post-processing * renew agent, restart scripts: connect to LDAP after kinit * renew agent: revert to host keytab authentication * install: request service certs after host keytab is set up * dsinstance, httpinstance: consolidate certificate request code * httpinstance: avoid httpd restart during certificate request * dsinstance: reconnect ldap2 after DS is restarted by certmonger * httpinstance: make sure NSS database is backed up * certdb: fix `AttributeError` in `verify_ca_cert_validity` * setup, pylint, spec file: drop python-nss dependency * certdb: use certutil and match_hostname for cert verification * spec file: bump libsss_nss_idmap-devel BuildRequires * spec file: bump krb5-devel BuildRequires for certauth * cert: do not limit internal searches in cert-find * replica prepare: fix wrong IPA CA nickname in replica file * httpinstance: clean up /etc/httpd/alias on uninstall * certs: do not implicitly create DS pin.txt * tasks: run `systemctl daemon-reload` after httpd.service.d updates

=== René Genz (3) === * fix minor spelling mistakes * fix spelling mistake; minor rewording * fix minor typos in ipa-adtrust-install.1

=== Martin Babinsky (45) === * Move tmpfiles.d configuration handling back to spec file * Do not remove the old masters when setting the attribute fails * *config-show: Do not show empty roles/attributes * smart-card-advises: ensure that krb5-pkinit is installed on client * smart card advise: use password when changing trust flags on HTTP cert * smart card advises: use a wrapper around Bash `for` loops * Use the compound statement formatting API for configuring PKINIT * Fix indentation of statements in Smart card advises * delegate formatting of compound Bash statements to dedicated classes * advise: add an infrastructure for formatting Bash compound statements * delegate the indentation handling in advises to dedicated class * add a class that tracks the indentation in the generated advises * Allow to pass in multiple CA cert paths to the smart card advises * smart-card advises: add steps to store smart card signing CA cert * smart-card advises: configure systemwide NSS DB also on master * Prepare advise plugin for smart card auth configuration * Extend the advice printing code by some useful abstractions * fix incorrect suffix handling in topology checks * Do not delete DS and PKI users during backup/restore tests * test_backup_restore: do not fail on missing KrbLastSuccessfulAuth * only stop/disable simple service if it is installed * test_serverroles: Get rid of MockLDAP and use ldap2 instead * Add `pkinit-status` command * Add the list of PKINIT servers as a virtual attribute to global config * Add an attribute reporting client PKINIT-capable servers * Refactor the role/attribute member reporting code * Allow for multivalued server attributes * Travis CI: Add the server uninstaller as a last step of tests * Travis CI: explicitly update pip before running the builds * Do not test anonymous PKINIT after install/upgrade * Upgrade: configure local/full PKINIT depending on the master status * Use local anchor when armoring password requests * Stop requesting anonymous keytab and purge all references of it * Use only anonymous PKINIT to fetch armor ccache * API for retrieval of master's PKINIT status and publishing it in LDAP * Allow for configuration of all three PKINIT variants when deploying KDC * separate function to set ipaConfigString values on service entry * Revert "Store GSSAPI session key in /var/run/ipa" * Remove duplicate functionality in upgrade * Always check and create anonymous principal during KDC install * Ensure KDC is propery configured after upgrade * Split out anonymous PKINIT test to a separate method * Remove unused variable from failed anonymous PKINIT handling * Upgrade: configure PKINIT after adding anonymous principal * Travis CI: invoke integration test helper scripts before test execution

=== Martin Basti (63) === * DNS update: reduce timeout for CA records * baseldap: fix format string * IPAOptionParser: fix dict comprehension * py3: run already ported scripts under py3 by default * py3: temporary set dependencies to both py2 and py3 packages * py3: test_otptoken_import: fix bytes usage * py3: ipa_otptoken_import: fix hex decoding * py3: ipa_otptoken_import: fix calling unicode on bytes * py3: ipa_otptoken_import: fix lamba code inspection * py3: Remove comparison >=2 of debnug log level * py3: vault: data must be bytes * py3: test_location_plugin: fix iteration over changed dict * py3: test_kerberos_principal_aliases: fix code scope * py3: dogtag.py: fix bytes warnings * py3: travis: enable tests for plugins that are aleready working * py3: secrets: remove iteritems usage * Travis: check for BytesWarnings in httpd error_log * py3: ipaldap: fix encoding of datetime objects * py3: LDAPClient: remove __del__ method * LDAPEntry: rename _orig to _orig_raw * python-netifaces: update to reflect upstream changes * Travis: enable temporary Py3 testing * Travis: build only py2 packages for py2 testing * Build: allow to build only py2 rpms for fedora * Remove network and broadcast address warnings * replica install: add missing check for non-local IP address * Remove ip_netmask from option parser * CheckedIPAddress: remove match_local param * refactor CheckedIPAddress class * ipa-dns-install: remove check for local ip address * Fix local IP address validation * Explicitly ask for py2 dependencies in py2 packages * Only warn when specified server IP addresses don't match intf * pylint: explicitly depends on python2-pylint * py3: update_mod_nss_cipher_suite: ordering doesn't work with None * py3: urlfetch: use "file://" prefix with filenames * py3: cainstance: fix BytesWarning * py3: schemaupdate: fix BytesWarning * py3: LDAP updates: use only bytes/raw values * py3: softhsm key_id must be bytes * py3: ipaldap: encode Boolean as bytes * py3: ConfigParser: replace deprecated readfd with read * py3: use ConfigParser instead of SafeConfigParser * Add remote_plugins subdirectories to RPM * custodia dep: require explictly python2 version * pylint: ignore new checks added in 1.7 * Pylint: fix ipa_forbidden_import checker * travis: fix pylint execution with py3 * py3: add missing py3 pylint depedencies * adtrust: move SELinux settings to constants * httpd: move SELinux settings to constants * ipasetup: fix dependencies handling based on python version * ipaclient: fix missing RPM ownership * tests: add missing dependency iptables * ca_status: add HTTP timeout 30 seconds * http_request: add timeout option * Use proper SELinux context with http.keytab * Store GSSAPI session key in /var/run/ipa * Fix PKCS11 helper * Remove surplus 'the' in output of ipa-adtrust-install * collect audit.log for easier selinux investigation * Set "KDC:Disable Last Success" by default * Set development version to 4.5.90

=== Lewis Eason (1) === * Correct typo estabilish->establish in the install scripts

=== Michal Reznik (9) === * test_caless: add SAN dNSName extensions for wildcard tests * test_caless: add replica ca-less to ca-full test (master caless) * test_caless: add server_replica ca-less to ca-full test * tests: fix external_ca test suite failing due to missing SKI * test_caless: remove xfail in wildcard certificate tests * test_caless: introduce new python makepki + fix SKI extension issue * test_caless: mark TestCertinstall intermediate CA tests as xfail * test_caless: add pkinit option and test it * - added krb5kdc.log to pytest logging

=== Nathaniel McCallum (1) === * ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace

=== Oliver Gutierrez (1) === * Added plugins directory to paclient subpackages

=== Petr Spacek (1) === * ipalib.constants: Remove default domain, realm, basedn, xmlrpc_uri, ldap_uri

=== Petr Vobornik (5) === * log progress of wait_for_open_ports * control logging of host_port_open from caller * kerberos session: use CA cert with full cert chain for obtaining cookie * restore: restart/reload gssproxy after restore * automount install: fix checking of SSSD functionality on uninstall

=== Pavel Vomacka (34) === * Fixes bug in actions creating for search facet * WebUI: fix showing required asterisk '*' * WebUI: Update unit test README * Fixes details_test.js * Fixes for widget_tests.js * Fixes for aci_tests.js * Fixes for entity_tests.js * Fixes for ipa_test.js * Add up to date JSON files * Add loader.js into requirements of all HTML unit test files * WebUI: remove creating js/libs symlink from makefile * WebUI: Remove plugins symlink as it is unused * Remove all old JSON files * Revert "Web UI: Remove offline version of Web UI" * WebUI: Add hyphenate versions of Host(Role) Based strings * WebUI: fix incorrectly shown links in association tables * WebUI: fix jslint error * WebUI: change validator of page size settings * WebUI: Add positive number validator * WebUI: add support for changing trust UPN suffixes * Bump version of python-gssapi * Turn off OCSP check * Change python-cryptography to python2-cryptography * Turn on NSSOCSP check in mod_nss conf * WebUI - Coverity: fix identical branches of if statement * WebUI - Coverity: fixed null pointer exception * WebUI: Coverity - add explicit window object to alert methods * WebUI: Allow to add certs to certmapping with CERT LINES around * WebUI: Fix showing vault in selfservice view * WebUI: suppress truncation warning in select widget * WebUI: Add support for suppressing warnings * WebUI: Add support for login for AD users * WebUI: add method for disabling item in user dropdown menu * WebUI: check principals in lowercase

=== Rob Crittenden (2) === * Include the CA basic constraint in CSRs when renewing a CA * Pass ipa-ca-agent credentials as PEM files

=== Gabe (2) === * Update get_attr_filter in LDAPSearch to handle nsaccountlock user searches * Add --password-expiration to allow admin to force user password expiration

=== Sumit Bose (11) === * ipa_pwd_extop: do not generate NT hashes in FIPS mode * ipa-sam: replace encode_nt_key() with E_md4hash() * ipa-kdb: use canonical principal in certauth plugin * ipa-kdb: reload certificate mapping rules periodically * IPA-KDB: use relative path in ipa-certmap config snippet * extdom: improve cert request * extdom: do reverse search for domain separator * ipa-kdb: do not depend on certauth_plugin.h * configure: fix --disable-server with certauth plugin * IPA certauth plugin * ipa-kdb: add ipadb_fetch_principals_with_extra_filter()

=== Simo Sorce (12) === * Always check peer has keys before connecting * Make sure we check ccaches in all rpcserver paths * Revert setting sessionMaxAge for old clients * Add code to be able to set default kinit lifetime * Fix rare race condition with missing ccache file * Make sure remote hosts have our keys * Fix s4u2self with adtrust * Prevent churn on ccaches * Work around issues fetching session data * Handle failed authentication via cookie * Avoid growing FILE ccaches unnecessarily * Add options to allow ticket caching

=== Stanislav Laznicka (97) === * spec: remove strict options from shebangs * spec: have the scripts depend on py3 packages * spec: remove python3 workaround * Remove unused variable * certmonger: remove temporary workaround * cert: fix wrong assumption of cert-show result type * rpc: don't encode bytes * py3: Fix searching for yubikeys * py3: remove relative import * py3: remove Exception.message appearances * Fix cert file creation during CA-less installation * Uninstall: fix BytesWarning exception * Unify storing certificates in LDAP * py3: fix caless to CA promotion on replica * cacert_manage: fix CA cert renewal * python3: port certmonger requests script * crtmgr: fix bug if CERTMONGER_CERTIFICATE not set * certmonger: finish refactoring for request script * certmonger: fix storing retrieved certificates * Make the IPA server run under Python 3 by default * Turn IPA scripts to python3 -bb for testing * py3: Depend on newer pyldap for server-upgrade * ipautil: port host_port_open() to python 3 * conncheck: fix progression on failure * kerberos: fix sorting Principal objects * host, service: fix adding host/svc with a cert * server plugin: pass bytes to ldap.modify_s * replica: fix SetuptoolsVersion comparison * replica-prepare: run the script in py3 by default * certs: write and read bytes as such * client: make ipa-client-install py3 compatible * cainstance: read cert file as bytes * ca: TypeError fix * krainstance: fix writing str to file * replica-conncheck: log when failed to RPC connect * Fixup of not-so-good PEM certs * x509,certdb: handle certificates as bytes * Create a Certificate parameter * parameters: relax type checks * tests: fix failing HTTPS connection * Introduce load_unknown_x509_certificate() * x509: Make certificates represented as objects * Split x509.load_certificate() into PEM/DER functions * README: Fix trailing whitespace * Ensure network is online prior to an upgrade * rpcserver: remove addition of str and bytes * wsgi plugins: mod_wsgi expects bytes as an output * adtrustinstance: write the conf as a string * adtrustinstance: pep8 fix * More verbose error message on kdc cert validation * cert-validate: keep all messages in cert validation * adtrustinstance: fix ID range comparison * Docstring+refactor of IPADiscovery.ipadnssearchkrbrealm() * ipadiscovery: Return realm as a string * session_storage: Correctly handle string/byte types * rpc: avoid possible recursion in create_connection * rpc: preparations for recursion fix * Avoid possible endless recursion in RPC call * kdc.key should not be visible to all * Change ConfigParser to RawConfigParser * ca/cert-show: check certificate_out in options * Remove pkinit-anonymous command * Make a doctext more clear * Provide useful messages during cert validation * cert-show: writable files does not mean dirs * fix managed-entries printing IPA not installed * Fix wrong message on Dogtag instances stop * Make CA/KRA fail when they don't start * Remove the cachedproperty class * Refresh Dogtag RestClient.ca_host property * compat plugin: Update link to slapi-nis project * compat: ignore cn=topology,cn=ipa,cn=etc subtree * Move the compat plugin setup at the end of install * compat-manage: behave the same for all users * Fix CAInstance.import_ra_cert for empty passwords * Fix RA cert import during DL0 replication * ext. CA: correctly write the cert chain * server-install: No double Kerberos install * Fix CA-less to CA-full upgrade * replicainstall: better client install exception handling * Add the force-join option to replica install * server-install: remove broken no-pkinit check * Add pki_pin only when needed * Remove publish_ca_cert() method from NSSDatabase * Get correct CA cert nickname in CA-less * Remove redundant option check for cert files * replica-prepare man: remove pkinit option refs * Don't allow setting pkinit-related options on DL0 * Fix the order of cert-files check * Generate PIN for PKI to help Dogtag in FIPS * Backup CA cert from kerberos folder * Allow renaming of the sudorule objects * Allow renaming of the HBAC rule objects * Reworked the renaming mechanism * Bump samba version for FIPS and priv. separation * Backup ipa-specific httpd unit-file * Add debug log in case cookie retrieval went wrong

=== Thierry Bordaz (1) === * NULL LDAP context in call to ldap_search_ext_s during search

=== Tibor Dudlák (11) === * otptoken_yubikey.py: Removed traceback when package missing. * topology.py: Removes error message from dictionary. * Add test: test_xmlrpc/test_whoami_plugin.py * whoami.py: Type error when running tests * Create indexes for 'serverhostname' attribute * Add --force-join into ipa-replica-install manpage * dnsserver.py: dnsserver-find no longer returns internal server error * Add Role 'Enrollment Administrator' * server.py: Removes dns-server configuration from ldap * sssd.py: Deprecating no-sssd option. * client.py: Replace hardcoded 'admin' with options.principal

=== Tibor Dudlák (2) === * user.py: replace user_mod with ldap.update_entry() * Add 'TIP' to enable copr repo.

=== Timo Aaltonen (2) === * ipa-otpd.socket.in: Use a platform specific value for KDC service file * configure: Use ODS_USER and NAMED_GROUP in daemons/dnssec/*.service.in

=== Tomas Krizek (25) === * Become IPA 4.6.0 * Contributors.txt: update * zanata: update translations for ipa-4-6 * zanata: set project version to ipa-4-6 * dnssec: keep dnssec daemons in Python2 * ipatests: collect log after ipa-ca-install * dnssec: fix localhsm.py utility script * prci: add caless tests * makerpms.sh: make git checkout optional * build: checkout *.po files at the end of makerpms.sh * freeipa-pr-ci: enable pull-request CI * ipactl: log check_version exception * logging: make sure logging level is set to proper value * ipatests: do not finalize api when IPA is not configured * ipatests: do not collect systemd journal when logfile_dir is missing * ipatests: add systemd journal collection for multihost tests * ipatests: change logdir naming pattern for multihost tests * named.conf template: add modification warning * ca, kra install: validate DM password * installutils: add DM password validator * ca install: merge duplicated code for DM password * upgrade: add missing suffix to http instance * installer service: fix typo in service entry * python2-ipalib: add missing python dependency * kra install: update installation failure message

=== Thorsten Scherf (2) === * Changed ownership of ldiffile to DS_USER * Fixed typo in ipa-client-install output