Problems after IPA upgrade: ipa-server-upgrade doesn't complete, pki-tomcatd won't start
by Jokinen Eemeli
Hello all!
I have very similiar problem as this one:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
ipa-server-upgrade fails as below
--
Update complete
Upgrading IPA services
Upgrading the configuration of the IPA services
[Verifying that root certificate is published]
[Migrate CRL publish directory]
CRL tree already moved
[Verifying that CA proxy configuration is correct]
IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
CA did not start in 300.0s
The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
--
And the log tells me that CA returns status 500
--
DEBUG Waiting for CA to start...
DEBUG request POST http://<<ipa1.fqdn>>:8080/ca/admin/ca/getStatus<http://%3c%3cipa1.fqdn%3e%3e:8080/ca/admin/ca/getStatus>
DEBUG request body ''
DEBUG response status 500
DEBUG response headers Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 2208
Date: Fri, 15 Jun 2018 10:05:29 GMT
Connection: close
DEBUG response body '<html><head><title>Apache Tomcat/7.0.76 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - Subsystem unavailable</h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u>Subsystem unavailable</u></p><p><b>description</b> <u>The server encountered an internal error that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.ws.rs.ServiceUnavailableException: Subsystem unavailable\n\tcom.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145)\n\torg.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:500)\n\torg.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\n\torg.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962)\n\torg.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)\n\torg.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)\n\torg.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)\n\torg.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)\n\tjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)\n\tjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)\n\torg.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tjava.lang.Thread.run(Thread.java:748)\n</pre></p><p><b>note</b> <u>The full stack trace of the root cause is available in the Apache Tomcat/7.0.76 logs.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.76</h3></body></html>'
DEBUG The CA status is: check interrupted due to error: Retrieving CA status failed with status 500
DEBUG Waiting for CA to start...
ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 172, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 48, in run
raise admintool.ScriptError(str(e))
The ipa-server-upgrade command failed, exception: ScriptError: CA did not start in 300.0s
ERROR CA did not start in 300.0s
--
With command "ipactl start --ignore-service-failures" I can start all the services but pki-tomcatd.
--
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
named Service: RUNNING
httpd Service: RUNNING
pki-tomcatd Service: STOPPED
smb Service: RUNNING
winbind Service: RUNNING
ipa-otpd Service: RUNNING
ipa-dnskeysyncd Service: RUNNING
ipa: INFO: The ipactl command was successful
--
Suggested resolution to above problem doesn't help me since the LDAP and NSS DB seem to have same certificates (some difference in wrapping but the string is same if I take out the line breaks) and even the serial number matches.
--
certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' -a
-----BEGIN CERTIFICATE-----
MIIDjD...
...Prh2G
-----END CERTIFICATE-----
certutil -L -d /etc/pki/pki-tomcat/alias -n 'subsystemCert cert-pki-ca' |grep Serial
Serial Number: 4 (0x4)
ldapsearch -LLL -D 'cn=directory manager' -W -b uid=pkidbuser,ou=people,o=ipaca userCertificate description seeAlso
Enter LDAP Password:
dn: uid=pkidbuser,ou=people,o=ipaca
userCertificate:: MIIDjD...
...Prh2
G
description: 2;4;CN=Certificate Authority,O=<<REALM>>;CN=CA Subsystem,
O=<<REALM>>
seeAlso: CN=CA Subsystem,O=<<REALM>>
--
And here's where my actual knowledge of things end. I've been trying to figure out all kind of logs (tomcat, Kerberos, directory server, ...) but haven't found a solid reason for it. I'm starting to believe this is a certificate issue, because although "getcert list" tells me that the certificate status is "Monitoring" on all certificates the expiry date is already in the past (current date 20.6.2018, certificate expiry 21.03.2018) on 4 certificates and it won't update even if I resubmit it or delete certificate and manually redo it (it got the same date as the "old ones"). The "main certs" ("caSigningCert cert-pki-ca", "Server-Cert cert-pki-ca" and two directory server certs) are valid for years (until 2020+).
--
Request ID '20160331084234':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set
certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB'
CA: dogtag-ipa-ca-renew-agent
issuer: CN=Certificate Authority,O=<<REALM>>
subject: CN=OCSP Subsystem,O=<<REALM>>
expires: 2018-03-21 09:42:04 UTC
key usage: digitalSignature,nonRepudiation,keyCertSign,cRLSign
eku: id-kp-OCSPSigning
pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad
post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca"
track: yes
auto-renew: yes
Request ID '20160331085008':
status: MONITORING
stuck: no
key pair storage: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB',pinfile='/etc/httpd/alias/pwdfile.txt'
certificate: type=NSSDB,location='/etc/httpd/alias',nickname='Server-Cert',token='NSS Certificate DB'
CA: IPA
issuer: CN=Certificate Authority,O=<<REALM>>
subject: CN=<<ipasrv1.fqdn>>,O=<<REALM>>
expires: 2020-03-04 09:58:23 UTC
principal name: HTTP/<<ipasrv1.fqdn>>@<<REALM>>
key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
eku: id-kp-serverAuth,id-kp-clientAuth
pre-save command:
post-save command: /usr/lib64/ipa/certmonger/restart_httpd
track: yes
auto-renew: yes
--
Has anyone else bumped into same kind of issues? Any ideas where I should continue looking? I'm starting to run out of ideas...
Eemeli Jokinen
5 years, 7 months
Changing domain name
by Alfredo De Luca
Hi all.
We'd like to change the domain name on our freeipa (4.5.4 on centos 7.5).
Not the realm but only the domain....
is it doable?
If so... how?
Cheers
--
*Alfredo*
5 years, 7 months
Re: Issues connecting to SQL Server in domain trust with CNAME
by Marc Boorshtein
>
>
>
> If you have more than one AD DC, make sure they actually synchronized.
> If there is only one, it might well be that a credentials manager has a
> cached version of the key for the MS SQL account.
>
>
>
We have a winner! To close the loop with anyone who runs into this issue
in the internets... The SPN needs to be on the same service account used to
run SQL Server (which seems obvious now that its working). My SQL Server
was running as a local account not a domain account. Switching it over to
the same account that had the spn fixed it immediately.
Thanks again for your help.
Marc
5 years, 7 months
IPA-Server-Upgrade crashes - Certificate has expired
by Tobi Berninger
Hello,
i upgrade my centos 7.5 ipaserver to an new version and runned into a few
problems.
It seems like 'subsystemCert cert-pki-ca' is expired nearly a month ago
(jul 22) and i am not sure how to renew it.
When i run the ipa-server-upgrade manual, i run into a error with the ca
certificates and in the log i found that line:
Internal Database Error encountered: Could not connect to LDAP server host
ipababy.int.asta-frankfurt.de port 636 Error netscape.ldap.LDAPException:
Unable to create socket: org.mozilla.jss.ssl.SSLSocketException:
org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8181)
Peer's Certificate has expired. (-1)
When i run ipactl start, tomcatd and httpd wont start.
I allready tried to turn back time, but i dont know how to manual start
pki-tomcatd or any other way to renew the certificates.
Or do i look in the wrong diection the whole time?
Thank u all for ur help
5 years, 7 months
odd random kerberos issues?
by Kat
Hi all --
RHEL 7.5 as of yesterday and 4.5.4-10.el7_5.3 FreeIPA.
I am randomly seeing: Server not found in Kerberos database
for a host that seems to work just fine and understand that most of the
time you see normal authentications happening for this same host, so it
is not happening all the time. Looking for guidance as to where to look
when one sees this kind of error popping up in the IPA Server logs.
Thanks
k
5 years, 7 months
Issues connecting to SQL Server in domain trust with CNAME
by Marc Boorshtein
I've got a FreeIPA domain in a domain trust with a windows 2012r2 domain.
SQL Server 2014 is a member of the windows domain and is configured to
accept both windows and native authentication. From a box thats a member
of my FreeIPA domain I'm able to get a ticket as a user from the windows
domain and connect to the server without issue, if I use the sql server's
fqdn.
Where I run into an issue is where I create a CNAME for my sql server. I
add an SPN to AD:
setspn -A MSSQLSvc/sqlserver2.ent2k12.domain.com:1433 ENT2K12\sqlserverspn
when i try to access the db using the CNAME I get the following error:
cn = pyodbc.connect('DRIVER={ODBC Driver 13 for SQL Server};Server=
sqlserver2.ent2k12.domain.com; DATABASE=testdb;Trusted_Connection=yes;')
pyodbc.Error: ('HY000', '[HY000] [unixODBC][Microsoft][ODBC Driver 13 for
SQL Server]SSPI Provider: Message stream modified (851968)
(SQLDriverConnect)')
I know this error usually means that the case of the domain is off but I
can't seem to create an SPN that kerberos likes. Here's my klist:
Ticket cache: KEYRING:persistent:0:0
Default principal: freeipa3(a)ENT2K12.DOMAIN.COM
Valid starting Expires Service principal
08/15/2018 11:22:16 08/15/2018 21:21:36
MSSQLSvc/sqlserver2.ent2k12.domain.com:1433@ENT2K12.DOMAIN.COM
renew until 08/16/2018 11:21:32
08/15/2018 11:21:36 08/15/2018 21:21:36 krbtgt/
ENT2K12.DOMAIN.COM(a)ENT2K12.DOMAIN.COM
renew until 08/16/2018 11:21:32
So I'm getting the ticket. not really sure where to go from here. Any
help would be greatly appreciated.
Thanks
Marc Boorshtein
5 years, 7 months
FreeIPA behind Traefik Reverse Proxy, with wildcard certs
by Ethan Lambert
I have FreeIPA running in a VM with a static IP assigned via dnsmasq with Traefik acting as a reverse proxy. I have traefik grabbing wildcard certs for the domain. However, it seems that FreeIPA does not like that as it has this error in the error log:
`SSL Library Error: - 12271 SSL client cannot verify your certificate`
I assume this is because the wildcard cert for the domain (example.com/*.example.com) is not the cert that FreeIPA is expecting?
When I try to access the web interface it returns: "Internal Server Error" and adds another entry of "SSL Library Error: = 12271 SSL client cannot verify your certificate"
What should I do to fix this, there is the CA-less install ( https://www.freeipa.org/page/V3/CA-less_install )
However that wants a long list of Certs (http_pkcs12, dirsrv_pkcs12, etc) and wants those at install, do I just have to reinstall? Will doing a CA-less install even fix my problem?
Thanks!
5 years, 7 months
Re: FreeIPA behind Traefik Reverse Proxy, with wildcard certs
by Ethan Lambert
I am seeing the "SSL Library Error: - 12271 SSL client cannot verify your
certificate "in /var/log/httpd/error_log" every time I try to access the
webui.
When I go to the web address auth.ethanlambert.info it just shows a blank
page with the text "Internal Server Error"
The reverse proxy is so that I can have one vm/machine per service, I like
the idea of self hosting my stuff and I would like single sign on for each
app so photos.ethanlambert.info, docs.ethanlambert.info, etc. and from what
I understand the easiest way to do that is a reverse proxy.
I will read the article and see what I can figure out from it.
Thanks!
On Tue, Aug 14, 2018 at 5:30 PM Ethan Lambert <preevete(a)gmail.com> wrote:
> I am seeing the "SSL Library Error: - 12271 SSL client cannot verify your
> certificate "in /var/log/httpd/error_log" every time I try to access the
> webui.
>
> When I go to the web address auth.ethanlambert.info it just shows a blank
> page with the text "Internal Server Error"
>
> The reverse proxy is so that I can have one vm/machine per service, I like
> the idea of self hosting my stuff and I would like single sign on for each
> app so photos.ethanlambert.info, docs.ethanlambert.info, etc. and from
> what I understand the easiest way to do that is a reverse proxy.
>
> I will read the article and see what I can figure out from it.
>
> Thanks!
>
> On Tue, Aug 14, 2018 at 9:04 AM Rob Crittenden <rcritten(a)redhat.com>
> wrote:
>
>> Ethan Lambert via FreeIPA-users wrote:
>> > I have FreeIPA running in a VM with a static IP assigned via dnsmasq
>> with Traefik acting as a reverse proxy. I have traefik grabbing wildcard
>> certs for the domain. However, it seems that FreeIPA does not like that as
>> it has this error in the error log:
>> >
>> > `SSL Library Error: - 12271 SSL client cannot verify your certificate`
>> >
>> > I assume this is because the wildcard cert for the domain (
>> example.com/*.example.com) is not the cert that FreeIPA is expecting?
>>
>> Doubtful.
>>
>> We need more context. Where are you seeing this, the web UI,
>> command-line, client enrollment?
>>
>> You are likely to also run into referrer issues. The IPA master(s) will
>> need to verify that the Referrer in the request points to them.
>>
>> Can you explain why you need a reverse proxy?
>>
>> You should read
>> https://www.adelton.com/freeipa/freeipa-behind-proxy-with-different-name
>>
>> >
>> > When I try to access the web interface it returns: "Internal Server
>> Error" and adds another entry of "SSL Library Error: = 12271 SSL client
>> cannot verify your certificate"
>> >
>> > What should I do to fix this, there is the CA-less install (
>> https://www.freeipa.org/page/V3/CA-less_install )
>> >
>> > However that wants a long list of Certs (http_pkcs12, dirsrv_pkcs12,
>> etc) and wants those at install, do I just have to reinstall? Will doing a
>> CA-less install even fix my problem?
>>
>> This has nothing to with the IPA CA (or lack-thereof).
>>
>> rob
>>
>
5 years, 7 months
Announcing SSSD 2.0
by Jakub Hrozek
SSSD 2.0
===========
The SSSD team is proud to announce the release of version 2.0 of the System Security Services Daemon.
The tarball can be downloaded from https://releases.pagure.org/SSSD/sssd/
RPM packages will be made available for Fedora shortly.
Feedback
————
Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists:
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Highlights
----------
This release removes or deprecates functionality from SSSD, therefore the SSSD
team decided it was time to bump the major version number. The sssd-1-16
branch will be still supported (most probably even as a LTM branch) so that
users who rely on any of the removed features can either migrate or ask for
the features to be readded.
Except for the removed features, this release contains a reworked internal IPC
and a new default storage back end for the KCM responder.
Platform support removal
^^^^^^^^^^^^^^^^^^^^^^^^
* Starting with SSSD 2.0, upstream no longer supports RHEL-6 and its derivatives.
Users of RHEL-6 are encouraged to stick with the sssd-1-16 branch.
Removed features
^^^^^^^^^^^^^^^^
* The Python API for managing users and groups in local domains
(``id_provider=local``) was removed completely. The interface
had been packaged as module called ``pysss.local``
* The LDAP provider had a special-case branch for evaluating group
memberships with the RFC2307bis schema when group nesting was
explicitly disabled. This codepath was adding needless additional
complexity for little performance gain and was rarely used.
* The ``ldap_groups_use_matching_rule_in_chain`` and
``ldap_initgroups_use_matching_rule_in_chain`` options and the code that
evaluated them was removed. Neither of these options provided
a significant performance benefit and the code implementing
these options was complex and rarely used.
Deprecated features
^^^^^^^^^^^^^^^^^^^
* The local provider (``id_provider=local``) and the command line
tools to manage users and groups in the local domains, such as
``sss_useradd`` is not built by default anymore. There is a configure-time
switch ``--enable-local-domain`` you can use to re-enable the local
domain support. However, upstream would like to remove the local
domain completely in a future release.
* The ``sssd_secrets`` responder is not packaged by default. The responder
was meant to provide a REST API to access user secrets as well as
a proxy to Custodia servers, but as Custodia development all but
stopped and the local secrets handling so far didn't gain traction,
we decided to not enable this code by default. This also means that the
default SSSD configuration no longer requires libcurl and http-parser.
Changed default settings
^^^^^^^^^^^^^^^^^^^^^^^^
* The ``ldap_sudo_include_regexp`` option changed its default value
from ``true`` to ``false``. This means that wild cards in the ``sudoHost``
LDAP attribute are no longer supported by default. The reason we
changed the default was that the wildcard was costly to evaluate
on the LDAP server side and at the same time rarely used.
New features
^^^^^^^^^^^^
* The KCM responder has a new back end to store credential caches
in a local database. This new back end is enabled by default and
actually uses the same storage as the ``sssd-secrets`` responder had used,
so the switch from sssd-secrets to this new back end should be
completely seamless. The ``sssd-secrets`` socket is no longer required for
KCM to operate.
* The list of PAM services which are allowed to authenticate using a
Smart Card is now configurable using a new option
``pam_p11_allowed_services``.
Packaging Changes
-----------------
* The ``sss_useradd``, ``sss_userdel``, ``sss_usermod``, ``sss_groupadd``,
``sss_groupdel``, ``sss_groupshow`` and ``sss_groupmod`` binaries and their
manual pages are no longer packaged by default unless
``--enable-local-provider`` is selected.
* The sssd_secrets responder is no longer packaged by default unless
``--enable-secrets-responder`` is selected.
* The new internal IPC mechanism uses several private libraries that
need to be packaged - ``libsss_sbus.so``, ``libsss_sbus_sync.so``, ``libsss_iface.so``,
``libsss_iface_sync.so``, ``libifp_iface.so`` and ``libifp_iface_sync.so``
* The new KCM ccache back end relies on a private library
``libsss_secrets.so`` that must be packaged in case either the KCM responder
or the secrets responder are enabled.
Documentation Changes
---------------------
* The ``ldap_groups_use_matching_rule_in_chain`` and
``ldap_initgroups_use_matching_rule_in_chain`` options were removed.
* The ``ldap_sudo_include_regexp`` option changed its default value
from ``true`` to ``false``.
Known issues
------------
* https://pagure.io/SSSD/sssd/issue/3807 - The sbus codegen script relies
on "python" which might not be available on all distributions
* There is a script that autogenerates code for the internal SSSD IPC.
The script happens to call "python" which is not available on all
distributions. Patching the ``sbus_generate.sh`` file to call e.g.
python3 explicitly works around the issue
Tickets Fixed
-------------
* `3717 <https://pagure.io/SSSD/sssd/issue/3717>`_ - Don't package sssd-secrets by default
* `3685 <https://pagure.io/SSSD/sssd/issue/3685>`_ - KCM: Default to a new back end that would write to the secrets database directly
* `3530 <https://pagure.io/SSSD/sssd/issue/3530>`_ - Remove CONFDB_DOMAIN_LEGACY_PASS
* `3515 <https://pagure.io/SSSD/sssd/issue/3515>`_ - Disable host wildcards in sudoHost attribute (ldap_sudo_include_regexp=false)
* `3494 <https://pagure.io/SSSD/sssd/issue/3494>`_ - Remove the special-case for RFC2307bis with zero nesting level
* `3493 <https://pagure.io/SSSD/sssd/issue/3493>`_ - Remove the pysss.local interface
* `3492 <https://pagure.io/SSSD/sssd/issue/3492>`_ - Remove support for ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain
* `3304 <https://pagure.io/SSSD/sssd/issue/3304>`_ - Only build the local provider conditionally
* `2926 <https://pagure.io/SSSD/sssd/issue/2926>`_ - Make list of local PAM services allowed for Smartcard authentication configurable
Detailed Changelog
------------------
* Amit Kumar (1):
* providers: disable ldap_sudo_include_regexp by default
* Fabiano Fidêncio (19):
* man/sss_ssh_knownhostsproxy: fix typo pubkeys -> pubkey
* providers: drop ldap_{init,}groups_use_matching_rule_in_chain support
* ldap: remove parallel requests from rfc2307bis
* tests: adapt common_dom to files_provider
* tests: adapt test_sysdb_views to files provider
* tests: adapt sysdb-tests to files_provider
* tests: adapt sysdb_ssh tests to files provider
* tests: adapt auth-tests to files provider
* tests: adapt tests_fqnames to files provider
* sysdb: sanitize the dn on cleanup_dn_filter
* sysdb: pass subfilter and ts_subfilter to sysdb_search_*_by_timestamp()
* tests: adapt test_ldap_id_cleanup to files provider
* tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_certmap
* tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_domain_resolution_order_
* tests: remove LOCAL_SYSDB_FILE reference from test_sysdb_subdomains
* tests: remove LOCAL_SYSDB_FILE reference from common_dom
* local: build local provider conditionally
* pysss: fix typo in comment
* pysss: remove pysss.local
* Jakub Hrozek (55):
* Updating the version to track 1.16.4 development
* src/tests/python-test.py is GPLv3+
* src/tests/intg/util.py is licensed under GPLv3+
* src/tests/intg/test_ts_cache.py is licensed under GPLv3+
* src/tests/intg/test_sudo.py is licensed under GPLv3+
* src/tests/intg/test_sssctl.py is licensed under GPLv3+
* src/tests/intg/test_ssh_pubkey.py is licensed under GPLv3+
* src/tests/intg/test_session_recording.py is licensed under GPLv3+
* src/tests/intg/test_secrets.py is licensed under GPLv3+
* src/tests/intg/test_pysss_nss_idmap.py is licensed under GPLv3+
* src/tests/intg/test_pam_responder.py is licensed under GPLv3+
* src/tests/intg/test_pac_responder.py is licensed under GPLv3+
* src/tests/intg/test_netgroup.py is licensed under GPLv3+
* src/tests/intg/test_memory_cache.py is licensed under GPLv3+
* src/tests/intg/test_local_domain.py is licensed under GPLv3+
* src/tests/intg/test_ldap.py is licensed under GPLv3+
* src/tests/intg/test_kcm.py is licensed under GPLv3+
* src/tests/intg/test_infopipe.py is licensed under GPLv3+
* src/tests/intg/test_files_provider.py is licensed under GPLv3+
* src/tests/intg/test_files_ops.py is licensed under GPLv3+
* src/tests/intg/test_enumeration.py is licensed under GPLv3+
* src/tests/intg/sssd_passwd.py is licensed under GPLv3+
* src/tests/intg/sssd_nss.py is licensed under GPLv3+
* src/tests/intg/sssd_netgroup.py is licensed under GPLv3+
* src/tests/intg/sssd_ldb.py is licensed under GPLv3+
* src/tests/intg/sssd_id.py is licensed under GPLv3+
* src/tests/intg/sssd_group.py is licensed under GPLv3+
* src/tests/intg/secrets.py is licensed under GPLv3+
* src/tests/intg/ldap_local_override_test.py is licensed under GPLv3+
* src/tests/intg/ldap_ent.py is licensed under GPLv3+
* src/tests/intg/krb5utils.py is licensed under GPLv3+
* src/tests/intg/kdc.py is licensed under GPLv3+
* src/tests/intg/files_ops.py is licensed under GPLv3+
* src/tests/intg/ent_test.py is licensed under GPLv3+
* src/tests/intg/ent.py is licensed under GPLv3+
* src/tests/intg/ds_openldap.py is licensed under GPLv3+
* src/tests/intg/ds.py is licensed under GPLv3+
* src/config/setup.py.in is licensed under GPLv3+
* src/config/SSSDConfig/ipachangeconf.py is licensed under GPLv3+
* Explicitly add GPLv3+ license blob to several files
* Updating the version before the 2.0 release
* TESTS: the sys package was used but not imported
* TESTS: Remove tests database in teardown
* TESTS: Properly set argv[0] when starting the secrets responder
* KCM: Move a confusing DEBUG message
* KCM: Fix a typo
* UTIL: Add libsss_secrets
* SECRETS: Use libsss_secrets
* KCM; Hide the secret URL as implementation detail instead of exposing it in the JSON-marshalling API
* UTIL: libsss_secrets: Add an update function
* KCM: Add a new back end that uses libsss_secrets directly
* TESTS: Get rid of KCM_PEER_UID
* TESTS: Add tests for the KCM libsss_secrets back end
* KCM: Change the default ccache storage from the secrets responder to libsecrets
* BUILD: Do not build the secrets responder by default
* Lukas Slebodnik (6):
* krb5_locator: Make debug function internal
* krb5_locator: Simplify usage of macro PLUGIN_DEBUG
* krb5_locator: Fix typo in debug message
* krb5_locator: Fix formatting of the variable port
* krb5_locator: Use format string checking for debug function
* PAM: Allow to configure pam services for Smartcards
* Pavel Březina (21):
* include stdarg.h directly in debug.h
* pam_add_response: fix talloc context
* sss_ptr_hash: add sss_ptr_get_value to make it useful in delete callbacks
* sss_ptr_list: add linked list of talloc pointers
* sbus: move sbus code to standalone library
* sbus: add sbus sssd error codes
* sbus: add new implementation
* sbus: build new sbus implementation
* sbus: disable generating old api
* sbus: fix indirect includes in sssd
* sbus: add sss_iface library
* sbus: convert monitor
* sbus: convert backend
* sbus: convert responders
* sbus: convert proxy provider
* sbus: convert infopipe
* sbus: convert sssctl
* sbus: remove old implementation
* sbus: add new internal libraries to specfile
* sbus: make tests run
* tests: disable parse_inp_call_dp, parse_inp_call_attach in responder-get-domains-tests
* amitkuma (1):
* confdb: Remove CONFDB_DOMAIN_LEGACY_PASS
5 years, 7 months