On pe, 15 loka 2021, Rob Crittenden via FreeIPA-users wrote:
Natxo Asenjo wrote:
> hi,
>
> On Fri, Oct 15, 2021 at 7:52 PM Rob Crittenden <rcritten(a)redhat.com
> <mailto:rcritten@redhat.com>> wrote:
>
>
> What are your package versions of ipa-server and pki-ca?
>
> The CA is trying to reduce its dependencies and one of them provides
> responses over XML. So IPA needed to adjust and expect this. It looks
> like the two sides are out-of-sync.
>
>
> I was wrong, not f34 but 35, so this is not released yet:
>
> rpm -qa | egrep "pki-ca|ipa-server"
> freeipa-server-common-4.9.7-1.fc35.noarch
> dogtag-pki-ca-11.0.0-1.fc35.noarch
> freeipa-server-4.9.7-1.fc35.x86_64
> freeipa-server-dns-4.9.7-1.fc35.noarch
Ok yeah, this confirms it. We'll have to do a patch to IPA in F35 and
rawhide to address this. It shouldn't be a ton of work but F35 is close
to release so we'll see if we can sneak the update in.
I filed
https://bugzilla.redhat.com/show_bug.cgi?id=2014658
I'm not sure if there is a workaround for this.
The fix is in upstream (and in C9S too) so it should be an easy rebuild.
I nominated this bug for F35 final release blocker.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland