November 2018 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2106][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by abbra 23 Mar '20

23 Mar '20

URL: https://github.com/freeipa/freeipa/pull/2106 Author: abbra Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2106/head:pr2106 git checkout pr2106

2 1

[freeipa PR#2331][opened] Installation of replica against a specific server
by mrizwan93 07 Oct '19

07 Oct '19

URL: https://github.com/freeipa/freeipa/pull/2331 Author: mrizwan93 Title: #2331: Installation of replica against a specific server Action: opened PR body: """ Test to check replica install against specific server. It uses master and replica1 without CA and having custodia service stopped. Then try to install replica2 from replica1 so that replica2 will fetch secrets from master as custodia service is not running on replica1. related ticket: https://pagure.io/freeipa/issue/7566 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2331/head:pr2331 git checkout pr2331

2 1

[freeipa PR#2065][opened] BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning
by menonsudhir 21 Aug '19

21 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2065 Author: menonsudhir Title: #2065: BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2065/head:pr2065 git checkout pr2065

1 1

[freeipa PR#2147][opened] Add a skeleton kdcpolicy plugin
by frozencemetery 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2147 Author: frozencemetery Title: #2147: Add a skeleton kdcpolicy plugin Action: opened PR body: """ Signed-off-by: Robbie Harwood <rharwood(a)redhat.com> Back in krb5-1.16 (and in RHEL-7.5), I added the [kdcpolicy plugin](http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/kdcpolicy.html) to krb5. This interface allows a module to hook all AS and TGS requests, potentially reject them, and manipulate ticket lifetimes. This PR is a basic implementation of the interface, with all the plumbing IPA needs to get it loaded and installed. There are two use cases I had in mind, though of course many more are possible (this is a very powerful place to have a hook into the KDC): - Reduced ticket lifetimes based on [auth indicator](http://web.mit.edu/kerberos/krb5-devel/doc/admin/auth_indicator.… - Adding (well, subtracting) random jitter from certain principal lifetimes to reduce contention from groups of tickets all needing renewal simultaneously Since presumably we don't want any of that to be hardcoded behavior, the difficult part is now making it all configurable. (As well as figuring out any behavior we want to control at the moment). Per IRC conversation, I'm opening this PR so that we have something to look at while we discuss that. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2147/head:pr2147 git checkout pr2147

1 1

[freeipa PR#2307][opened] Use pki config file template
by tiran 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2307 Author: tiran Title: #2307: Use pki config file template Action: opened PR body: """ WIP For HSM support and more flexible options. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2307/head:pr2307 git checkout pr2307

1 1

[freeipa PR#1441][opened] Removing ipaCert Private key & certificate after ipa upgrade
by amitkumar50 08 Jul '19

08 Jul '19

URL: https://github.com/freeipa/freeipa/pull/1441 Author: amitkumar50 Title: #1441: Removing ipaCert Private key & certificate after ipa upgrade Action: opened PR body: """ `# yum install ipa-server -y {IPA 4.4}` `# ipa-server-install` `#yum update ipa-* -y` `# ls -ltr /etc/httpd/alias` Presently "-D" option only removes Cert. **`certutil ... -D -n ipaCert`** Using '-F' option to remove Private key and cert both **`certutil ... -F -n ipaCert`** Resolves: https://pagure.io/freeipa/issue/7329 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1441/head:pr1441 git checkout pr1441

2 1

[freeipa PR#919][opened] client.py: Using Augeas to configure krb5.conf
by Tiboris 02 Jul '19

02 Jul '19

URL: https://github.com/freeipa/freeipa/pull/919 Author: Tiboris Title: #919: client.py: Using Augeas to configure krb5.conf Action: opened PR body: """ Using Augeas should avoid issues like https://pagure.io/freeipa/issue/5912. Resolves: https://pagure.io/freeipa/issue/5913 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/919/head:pr919 git checkout pr919

1 1

[freeipa PR#2415][opened] diffs for freeipa 7716
by germanparente 28 May '19

28 May '19

URL: https://github.com/freeipa/freeipa/pull/2415 Author: germanparente Title: #2415: diffs for freeipa 7716 Action: opened PR body: """ this could be a potential diff candidate for https://pagure.io/freeipa/issue/7716 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2415/head:pr2415 git checkout pr2415

2 1

[freeipa PR#2291][opened] Update CA signing certificate default key size to 4096
by abbra 26 Apr '19

26 Apr '19

URL: https://github.com/freeipa/freeipa/pull/2291 Author: abbra Title: #2291: Update CA signing certificate default key size to 4096 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2291/head:pr2291 git checkout pr2291

1 1

[freeipa PR#2411][opened] Test ipa-server-install when mandatory params not specified.
by onkarkarale 12 Apr '19

12 Apr '19

URL: https://github.com/freeipa/freeipa/pull/2411 Author: onkarkarale Title: #2411: Test ipa-server-install when mandatory params not specified. Action: opened PR body: """ When installing ipa-server in unattended mode (i.e -U option), some manadatory params should be specified with the install commands like -p, -r and -a etc. If we don't specify these params, installation will fail. Signed-off-by: Onkar Karale <karaleonkar19(a)gmail.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2411/head:pr2411 git checkout pr2411

2 1

[freeipa PR#2464][opened] Support interactive prompt for ntp options
by Tiboris 11 Apr '19

11 Apr '19

URL: https://github.com/freeipa/freeipa/pull/2464 Author: Tiboris Title: #2464: Support interactive prompt for ntp options Action: opened PR body: """ FreeIPA will now ask user for NTP source server or pool address in interactive mode if there is no server nor pool specified and autodiscovery has not found any NTP source in DNS records. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2464/head:pr2464 git checkout pr2464

2 1

[freeipa PR#1726][opened] [RFE] IPA server installation with successful message
by amitkumar50 29 Mar '19

29 Mar '19

URL: https://github.com/freeipa/freeipa/pull/1726 Author: amitkumar50 Title: #1726: [RFE] IPA server installation with successful message Action: opened PR body: """ This PR updates IPA success installation message as this: ============================================= IPA server installation successful You can access Web UI using https://ipaserver1.testrelm.test/ipa/ui Obtain a Kerberos Ticket for issuing IPA command 'kinit admin' Server is installed with following roles : * Directory Server * Kerbeors Server * Httpd Server * CA Server * DNS Server For troubleshooting and errors : Please visit : https://www.redhat.com/en For documentation : Please visit : https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Resolves: https://pagure.io/freeipa/issue/6355 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1726/head:pr1726 git checkout pr1726

2 1

[freeipa PR#2584][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by tiran 29 Mar '19

29 Mar '19

URL: https://github.com/freeipa/freeipa/pull/2584 Author: tiran Title: #2584: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ The PR was originally PR @abbra's PR https://github.com/freeipa/freeipa/pull/2106. PR-CI was broken for that PR. I also squashed some intermediate commits. ## Original PR message Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2584/head:pr2584 git checkout pr2584

1 1

[freeipa PR#2163][opened] Make ipaclient.csrgen optional
by tiran 27 Mar '19

27 Mar '19

URL: https://github.com/freeipa/freeipa/pull/2163 Author: tiran Title: #2163: Make ipaclient.csrgen optional Action: opened PR body: """ ipaclient's csrgen plugin has been turned into an optional dependency. The ipaclient plugin, helper modules like ipaclient.csrgen and templates are shipped conditionally. The ipaclient cert plugin and ipatests handle missing csrgen gracefully. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2163/head:pr2163 git checkout pr2163

1 1

[freeipa PR#1843][opened] Allow issuing certificates with IP addresses in subjectAltName (ftweedal)
by frasertweedale 04 Mar '19

04 Mar '19

URL: https://github.com/freeipa/freeipa/pull/1843 Author: frasertweedale Title: #1843: Allow issuing certificates with IP addresses in subjectAltName (ftweedal) Action: opened PR body: """ Continuation of https://github.com/freeipa/freeipa/pull/1700 by @ipilcher, adding commits by @ftweedal. Please keep both PRs open for the time being. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1843/head:pr1843 git checkout pr1843

2 1

[freeipa PR#1883][opened] ipactl: Correction of named to named-pkcs11
by amitkumar50 21 Feb '19

21 Feb '19

URL: https://github.com/freeipa/freeipa/pull/1883 Author: amitkumar50 Title: #1883: ipactl: Correction of named to named-pkcs11 Action: opened PR body: """ Whenever ipactl status is run it returned: Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ... This PR changes ipactl o/p to: Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named-pkcs11 Service: RUNNING Resolves: https://pagure.io/freeipa/issue/7446 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1883/head:pr1883 git checkout pr1883

2 1

[freeipa PR#2628][opened] [WIP] Refactor LDAPClient
by tiran 05 Feb '19

05 Feb '19

URL: https://github.com/freeipa/freeipa/pull/2628 Author: tiran Title: #2628: [WIP] Refactor LDAPClient Action: opened PR body: """ **WIP** Simplify LDAPClient construction and ensure that LDAP connections are always secure (LDAP + STARTTLS, LDAPI, LDAPS) unless explicitly stated otherwise. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2628/head:pr2628 git checkout pr2628

1 1

[freeipa PR#2591][opened] [Backport][ipa-4-7] Unify and simplify LDAP service discovery
by tiran 03 Jan '19

03 Jan '19

URL: https://github.com/freeipa/freeipa/pull/2591 Author: tiran Title: #2591: [Backport][ipa-4-7] Unify and simplify LDAP service discovery Action: opened PR body: """ This PR was opened automatically because PR #2144 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2591/head:pr2591 git checkout pr2591

2 1

[freeipa PR#2580][opened] Issue #7744: Use api.env.server for config.ca_host_name
by jaredledvina 20 Dec '18

20 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2580 Author: jaredledvina Title: #2580: Issue #7744: Use api.env.server for config.ca_host_name Action: opened PR body: """ Bug: https://pagure.io/freeipa/issue/7744 This is a really quick attempt to fix this bug. Currently, the CA server is always chosen from LDAP. As a result, when installing the CA but, passing in `--server`, the replica install will use the server passed in but the CA install can replicate from another. This leads to lots of confusion when reviewing the replication topology and can lead to replicating the entire CA domain from a high latency link. This really bites us in production where new replicas will replicate initially from a server on the other side of the world and that link has high latency causing failures midway through the install. I think this change will work and am happy to test it out. I'd love to see this back ported to 4.5.4 but, understand if that's not possible. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2580/head:pr2580 git checkout pr2580

1 1

[freeipa PR#2576][opened] Allow Apache user to access SSSD IFP for smart card auth
by tiran 11 Dec '18

11 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2576 Author: tiran Title: #2576: Allow Apache user to access SSSD IFP for smart card auth Action: opened PR body: """ * Remove dead code * Allow HTTPd user to access SSSD IFP * Smart card auth advise: Allow Apache user See: https://pagure.io/freeipa/issue/7751 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2576/head:pr2576 git checkout pr2576

1 1

[freeipa PR#2627][opened] Make ipa-client-automount --uninstall more robust.
by fcami 10 Dec '18

10 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2627 Author: fcami Title: #2627: Make ipa-client-automount --uninstall more robust. Action: opened PR body: """ Add exception handling to calls to systemctl stop / disable. Fixes: https://pagure.io/freeipa/issue/7780 Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2627/head:pr2627 git checkout pr2627

1 1

[freeipa PR#2629][opened] less is added to dependencies for python3-ipalib
by xxblx 07 Dec '18

07 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2629 Author: xxblx Title: #2629: less is added to dependencies for python3-ipalib Action: opened PR body: """ less is added to dependencies for python3-ipalib package Fixes: https://pagure.io/freeipa/issue/7746 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2629/head:pr2629 git checkout pr2629

1 1

[freeipa PR#2603][opened] Add gating tests to nightly
by dhnunes 07 Dec '18

07 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2603 Author: dhnunes Title: #2603: Add gating tests to nightly Action: opened PR body: """ The objective of this change is to address the problem mentioned in this thread: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… Since the concept of nightly is being a superset of gating, the gating tests are incorporated in nightly in this commit. Signed-off-by: Diogo Nunes <diogo.hap(a)gmail.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2603/head:pr2603 git checkout pr2603

1 1

[freeipa PR#2306][opened] Test package installation suggetion being prompt
by mrizwan93 06 Dec '18

06 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2306 Author: mrizwan93 Title: #2306: Test package installation suggetion being prompt Action: opened PR body: """ In order to work with IPA and Yubikey, libyubikey is required. Before the fix, if yubikey added without having packages, it used to result in traceback. Now it prompt error suggeting to install 'libyubikey' and 'libusb' packages. related ticket : https://pagure.io/freeipa/issue/6979 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2306/head:pr2306 git checkout pr2306

2 1

[freeipa PR#2630][opened] PKINIT: fix ipa-pkinit-manage enable|disable
by flo-renaud 05 Dec '18

05 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2630 Author: flo-renaud Title: #2630: PKINIT: fix ipa-pkinit-manage enable|disable Action: opened PR body: """ ## PKINIT: fix ipa-pkinit-manage enable|disable The command ipa-pkinit-manage enable|disable is reporting success even though the PKINIT cert is not re-issued. The command triggers the request of a new certificate (signed by IPA CA when state=enable, selfsigned when disabled), but as the cert file is still present, certmonger does not create a new request and the existing certificate is kept. The fix consists in deleting the cert and key file before calling certmonger to request a new cert. There was also an issue in the is_pkinit_enabled() function: if no tracking request was found for the PKINIT cert, is_pkinit_enabled() was returning True while it should not. Fixes https://pagure.io/freeipa/issue/7200 ## ipatest: add test for ipa-pkinit-manage enable|disable Add a test for ipa-pkinit-manage with the following scenario: - install master with option --no-pkinit - call ipa-pkinit-manage enable - call ipa-pkinit-manage disable - call ipa-pkinit-manage enable At each step, check that the PKINIT cert is consistent with the expectations: when pkinit is enabled, the cert is signed by IPA CA and tracked by 'IPA' ca helper, but when pkinit is disabled, the cert is self-signed and tracked by 'SelfSign' CA helper. Related to https://pagure.io/freeipa/issue/7200 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2630/head:pr2630 git checkout pr2630

1 1

[freeipa PR#2625][opened] Update ipa-4-7 translations from Zanata
by abbra 05 Dec '18

05 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2625 Author: abbra Title: #2625: Update ipa-4-7 translations from Zanata Action: opened PR body: """ Manual update for translations in ipa-4-7 branch as it differs from the master (branches are separate in Zanata). """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2625/head:pr2625 git checkout pr2625

2 1

[freeipa PR#2624][opened] Update translations from Zanata
by abbra 05 Dec '18

05 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2624 Author: abbra Title: #2624: Update translations from Zanata Action: opened PR body: """ Following translations were updated: - Spanish - Ukranian """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2624/head:pr2624 git checkout pr2624

2 1

[freeipa PR#2422][opened] Test KRA installtion after ca agent cert renewal
by mrizwan93 05 Dec '18

05 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2422 Author: mrizwan93 Title: #2422: Test KRA installtion after ca agent cert renewal Action: opened PR body: """ KRA installtion was failing after ca-agent cert gets renewed. This test check if the syptoms no longer exists. related ticket: https://pagure.io/freeipa/issue/7288 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2422/head:pr2422 git checkout pr2422

2 1

FreeIPA 4.7.2 release planning
by Alexander Bokovoy 03 Dec '18

03 Dec '18

Hi, let us release FreeIPA 4.7.2 on Monday, December 3rd. Release notes draft is attached, please comment on it and add more details. TODO: - Add Sudharsan Omprakash to the list of contributors - Add Adam Williamson to the list of contributors - Add Sergey Orlov to the list of contributors -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

3 4

[freeipa PR#2631][opened] [testing_master] Nightly PR
by freeipa-pr-ci 03 Dec '18

03 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2631 Author: freeipa-pr-ci Title: #2631: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2631/head:pr2631 git checkout pr2631

1 1

[freeipa PR#2404][opened] Automation added for NTP Replacement test scenarios
by varunmylaraiah 03 Dec '18

03 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2404 Author: varunmylaraiah Title: #2404: Automation added for NTP Replacement test scenarios Action: opened PR body: """ -test_server_install_without_option_N -test_server_install_with_option_N -test_server_install_with_ntp_server -test_server_install_with_ntp_pool -test_server_install_with_multiple_ntp_server https://pagure.io/freeipa/issue/7719 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2404/head:pr2404 git checkout pr2404

2 1

[freeipa PR#2542][opened] Enable firewall in the tests
by t-woerner 03 Dec '18

03 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2542 Author: t-woerner Title: #2542: Enable firewall in the tests Action: opened PR body: """ Currently the firewall is not enabled in the tests. The goal is to enable the file firewall using firewalld in the tests. All uses of iptables and ip6tables commands in the tests need to be replaced. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2542/head:pr2542 git checkout pr2542

1 1

[freeipa PR#2623][opened] [Backport][ipa-4-7] Update temp commit template to F29
by tiran 03 Dec '18

03 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2623 Author: tiran Title: #2623: [Backport][ipa-4-7] Update temp commit template to F29 Action: opened PR body: """ Manual backport of PR #2619 The temp_commit.yaml template now uses F29 as well. It also contains all topology configurations from the nightly jobs. Fixes: https://pagure.io/freeipa/issue/7779 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2623/head:pr2623 git checkout pr2623

2 1

[freeipa PR#2622][opened] certupdate: add commentary about certmonger behaviour
by frasertweedale 03 Dec '18

03 Dec '18

URL: https://github.com/freeipa/freeipa/pull/2622 Author: frasertweedale Title: #2622: certupdate: add commentary about certmonger behaviour Action: opened PR body: """ It is not obvious why we "renew" (reuse only) the IPA CA certificate in ipa-certupdate. Add some commentary to explain this behaviour. Related: https://pagure.io/freeipa/issue/7751 See also: https://github.com/freeipa/freeipa/pull/2576#issuecomment-442220840 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2622/head:pr2622 git checkout pr2622

2 1

[DESIGN] IPA healthcheck design
by Rob Crittenden 03 Dec '18

03 Dec '18

I started a design of an IPA healthcheck framework at https://www.freeipa.org/page/V4/Healthcheck Have at it. Note that this concentrates more on how it will work big picture and less on individual checks that may be performed. I'm happy to add any ideas you come up with for specific tests. rob

4 10

[freeipa PR#2617][opened] [testing_master] Nightly PR
by freeipa-pr-ci 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2617 Author: freeipa-pr-ci Title: #2617: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2617/head:pr2617 git checkout pr2617

1 1

[freeipa PR#2626][opened] [Backport][ipa-4-7] PR-CI: Move to Fedora 29 template, version 0.2.0
by f-trivino 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2626 Author: f-trivino Title: #2626: [Backport][ipa-4-7] PR-CI: Move to Fedora 29 template, version 0.2.0 Action: opened PR body: """ Manual backport of PR #2605 to ipa-4-7 branch. Original author: @dhnunes """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2626/head:pr2626 git checkout pr2626

2 1

[freeipa PR#2621][opened] [Backport][ipa-4-6] ipa upgrade: handle double-encoded certificates
by tiran 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2621 Author: tiran Title: #2621: [Backport][ipa-4-6] ipa upgrade: handle double-encoded certificates Action: opened PR body: """ This PR was opened automatically because PR #2618 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2621/head:pr2621 git checkout pr2621

2 1

[freeipa PR#2620][opened] [Backport][ipa-4-7] ipa upgrade: handle double-encoded certificates
by tiran 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2620 Author: tiran Title: #2620: [Backport][ipa-4-7] ipa upgrade: handle double-encoded certificates Action: opened PR body: """ This PR was opened automatically because PR #2618 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2620/head:pr2620 git checkout pr2620

2 1

[freeipa PR#2619][opened] Update temp commit template to F29
by tiran 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2619 Author: tiran Title: #2619: Update temp commit template to F29 Action: opened PR body: """ The temp_commit.yaml template now uses F29 as well. It also contains all topology configurations from the nightly jobs. Fixes: https://pagure.io/freeipa/issue/7779 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2619/head:pr2619 git checkout pr2619

1 1

[freeipa PR#2618][opened] ipa upgrade: handle double-encoded certificates
by flo-renaud 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2618 Author: flo-renaud Title: #2618: ipa upgrade: handle double-encoded certificates Action: opened PR body: """ ## ipa upgrade: handle double-encoded certificates Issue is linked to the ticket #3477 LDAP upload CA cert sometimes double-encodes the value In old FreeIPA releases (< 3.2), the upgrade plugin was encoding twice the value of the certificate in `cn=cacert,cn=ipa,cn=etc,$BASEDN`. The fix for 3477 is only partial as it prevents double-encoding when a new cert is uploaded but does not fix wrong values already present in LDAP. With this commit, the code first tries to read a der cert. If it fails, it logs a debug message and re-writes the value caCertificate;binary to repair the entry. Fixes https://pagure.io/freeipa/issue/7775 ## ipatests: add upgrade test for double-encoded cacert Create a test for upgrade with the following scenario: - install master - write a double-encoded cert in the entry `cn=cacert,,cn=ipa,cn=etc,$basedn` to simulate bug 7775 - call ipa-server-upgrade - check that the upgrade fixed the value The upgrade should finish successfully and repair the double-encoded cert. Related to https://pagure.io/freeipa/issue/7775 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2618/head:pr2618 git checkout pr2618

2 1

[freeipa PR#2616][opened] [Backport][ipa-4-6] prci_definitions: update vagrant memory topology requirements
by netoarmando 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2616 Author: netoarmando Title: #2616: [Backport][ipa-4-6] prci_definitions: update vagrant memory topology requirements Action: opened PR body: """ Manual backport of PR #2609 to `ipa-4-6` branch. Original author: @f-trivino """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2616/head:pr2616 git checkout pr2616

2 1

[freeipa PR#2615][opened] [Backport][ipa-4-7] Memory requirements for master and replica have been increased
by netoarmando 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2615 Author: netoarmando Title: #2615: [Backport][ipa-4-7] Memory requirements for master and replica have been increased Action: opened PR body: """ Manual backport of PR #2609 to `ipa-4-7` branch. Original author: @f-trivino """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2615/head:pr2615 git checkout pr2615

2 1

[freeipa PR#2605][opened] Test Fedora 29 Template Box
by dhnunes 30 Nov '18

30 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2605 Author: dhnunes Title: #2605: Test Fedora 29 Template Box Action: opened PR body: """ Testing new Fedora 29 Vagrant template box. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2605/head:pr2605 git checkout pr2605

2 1

[freeipa PR#2611][opened] [Backport][ipa-4-7] Fix authselect invocations to work with 1.0.2
by tiran 29 Nov '18

29 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2611 Author: tiran Title: #2611: [Backport][ipa-4-7] Fix authselect invocations to work with 1.0.2 Action: opened PR body: """ Manual backport of PR #2610. Since authselect 1.0.2, invoking an authselect command sequence like this: ['authselect', 'sssd', '', '--force'] does not work: authselect barfs on the empty string arg and errors out. We must only pass a features arg if we actually have some text to go in it. This broke uninstallation. In all cases, features are now passed as separate arguments instead of one argument separated by space. Fixes: https://pagure.io/freeipa/issue/7776 Signed-off-by: Adam Williamson <awilliam(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2611/head:pr2611 git checkout pr2611

1 1

[freeipa PR#2610][opened] Fix authselect invocations to work with 1.0.2
by AdamWill 29 Nov '18

29 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2610 Author: AdamWill Title: #2610: Fix authselect invocations to work with 1.0.2 Action: opened PR body: """ Since authselect 1.0.2, invoking an authselect command sequence like this: ['authselect', 'sssd', '', '--force'] does not work: authselect barfs on the empty string arg and errors out. We must only pass a features arg if we actually have some text to go in it. This broke uninstallation. I don't know for sure whether the fix in `restore` is needed - it may be that `cfg[1]` is never an empty sequence - but it seems sensible to do it just in case. Signed-off-by: Adam Williamson <awilliam(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2610/head:pr2610 git checkout pr2610

2 1

[freeipa PR#2613][opened] [Backport][ipa-4-6] Fix ipa user-find --certificate
by flo-renaud 29 Nov '18

29 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2613 Author: flo-renaud Title: #2613: [Backport][ipa-4-6] Fix ipa user-find --certificate Action: opened PR body: """ Manual backport of PR #2598 to ipa-4-6 branch. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2613/head:pr2613 git checkout pr2613

1 1

[freeipa PR#2608][opened] [Backport][ipa-4-7] Increase debugging for blocked port 749 and 464
by t-woerner 29 Nov '18

29 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2608 Author: t-woerner Title: #2608: [Backport][ipa-4-7] Increase debugging for blocked port 749 and 464 Action: opened PR body: """ This PR was opened automatically because PR #2604 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2608/head:pr2608 git checkout pr2608

2 1

[freeipa PR#2614][opened] [Backport][ipa-4-6] Fix issues found by pylint 2.2.0
by tiran 29 Nov '18

29 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2614 Author: tiran Title: #2614: [Backport][ipa-4-6] Fix issues found by pylint 2.2.0 Action: opened PR body: """ Manual backport of PR #2602 * pylint 2.2: Fix unnecessary pass statement * pylint: Fix duplicate-string-formatting-argument * pylint: also verify scripts * Address misc pylint issues in CLI scripts See https://pagure.io/freeipa/issue/7772 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2614/head:pr2614 git checkout pr2614

2 1

[freeipa PR#2612][opened] [Backport][ipa-4-7] Fix ipa user-find --certificate
by flo-renaud 28 Nov '18

28 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2612 Author: flo-renaud Title: #2612: [Backport][ipa-4-7] Fix ipa user-find --certificate Action: opened PR body: """ Manual backport of PR #2598 to ipa-4-7 branch. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2612/head:pr2612 git checkout pr2612

2 1

[freeipa PR#2607][opened] [testing_master] Nightly PR
by freeipa-pr-ci 28 Nov '18

28 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2607 Author: freeipa-pr-ci Title: #2607: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2607/head:pr2607 git checkout pr2607

1 1

[freeipa PR#2609][opened] prci: update vagrant memory topology requirements
by f-trivino 28 Nov '18

28 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2609 Author: f-trivino Title: #2609: prci: update vagrant memory topology requirements Action: opened PR body: """ Memory requirements for master and replica have been increased due to OOM issues. This PR updates prci_definitions accordingly. This PR also roll-back ipaserver mem reqs to the previous value since the WebUI tests were split into different blocks. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2609/head:pr2609 git checkout pr2609

1 1

[freeipa PR#2606][opened] [Backport][ipa-4-7] Fix issues found by pylint 2.2.0
by tiran 28 Nov '18

28 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2606 Author: tiran Title: #2606: [Backport][ipa-4-7] Fix issues found by pylint 2.2.0 Action: opened PR body: """ Manual backport of PR #2602 * pylint 2.2: Fix unnecessary pass statement * pylint: Fix duplicate-string-formatting-argument * pylint: also verify scripts * Address misc pylint issues in CLI scripts See https://pagure.io/freeipa/issue/7772 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2606/head:pr2606 git checkout pr2606

2 1

[freeipa PR#2598][opened] Fix ipa user-find --certificate
by flo-renaud 27 Nov '18

27 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2598 Author: flo-renaud Title: #2598: Fix ipa user-find --certificate Action: opened PR body: """ ## ipaldap.py: fix method creating a ldap filter for IPACertificate `ipa user-find --certificate` and `ipa host-find --certificate` fail to return matching entries, because the method transforming the attribute into a LDAP filter does not properly handle IPACertificate objects. Directory Server logs show a filter with `(usercertificate=ipalib.x509.IPACertificate object at 0x7fc0a5575b90>)` When the attribute contains a IPACertificate, the method needs to extract the public bytes instead of calling str(value). Fixes https://pagure.io/freeipa/issue/7770 ## ipatests: add xmlrpc test for user|host-find --certificate There were no xmlrpc tests for `ipa user-find --certificate` or `ipa host-find --certificate`. The commit adds tests for these commands. Related to https://pagure.io/freeipa/issue/7770 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2598/head:pr2598 git checkout pr2598

2 1

[freeipa PR#2604][opened] Increase debugging for blocked port 749
by tiran 27 Nov '18

27 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2604 Author: tiran Title: #2604: Increase debugging for blocked port 749 Action: opened PR body: """ kadmin.service is still failing to start sometimes. List and check both source and destination ports of listening and non-listening TCP and UDP sockets. See: https://pagure.io/freeipa/issue/7769 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Note: This PR contains an additional commit from https://github.com/freeipa/freeipa/pull/2602 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2604/head:pr2604 git checkout pr2604

2 1

[freeipa PR#2600][opened] Fix crashing WebUI identity tests in Nightly PR
by serg-cymbaluk 27 Nov '18

27 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2600 Author: serg-cymbaluk Title: #2600: Fix crashing WebUI identity tests in Nightly PR Action: opened PR body: """ Clear default user/host group before deleting it in "Automember" tests. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2600/head:pr2600 git checkout pr2600

1 1

[freeipa PR#2599][opened] [testing_master] Nightly PR
by freeipa-pr-ci 26 Nov '18

26 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2599 Author: freeipa-pr-ci Title: #2599: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2599/head:pr2599 git checkout pr2599

1 1

[freeipa PR#2601][opened] prci: update vagrant memory topology requirements
by f-trivino 26 Nov '18

26 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2601 Author: f-trivino Title: #2601: prci: update vagrant memory topology requirements Action: opened PR body: """ Memory requirements for master and replica have been increased due to OOM issues. This PR updates prci_definitions accordingly. This PR also roll-back ipaserver mem reqs to the previous value since the WebUI tests were split into different blocks. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2601/head:pr2601 git checkout pr2601

1 1

[freeipa PR#2602][opened] Fix issues found by pylint 2.2.0
by tiran 26 Nov '18

26 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2602 Author: tiran Title: #2602: Fix issues found by pylint 2.2.0 Action: opened PR body: """ See https://pagure.io/freeipa/issue/7772 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2602/head:pr2602 git checkout pr2602

1 1

[freeipa PR#2597][opened] [Backport][ipa-4-7] [ipatest] Added test for ipa-client-install with a non-standard ldap.conf file
by flo-renaud 26 Nov '18

26 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2597 Author: flo-renaud Title: #2597: [Backport][ipa-4-7] [ipatest] Added test for ipa-client-install with a non-standard ldap.conf file Action: opened PR body: """ This PR was opened automatically because PR #2567 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2597/head:pr2597 git checkout pr2597

1 1

[freeipa PR#2595][opened] [testing_master] Nightly PR
by freeipa-pr-ci 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2595 Author: freeipa-pr-ci Title: #2595: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2595/head:pr2595 git checkout pr2595

1 1

[freeipa PR#2583][opened] [Backport][ipa-4-7] PR-CI: Restart rpcbind when it blocks kadmin port
by tiran 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2583 Author: tiran Title: #2583: [Backport][ipa-4-7] PR-CI: Restart rpcbind when it blocks kadmin port Action: opened PR body: """ This PR was opened automatically because PR #2581 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2583/head:pr2583 git checkout pr2583

2 1

[freeipa PR#2593][opened] [Backport][ipa-4-7] Fix "ipa vault-retrieve --shared $vault" does not work if IPA host is not a KRA (issue 7691)
by tiran 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2593 Author: tiran Title: #2593: [Backport][ipa-4-7] Fix "ipa vault-retrieve --shared $vault" does not work if IPA host is not a KRA (issue 7691) Action: opened PR body: """ This PR was opened automatically because PR #2553 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2593/head:pr2593 git checkout pr2593

2 1

[freeipa PR#2594][opened] [Backport][ipa-4-6] Fix "ipa vault-retrieve --shared $vault" does not work if IPA host is not a KRA (issue 7691)
by tiran 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2594 Author: tiran Title: #2594: [Backport][ipa-4-6] Fix "ipa vault-retrieve --shared $vault" does not work if IPA host is not a KRA (issue 7691) Action: opened PR body: """ This PR was opened automatically because PR #2553 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2594/head:pr2594 git checkout pr2594

2 1

[freeipa PR#2596][opened] TestBackupAndRestoreWithReplica needs 2 replicas
by tiran 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2596 Author: tiran Title: #2596: TestBackupAndRestoreWithReplica needs 2 replicas Action: opened PR body: """ The test case TestBackupAndRestoreWithReplica needs two replicas but PR-CI just had topology: *master_1repl. Fixes: https://pagure.io/freeipa/issue/7691 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2596/head:pr2596 git checkout pr2596

1 1

[freeipa PR#2567][opened] [ipatest] Added test for ipa-client-install with a non-standard ldap.conf file
by varunmylaraiah 23 Nov '18

23 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2567 Author: varunmylaraiah Title: #2567: [ipatest] Added test for ipa-client-install with a non-standard ldap.conf file Action: opened PR body: """ Added test for ipa-client-install with a non-standard ldap.conf file Ticket: https://pagure.io/freeipa/issue/7418 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2567/head:pr2567 git checkout pr2567

2 1

[freeipa PR#2582][opened] [testing_master] Nightly PR
by freeipa-pr-ci 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2582 Author: freeipa-pr-ci Title: #2582: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2582/head:pr2582 git checkout pr2582

1 1

[freeipa PR#2553][opened] dogtag.py: raise exception if select_any_master() fails
by fcami 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2553 Author: fcami Title: #2553: dogtag.py: raise exception if select_any_master() fails Action: opened PR body: """ Standard users cannot determine services like KRA. Using ldapsearch with (ipaConfigString=enabledService) always fails. Catch that. Note that this is not the definitive fix for https://pagure.io/freeipa/issue/7691 (yet) """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2553/head:pr2553 git checkout pr2553

2 1

[freeipa PR#2592][opened] [Backport][ipa-4-7] ipatests: add test for ipa-restore in multi-master configuration
by wladich 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2592 Author: wladich Title: #2592: [Backport][ipa-4-7] ipatests: add test for ipa-restore in multi-master configuration Action: opened PR body: """ This PR is manual backport of https://github.com/freeipa/freeipa/pull/2588 please wait for CI before pushing and do not forget about backport to branches specified with labels if needed. In case of questions or problems contact @wladich who is author of the original PR. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2592/head:pr2592 git checkout pr2592

1 1

[freeipa PR#2588][opened] ipatests: add test for ipa-restore in multi-master configuration
by wladich 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2588 Author: wladich Title: #2588: ipatests: add test for ipa-restore in multi-master configuration Action: opened PR body: """ Test ensures that after ipa-restore on the master, the replica can be re-synchronized and a new replica can be created. https://pagure.io/freeipa/issue/7455 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2588/head:pr2588 git checkout pr2588

1 1

[freeipa PR#2144][opened] [WIP] Find active servers
by tiran 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2144 Author: tiran Title: #2144: [WIP] Find active servers Action: opened PR body: """ Prototype, work in progress Refactor and improve selection of servers for CA and KRA. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2144/head:pr2144 git checkout pr2144

1 1

[freeipa PR#2589][opened] [Backport][ipa-4-6] ipatests: fix test_replica_uninstall_deletes_ruvs
by flo-renaud 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2589 Author: flo-renaud Title: #2589: [Backport][ipa-4-6] ipatests: fix test_replica_uninstall_deletes_ruvs Action: opened PR body: """ This PR was opened because PR #2574 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2589/head:pr2589 git checkout pr2589

1 1

[freeipa PR#2590][opened] [Backport][ipa-4-6] ipa-replica-install: password and admin-password options mutually exclusive
by flo-renaud 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2590 Author: flo-renaud Title: #2590: [Backport][ipa-4-6] ipa-replica-install: password and admin-password options mutually exclusive Action: opened PR body: """ This PR was opened manually because PR #2585 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2590/head:pr2590 git checkout pr2590

1 1

[freeipa PR#2586][opened] [Backport][ipa-4-7] ipatests: fix test_replica_uninstall_deletes_ruvs
by flo-renaud 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2586 Author: flo-renaud Title: #2586: [Backport][ipa-4-7] ipatests: fix test_replica_uninstall_deletes_ruvs Action: opened PR body: """ This PR was opened automatically because PR #2574 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2586/head:pr2586 git checkout pr2586

1 1

[freeipa PR#2563][opened] ipatests: add missing nightly tests for replica_promotion installation and external_ca
by flo-renaud 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2563 Author: flo-renaud Title: #2563: ipatests: add missing nightly tests for replica_promotion installation and external_ca Action: opened PR body: """ ## ipatests: add missing tests for test_installation.py Some tests were missing in the nightly: - test_installation.py::TestInstallWithCA_DNS3 - test_installation.py::TestInstallWithCA_DNS4 ## ipatests: add missing tests for test_replica_promotion.py The following test was missing from nightly: test_replica_promotion.py::TestReplicaInstallCustodia ## ipatests: add missing tests for test_external_ca.py Some tests were missing from nightly definition: - test_external_ca.py::TestExternalCAdirsrvStop - test_external_ca.py::TestExternalCAInvalidCert - test_external_ca.py::TestMultipleExternalCA Related to https://pagure.io/freeipa/issue/7743 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2563/head:pr2563 git checkout pr2563

1 1

[freeipa PR#2587][opened] [Backport][ipa-4-7] ipa-replica-install: password and admin-password options mutually exclusive
by Tiboris 21 Nov '18

21 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2587 Author: Tiboris Title: #2587: [Backport][ipa-4-7] ipa-replica-install: password and admin-password options mutually exclusive Action: opened PR body: """ This PR was opened automatically because PR #2585 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2587/head:pr2587 git checkout pr2587

2 1

[freeipa PR#2585][opened] ipa-replica-install: password and admin-password options mutually exclusive
by flo-renaud 20 Nov '18

20 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2585 Author: flo-renaud Title: #2585: ipa-replica-install: password and admin-password options mutually exclusive Action: opened PR body: """ ## ipa-replica-install: make password and admin-password options mutually exclusive Currently it is possible to run ipa-replica-install in one step, and provide --password and --admin-password simultaneously. This is confusing as --password is intended for one-time pwd when the ipa-replica-install command is delegated to a user who doesn't know the admin password. The fix makes --password and --admin-password options mutually exclusive. Fixes https://pagure.io/freeipa/issue/6353 ## ipatests: add test for ipa-replica-install options Add a test checking that --password and --admin-password options are mutually exclusive. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2585/head:pr2585 git checkout pr2585

2 1

[freeipa PR#2521][opened] ipatests: add test for ipa-restore in multi-master configuration
by wladich 20 Nov '18

20 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2521 Author: wladich Title: #2521: ipatests: add test for ipa-restore in multi-master configuration Action: opened PR body: """ Test ensures that after ipa-restore on master replica can be re-synchronized and new replica can be created. https://pagure.io/freeipa/issue/7455 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2521/head:pr2521 git checkout pr2521

1 1

[freeipa PR#2574][opened] ipatests: fix test_replica_uninstall_deletes_ruvs
by flo-renaud 20 Nov '18

20 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2574 Author: flo-renaud Title: #2574: ipatests: fix test_replica_uninstall_deletes_ruvs Action: opened PR body: """ test_topology.py is failing because of a wrong scenario. Currently, test_replica_uninstall_deletes_ruvs does: - install master + replica with CA - `ipa-replica-manage list-ruv` to check that the repl is propery setup - `ipa-replica-manage del $replica` - (on replica) `ipa-server-install --uninstall -U` - `ipa-replica-manage list-ruv` to check that replica does not appear any more in the RUV list When ipa-replica-manage del is run, the topology plugin creates 2 tasks cleanallruvs (one for the domain, one for the ca) and they are run asynchronously. This means that the ruvs may still be present when the test moves forward and calls list-ruv. The test should wait for the cleanallruvs tasks to finish before checking that list-ruv does not display replica anymore. Fixes https://pagure.io/freeipa/issue/7545 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2574/head:pr2574 git checkout pr2574

1 1

[freeipa PR#2581][opened] PR-CI: Restart rpcbind when it blocks kadmin port
by tiran 20 Nov '18

20 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2581 Author: tiran Title: #2581: PR-CI: Restart rpcbind when it blocks kadmin port Action: opened PR body: """ Every now and then, a PR-CI job fails because rpcbind blocks the kadmin port 749/UDP and kadmin.service fails to start. When NFS secure port is configured, rpcbind reserves a random low port. A new workaround detects a blocked port and restart rpcbind.service. See: https://pagure.io/freeipa/issue/7769 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2581/head:pr2581 git checkout pr2581

1 1

[freeipa PR#2579][opened] [testing_master] Nightly PR
by freeipa-pr-ci 19 Nov '18

19 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2579 Author: freeipa-pr-ci Title: #2579: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2579/head:pr2579 git checkout pr2579

1 1

[freeipa PR#2578][opened] [Backport][ipa-4-7] ipa-kdb: reduce LDAP operations timeout to 30 seconds
by rcritten 19 Nov '18

19 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2578 Author: rcritten Title: #2578: [Backport][ipa-4-7] ipa-kdb: reduce LDAP operations timeout to 30 seconds Action: opened PR body: """ This PR was opened automatically because PR #2575 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2578/head:pr2578 git checkout pr2578

2 1

[freeipa PR#2577][opened] [Backport][ipa-4-6] ipa-kdb: reduce LDAP operations timeout to 30 seconds
by rcritten 19 Nov '18

19 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2577 Author: rcritten Title: #2577: [Backport][ipa-4-6] ipa-kdb: reduce LDAP operations timeout to 30 seconds Action: opened PR body: """ This PR was opened automatically because PR #2575 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2577/head:pr2577 git checkout pr2577

2 1

[freeipa PR#2566][opened] [testing_master] Nightly PR
by freeipa-pr-ci 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2566 Author: freeipa-pr-ci Title: #2566: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2566/head:pr2566 git checkout pr2566

1 1

[freeipa PR#2575][opened] ipa-kdb: reduce LDAP operations timeout to 30 seconds
by abbra 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2575 Author: abbra Title: #2575: ipa-kdb: reduce LDAP operations timeout to 30 seconds Action: opened PR body: """ Since LDAP operations used by ipa-kdb driver are synchronous, the timeout specified here is blocking entire KDC. It is worth reducing the timeout and since AS REQ processing timeout in KDC is 1 minute, reducing the timeout for LDAP operations down to 30 seconds allows KDC to respond promptly in worst case scenario as well. Fixes: https://pagure.io/freeipa/issue/7217 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2575/head:pr2575 git checkout pr2575

2 1

[freeipa PR#2573][opened] [Backport][ipa-4-7] freeipa.spec.in: add BuildRequires for python3-lib389
by tiran 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2573 Author: tiran Title: #2573: [Backport][ipa-4-7] freeipa.spec.in: add BuildRequires for python3-lib389 Action: opened PR body: """ This PR was opened automatically because PR #2565 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2573/head:pr2573 git checkout pr2573

2 1

[freeipa PR#2572][opened] [Backport][ipa-4-7] compatablity with http2.4
by rcritten 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2572 Author: rcritten Title: #2572: [Backport][ipa-4-7] compatablity with http2.4 Action: opened PR body: """ This PR was opened automatically because PR #2516 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2572/head:pr2572 git checkout pr2572

2 1

[freeipa PR#2568][opened] Fix nightly PR CI configuration for Web UI tests
by serg-cymbaluk 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2568 Author: serg-cymbaluk Title: #2568: Fix nightly PR CI configuration for Web UI tests Action: opened PR body: """ Add strip operator for test_suite definitions (in nightly_*.yaml) to prevent inserting line breaks. https://pagure.io/freeipa/issue/7756 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2568/head:pr2568 git checkout pr2568

1 1

[freeipa PR#2565][opened] freeipa.spec.in: add BuildRequires for python3-lib389
by flo-renaud 16 Nov '18

16 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2565 Author: flo-renaud Title: #2565: freeipa.spec.in: add BuildRequires for python3-lib389 Action: opened PR body: """ freeipa.spec.in is missing BuildRequires for python3-lib389. The consequence is that make fasttest is failing. Fixes https://pagure.io/freeipa/issue/7767 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2565/head:pr2565 git checkout pr2565

2 1

[freeipa PR#2571][opened] [Backport][ipa-4-6] Fix pytest deprecation warning
by tiran 15 Nov '18

15 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2571 Author: tiran Title: #2571: [Backport][ipa-4-6] Fix pytest deprecation warning Action: opened PR body: """ This PR was opened automatically because PR #2569 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2571/head:pr2571 git checkout pr2571

2 1

[freeipa PR#2570][opened] [Backport][ipa-4-7] Fix pytest deprecation warning
by tiran 15 Nov '18

15 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2570 Author: tiran Title: #2570: [Backport][ipa-4-7] Fix pytest deprecation warning Action: opened PR body: """ This PR was opened automatically because PR #2569 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2570/head:pr2570 git checkout pr2570

2 1

[freeipa PR#2516][opened] compatablity with http2.4
by sudharsanomprakash 15 Nov '18

15 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2516 Author: sudharsanomprakash Title: #2516: compatablity with http2.4 Action: opened PR body: """ IPA server running httpd-2.4 and using the following old directives (Order, Allow or Deny) which have been deprecated Changes commited "Require all granted" """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2516/head:pr2516 git checkout pr2516

2 1

[freeipa PR#2569][opened] Fix pytest deprecation warning
by tiran 15 Nov '18

15 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2569 Author: tiran Title: #2569: Fix pytest deprecation warning Action: opened PR body: """ conftest uses the Function attribute of a pytest.Function object. Latest pytest has deprecated the attribute: _pytest.warning_types.RemovedInPytest4Warning: usage of Function.Function is deprecated, please use pytest.Function instead Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2569/head:pr2569 git checkout pr2569

1 1

[freeipa PR#2547][opened] [testing_master] Nightly PR
by freeipa-pr-ci 14 Nov '18

14 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2547 Author: freeipa-pr-ci Title: #2547: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2547/head:pr2547 git checkout pr2547

1 1

vault implementation vs ACI to read ipaconfigstring
by François Cami 14 Nov '18

14 Nov '18

Hi, While investigating why non-admin users having access to a shared vault got an error that stemmed from them not being able to find the KRA server to query (*), I found out that by changing the ldapsearch query normal users could, in fact, get the list of KRA servers. (*) https://pagure.io/freeipa/issue/7691 E.g. the query built from select_any_master(ldap2, service='CA') does not return any server when run by a non-admin user: ############## # ldapsearch -Y GSSAPI -b cn=masters,cn=ipa,cn=etc,dc=laptop,dc=example,dc=org '(&(objectClass=ipaConfigObject)(ipaConfigString=enabledService)(cn=KRA))' (...) ############## but removing (ipaConfigString=enabledService) from the query works: ############## # ldapsearch -Y GSSAPI -b cn=masters,cn=ipa,cn=etc,dc=laptop,dc=example,dc=org '(&(objectClass=ipaConfigObject)(cn=KRA))' # KRA, idm0.laptop.example.org, masters, ipa, etc, laptop.example.org dn: cn=KRA,cn=idm0.laptop.example.org,cn=masters,cn=ipa,cn=etc,dc=laptop,dc=ex ample,dc=org objectClass: nsContainer objectClass: ipaConfigObject objectClass: top cn: KRA ############## So it looks like once we're past logging an exception when we can't find a KRA master ( https://github.com/freeipa/freeipa/pull/2553 ), we have to decide what to do: * should users be able to see more data in LDAP by default - it looks like by using ldapsearch they already can find the information they need anyway - so allow all users to read status of services OR * add "System: Read Status of Services on IPA Servers" only to users which should be able to use Vault (as originally suggested by Petr) OR * or update select_any_master()'s search logic so that if the first query fails, we retry without (ipaConfigString=enabledService) Essentially we are revisiting https://pagure.io/freeipa/issue/3566 (thanks Florence for pointing that out!). Input please? Cheers François

5 5

[freeipa PR#2564][opened] [Backport][ipa-4-7] certdb: validate server cert signature
by tiran 14 Nov '18

14 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2564 Author: tiran Title: #2564: [Backport][ipa-4-7] certdb: validate server cert signature Action: opened PR body: """ This PR was opened automatically because PR #2556 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2564/head:pr2564 git checkout pr2564

2 1

[freeipa PR#2556][opened] certdb: validate server cert signature
by tiran 14 Nov '18

14 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2556 Author: tiran Title: #2556: certdb: validate server cert signature Action: opened PR body: """ PR https://github.com/freeipa/freeipa/pull/2554 added the '-e' option for CA cert validation. Let's also verify signature, key size, and signing algorithm of server certs. With the '-e' option, the installer and other tools will catch weak certs early. Fixes: pagure.io/freeipa/issue/7761 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2556/head:pr2556 git checkout pr2556

1 1

[freeipa PR#2562][opened] ipa-4-7: merge translations from zanata
by abbra 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2562 Author: abbra Title: #2562: ipa-4-7: merge translations from zanata Action: opened PR body: """ Updated translations from Zanata and also merged changes to Zanata for 4.7 release. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2562/head:pr2562 git checkout pr2562

2 1

[freeipa PR#2560][opened] [Backport][ipa-4-7] certdb: validate certificate signatures
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2560 Author: tiran Title: #2560: [Backport][ipa-4-7] certdb: validate certificate signatures Action: opened PR body: """ This PR was opened automatically because PR #2554 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2560/head:pr2560 git checkout pr2560

1 1

[freeipa PR#2561][opened] Update translations from Zanata
by abbra 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2561 Author: abbra Title: #2561: Update translations from Zanata Action: opened PR body: """ I pushed update to Zanata and pulled some changes from it for master. IPA-4-7 will come as a separate pull request. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2561/head:pr2561 git checkout pr2561

2 1

[freeipa PR#2559][opened] [Backport][ipa-4-7] Fedora 29: Fix pylint 2.1.1 violations
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2559 Author: tiran Title: #2559: [Backport][ipa-4-7] Fedora 29: Fix pylint 2.1.1 violations Action: opened PR body: """ Manual backport of PR #2543 * Ignore W504 code style like in travis config * Address pylint violations in lite-server * Address inconsistent-return-statements * Ignore consider-using-enumerate for now * Address consider-using-in * Fix comparison-with-callable * Fix useless-import-alias * Fix Module 'pytest' has no 'config' member * Fix various dict related pylint warnings * Fix raising-format-tuple * Silence comparison-with-itself in tests * Require pylint 2.1.1-2 See: https://pagure.io/freeipa/issue/7758 See: https://bugzilla.redhat.com/show_bug.cgi?id=1648299 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2559/head:pr2559 git checkout pr2559

1 1

[freeipa PR#2551][opened] ipatests: add missing tests in test_backup_and_restore.py
by flo-renaud 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2551 Author: flo-renaud Title: #2551: ipatests: add missing tests in test_backup_and_restore.py Action: opened PR body: """ 3 tests were missing from this test file in the nightly tests: - TestBackupAndRestoreWithReplica - TestBackupAndRestoreDMPassword - TestReplicaInstallAfterRestore one test was having the wrong name in nightly_rawhide: - TestUserRootFilesOwnershipPermission Related to https://pagure.io/freeipa/issue/7743 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2551/head:pr2551 git checkout pr2551

2 1

[freeipa PR#2557][opened] [Backport][ipa-4-7] Fix ipa user-add --radius=radiusserver
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2557 Author: tiran Title: #2557: [Backport][ipa-4-7] Fix ipa user-add --radius=radiusserver Action: opened PR body: """ This PR was opened automatically because PR #2530 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2557/head:pr2557 git checkout pr2557

1 1

[freeipa PR#2558][opened] [Backport][ipa-4-6] Fix ipa user-add --radius=radiusserver
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2558 Author: tiran Title: #2558: [Backport][ipa-4-6] Fix ipa user-add --radius=radiusserver Action: opened PR body: """ This PR was opened automatically because PR #2530 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2558/head:pr2558 git checkout pr2558

1 1

[freeipa PR#2554][opened] certdb: validate certificate signatures
by frasertweedale 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2554 Author: frasertweedale Title: #2554: certdb: validate certificate signatures Action: opened PR body: """ When verifying a CA certificate, validate its signature. This causes FreeIPA to reject certificate chains with bad signatures, signatures using unacceptable algorithms, or certificates with unacceptable key sizes. The '-e' option to 'certutil -V' was the missing ingredient. An an example of a problem prevented by this change, a certifiate signed by a 1024-bit intermediate CA, would previously have been imported by ipa-cacert-manage, but would cause Dogtag startup failure due to failing self-test. With this change, ipa-cacert-manage will reject the certificate: \# ipa-cacert-manage renew --external-cert-file /tmp/ipa.p7 Importing the renewed CA certificate, please wait CA certificate CN=Certificate Authority,O=IPA.LOCAL 201809261455 in /tmp/ipa.p7 is not valid: certutil: certificate is invalid: The certificate was signed using a signature algorithm that is disabled because it is not secure. Fixes: https://pagure.io/freeipa/issue/7761 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2554/head:pr2554 git checkout pr2554

2 1

[freeipa PR#2543][opened] Fedora 29: Fix pylint 2.1.1 violations
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2543 Author: tiran Title: #2543: Fedora 29: Fix pylint 2.1.1 violations Action: opened PR body: """ * Ignore W504 code style like in travis config * Address pylint violations in lite-server * Address inconsistent-return-statements * Ignore consider-using-enumerate for now * Address consider-using-in * Fix comparison-with-callable * Fix useless-import-alias * Fix Module 'pytest' has no 'config' member * Fix various dict related pylint warnings * Fix raising-format-tuple * Silence comparison-with-itself in tests See: https://pagure.io/freeipa/issue/7758 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2543/head:pr2543 git checkout pr2543

1 1

[freeipa PR#2545][opened] ipatests: update tests for ipa-server-certinstall
by flo-renaud 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2545 Author: flo-renaud Title: #2545: ipatests: update tests for ipa-server-certinstall Action: opened PR body: """ 1. The test test_http_intermediate_ca was expecting success when it should expect a failure. Scenario: - install IPA ca-less with certs signed by rootCA - call ipa-server-certinstall with a cert signed by a subCA to replace http cert. In this case, the command should refuse changing the cert (otherwise the clients won't be able any more to use ipa * commands as the subca is not installed in /etc/ipa/nssdb or in /etc/ipa/ca.crt). The commit fixes the test expectation and marks the test as xfail (see ticket 7759). 2. The test test_ds_intermediate_ca was expecting success when it should expect a failure. Same scenario as above, but for the ldap server cert. The commit fixes the test expectation and removes the xfail (ticket 6959 was closed as invalid). Note: The behavior differs for ldap and http cert because LDAP server is using a NSSDB and http server is using openssl, hence ipa-server-certinstall follows 2 different code paths when changing the server cert. Related to https://pagure.io/freeipa/issue/7759 Related to https://pagure.io/freeipa/issue/6959 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2545/head:pr2545 git checkout pr2545

2 1

[freeipa PR#2555][opened] [Backport][ipa-4-7] Add support for multiple certificates/formats to ipa-cacert-manage
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2555 Author: tiran Title: #2555: [Backport][ipa-4-7] Add support for multiple certificates/formats to ipa-cacert-manage Action: opened PR body: """ This PR was opened automatically because PR #2465 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2555/head:pr2555 git checkout pr2555

1 1

[freeipa PR#2552][opened] ipatests: add missing tests for test_caless
by flo-renaud 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2552 Author: flo-renaud Title: #2552: ipatests: add missing tests for test_caless Action: opened PR body: """ Two tests were missing from nightly definition: - test_caless.py::TestReplicaCALessToCAFull - test_caless.py::TestServerCALessToExternalCA Related to https://pagure.io/freeipa/issue/7743 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2552/head:pr2552 git checkout pr2552

2 1

[freeipa PR#2530][opened] Fix ipa user-add --radius=radiusserver
by flo-renaud 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2530 Author: flo-renaud Title: #2530: Fix ipa user-add --radius=radiusserver Action: opened PR body: """ ## ipa user-add: add optional objectclass for radius-username The command `ipa user-add --radius-username` fails with `ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed` because it does not add the objectclass ipatokenradiusproxyuser that is required by the attribute ipatokenradiususername. The issue happens with `ipa user-add / stageuser-add / user-mod / stageuser-mod`. The fix adds the objectclass when needed in the pre_common_callback method of baseuser_add and baseuser_mod (ensuring that user and stageuser commands are fixed). Also add a xmlrpc unit test for `ipa user-add|mod --radius-username` Fixes https://pagure.io/freeipa/issue/7569 ## radiusproxy: add permission for reading radius proxy servers A non-admin user which has the `User Administrator` role cannot add a user with `ipa user-add --radius=<proxy>` because the call needs to read the radius proxy server entries. The fix adds a System permission for reading radius proxy server entries (all attributes except the ipatokenradiussecret). This permission is added to the already existing privileges `User Administrators` and `Stage User Administrators`, so that the role `User Administrator` can call `ipa [stage]user-add|mod --radius=<proxy>` Also add an integration test for the following scenario: - create a user with the "User Administrator" role - as this user, create a user with a --radius=<radius_proxy_server> Fixes: https://pagure.io/freeipa/issue/7570 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2530/head:pr2530 git checkout pr2530

2 1

[freeipa PR#2312][opened] Support the 1.4.x 389-DS Python installer
by tiran 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2312 Author: tiran Title: #2312: Support the 1.4.x 389-DS Python installer Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2312/head:pr2312 git checkout pr2312

1 1

[freeipa PR#2550][opened] ipatests: fix CA less expectations
by flo-renaud 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2550 Author: flo-renaud Title: #2550: ipatests: fix CA less expectations Action: opened PR body: """ The test TestServerInstall::test_ca_2_certs has a wrong expectation. Scenario: install a CA-less master with `ipa-server-install --ca-cert-file root.pem` where root.pem contains the CA that signed the http and ldap certificates + an additional (unneeded) CA cert. The test was expecting a failure, but this scenario is not problematic as long as the unneeded CA cert is not added. Related to https://pagure.io/freeipa/issue/6289 which has been closed as won't fix """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2550/head:pr2550 git checkout pr2550

2 1

[freeipa PR#2465][opened] Add support for multiple certificates/formats to ipa-cacert-manage
by rcritten 13 Nov '18

13 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2465 Author: rcritten Title: #2465: Add support for multiple certificates/formats to ipa-cacert-manage Action: opened PR body: """ Add support for multiple certificates/formats to ipa-cacert-manage Only a single cert in DER or PEM format would be loaded from the provided file. Extend this to include PKCS#7 format and load all certificates found in the file. Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> https://pagure.io/freeipa/issue/7579 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2465/head:pr2465 git checkout pr2465

2 1

How to modify a base image which FreeIPA-PR-CI uses for testing
by Petr Vobornik 12 Nov '18

12 Nov '18

Hello, There were couple questions about how a creation of template boxes which are used in tests works, respectively how the boxes can be amended. So I'll try to cover it in this mail so that it is reusable in the future. FreeIPA PR-CI is using vagrant to provision vms. So the base image is Vagrant libvirt box. Boxes for Fedora are based on Fedora-Cloud-Base-Vagrant-$VERSION-*x86_64.vagrant-libvirt.box boxes which are being produced by Fedora project. The box name is defined in ansible/vars/fedora dir for each version of Fedora, see: https://github.com/freeipa/freeipa-pr-ci/tree/master/ansible/vars/fedora FreeIPA base images are generated by utility 'create-template-box' ( https://github.com/freeipa/freeipa-pr-ci/blob/master/create-template-box ) which basically runs ansible/create_template_box.yml playbook ( https://github.com/freeipa/freeipa-pr-ci/blob/master/ansible/create_templat… ) This playbook has 4 steps: 1. Creating of template box from a base image - defined by box/prepare ansible role 2. Doing some workarounds 3. Modifying the template box (use case of this mail). This is defined by Ansible roles: "builder" and "machine". Let's skip builder and focus on a test machine see ansible/roles/mahine/tasks/main.yml 4. Uploading of the template box to VagrantCloud - defined by box/package ansible role With machine role, be careful that it also contains roles: machine/provision and machine/provision_ipaserver. These two are executed in each test job execution (defined in Vagrantfile matching a topology). So for box preparation see roles defined in the machine/tasks/main.yml: 1. machine/setup 2. machine/workarounds 3. machine/cleanup If our use case is adding an rpm dependency to a box itself, e.g. firewalld, then the file to modify is: machine/setup/tasks/install_packages.yml https://github.com/freeipa/freeipa-pr-ci/blob/master/ansible/roles/machine/… If our use case is to install a dependency in each tests (usually not preferred) then the file to modify is: machine/provision/tasks/main.yml https://github.com/freeipa/freeipa-pr-ci/blob/master/ansible/roles/machine/… So from a practical perspective, the workflow should be: 1. anybody can do the required changes in "ansible/roles/machine/setup/tasks/$SOMETHING.yml" ansible files. Then open a pull request on freeipa/freeipa-pr-ci GitHub project https://github.com/freeipa/freeipa-pr-ci/pulls 2. FreeIPA-PR-CI team (currently mostly f-trivino, dhnunes and netoarmando) will review the PR and merge if it is OK 3. anybody authorized (dedicated by team and has credentials, mostly the same group as in #2) to upload new images to Vagrant cloud will run create-template-box with the expected parameters 4. the image must be tested (at least couple runs of gating and some nightly) if it is OK 5. to use in gating and nighlies, new version of the box (provided that previous existed) needs to be specified in prci.yaml files (nighly_master.yaml, gating.yaml) by changing the name of the template (usually in build job, rest refers to it). HTH -- Petr Vobornik

1 1

[freeipa PR#2502][opened] Fix behaviour when the random node is chosen during the replica
by shaman007 12 Nov '18

12 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2502 Author: shaman007 Title: #2502: Fix behaviour when the random node is chosen during the replica Action: opened PR body: """ installation, not the one that is defined in the --server option """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2502/head:pr2502 git checkout pr2502

1 1

[freeipa PR#2549][opened] [Backport][ipa-4-7] certdb: ensure non-empty Subject Key Identifier
by tiran 12 Nov '18

12 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2549 Author: tiran Title: #2549: [Backport][ipa-4-7] certdb: ensure non-empty Subject Key Identifier Action: opened PR body: """ This PR was opened automatically because PR #2548 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2549/head:pr2549 git checkout pr2549

1 1

[freeipa PR#2538][opened] Split Web UI test suite in nightly PR CI configuration
by serg-cymbaluk 12 Nov '18

12 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2538 Author: serg-cymbaluk Title: #2538: Split Web UI test suite in nightly PR CI configuration Action: opened PR body: """ Ticket: https://pagure.io/freeipa/issue/7756 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2538/head:pr2538 git checkout pr2538

1 1

[freeipa PR#2548][opened] certdb: ensure non-empty Subject Key Identifier
by frasertweedale 12 Nov '18

12 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2548 Author: frasertweedale Title: #2548: certdb: ensure non-empty Subject Key Identifier Action: opened PR body: """ Installation or IPA CA renewal with externally-signed CA accepts an IPA CA certificate with empty Subject Key Identifier. This is technically legal in X.509, but is an operational issue. Furthermore, due to an extant bug in Dogtag (https://pagure.io/dogtagpki/issue/3079) it will cause Dogtag startup failure. Reject CA certificates with empty Subject Key Identifier. Fixes: https://pagure.io/freeipa/issue/7762 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2548/head:pr2548 git checkout pr2548

2 1

[freeipa PR#2546][opened] [Backport][ipa-4-7] Add sysadm_r to default SELinux user map order
by rcritten 12 Nov '18

12 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2546 Author: rcritten Title: #2546: [Backport][ipa-4-7] Add sysadm_r to default SELinux user map order Action: opened PR body: """ This PR was opened automatically because PR #2544 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2546/head:pr2546 git checkout pr2546

2 1

[freeipa PR#2533][opened] [testing_master] Nightly PR
by freeipa-pr-ci 09 Nov '18

09 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2533 Author: freeipa-pr-ci Title: #2533: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2533/head:pr2533 git checkout pr2533

1 1

[freeipa PR#2544][opened] Add sysadm_r to default SELinux user map order
by fcami 09 Nov '18

09 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2544 Author: fcami Title: #2544: Add sysadm_r to default SELinux user map order Action: opened PR body: """ It is a standard SELinux user role included in RHEL (like user_r, staff_r, guest_r) and used quite often. See: https://pagure.io/freeipa/issue/7658 So far the upgrade process is not covered, only new install. I suppose a file like ./install/updates/50-ipaconfig.update has to be created for upgrades to be covered. Without the change to the ldif: SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 New install with the change to the ldif: SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$sysadm_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2544/head:pr2544 git checkout pr2544

2 1

[freeipa PR#2540][opened] Nightly test definition: remove redundant and add missing tests
by flo-renaud 09 Nov '18

09 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2540 Author: flo-renaud Title: #2540: Nightly test definition: remove redundant and add missing tests Action: opened PR body: """ ## Nightly tests: remove tests already executed in gating Remove tests from nightly_master and nightly_rawhide as they are already executed in gating: - test_caless.py::TestServerReplicaCALessToCAFull - test_replica_promotion.py::TestSubCAkeyReplication ## Nightly tests: add test_user_permissions.py Run the above test in the nightly test suites Related to https://pagure.io/freeipa/issue/7743 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2540/head:pr2540 git checkout pr2540

2 1

Gating and nightly tests
by Florence Blanc-Renaud 09 Nov '18

09 Nov '18

Hi Developers, Currently our test suite contains 3 different test sets: - gating: executed on each pull request - nightly_master: executed monday, wednesday, friday - nightly_rawhide: not executed Some tests are part of both gating and nightly, but that is an exception. The majority of gating tests are not part of nightly, and this was a choice done earlier in the project. Christian raised a concern with this decision (see https://github.com/freeipa/freeipa/pull/2540#issuecomment-437078271) and would like nightly to also contain all the gating tests. So what's your opinion on this? Should we keep gating and nightly disjoint or make gating a subset of nightly? I don't have any strong opinion on this, except that we should be consistent... flo

4 3

[freeipa PR#2539][opened] [Backport][ipa-4-7] Fix test_cli_fsencoding on Python 3.7, take 2
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2539 Author: tiran Title: #2539: [Backport][ipa-4-7] Fix test_cli_fsencoding on Python 3.7, take 2 Action: opened PR body: """ This PR was opened automatically because PR #2532 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2539/head:pr2539 git checkout pr2539

1 1

[freeipa PR#2541][opened] [Backport][ipa-4-7] Replace messagebus with modern name dbus
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2541 Author: tiran Title: #2541: [Backport][ipa-4-7] Replace messagebus with modern name dbus Action: opened PR body: """ This PR was opened automatically because PR #2531 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2541/head:pr2541 git checkout pr2541

1 1

[freeipa PR#2500][opened] Check omitted tests
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2500 Author: tiran Title: #2500: Check omitted tests Action: opened PR body: """ Let's see if the omitted tests are still working at all. See: https://pagure.io/freeipa/issue/7743 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2500/head:pr2500 git checkout pr2500

1 1

[freeipa PR#2531][opened] Replace messagebus with modern name dbus
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2531 Author: tiran Title: #2531: Replace messagebus with modern name dbus Action: opened PR body: """ "messagebus" is an old, archaic name for dbus. Upstream dbus has started to move away from the old name. Let's use the modern term in FreeIPA, too. Fixes: https://pagure.io/freeipa/issue/7754 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2531/head:pr2531 git checkout pr2531

1 1

[freeipa PR#2532][opened] Fix test_cli_fsencoding on Python 3.7, take 2
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2532 Author: tiran Title: #2532: Fix test_cli_fsencoding on Python 3.7, take 2 Action: opened PR body: """ 0a5a7bdef7c300cb8f8a8128ce6cf5b115683cbe introduced another problem. The test is now failing on systems without a full IPA client or server installation. Use IPA_CONFDIR env var to override location of default.conf, so that the command always fails. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2532/head:pr2532 git checkout pr2532

1 1

[freeipa PR#2536][opened] [Backport][ipa-4-7] Copy-paste error in permssions plugin, CID 323649
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2536 Author: tiran Title: #2536: [Backport][ipa-4-7] Copy-paste error in permssions plugin, CID 323649 Action: opened PR body: """ This PR was opened automatically because PR #2535 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2536/head:pr2536 git checkout pr2536

1 1

[freeipa PR#2537][opened] [Backport][ipa-4-6] Copy-paste error in permssions plugin, CID 323649
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2537 Author: tiran Title: #2537: [Backport][ipa-4-6] Copy-paste error in permssions plugin, CID 323649 Action: opened PR body: """ This PR was opened automatically because PR #2535 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2537/head:pr2537 git checkout pr2537

1 1

Font Awesome icon
by Serhii Tsymbaliuk 08 Nov '18

08 Nov '18

Hello, I'm going to create an issue for Font Awesome project to include our icon to the their collection (https://github.com/FortAwesome/Font-Awesome/issues) This two icons will be attached to this issue. First one as original image and second as FA icon. I have been trying to make contrast between green and blue parts of logo but stopped at the simplest option because it is closer to FA style. Please give me a feedback, is it ok or not. Also if someone has any remarks, please, post it. Related issue: https://pagure.io/freeipa/issue/7633 -- Serhii Tsymbaliuk Software Engineer Red Hat Czech s.r.o.

2 1

[freeipa PR#2535][opened] Copy-paste error in permssions plugin, CID 323649
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2535 Author: tiran Title: #2535: Copy-paste error in permssions plugin, CID 323649 Action: opened PR body: """ Address a bug in the code block for attributeLevelRights for old clients. The backward compatibility code for deprecated options was not triggered, because the new name was checked against wrong dict. Coverity Scan issue 323649, Copy-paste error The copied code will not have its intended effect. In postprocess_result: A copied piece of code is inconsistent with the original (CWE-398) See: Fixes: https://pagure.io/freeipa/issue/7753 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2535/head:pr2535 git checkout pr2535

1 1

[freeipa PR#2534][opened] [Backport]]ipa-4-7] ipaserver.install.adtrust: fix CID 323644
by abbra 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2534 Author: abbra Title: #2534: [Backport]]ipa-4-7] ipaserver.install.adtrust: fix CID 323644 Action: opened PR body: """ This is a manual backport to account for Python 2.7 differences. Fix Coverity finding CID 323644: logically dead code path The code to determine whether NetBIOS name was already set or need to be set after deriving it from a domain or asking a user for an interactive input, was refactored at some point to avoid retrieving the whole LDAP entry. Instead, it was provided with the actual NetBIOS name retrieved. As result, a part of the code got neglected and was never executed. Fix this code and provide a test that tries to test predefined, interactively provided and automatically derived NetBIOS name depending on how the installer is being run. We mock up the actual execution so that no access to LDAP or Samba is needed. Backport to ipa-4-7 takes into account Python 2.7 differences: - uses mock instead of unittest.mock if the latter is not available - derives ApiMockup from object Fixes: https://pagure.io/freeipa/issue/7753 Reviewed-By: Christian Heimes <cheimes(a)redhat.com> (cherry picked from commit 82af034023b03ae64f005c8160b9e961e7b9fd55) """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2534/head:pr2534 git checkout pr2534

2 1

[freeipa PR#2529][opened] [Backport][ipa-4-7] ipaserver.install.adtrust: fix CID 323644
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2529 Author: tiran Title: #2529: [Backport][ipa-4-7] ipaserver.install.adtrust: fix CID 323644 Action: opened PR body: """ This PR was opened automatically because PR #2522 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2529/head:pr2529 git checkout pr2529

2 1

[freeipa PR#2526][opened] Increase memory size for ipaserver topology (nightly-master.yaml)
by serg-cymbaluk 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2526 Author: serg-cymbaluk Title: #2526: Increase memory size for ipaserver topology (nightly-master.yaml) Action: opened PR body: """ Trying to fix "Cannot allocate memory" error for Web UI tests """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2526/head:pr2526 git checkout pr2526

2 1

[freeipa PR#2528][opened] [Backport][ipa-4-6] Allow ipaapi user to access SSSD's info pipe
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2528 Author: tiran Title: #2528: [Backport][ipa-4-6] Allow ipaapi user to access SSSD's info pipe Action: opened PR body: """ Manual backport of PR #2515 For smart card authentication, ipaapi must be able to access to sss-ifp. During installation and upgrade, the ipaapi user is now added to [ifp]allowed_uids. The commit also fixes two related issues: * The server upgrade code now enables ifp service in sssd.conf. The existing code modified sssd.conf but never wrote the changes to disk. * sssd_enable_service() no longer fails after it has detected an unrecognized service. Fixes: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2528/head:pr2528 git checkout pr2528

1 1

[freeipa PR#2527][opened] [Backport][ipa-4-7] Allow ipaapi user to access SSSD's info pipe
by tiran 08 Nov '18

08 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2527 Author: tiran Title: #2527: [Backport][ipa-4-7] Allow ipaapi user to access SSSD's info pipe Action: opened PR body: """ Manual backport of PR #2515 For smart card authentication, ipaapi must be able to access to sss-ifp. During installation and upgrade, the ipaapi user is now added to [ifp]allowed_uids. The commit also fixes two related issues: * The server upgrade code now enables ifp service in sssd.conf. The existing code modified sssd.conf but never wrote the changes to disk. * sssd_enable_service() no longer fails after it has detected an unrecognized service. Fixes: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2527/head:pr2527 git checkout pr2527

1 1

[freeipa PR#2510][opened] [testing_master] Nightly PR
by freeipa-pr-ci 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2510 Author: freeipa-pr-ci Title: #2510: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2510/head:pr2510 git checkout pr2510

1 1

[freeipa PR#2522][opened] ipaserver.install.adtrust: fix CID 323644
by abbra 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2522 Author: abbra Title: #2522: ipaserver.install.adtrust: fix CID 323644 Action: opened PR body: """ Fix Coverity finding CID 323644: logically dead code path The code to determine whether NetBIOS name was already set or need to be set after deriving it from a domain or asking a user for an interactive input, was refactored at some point to avoid retrieving the whole LDAP entry. Instead, it was provided with the actual NetBIOS name retrieved. As result, a part of the code got neglected and was never executed. Fix this code and provide a test that tries to test predefined, interactively provided and automatically derived NetBIOS name depending on how the installer is being run. We mock up the actual execution so that no access to LDAP or Samba is needed. Fixes: https://pagure.io/freeipa/issue/7753 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2522/head:pr2522 git checkout pr2522

2 1

[freeipa PR#2515][opened] Allow ipaapi user to access SSSD's info pipe
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2515 Author: tiran Title: #2515: Allow ipaapi user to access SSSD's info pipe Action: opened PR body: """ For smart card authentication, ipaapi must be able to access to sss-ifp. During installation and upgrade, the ipaapi user is now added to [ifp]allowed_uids. The commit also fixes two related issues: * The server upgrade code now enables ifp service in sssd.conf. The existing code modified sssd.conf but never wrote the changes to disk. * sssd_enable_service() no longer fails after it has detected an unrecognized service. Fixes: https://pagure.io/freeipa/issue/7751 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2515/head:pr2515 git checkout pr2515

1 1

[freeipa PR#2525][opened] [Backport][ipa-4-7] ipatests: add test for ipa-advise for enabling sudo for admins group
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2525 Author: tiran Title: #2525: [Backport][ipa-4-7] ipatests: add test for ipa-advise for enabling sudo for admins group Action: opened PR body: """ This PR was opened automatically because PR #2494 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2525/head:pr2525 git checkout pr2525

1 1

[freeipa PR#2524][opened] [Backport][ipa-4-7] Fix test_cli_fsencoding on Python 3.7
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2524 Author: tiran Title: #2524: [Backport][ipa-4-7] Fix test_cli_fsencoding on Python 3.7 Action: opened PR body: """ This PR was opened automatically because PR #2523 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2524/head:pr2524 git checkout pr2524

1 1

[freeipa PR#2512][opened] [Backport][ipa-4-7] ipaldap: avoid invalid modlist when attribute encoding differs
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2512 Author: tiran Title: #2512: [Backport][ipa-4-7] ipaldap: avoid invalid modlist when attribute encoding differs Action: opened PR body: """ This PR was opened automatically because PR #2511 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2512/head:pr2512 git checkout pr2512

1 1

[freeipa PR#2518][opened] [Backport][ipa-4-7] rpc: always read response
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2518 Author: tiran Title: #2518: [Backport][ipa-4-7] rpc: always read response Action: opened PR body: """ This PR was opened automatically because PR #2517 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2518/head:pr2518 git checkout pr2518

1 1

[freeipa PR#2507][opened] [Backport][ipa-4-7] Fixes for more issues found by coverity
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2507 Author: tiran Title: #2507: [Backport][ipa-4-7] Fixes for more issues found by coverity Action: opened PR body: """ This PR was opened automatically because PR #2505 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2507/head:pr2507 git checkout pr2507

1 1

[freeipa PR#2494][opened] ipatests: add test for ipa-advise for enabling sudo for admins group
by wladich 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2494 Author: wladich Title: #2494: ipatests: add test for ipa-advise for enabling sudo for admins group Action: opened PR body: """ Test that 1) sudo is not enabled for members of admins group by default 2) sudo is enabled for them after execution of script provided by ipa-advise enable_admins_sudo Related to https://pagure.io/freeipa/issue/7538 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2494/head:pr2494 git checkout pr2494

2 1

[freeipa PR#2519][opened] [Backport][ipa-4-6] rpc: always read response
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2519 Author: tiran Title: #2519: [Backport][ipa-4-6] rpc: always read response Action: opened PR body: """ This PR was opened automatically because PR #2517 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2519/head:pr2519 git checkout pr2519

1 1

[freeipa PR#2523][opened] Fix test_cli_fsencoding on Python 3.7
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2523 Author: tiran Title: #2523: Fix test_cli_fsencoding on Python 3.7 Action: opened PR body: """ Starting with Python 3.7, PEP 538 addresses the locale issue. Python now supports UTF-8 file system encoding with non-UTF-8 C locale. See: https://docs.python.org/3/whatsnew/3.7.html#whatsnew37-pep538 See: https://pagure.io/freeipa/issue/5887 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2523/head:pr2523 git checkout pr2523

1 1

[freeipa PR#2520][opened] [Backport][ipa-4-7] Restore KRA clone installation integration test
by tiran 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2520 Author: tiran Title: #2520: [Backport][ipa-4-7] Restore KRA clone installation integration test Action: opened PR body: """ Manual backport of PR #2436 * Restore KRA clone installation integration test * Require Dogtag 10.6.7-3 Travis CI on 4.7 is failing with Dogtag 10.6.6. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2520/head:pr2520 git checkout pr2520

1 1

[freeipa PR#2517][opened] rpc: always read response
by frasertweedale 07 Nov '18

07 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2517 Author: frasertweedale Title: #2517: rpc: always read response Action: opened PR body: """ If the server responds 401 and the response body is empty, the client raises ResponseNotReady. This occurs because: 1. For a non-200 response, the response read only if the Content-Length header occurs. 2. The response must be read before another request (e.g. the follow-up request with WWW-Authenticate header set), and this condition was not met. For details see https://github.com/python/cpython/blob/v3.6.7/Lib/http/client.py#L1305-L1321. This situation should not arise in regular use, because the client either has a session cookie, or, knowing the details of the server it is contacting, it establishes the GSS-API context and includes the WWW-Authenticate header in the initial request. Nevertheless, this problem has been observed in the wild. I do not know its ordinary cause(s), but one can force the issue by removing an authenticated user's session cache from /run/ipa/ccaches, then performing a request. Resolve the issue by always reading the response. It is safe to call response.read() regardless of whether the Content-Length header appears, or whether the body is empty. Fixes: https://pagure.io/freeipa/issue/7752 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2517/head:pr2517 git checkout pr2517

2 1

[freeipa PR#2514][opened] [Backport][ipa-4-5] ipaldap: avoid invalid modlist when attribute encoding differs
by tiran 06 Nov '18

06 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2514 Author: tiran Title: #2514: [Backport][ipa-4-5] ipaldap: avoid invalid modlist when attribute encoding differs Action: opened PR body: """ This PR was opened automatically because PR #2511 was pushed to master and backport to ipa-4-5 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2514/head:pr2514 git checkout pr2514

1 1

[freeipa PR#2513][opened] [Backport][ipa-4-6] ipaldap: avoid invalid modlist when attribute encoding differs
by tiran 06 Nov '18

06 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2513 Author: tiran Title: #2513: [Backport][ipa-4-6] ipaldap: avoid invalid modlist when attribute encoding differs Action: opened PR body: """ This PR was opened automatically because PR #2511 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2513/head:pr2513 git checkout pr2513

1 1

[freeipa PR#2506][opened] [Backport][ipa-4-7] Display succesful install message when ipa-replica-install completes
by tiran 06 Nov '18

06 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2506 Author: tiran Title: #2506: [Backport][ipa-4-7] Display succesful install message when ipa-replica-install completes Action: opened PR body: """ This PR was opened automatically because PR #2503 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2506/head:pr2506 git checkout pr2506

1 1

[freeipa PR#2508][opened] [Backport][ipa-4-6] Fixes for more issues found by coverity
by tiran 06 Nov '18

06 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2508 Author: tiran Title: #2508: [Backport][ipa-4-6] Fixes for more issues found by coverity Action: opened PR body: """ This PR was opened automatically because PR #2505 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2508/head:pr2508 git checkout pr2508

1 1

[freeipa PR#2511][opened] ipaldap: avoid invalid modlist when attribute encoding differs
by frasertweedale 06 Nov '18

06 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2511 Author: frasertweedale Title: #2511: ipaldap: avoid invalid modlist when attribute encoding differs Action: opened PR body: """ ipaldap does not take into account the possibility of the attribute encoding returned by python-ldap differing from the attribute encoding produced by FreeIPA. In particular this can occur with DNs with special characters that require escaping. For example, python-ldap (or the underlying LDAP library) escapes special characters using hex encoding: ``` CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU ``` Whereas FreeIPA, when encoding the DN, escapes the character directly: ``` CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU ``` Therefore it is possible to generate an invalid modlist. For example, during external CA certificate renewal, if the issuer DN includes a comma in one of the attribute values (as above), an invalid modlist will be generated: ``` [ (ldap.MOD_ADD, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU']) , (ldap.MOD_DELETE, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU']) ] ``` Although encoded differently, these are the same value. If this modification is applied to the object, attributeOrValueExists (error 20) occurs. To avoid the issue, put deletes before adds in the modlist. If a value is present (with different encodings) as both an addition and a deletion, it must be because the original object contained the value with a different encoding. Therefore it is safe to delete it, then add it back. Note that the modlist is not optimal. In the simplest case (like above example), there should be no modification to perform. It is considerably more complex (and more computation) to implement this because the raw attribute values must be decoded before comparison. Fixes: https://pagure.io/freeipa/issue/7750 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2511/head:pr2511 git checkout pr2511

2 1

[freeipa PR#2509][opened] [testing_master] Nightly PR
by freeipa-pr-ci 05 Nov '18

05 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2509 Author: freeipa-pr-ci Title: #2509: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2509/head:pr2509 git checkout pr2509

1 1

[freeipa PR#2504][opened] [testing_master] Nightly PR
by freeipa-pr-ci 02 Nov '18

02 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2504 Author: freeipa-pr-ci Title: #2504: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2504/head:pr2504 git checkout pr2504

1 1

Ticket cleanup
by Rob Crittenden 02 Nov '18

02 Nov '18

You may notice that over the next few weeks a LOT of issues on https://pagure.io/freeipa will close. Most of them fall into one or buckets: * seems like a good idea but we'll never get to it due to other priorities * is a great idea but is incredibly complex and we'll never get to it * was a fantastic idea and we fixed it in a duplicate issue * a bug that no longer applies or is against an unsupported version * a small percentage will be something else If we close one in error then please don't hesitate to comment in the issue. The goal is to get the number of issues down to a size we actually have a capacity to address. regards rob

1 0

[freeipa PR#2505][opened] Fixes for more issues found by coverity
by tiran 01 Nov '18

01 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2505 Author: tiran Title: #2505: Fixes for more issues found by coverity Action: opened PR body: """ * ipa_krb5_free_key_data: avoid double free * ipadb_mspac_get_trusted_domains: NULL ptr deref * ipapwd_pre_mod: NULL ptr deref See https://pagure.io/freeipa/issue/7738 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2505/head:pr2505 git checkout pr2505

1 1

[freeipa PR#2503][opened] Display succesful install message when ipa-replica-install completes
by rcritten 01 Nov '18

01 Nov '18

URL: https://github.com/freeipa/freeipa/pull/2503 Author: rcritten Title: #2503: Display succesful install message when ipa-replica-install completes Action: opened PR body: """ Commit b96906156be37a7b29ee74423b82f04070c84e22 enabled better output logging for ipa-server-install. This includes displaying at the end: The ipa-server-install command was successful Do the same for ipa-replica-install This also contains a fix for an issue hidden by the previous logging configuration. https://pagure.io/freeipa/issue/7408 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2503/head:pr2503 git checkout pr2503

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel November 2018