February 2018 - FreeIPA-devel - Fedora Mailing-Lists

[freeipa PR#1529][opened] ipa-kdb: update trust information in all workers

by sumit-bose

URL: https://github.com/freeipa/freeipa/pull/1529 Author: sumit-bose Title: #1529: ipa-kdb: update trust information in all workers Action: opened PR body: """ Currently there is already code to make sure that after trust is established an AS-REQ of the local HTTP principal causes a refresh of the internal structures holding the information about the trusted domains. But this refreshes only the data of the current krb5kdc worker process on the local host. Other workers and the KDCs on other hosts will update the data eventually when a request with a principal from a trusted realm is handled. During this phase, which might last quite long if remote principals are only handled rarely, TGTs for local principals might or might not contain a PAC because the decision if a PAC should be added or not is based on the information about trusted domains. Since the PAC is needed to access services on the AD side this access might fail intermittently depending which worker process on which host is handling the request. This might e.g. affect SSSD running on the IPA server with two-way trust. To fix this this patch calls ipadb_reinit_mspac() whenever a PAC is needed but without the 'force' flag so that the refresh will only happen if it wasn't called recently (currently not more often than once a minute). An alternative might be to do the refresh only when processing cross-realm TGT requests. But this would be already too late because the local principal asking for a cross-realm ticket would not have a PAC and hence the first attempt will still fail due to the missing PAC. And injecting the PAC in the cross-realm TGT while there is none in the requesting ticket does not sound right. Related to https://pagure.io/freeipa/issue/7351 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1529/head:pr1529 git checkout pr1529

6 years, 2 months

2
1
0 / 0

[freeipa PR#1549][opened] [Backport][ipa-4-6] Update existing 389-DS cn=RSA, cn=encryption config

by tiran

URL: https://github.com/freeipa/freeipa/pull/1549 Author: tiran Title: #1549: [Backport][ipa-4-6] Update existing 389-DS cn=RSA,cn=encryption config Action: opened PR body: """ This PR was opened automatically because PR #1547 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1549/head:pr1549 git checkout pr1549

6 years, 2 months

1
1
0 / 0

[freeipa PR#1522][opened] Restart named-pkcs11 after KRA installation

by tiran

URL: https://github.com/freeipa/freeipa/pull/1522 Author: tiran Title: #1522: Restart named-pkcs11 after KRA installation Action: opened PR body: """ KRA installer restarts 389-DS, which disrupts named-pkcs11 bind-dyndb-ldap for a short while. Restart named-pkcs11 to fix DNS resolver. Fixes: https://pagure.io/freeipa/issue/5813 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1522/head:pr1522 git checkout pr1522

6 years, 2 months

1
1
0 / 0

[freeipa PR#1548][opened] [Backport][ipa-4-6] Update IPA CA issuer DN upon renewal

by tiran

URL: https://github.com/freeipa/freeipa/pull/1548 Author: tiran Title: #1548: [Backport][ipa-4-6] Update IPA CA issuer DN upon renewal Action: opened PR body: """ This PR was opened automatically because PR #1503 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1548/head:pr1548 git checkout pr1548

6 years, 2 months

1
1
0 / 0

[freeipa PR#1547][opened] Update existing 389-DS cn=RSA, cn=encryption config

by tiran

URL: https://github.com/freeipa/freeipa/pull/1547 Author: tiran Title: #1547: Update existing 389-DS cn=RSA,cn=encryption config Action: opened PR body: """ 389-DS >= 1.4.0 on Fedora 28 has a default entry for cn=RSA,cn=encryption,cn=config. The installer now updates the entry in case it already exists. This ensures that token and personality are correct for freeIPA Fixes: https://pagure.io/freeipa/issue/7393 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1547/head:pr1547 git checkout pr1547

6 years, 2 months

1
1
0 / 0

[freeipa PR#1546][opened] [Backport][ipa-4-6] Fix detection of KRA installation so upgrades can succeed

by tiran

URL: https://github.com/freeipa/freeipa/pull/1546 Author: tiran Title: #1546: [Backport][ipa-4-6] Fix detection of KRA installation so upgrades can succeed Action: opened PR body: """ This PR was opened automatically because PR #1517 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1546/head:pr1546 git checkout pr1546

6 years, 2 months

1
1
0 / 0

[freeipa PR#1503][closed] Update IPA CA issuer DN upon renewal

by tiran

URL: https://github.com/freeipa/freeipa/pull/1503 Author: frasertweedale Title: #1503: Update IPA CA issuer DN upon renewal Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1503/head:pr1503 git checkout pr1503

6 years, 2 months

1
0
0 / 0

[freeipa PR#1545][opened] [Backport][ipa-4-6] Bump python-ldap version to fix syncrepl bug

by tiran

URL: https://github.com/freeipa/freeipa/pull/1545 Author: tiran Title: #1545: [Backport][ipa-4-6] Bump python-ldap version to fix syncrepl bug Action: opened PR body: """ This PR was opened automatically because PR #1530 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1545/head:pr1545 git checkout pr1545

6 years, 2 months

1
1
0 / 0

[freeipa PR#980][opened] [WIP][tests] Replica Promotion improvements

by Akasurde

URL: https://github.com/freeipa/freeipa/pull/980 Author: Akasurde Title: #980: [WIP][tests] Replica Promotion improvements Action: opened PR body: """ * Change string check in replica install at domain level 0 Fixes: https://pagure.io/freeipa/issue/7104 Signed-off-by: Abhijeet Kasurde <akasurde(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/980/head:pr980 git checkout pr980

6 years, 2 months

2
3
0 / 0

[freeipa PR#1544][opened] [Backport][ipa-4-6] ipa-kdb: use magic value to check if ipadb is used

by tiran

URL: https://github.com/freeipa/freeipa/pull/1544 Author: tiran Title: #1544: [Backport][ipa-4-6] ipa-kdb: use magic value to check if ipadb is used Action: opened PR body: """ Manual backport of PR #1537 The certauth plugin is configured in /etc/krb5.conf independently form the database module. As a result the IPA certauth plugin can be added to the configuration without the IPA DAL driver. Since the IPA certauth plugin depends on the presence of the IPA DAL driver this patch adds a magic value at the beginning of struct ipadb_context which can be checked to see if the IPA DAL driver is properly initialized. Resolves https://pagure.io/freeipa/issue/7261 Reviewed-By: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1544/head:pr1544 git checkout pr1544

6 years, 2 months

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel February 2018