June 2018 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2065][opened] BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning
by menonsudhir 21 Aug '19

21 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2065 Author: menonsudhir Title: #2065: BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2065/head:pr2065 git checkout pr2065

1 1

[freeipa PR#1441][opened] Removing ipaCert Private key & certificate after ipa upgrade
by amitkumar50 08 Jul '19

08 Jul '19

URL: https://github.com/freeipa/freeipa/pull/1441 Author: amitkumar50 Title: #1441: Removing ipaCert Private key & certificate after ipa upgrade Action: opened PR body: """ `# yum install ipa-server -y {IPA 4.4}` `# ipa-server-install` `#yum update ipa-* -y` `# ls -ltr /etc/httpd/alias` Presently "-D" option only removes Cert. **`certutil ... -D -n ipaCert`** Using '-F' option to remove Private key and cert both **`certutil ... -F -n ipaCert`** Resolves: https://pagure.io/freeipa/issue/7329 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1441/head:pr1441 git checkout pr1441

2 1

[freeipa PR#919][opened] client.py: Using Augeas to configure krb5.conf
by Tiboris 02 Jul '19

02 Jul '19

URL: https://github.com/freeipa/freeipa/pull/919 Author: Tiboris Title: #919: client.py: Using Augeas to configure krb5.conf Action: opened PR body: """ Using Augeas should avoid issues like https://pagure.io/freeipa/issue/5912. Resolves: https://pagure.io/freeipa/issue/5913 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/919/head:pr919 git checkout pr919

1 1

[freeipa PR#1726][opened] [RFE] IPA server installation with successful message
by amitkumar50 29 Mar '19

29 Mar '19

URL: https://github.com/freeipa/freeipa/pull/1726 Author: amitkumar50 Title: #1726: [RFE] IPA server installation with successful message Action: opened PR body: """ This PR updates IPA success installation message as this: ============================================= IPA server installation successful You can access Web UI using https://ipaserver1.testrelm.test/ipa/ui Obtain a Kerberos Ticket for issuing IPA command 'kinit admin' Server is installed with following roles : * Directory Server * Kerbeors Server * Httpd Server * CA Server * DNS Server For troubleshooting and errors : Please visit : https://www.redhat.com/en For documentation : Please visit : https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Resolves: https://pagure.io/freeipa/issue/6355 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1726/head:pr1726 git checkout pr1726

2 1

[freeipa PR#1843][opened] Allow issuing certificates with IP addresses in subjectAltName (ftweedal)
by frasertweedale 04 Mar '19

04 Mar '19

URL: https://github.com/freeipa/freeipa/pull/1843 Author: frasertweedale Title: #1843: Allow issuing certificates with IP addresses in subjectAltName (ftweedal) Action: opened PR body: """ Continuation of https://github.com/freeipa/freeipa/pull/1700 by @ipilcher, adding commits by @ftweedal. Please keep both PRs open for the time being. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1843/head:pr1843 git checkout pr1843

2 1

[freeipa PR#1883][opened] ipactl: Correction of named to named-pkcs11
by amitkumar50 21 Feb '19

21 Feb '19

URL: https://github.com/freeipa/freeipa/pull/1883 Author: amitkumar50 Title: #1883: ipactl: Correction of named to named-pkcs11 Action: opened PR body: """ Whenever ipactl status is run it returned: Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING ... This PR changes ipactl o/p to: Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named-pkcs11 Service: RUNNING Resolves: https://pagure.io/freeipa/issue/7446 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1883/head:pr1883 git checkout pr1883

2 1

[freeipa PR#2020][opened] [WIP] Remove Python 2 support and packages
by tiran 06 Sep '18

06 Sep '18

URL: https://github.com/freeipa/freeipa/pull/2020 Author: tiran Title: #2020: [WIP] Remove Python 2 support and packages Action: opened PR body: """ Remove Python 2 related code and configuration from spec file, autoconf and CI infrastructure. Fixes: https://pagure.io/freeipa/issue/7568 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2020/head:pr2020 git checkout pr2020

1 1

[freeipa PR#1563][opened] Support the 1.4.x python installer tools in 389-ds
by stlaz 03 Sep '18

03 Sep '18

URL: https://github.com/freeipa/freeipa/pull/1563 Author: stlaz Title: #1563: Support the 1.4.x python installer tools in 389-ds Action: opened PR body: """ Opened on behalf of https://github.com/Firstyear """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1563/head:pr1563 git checkout pr1563

2 1

[freeipa PR#1353][opened] Add script to regenerate Custodia keys and config
by tiran 23 Aug '18

23 Aug '18

URL: https://github.com/freeipa/freeipa/pull/1353 Author: tiran Title: #1353: Add script to regenerate Custodia keys and config Action: opened PR body: """ /usr/libexec/ipa/ipa-custodia-regen can be used to recover from broken ipa-custodia keys and configuration. It removes existing config and server key files, regenerates new files and uploads the new public keys to LDAP. https://pagure.io/freeipa/issue/6893 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1353/head:pr1353 git checkout pr1353

1 1

[freeipa PR#2074][opened] Check if user permssions and umask 0022 is set when executing ipa-restore
by mrizwan93 31 Jul '18

31 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2074 Author: mrizwan93 Title: #2074: Check if user permssions and umask 0022 is set when executing ipa-restore Action: opened PR body: """ This test checks if the access rights for user/group is set to 644 on /var/lib/dirsrv/slapd-TESTRELM-TEST/ldif/* and umask 0022 set while restoring. related ticket: https://pagure.io/freeipa/issue/6844 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2074/head:pr2074 git checkout pr2074

1 1

[freeipa PR#1932][opened] test_server_del: fix TestServerDel suite
by pvoborni 26 Jul '18

26 Jul '18

URL: https://github.com/freeipa/freeipa/pull/1932 Author: pvoborni Title: #1932: test_server_del: fix TestServerDel suite Action: opened PR body: """ TestLastServices suite was fixed in PR #1913 . This PR completes ticket https://pagure.io/freeipa/issue/7517 The first patch does a bit of optimization so that this suite can be run on smaller topology, e.g. https://github.com/freeipa/freeipa-pr-ci/pull/165 Second fixes test_removal_of_replica1_disconnects_domain_topology, test_removal_of_replica2_disconnects_ca_topology. Details in commit message. Third fixes test_removal_of_master_disconnects_both_topologies. Details in commit message. Temp commit will be removed on successful run. I think that the suite is still bit unstable as test_ignore_topology_disconnect_replica{1,2} reinstall master in disconnected topology so bad things might in theory happen. It might not be hit though, so let's try if it will work as is. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1932/head:pr1932 git checkout pr1932

1 1

[freeipa PR#2004][opened] [Tests] Test for removal server with verbose option
by gkaihorodova 20 Jul '18

20 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2004 Author: gkaihorodova Title: #2004: [Tests] Test for removal server with verbose option Action: opened PR body: """ Test for removal server with verbose option Related to https://bugzilla.redhat.com/show_bug.cgi?id=1480502 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2004/head:pr2004 git checkout pr2004

2 1

Updating time&data servers system
by Andrey Bychkov 19 Jul '18

19 Jul '18

Hello! I'm thinking of adding a separate modules, which will contain all the functions for working with the time and date server. Namely: 1. Will be create a file ntpserverconf.py in the ipaserver/install/ directory. This file will contain configurations and methods for configuring the time server and synchronization. The methods from this file will be called when you install the server (ipaserver/install/server/install.py). 2. Will be create the ntpclientconf.py file in the ipaclient/install/ directory. This file will contain methods for synchronizing the client with the server, which will be called from ipaclient/install/client.py 3. Will be add support for ntpd and openntpd time servers 4. Will be add a mechanism for selecting the server configuration, depending on what is present in the system 5. Also, can make packages for each time server with its dependencies. This will ensure the operation of the freeipa on platforms with different time servers and will simplify the addition of support for the new servers. What can you say about this?

2 1

[freeipa PR#2025][opened] replica install: fix --password handling
by stlaz 19 Jul '18

19 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2025 Author: stlaz Title: #2025: replica install: fix --password handling Action: opened PR body: """ Don't specify host_password if admin_password has already been resolved. This fixes the case when --password and --principal are both set in replica installation when the client is not yet installed on the replica-to-be machine. Fixes: https://github.com/freeipa/freeipa-container/issues/177 ------------------------ The `--password` option handling is way too complex for what it should be. Damn you, backward compatibility. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2025/head:pr2025 git checkout pr2025

2 1

[freeipa PR#2072][opened] Fix login page translations
by stanislavlevin 17 Jul '18

17 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2072 Author: stanislavlevin Title: #2072: Fix login page translations Action: opened PR body: """ This should fix https://pagure.io/freeipa/issue/7559 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2072/head:pr2072 git checkout pr2072

2 1

[freeipa PR#2053][opened] Add ipa-advise plugin to set the CRL master
by rcritten 17 Jul '18

17 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2053 Author: rcritten Title: #2053: Add ipa-advise plugin to set the CRL master Action: opened PR body: """ This might still be a bit rough around the edges but is ready for a review. Note that for sudo to work you need to allow whatever use you are authenticating as to be able to run systemctl, grep and sed (not a very nice combination at all). I could easily drop this and require root only, I was trying to be nice. I ran the script output through a bash linter and it is generally ok. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2053/head:pr2053 git checkout pr2053

1 1

[freeipa PR#2060][opened] WebUI build update: use NodeJS instead of Rhino, use system UglifyJS, update Dojo
by pvoborni 12 Jul '18

12 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2060 Author: pvoborni Title: #2060: WebUI build update: use NodeJS instead of Rhino, use system UglifyJS, update Dojo Action: opened PR body: """ ## WebUI build: replace uglifyjs with system package UgligyJS is packaged in Fedora and other OSes it is no longer required to carry our own version. This will lower the maintenance burden - the code doesn't need to be updated and it is less code to have in repo. On some configuration usage of the bundled UglifyJS 1 produces "JavaScript throw: java.lang.StackOverflowError" exception. Usage of more recent version should fix it. ## WebUI build: use NodeJS instead of Rhino Rhino is no longer mainstream, nor is Nashorn. In addition it is quite slow (about 10x) in comparison to NodeJS. Over the years NodeJS became common part of OSes, thus one of the original reasons why use Rhino went away. The change in 01-Make-dojo-builder-buildable-by-itself.patch fixes an incorrect change of the patch (it was not processing input options well). Removing configRhino.js and adding configNode.js are prerequisites for Dojo Builder. These files are copied from Dojo project. Without them it doesn̈́'t run. In long run, it would be good to replace Dojo builder with something else but that is outside of this commit/PR. Last changes are preparation for update to latest stable version of Dojo 1. The updated Dojo and Dojo builder are in subsequent commit. ## Update Dojo and Dojo builder to 1.13.0 This is a result of the previous commits. Building the Dojo builder was bit more complex as it was: 1. patched Dojo sources 2. built from Dojo builder sources. 3. moved to it's location in FreeIPA project 4. built by util/make-builder.sh (does minimazation and replaces itself) Then Dojo layer is built by just: 1. util/make-dojo.sh This process was documented some time ago at: https://www.freeipa.org/page/V3/WebUI_build """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2060/head:pr2060 git checkout pr2060

2 1

[freeipa PR#1957][opened] Making nigthly test definition editable by FreeIPA contributors
by felipevolpone 11 Jul '18

11 Jul '18

URL: https://github.com/freeipa/freeipa/pull/1957 Author: felipevolpone Title: #1957: Making nigthly test definition editable by FreeIPA contributors Action: opened PR body: """ Now the test definition of nightly tests will be on freeipa repo. The the definition that's used on every PR (previously as .freeipa-pr-ci.yaml) is in ipatests/prci_definitions/gating and the .freeipa-pr-ci.yaml file is just a symlink to the real file. In the same dir there is also nightly_master and nightly_rawhide, both to be used in nightly tests. This PR is the result of the discussion on freeipa-devel mailing list [1]. [1] https://lists.fedoraproject.org/archives/list/freeipa-devel@lists.fedorahos… PS: This PR depends on [this PR in freeipa-pr-ci](https://github.com/freeipa/freeipa-pr-ci/pull/201) """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1957/head:pr1957 git checkout pr1957

2 1

[freeipa PR#2029][opened] Test Server-del fix
by pavelpicka 10 Jul '18

10 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2029 Author: pavelpicka Title: #2029: Test Server-del fix Action: opened PR body: """ fix segments before re-install replica in two test cases """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2029/head:pr2029 git checkout pr2029

1 1

[freeipa PR#2076][opened] ui_tests - stabilization fixes
by Rezney 04 Jul '18

04 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2076 Author: Rezney Title: #2076: ui_tests - stabilization fixes Action: opened PR body: """ This patch aims to fix the following tests which seems to be quite unstable recently: test_user::test_actions - closing notification and moving to element to have screenshot of current place. test_user::certificates - add wait() / close_notification test_config::test_size_limits - add wait() to fill_input() """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2076/head:pr2076 git checkout pr2076

2 1

[freeipa PR#2050][opened] Extend Sub CA replication test
by tiran 04 Jul '18

04 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2050 Author: tiran Title: #2050: Extend Sub CA replication test Action: opened PR body: """ Test more scenarios like replication replica -> master, validate keys. See: https://pagure.io/freeipa/issue/7590 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2050/head:pr2050 git checkout pr2050

1 1

[freeipa PR#2027][opened] Created Automation for verification of Pagure issue: 7518
by ndehadrai 03 Jul '18

03 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2027 Author: ndehadrai Title: #2027: Created Automation for verification of Pagure issue: 7518 Action: opened PR body: """ 'https://pagure.io/freeipa/issue/7518' Verification Steps: 1.Setup IPA server with CA 2. Setup REPLICA-1 against this IPA in step1, without CA. The setup of REPLICA-1 is successful. 3. Now stop custodia service on REPLICA-1. 4. Setup REPLICA-2 with CA (--setup-ca), and using REPLICA-1 as source. Verify that the install of REPLICA-2 is successful. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2027/head:pr2027 git checkout pr2027

2 1

[freeipa PR#1427][opened] Skip zone overlap check with auto-reverse
by justin-stephenson 03 Jul '18

03 Jul '18

URL: https://github.com/freeipa/freeipa/pull/1427 Author: justin-stephenson Title: #1427: Skip zone overlap check with auto-reverse Action: opened PR body: """ Skip the existing reverse zone overlap check during DNS installation when both `--auto-reverse` and `--allow-zone-overlap` arguments are provided together. https://pagure.io/freeipa/issue/7239 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1427/head:pr1427 git checkout pr1427

2 1

[freeipa PR#2089][opened] [testing_master] Nightly PR
by freeipa-pr-ci 03 Jul '18

03 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2089 Author: freeipa-pr-ci Title: #2089: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2089/head:pr2089 git checkout pr2089

1 1

[freeipa PR#2080][opened] [testing_master] Nightly PR
by freeipa-pr-ci 30 Jun '18

30 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2080 Author: freeipa-pr-ci Title: #2080: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2080/head:pr2080 git checkout pr2080

1 1

[freeipa PR#2086][opened] [Backport] [ipa-4.5] Test for ipa-client-install should not use hardcoded admin principal
by amore17 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2086 Author: amore17 Title: #2086: [Backport] [ipa-4.5] Test for ipa-client-install should not use hardcoded admin principal Action: opened PR body: """ Signed-off-by: Anuja More <amore(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> Reviewed-By: Tibor Dudlak <tdudlak(a)redhat.com> Conflicts: ipatests/test_integration/test_user_permissions.py """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2086/head:pr2086 git checkout pr2086

2 1

[freeipa PR#2085][opened] Python 3.7 and pylint 2.0 fixes
by tiran 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2085 Author: tiran Title: #2085: Python 3.7 and pylint 2.0 fixes Action: opened PR body: """ Two trivial fixes for compatibility with Python 3.7 and pylint 2.0.0.dev1 for Python 3.7. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2085/head:pr2085 git checkout pr2085

1 1

[freeipa PR#2087][opened] [Backport][ipa-4-6] Catch ACIError instead of invalid credentials
by tiran 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2087 Author: tiran Title: #2087: [Backport][ipa-4-6] Catch ACIError instead of invalid credentials Action: opened PR body: """ This PR was opened automatically because PR #2084 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2087/head:pr2087 git checkout pr2087

1 1

[freeipa PR#2088][opened] Catch ACIError instead of invalid credentials
by tiran 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2088 Author: tiran Title: #2088: Catch ACIError instead of invalid credentials Action: opened PR body: """ ipaldap's LDAPClient client turns INVALID_CREDENTIAL error into ACIError. Catch the ACIError and wait until the user has been replicated. Apparently no manual or automated test ran into the timeout during testing. Fixes: Fixes: https://pagure.io/freeipa/issue/7593 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Manual backport of PR #2084 to 4.5 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2088/head:pr2088 git checkout pr2088

1 1

[freeipa PR#2082][opened] [Backport][ipa-4-6] Rename test class for testing simple commands, add test
by rcritten 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2082 Author: rcritten Title: #2082: [Backport][ipa-4-6] Rename test class for testing simple commands, add test Action: opened PR body: """ Manual backport of the test from PR 1956. Only the code was pushed to the ipa-4-6 branch. The consensus in the review was that the name test_commands was more generic than test_ipa_cli. Add a test to change the password for sysaccount users using using ldappasswd to confirm that a segfault fix does not regress. https://pagure.io/freeipa/issue/7561 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2082/head:pr2082 git checkout pr2082

1 1

[freeipa PR#2084][opened] Catch ACIError instead of invalid credentials
by tiran 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2084 Author: tiran Title: #2084: Catch ACIError instead of invalid credentials Action: opened PR body: """ ipaldap's LDAPClient client turns INVALID_CREDENTIAL error into ACIError. Catch the ACIError and wait until the user has been replicated. Apparently no manual or automated test ran into the timeout during testing. Fixes: Fixes: https://pagure.io/freeipa/issue/7593 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2084/head:pr2084 git checkout pr2084

1 1

[freeipa PR#2083][opened] [Backport][ipa-4-6] Test for : ipa-client-install should not use hardcoded admin principal
by Tiboris 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2083 Author: Tiboris Title: #2083: [Backport][ipa-4-6] Test for : ipa-client-install should not use hardcoded admin principal Action: opened PR body: """ This PR was opened automatically because PR #2043 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2083/head:pr2083 git checkout pr2083

2 1

[freeipa PR#2081][opened] [Backport][ipa-4-6] Ensure that public cert and CA bundle are readable
by tiran 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2081 Author: tiran Title: #2081: [Backport][ipa-4-6] Ensure that public cert and CA bundle are readable Action: opened PR body: """ In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Make CA bundles, certs, and cert directories world-accessible in upgrader. Fixes: pagure.io/freeipa/issue/7594 Manual backport of PR #2057 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2081/head:pr2081 git checkout pr2081

1 1

[freeipa PR#2043][opened] Test for : ipa-client-install should not use hardcoded admin principal
by amore17 29 Jun '18

29 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2043 Author: amore17 Title: #2043: Test for : ipa-client-install should not use hardcoded admin principal Action: opened PR body: """ Related to : https://pagure.io/freeipa/issue/5406 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2043/head:pr2043 git checkout pr2043

2 1

[freeipa PR#2078][opened] [Backport][ipa-4-6] Prevent the creation on users and groups with numeric characters only
by netoarmando 28 Jun '18

28 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2078 Author: netoarmando Title: #2078: [Backport][ipa-4-6] Prevent the creation on users and groups with numeric characters only Action: opened PR body: """ Update regular expression validator to prevent user and group creation. Fixes: https://pagure.io/freeipa/issue/7572 Signed-off-by: Armando Neto <abiagion(a)redhat.com> Manual backport of #2067 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2078/head:pr2078 git checkout pr2078

2 1

[freeipa PR#2077][opened] ipaserver/dcerpc.py: handle indirect topology conflicts
by abbra 28 Jun '18

28 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2077 Author: abbra Title: #2077: ipaserver/dcerpc.py: handle indirect topology conflicts Action: opened PR body: """ Backport for 4.6: When AD forest A has a trust with a forest B that claims ownership of a domain name (TLN) owned by an IPA forest, we need to build exclusion record for that specific TLN, not our domain name. Use realmdomains to find a correct exclusion entry to build. Fixes: https://pagure.io/freeipa/issue/7370 Reviewed-By: Armando Neto <abiagion(a)redhat.com> Reviewed-By: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2077/head:pr2077 git checkout pr2077

1 1

[freeipa PR#2079][opened] ipa-client-install: enable and start oddjobd if mkhomedir
by flo-renaud 28 Jun '18

28 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2079 Author: flo-renaud Title: #2079: ipa-client-install: enable and start oddjobd if mkhomedir Action: opened PR body: """ Since the switch to authselect, the service oddjobd is not automatically enabled when ipa client is installed with `--mkhomedir`. The fix makes sure that the service is enabled/started, and stores the pre-install state in sysrestore.state, in order to revert to the pre-install state when uninstall is called The commit also add a test. https://pagure.io/freeipa/issue/7604 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2079/head:pr2079 git checkout pr2079

2 1

[freeipa PR#2075][opened] [WIP] Run tests with latest Custodia
by tiran 28 Jun '18

28 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2075 Author: tiran Title: #2075: [WIP] Run tests with latest Custodia Action: opened PR body: """ Verify that FreeIPA works with Custodia 0.6.0 and jwcrypto 0.5.0. I have added builds to https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-master/ Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2075/head:pr2075 git checkout pr2075

1 1

[freeipa PR#2070][opened] [testing_master] Nightly PR
by freeipa-pr-ci 28 Jun '18

28 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2070 Author: freeipa-pr-ci Title: #2070: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2070/head:pr2070 git checkout pr2070

1 1

[freeipa PR#2067][opened] Prevent the creation on users and groups with numeric characters only
by netoarmando 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2067 Author: netoarmando Title: #2067: Prevent the creation on users and groups with numeric characters only Action: opened PR body: """ Update regular expression validator to prevent user and group creation. Issue: https://pagure.io/freeipa/issue/7572 The expression updated by this PR was changed only twice [since the beginging on project](https://github.com/freeipa/freeipa/blob/d1691eee88c5462ef1d015617f…: - [first change](https://github.com/freeipa/freeipa/commit/37200806118d39ef8afe84ad5… removed the lenght limit - [second change](https://github.com/freeipa/freeipa/commit/8f8e3d008f1de91337a83ea6d… unified the expression used by user and group in the `constants.py` file This PR doesn't prevent the creation of user or groups starting with a number. Related info: https://access.redhat.com/solutions/3103631 Also, I haven't updated the error message, should I do it? If so, possible wording: ``` may only include letters, numbers, _, -, ., $ and must contain a letter ``` It seems that _systemd_ has a [stricter set of rules](https://github.com/systemd/systemd/blob/master/src/basic/user-util.c…, which I think it could affect FreeIPA in the future: > - We don't allow any dots (this would break chown syntax which permits dots as user/group name separator) > - We require that names fit into the appropriate utmp field > - We don't allow empty user names """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2067/head:pr2067 git checkout pr2067

1 1

[freeipa PR#2071][opened] ipaserver/dcerpc.py: handle indirect topology conflicts
by abbra 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2071 Author: abbra Title: #2071: ipaserver/dcerpc.py: handle indirect topology conflicts Action: opened PR body: """ When AD forest A has a trust with a forest B that claims ownership of a domain name (TLN) owned by an IPA forest, we need to build exclusion record for that specific TLN, not our domain name. Use realmdomains to find a correct exclusion entry to build, not just using our own domain name. Fixes: https://pagure.io/freeipa/issue/7370 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2071/head:pr2071 git checkout pr2071

2 1

[freeipa PR#1969][opened] [Backport][ipa-4-6] Add test case for allow-retrieve-keytab
by tiran 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1969 Author: tiran Title: #1969: [Backport][ipa-4-6] Add test case for allow-retrieve-keytab Action: opened PR body: """ This PR was opened automatically because PR #1964 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1969/head:pr1969 git checkout pr1969

1 1

[freeipa PR#1979][opened] WebUI: Extend password policy tests with more scenarios
by varunmylaraiah 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1979 Author: varunmylaraiah Title: #1979: WebUI: Extend password policy tests with more scenarios Action: opened PR body: """ Extend WebUI test_pwpolicy suite with the following test cases Added tests: krbpwdminlength: lower range integer krbmaxpwdlife: non-integer, abc krbmaxpwdlife: upper range integer,2147483648 krbmaxpwdlife: lower range integer,-1 krbminpwdlife: non-integer,edf krbminpwdlife: upper range integer,2147483648 krbminpwdlife: lower range integer,-1 krbpwdhistorylength: non-integer,HIJ krbpwdhistorylength: upper range integer,2147483648 krbpwdhistorylength: lower range integer,-1 krbpwdmindiffchars: noon-integer,3lm krbpwdmindiffchars: upper range integer,2147483648 krbpwdmindiffchars: lower range integer, -1 krbpwdminlength: non-integer, n0p krbpwdminlength: upper range integer,2147483648 krbpwdminlength: lower range integer, -1 cospriority: non-integer, abc cospriority: upper range integer,2147483648 cospriority: lower range integer,-1 krbpwdmaxfailure: non-integer krbpwdmaxfailure: upper range integer krbpwdmaxfailure: lower range integer krbpwdfailurecountinterval: non-integer krbpwdfailurecountinterval: upper range integer krbpwdfailurecountinterval: lower range integer krbpwdlockoutduration: non-integer krbpwdlockoutduration: upper range integer krbpwdlockoutduration: lower range integer deletePolicy_with various scenario MeasurementUnitAdded_Bug798363 Delete global password policy add_Policy_adder_dialog_bug910463 delete_Policy_deleter_dialog_bug910463 test field: cospriority modifyPolicy(undo/refresh/reset) empty policy name upper bound of data range lower bound of data range non integer for policy priority Details in the ticket https://pagure.io/freeipa/issue/7574 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1979/head:pr1979 git checkout pr1979

2 1

[freeipa PR#2073][opened] Check if user permssions and umask 0022 is set when executing ipa-restore
by mrizwan93 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2073 Author: mrizwan93 Title: #2073: Check if user permssions and umask 0022 is set when executing ipa-restore Action: opened PR body: """ This test checks if the access rights for user/group is set to 644 on /var/lib/dirsrv/slapd-TESTRELM-TEST/ldif/* and umask 0022 set while restoring. related ticket: https://pagure.io/freeipa/issue/6844 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2073/head:pr2073 git checkout pr2073

1 1

[freeipa PR#2057][opened] Ensure that public cert and CA bundle are readable
by tiran 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2057 Author: tiran Title: #2057: Ensure that public cert and CA bundle are readable Action: opened PR body: """ In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Make CA bundles, certs, and cert directories world-accessible in upgrader. Fixes: pagure.io/freeipa/issue/7594 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2057/head:pr2057 git checkout pr2057

2 1

[freeipa PR#2013][opened] [RFE] DNS package check should be called earlier in installation routine
by amitkumar50 27 Jun '18

27 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2013 Author: amitkumar50 Title: #2013: [RFE] DNS package check should be called earlier in installation routine Action: opened PR body: """ In case the integrated DNS service should be used for IdM, either by using the non-interactive '--setup-dns' option or by answering 'yes' to the interactive 'Do you want to configure integrated DNS (BIND)?' question, the check whether the 'ipa-server-dns' package is installed, only comes after a lot of other information have been evaluated ([server|dns|realm] name, DM and admin password). This PR check, whether the 'ipa-server-dns' package is installed or not, earlier in the installation routine. Resolves: https://pagure.io/freeipa/issue/7577 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2013/head:pr2013 git checkout pr2013

1 1

[freeipa PR#2063][opened] Check if issuer DN is updated after self-signed > external-ca
by mrizwan93 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2063 Author: mrizwan93 Title: #2063: Check if issuer DN is updated after self-signed > external-ca Action: opened PR body: """ This test checks if issuer DN is updated properly after CA is renewed from self-signed to external-ca related ticket: https://pagure.io/freeipa/issue/7316 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> Replaced hardcoded issuer CN for external ca with constant Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> Reviewed-By: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2063/head:pr2063 git checkout pr2063

2 1

[freeipa PR#2064][opened] [Backport][ipa-4-5] Check if issuer DN is updated after self-signed > external-ca
by mrizwan93 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2064 Author: mrizwan93 Title: #2064: [Backport][ipa-4-5] Check if issuer DN is updated after self-signed > external-ca Action: opened PR body: """ This test checks if issuer DN is updated properly after CA is renewed from self-signed to external-ca related ticket: https://pagure.io/freeipa/issue/7316 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> Replaced hardcoded issuer CN for external ca with constant Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> Reviewed-By: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2064/head:pr2064 git checkout pr2064

2 1

[freeipa PR#2066][opened] Use 4 WSGI workers on 64bit systems
by tiran 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2066 Author: tiran Title: #2066: Use 4 WSGI workers on 64bit systems Action: opened PR body: """ Commit f1d5ab3a03191dbb02e5f95308cf8c4f1971cdcf increases WSGI worker count to five. This turned out to be a bit much for our test systems. Four workers are good enough and still double the old amount. See: https://pagure.io/freeipa/issue/7587 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Manual backport of PR #2062 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2066/head:pr2066 git checkout pr2066

1 1

[freeipa PR#2069][opened] [testing_master] Nightly PR
by freeipa-pr-ci 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2069 Author: freeipa-pr-ci Title: #2069: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2069/head:pr2069 git checkout pr2069

1 1

[freeipa PR#2068][opened] [testing_master] Nightly PR
by freeipa-pr-ci 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2068 Author: freeipa-pr-ci Title: #2068: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2068/head:pr2068 git checkout pr2068

1 1

[freeipa PR#2061][opened] [testing_master] Nightly PR
by freeipa-pr-ci 26 Jun '18

26 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2061 Author: freeipa-pr-ci Title: #2061: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2061/head:pr2061 git checkout pr2061

1 1

[freeipa PR#2062][opened] Use 4 WSGI workers on 64bit systems
by tiran 25 Jun '18

25 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2062 Author: tiran Title: #2062: Use 4 WSGI workers on 64bit systems Action: opened PR body: """ Commit f1d5ab3a03191dbb02e5f95308cf8c4f1971cdcf increases WSGI worker count to five. This turned out to be a bit much for our test systems. Four workers are good enough and still double the old amount. See: https://pagure.io/freeipa/issue/7587 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2062/head:pr2062 git checkout pr2062

2 1

[freeipa PR#2030][opened] Increase WSGI process count to 5 on 64bit
by tiran 25 Jun '18

25 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2030 Author: tiran Title: #2030: Increase WSGI process count to 5 on 64bit Action: opened PR body: """ Increase the WSGI daemon worker process count from 2 processes to 5 processes. This allows IPA RPC to handle more parallel requests. The additional processes increase memory consumption by approximante 250 MB in total. Since memory is scarce on 32bit platforms, only 64bit platforms are bumped to 5 workers. PR was ACKed manually because this is backport of PR #2028. Fixes: https://pagure.io/freeipa/issue/7587 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2030/head:pr2030 git checkout pr2030

2 1

[freeipa PR#2049][opened] Check if issuer DN is updated after self-signed > external-ca
by mrizwan93 25 Jun '18

25 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2049 Author: mrizwan93 Title: #2049: Check if issuer DN is updated after self-signed > external-ca Action: opened PR body: """ This test checks if issuer DN is updated properly after CA is renewed from self-signed to external-ca related ticket: https://pagure.io/freeipa/issue/7316 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2049/head:pr2049 git checkout pr2049

2 1

[freeipa PR#2052][opened] [testing_master] Nightly PR
by freeipa-pr-ci 23 Jun '18

23 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2052 Author: freeipa-pr-ci Title: #2052: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2052/head:pr2052 git checkout pr2052

1 1

[freeipa PR#2058][opened] [Backport][ipa-4-5] Fix replication races in Dogtag admin code
by tiran 22 Jun '18

22 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2058 Author: tiran Title: #2058: [Backport][ipa-4-5] Fix replication races in Dogtag admin code Action: opened PR body: """ Manual backport of PR #2051 PR fixes two related issues: # Fix replication races in Dogtag admin code DogtagInstance.setup_admin and related methods have multiple LDAP replication race conditions. The bugs can cause parallel ipa-replica-install to fail. The code from __add_admin_to_group() has been changed to use MOD_ADD ather than search + MOD_REPLACE. The MOD_REPLACE approach can lead to data loss, when more than one writer changes a group. setup_admin() now waits until both admin user and group membership have been replicated to the master peer. Fixes: https://pagure.io/freeipa/issue/7593 # Improve and fix timeout bug in wait_for_entry() replication.wait_for_entry() now can wait for an attribute value to appear on a replica. Fixed timeout handling caused by bad rounding and comparison. For small timeouts, the actual time was rounded down. For example for 60 seconds timeout and fast replica, the query accumulated to about 0.45 seconds plus 60 seconds sleep. 60.45 is large enough to terminate the loop "while int(time.time()) < timeout", but not large enough to trigger the exception in "if int(time.time()) > timeout", because int(60.65) == 60. Fixes: https://pagure.io/freeipa/issue/7595 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2058/head:pr2058 git checkout pr2058

1 1

[freeipa PR#2021][opened] Create DOAP description for the IPA project
by menonsudhir 22 Jun '18

22 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2021 Author: menonsudhir Title: #2021: Create DOAP description for the IPA project Action: opened PR body: """ https://pagure.io/freeipa/issue/2536 Signed-off-by: Sudhir Menon <sumenon(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2021/head:pr2021 git checkout pr2021

2 1

[freeipa PR#2059][opened] [Backport][ipa-4-6] Fix replication races in Dogtag admin code
by tiran 22 Jun '18

22 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2059 Author: tiran Title: #2059: [Backport][ipa-4-6] Fix replication races in Dogtag admin code Action: opened PR body: """ Manual backport of PR #2051 PR fixes two related issues: # Fix replication races in Dogtag admin code DogtagInstance.setup_admin and related methods have multiple LDAP replication race conditions. The bugs can cause parallel ipa-replica-install to fail. The code from __add_admin_to_group() has been changed to use MOD_ADD ather than search + MOD_REPLACE. The MOD_REPLACE approach can lead to data loss, when more than one writer changes a group. setup_admin() now waits until both admin user and group membership have been replicated to the master peer. Fixes: https://pagure.io/freeipa/issue/7593 # Improve and fix timeout bug in wait_for_entry() replication.wait_for_entry() now can wait for an attribute value to appear on a replica. Fixed timeout handling caused by bad rounding and comparison. For small timeouts, the actual time was rounded down. For example for 60 seconds timeout and fast replica, the query accumulated to about 0.45 seconds plus 60 seconds sleep. 60.45 is large enough to terminate the loop "while int(time.time()) < timeout", but not large enough to trigger the exception in "if int(time.time()) > timeout", because int(60.65) == 60. Fixes: https://pagure.io/freeipa/issue/7595 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2059/head:pr2059 git checkout pr2059

1 1

[freeipa PR#2051][opened] Fix replication races in Dogtag admin code
by tiran 22 Jun '18

22 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2051 Author: tiran Title: #2051: Fix replication races in Dogtag admin code Action: opened PR body: """ DogtagInstance.setup_admin and related methods have multiple LDAP replication race conditions. The bugs can cause parallel ipa-replica-install to fail. The code from __add_admin_to_group() has been changed to use MOD_ADD ather than search + MOD_REPLACE. The MOD_REPLACE approach can lead to data loss, when more than one writer changes a group. setup_admin() now waits until both admin user and group membership have been replicated to the master peer. Fixes: https://pagure.io/freeipa/issue/7593 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2051/head:pr2051 git checkout pr2051

1 1

[freeipa PR#2056][opened] [Backport][ipa-4-6] Increase search records minimum limit
by netoarmando 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2056 Author: netoarmando Title: #2056: [Backport][ipa-4-6] Increase search records minimum limit Action: opened PR body: """ This PR was opened automatically because PR #2037 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2056/head:pr2056 git checkout pr2056

2 1

[freeipa PR#2037][opened] ipaserver config plugin: Increase search records minimum limit
by netoarmando 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2037 Author: netoarmando Title: #2037: ipaserver config plugin: Increase search records minimum limit Action: opened PR body: """ Issue: https://pagure.io/freeipa/issue/6617 Check if the given search records value is greater than an arbitrary number that is not so close to zero. The number 10 is arbitrary, I'm open for discussion. The last test also works as a clean-up task, returning the setting back to _unlimited_. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2037/head:pr2037 git checkout pr2037

2 1

[freeipa PR#2046][opened] Apply validate_doc() to NO_CLI commands
by stanislavlevin 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2046 Author: stanislavlevin Title: #2046: Apply validate_doc() to NO_CLI commands Action: opened PR body: """ For now validate_doc() checks NO_CLI commands only. From validate_doc: ``` * Every command must have documentation and it must be marked for international translation * Every module hosting a command must have documentation and it must be marked for international translation * Every module topic must be marked for international translation ``` So, to prevent from NO_CLI commands have no translatable description or have no one at all in Web UI API Browser validation of ```__doc__``` is required. https://pagure.io/freeipa/issue/7592 Additionally, ``` 1 commands without doc, 0 commands whose doc is not i18n 1 modules without doc, 2 modules whose doc is not i18n ``` are fixed. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2046/head:pr2046 git checkout pr2046

2 3

[freeipa PR#1559][opened] test_dnssec: re-add named-pkcs11 workarounds
by tiran 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1559 Author: tiran Title: #1559: test_dnssec: re-add named-pkcs11 workarounds Action: opened PR body: """ DNSSEC tests starrted to fail again, probably due to a bug in some underlaying component. This reverts commit 8bc677512296a7e94c29edd0c1a96aa7273f352a and makes the xfail test check less strict - it will no longer mark the test suite red if it passes. Related https://pagure.io/freeipa/issue/5348 Clone of @tomaskrizek PR #973 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1559/head:pr1559 git checkout pr1559

1 1

[freeipa PR#1793][opened] [WIP] ipa tests: Set default TTL for the IPA zone to 1 second
by abbra 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1793 Author: abbra Title: #1793: [WIP] ipa tests: Set default TTL for the IPA zone to 1 second Action: opened PR body: """ When running IPA tests, a default TTL for the zone should be set very low to allow get rid of timeouts in the tests. Zone updates should be propagated to the clients as soon as possible. This is not something that should be used in production so the change is done purely at install time within the tests. As zone information is replicated, we only modify it when creating a master with integrated DNS. This change should fix a number of DNSSEC-related tests where default TTL is longer than what a test expects and a change of DNSSEC keys never gets noticed by the BIND. As result, DNSSEC tests never match their expected output with what they received from the BIND. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1793/head:pr1793 git checkout pr1793

2 1

[freeipa PR#2055][opened] [Backport][ipa-4-5] [Backport][ipa-4-6] Always set ca_host when installing replica
by Tiboris 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2055 Author: Tiboris Title: #2055: [Backport][ipa-4-5] [Backport][ipa-4-6] Always set ca_host when installing replica Action: opened PR body: """ This PR was opened automatically because PR #2054 was pushed to ipa-4-6 and backport to ipa-4-5 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2055/head:pr2055 git checkout pr2055

2 1

[freeipa PR#1997][opened] Fix translation of python brace formatted messages
by stanislavlevin 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1997 Author: stanislavlevin Title: #1997: Fix translation of python brace formatted messages Action: opened PR body: """ Some of the messages cannot be translated because of a broken python brace formatting. Simple reproducer: Take a translatable message string from ipaserver/plugins/topology.py ```Topology management requires minimum domain level {0} ``` and put it on a test script with original formatting: ```python #!/usr/bin/python import gettext ru = gettext.translation('ipa', languages=['ru']) ru.install() _ = ru.gettext test_value = '1' msgtest = _('Topology management requires minimum domain level {0} '.format(test_value)) print(msgtest) ``` Out: ```Topology management requires minimum domain level 1``` But msgid is here, should be no problem: ```msgunfmt /usr/share/locale/ru/LC_MESSAGES/ipa.mo | grep 'Topology management requires minimum domain level {0} ' -A 1 msgid "Topology management requires minimum domain level {0} " msgstr "Управление топологией требует уровня домена не ниже {0}" ``` Cause: The 'format' method should be called after a gettext one to follow 'python-brace-format' rule: ```python msgtest = _('Topology management requires minimum domain level {0} ').format(desired_value) ``` with correct out: ```Управление топологией требует уровня домена не ниже 1``` List of affected: ``` ipaserver/plugins/idrange.py:56 ipaserver/plugins/idrange.py:246 ipaserver/plugins/idrange.py:383 ipaserver/plugins/idrange.py:616 ipaserver/plugins/trust.py:688 ipaserver/plugins/topology.py:88 ipaserver/plugins/topology.py:257 ipaserver/plugins/topology.py:265 ipaserver/plugins/serverroles.py:82 ipaserver/plugins/serverroles.py:167 ipaserver/plugins/domainlevel.py:68 ipaserver/plugins/domainlevel.py:153 ``` This patch should fix it. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1997/head:pr1997 git checkout pr1997

2 1

[freeipa PR#2054][opened] [Backport][ipa-4-6] Always set ca_host when installing replica
by Tiboris 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2054 Author: Tiboris Title: #2054: [Backport][ipa-4-6] Always set ca_host when installing replica Action: opened PR body: """ This PR was opened automatically because PR #2048 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2054/head:pr2054 git checkout pr2054

1 1

[freeipa PR#2048][opened] Always set ca_host when installing replica
by tiran 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2048 Author: tiran Title: #2048: Always set ca_host when installing replica Action: opened PR body: """ ipa-replica-install only set ca_host in its temporary /etc/ipa/default.conf, when it wasn't installing a replica with CA. As a consequence, the replica installer was picking a random CA server from LDAP. Always set the replication peer as ca_host. This will ensure that the installer uses the same replication peer for CA. In case the replication peer is not a CA master, the installer will automatically pick another host later. See: https://pagure.io/freeipa/issue/7566 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2048/head:pr2048 git checkout pr2048

2 1

[freeipa PR#2038][opened] [testing_master] Nightly PR
by freeipa-pr-ci 21 Jun '18

21 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2038 Author: freeipa-pr-ci Title: #2038: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2038/head:pr2038 git checkout pr2038

1 1

[freeipa PR#1992][opened] Bug 1579189
by gkaihorodova 20 Jun '18

20 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1992 Author: gkaihorodova Title: #1992: Bug 1579189 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1992/head:pr1992 git checkout pr1992

2 1

[freeipa PR#2034][opened] Test that host can remove there own services
by amore17 20 Jun '18

20 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2034 Author: amore17 Title: #2034: Test that host can remove there own services Action: opened PR body: """ A service may be decommissioned on the host and needs to be removed. Related to : https://pagure.io/freeipa/issue/7486 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2034/head:pr2034 git checkout pr2034

2 1

[freeipa PR#1899][opened] Clean up Uninstall output
by rcritten 20 Jun '18

20 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1899 Author: rcritten Title: #1899: Clean up Uninstall output Action: opened PR body: """ ipa-server-install did not configure a console logger. This caused odd output because ipa-client-install does and a normal server uninstall would end with "ipa-client-install command was successful" Because there was no console logger there were print statements in a lot of places. Those were dropped because the equivalent logging statement was already there. A number of info loggers were converted to debug to suppress their output. They were never shown in the past for the most part with the exception of the client installer and Forwarding and trying statements. Adding the logger exposed two additional issues: 1. When deleting the last server the server-del command threw an LDAP error trying to write an empty attribute 2. Two ACI parsing issues related to subtypes """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1899/head:pr1899 git checkout pr1899

2 1

[freeipa PR#2045][opened] [Backport][ipa-4-6] ui_tests: extend test_config.py suite
by Tiboris 20 Jun '18

20 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2045 Author: Tiboris Title: #2045: [Backport][ipa-4-6] ui_tests: extend test_config.py suite Action: opened PR body: """ This PR was opened automatically because PR #1995 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2045/head:pr2045 git checkout pr2045

1 1

[freeipa PR#2044][opened] [Fedora29]: fix dependency for *-domainname.service file
by flo-renaud 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2044 Author: flo-renaud Title: #2044: [Fedora29]: fix dependency for *-domainname.service file Action: opened PR body: """ FreeIPA has a dependency on /usr/lib/systemd/system/*-domainname.service file. In fedora <=28, this is provided by package 'initscripts' but in fedora >= 29, this is provided by package 'hostname'. Fixes: https://pagure.io/freeipa/issue/7591 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2044/head:pr2044 git checkout pr2044

2 1

[freeipa PR#2047][opened] Check if user with 'User Administrator' role can delete group.
by ndehadrai 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2047 Author: ndehadrai Title: #2047: Check if user with 'User Administrator' role can delete group. Action: opened PR body: """ Automation for Pagure issue 6884 This Automation checks if test user with 'User Administrator' role can delete group and no errors to be returned. Signed-off-by: Nikhil Dehadrai <ndehadra(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2047/head:pr2047 git checkout pr2047

1 0

[freeipa PR#1995][opened] ui_tests: extend test_config.py suite
by Rezney 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1995 Author: Rezney Title: #1995: ui_tests: extend test_config.py suite Action: opened PR body: """ Extend test_config.py suite with new test cases. https://pagure.io/freeipa/issue/7576 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1995/head:pr1995 git checkout pr1995

2 1

[freeipa PR#1700][opened] Allow issuing certificates with IP addresses in subjectAltName
by ipilcher 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1700 Author: ipilcher Title: #1700: Allow issuing certificates with IP addresses in subjectAltName Action: opened PR body: """ Allow issuing certificates with IP addresses in the subject alternative name (SAN), if all of the following are true. * One of the DNS names in the SAN resolves to the IP address (possibly through a CNAME). * All of the DNS entries in the resolution chain are managed by this IPA instance. * The IP address has a (correct) reverse DNS entry that is managed by this IPA instance """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1700/head:pr1700 git checkout pr1700

2 1

[freeipa PR#2042][opened] [Backport][ipa-4-6] Extended UI test for Certificates
by Rezney 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2042 Author: Rezney Title: #2042: [Backport][ipa-4-6] Extended UI test for Certificates Action: opened PR body: """ This PR was opened automatically because PR #1961 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2042/head:pr2042 git checkout pr2042

2 1

[freeipa PR#1975][opened] Start to deprecate Python 2 support
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1975 Author: tiran Title: #1975: Start to deprecate Python 2 support Action: opened PR body: """ Python 2 will reach EOL in 18 months. Start to issue deprecation warnings on Python 2. No longer claim support for Python 3.5. Python 3.5 is untested. Fixes: https://pagure.io/freeipa/issue/7568 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1975/head:pr1975 git checkout pr1975

2 1

[freeipa PR#2031][opened] [Backport][ipa-4-6] Increase WSGI process count to 5 on 64bit
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2031 Author: tiran Title: #2031: [Backport][ipa-4-6] Increase WSGI process count to 5 on 64bit Action: opened PR body: """ Increase the WSGI daemon worker process count from 2 processes to 5 processes. This allows IPA RPC to handle more parallel requests. The additional processes increase memory consumption by approximante 250 MB in total. Since memory is scarce on 32bit platforms, only 64bit platforms are bumped to 5 workers. PR was ACKed manually because this is backport of PR #2028. Fixes: https://pagure.io/freeipa/issue/7587 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2031/head:pr2031 git checkout pr2031

2 1

[freeipa PR#2041][opened] [Backport][ipa-4-5] Sort and shuffle SRV record by priority and weight
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2041 Author: tiran Title: #2041: [Backport][ipa-4-5] Sort and shuffle SRV record by priority and weight Action: opened PR body: """ On multiple occasions, SRV query answers were not properly sorted by priority. Records with same priority weren't randomized and shuffled. This caused FreeIPA to contact the same remote peer instead of distributing the load across all available servers. Two new helper functions now take care of SRV queries. sort_prio_weight() sorts SRV and URI records. query_srv() combines SRV lookup with sort_prio_weight(). PR was ACKed manually because this is backport of PR #2032. Fixes: https://pagure.io/freeipa/issue/7475 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2041/head:pr2041 git checkout pr2041

2 1

[freeipa PR#2039][opened] [Backport][ipa-4-6] Sort and shuffle SRV record by priority and weight
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2039 Author: tiran Title: #2039: [Backport][ipa-4-6] Sort and shuffle SRV record by priority and weight Action: opened PR body: """ This PR was opened automatically because PR #2032 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2039/head:pr2039 git checkout pr2039

2 1

[freeipa PR#1961][opened] Extended UI test for Certificates
by mrizwan93 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1961 Author: mrizwan93 Title: #1961: Extended UI test for Certificates Action: opened PR body: """ UI test for certificates Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1961/head:pr1961 git checkout pr1961

2 1

[freeipa PR#2040][opened] [Backport][ipa-4-6] Replace some test case adjectives
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2040 Author: tiran Title: #2040: [Backport][ipa-4-6] Replace some test case adjectives Action: opened PR body: """ This PR was opened automatically because PR #2036 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2040/head:pr2040 git checkout pr2040

1 1

[freeipa PR#2036][opened] Replace some test case adjectives
by rcritten 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2036 Author: rcritten Title: #2036: Replace some test case adjectives Action: opened PR body: """ Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2036/head:pr2036 git checkout pr2036

2 1

[freeipa PR#2032][opened] Sort and shuffle SRV record by priority and weight
by tiran 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2032 Author: tiran Title: #2032: Sort and shuffle SRV record by priority and weight Action: opened PR body: """ On multiple occasions, SRV query answers were not properly sorted by priority. Records with same priority weren't randomized and shuffled. This caused FreeIPA to contact the same remote peer instead of distributing the load across all available servers. Two new helper functions now take care of SRV queries. sort_srv() sorts SRV records. query_srv() combines SRV lookup with sort_srv(). Fixes: https://pagure.io/freeipa/issue/7475 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2032/head:pr2032 git checkout pr2032

1 1

[freeipa PR#2035][opened] Installer: configure authselect with-sudo
by flo-renaud 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2035 Author: flo-renaud Title: #2035: Installer: configure authselect with-sudo Action: opened PR body: """ authselect needs to be configured with the 'with-sudo' feature (except when ipa-client-install is called with the option --no-sudo). https://pagure.io/freeipa/issue/7562 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2035/head:pr2035 git checkout pr2035

2 1

[freeipa PR#2033][opened] [testing_master] Nightly PR
by freeipa-pr-ci 19 Jun '18

19 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2033 Author: freeipa-pr-ci Title: #2033: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2033/head:pr2033 git checkout pr2033

1 1

[freeipa PR#1991][opened] Test for ipa-replica-install fails with PIN error for CA-less env.
by amore17 18 Jun '18

18 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1991 Author: amore17 Title: #1991: Test for ipa-replica-install fails with PIN error for CA-less env. Action: opened PR body: """ related to : https://pagure.io/freeipa/issue/7274 when the keys are not protected by a PIN ipa-replica-install fails with PIN error Signed-off-by: Anuja More <amore(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1991/head:pr1991 git checkout pr1991

2 1

[freeipa PR#2000][opened] Test: when non responding forwarder is used, wrong error message is reported.
by amore17 18 Jun '18

18 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2000 Author: amore17 Title: #2000: Test: when non responding forwarder is used, wrong error message is reported. Action: opened PR body: """ related : https://pagure.io/freeipa/issue/6989 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2000/head:pr2000 git checkout pr2000

1 1

[freeipa PR#1989][opened] Add test for --external-cert-file points to a non-existing file or in…
by amore17 18 Jun '18

18 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1989 Author: amore17 Title: #1989: Add test for --external-cert-file points to a non-existing file or in… Action: opened PR body: """ …valid file Signed-off-by: Anuja More <amore(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1989/head:pr1989 git checkout pr1989

1 1

[freeipa PR#2024][opened] [testing_master] Nightly PR
by freeipa-pr-ci 16 Jun '18

16 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2024 Author: freeipa-pr-ci Title: #2024: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2024/head:pr2024 git checkout pr2024

1 1

[freeipa PR#2008][opened] [Backport][ipa-4-6] Use replace instead of add to set new default ipaSELinuxUserMapOrder
by rcritten 15 Jun '18

15 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2008 Author: rcritten Title: #2008: [Backport][ipa-4-6] Use replace instead of add to set new default ipaSELinuxUserMapOrder Action: opened PR body: """ The add was in effect replacing whatever data was already there causing any custom order to be lost on each run of ipa-server-upgrade. https://pagure.io/freeipa/issue/6610 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2008/head:pr2008 git checkout pr2008

1 1

[freeipa PR#2028][opened] Increase WSGI process count to 5 on 64bit
by tiran 15 Jun '18

15 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2028 Author: tiran Title: #2028: Increase WSGI process count to 5 on 64bit Action: opened PR body: """ Increase the WSGI daemon worker process count from 2 processes to 5 processes. This allows IPA RPC to handle more parallel requests. The additional processes increase memory consumption by approximante 250 MB in total. Since memory is scarce on 32bit platforms, only 64bit platforms are bumped to 5 workers. Fixes: https://pagure.io/freeipa/issue/7587 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2028/head:pr2028 git checkout pr2028

1 1

[freeipa PR#2014][opened] Fedora 29 renamed fedora-domainname.service
by tiran 15 Jun '18

15 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2014 Author: tiran Title: #2014: Fedora 29 renamed fedora-domainname.service Action: opened PR body: """ In Fedora 29, the fedora-domainname.service has been renamed to nis-domainname.service like on RHEL. The ipaplatform service module for Fedora now only renames the service, when it detects the presence of fedora-domainname.service. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1588192 Fixes: https://pagure.io/freeipa/issue/7582 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2014/head:pr2014 git checkout pr2014

1 1

[freeipa PR#2007][opened] zanata: update translations for ipa-4-6
by rcritten 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2007 Author: rcritten Title: #2007: zanata: update translations for ipa-4-6 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2007/head:pr2007 git checkout pr2007

2 1

[freeipa PR#2026][opened] Created Automation for verification of Pagure issue: 7518
by neekheel 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2026 Author: neekheel Title: #2026: Created Automation for verification of Pagure issue: 7518 Action: opened PR body: """ 'https://pagure.io/freeipa/issue/7518' Verification Steps: 1. Setup IPA server with CA 2. Setup REPLICA-1 against this IPA in step1, without CA. The setup of REPLICA-1 is successful. 3. Now stop custodia service on REPLICA-1. 4. Setup REPLICA-2 with CA (--setup-ca), and using REPLICA-1 as source. Verify that the install of REPLICA-2 is successful. Signed-off-by: Nikhil Dehadrai <dehadrai.nikhil(a)gmail.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2026/head:pr2026 git checkout pr2026

1 1

[freeipa PR#2006][opened] [Backport][ipa-4-6] ui_tests: fixes for issues with sending key and focus on element
by Rezney 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2006 Author: Rezney Title: #2006: [Backport][ipa-4-6] ui_tests: fixes for issues with sending key and focus on element Action: opened PR body: """ This PR was opened automatically because PR #1999 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2006/head:pr2006 git checkout pr2006

2 1

[freeipa PR#2023][opened] [Backport][ipa-4-6] Test coverage for multiservers for radius proxy
by rcritten 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2023 Author: rcritten Title: #2023: [Backport][ipa-4-6] Test coverage for multiservers for radius proxy Action: opened PR body: """ This PR was opened automatically because PR #2005 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2023/head:pr2023 git checkout pr2023

2 1

[freeipa PR#2022][opened] [Backport][ipa-4-5] Test coverage for multiservers for radius proxy
by rcritten 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2022 Author: rcritten Title: #2022: [Backport][ipa-4-5] Test coverage for multiservers for radius proxy Action: opened PR body: """ This PR was opened automatically because PR #2005 was pushed to master and backport to ipa-4-5 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2022/head:pr2022 git checkout pr2022

2 1

[FYI] freeipa-master COPR cleanup
by Christian Heimes 14 Jun '18

14 Jun '18

For your information, a couple of days ago, Standa has removed Fedora 27 packages from @freeipa/freeipa-master COPR. Yesterday I removed all stale packages that don't have F28 builds or already have the same or newer version available in Fedora 28. The COPR repository is now down from 7 pages of packages to a single package, https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-master/ Christian -- Christian Heimes Senior Software Engineer, Identity Management and Platform Security Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Michael Cunningham, Michael O'Neill, Eric Shander

2 1

[freeipa PR#2019][opened] Use python3-lesscpy 0.13.0
by tiran 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2019 Author: tiran Title: #2019: Use python3-lesscpy 0.13.0 Action: opened PR body: """ Require python-lesscpy 0.13. with Python 3 fix and use py3-lesscpy to compile ipa.css. python2-lesscpy was the last Python 2 dependency. Fixes: https://pagure.io/freeipa/issue/7585 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2019/head:pr2019 git checkout pr2019

1 1

[freeipa PR#2018][opened] [testing_master] Nightly PR
by freeipa-pr-ci 14 Jun '18

14 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2018 Author: freeipa-pr-ci Title: #2018: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2018/head:pr2018 git checkout pr2018

1 1

[freeipa PR#2005][opened] Test coverage for multiservers for radius proxy
by kaleemsiddiqu 13 Jun '18

13 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2005 Author: kaleemsiddiqu Title: #2005: Test coverage for multiservers for radius proxy Action: opened PR body: """ Test checks that no multiservers can be added for radius proxy Pagure: https://pagure.io/freeipa/issue/7542 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2005/head:pr2005 git checkout pr2005

2 1

[ANNOUNCE] IPA 4.6.4 release notes
by Rob Crittenden 12 Jun '18

12 Jun '18

The FreeIPA team would like to announce FreeIPA 4.6.4 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 27 will be available soon. == Highlights in 4.6.4 == * Several changes to upgrade process so it will be more robust: * The schema compat plugin is disabled during upgrades * Verify the Custodia keys * Handle entries that already exist when adding new ones * Run the upgrade in an empty ccache * Don't try to backup CS.cfg during upgrade if CA is not configured * Properly detect whether a KRA is configured * Set nsds5ReplicaReleaseTimeout to avoid monopolization of a master during replication === Bug fixes === FreeIPA 4.6.4 is a stabilization release for the features delivered as a part of 4.6.0. There are more than 50 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on Upgrade page on the freeipa wiki. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 5638 Port client code to Python 3 * 5776 webui: some data disappear from user details page after the save action is performed * 5813 ipa-kra-install disrupts bind-dyndb-ldap * 5922 ipa vault-archive overwrites an existing value without warning * 6525 makeapi & makeaci under Python 2/3 generate different files * 6531 Refactor the execution flow of `cert-request` command * 6609 A CA administrator fails to add CA for Insufficient 'add' privilege * 6721 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process * 6851 Don't use ctypes.util.find_library in ipaclient * 7012 Users can delete their last active OTP token * 7131 Finish Python3 support * 7136 ipa-restore command doesn't exit with failure if wrong directory manager's password is provided * 7240 ipa-dnskeysyncd broken (and ipactl doesn't tell) * 7313 trust integration tests need to override test_establish_trust method when using different trust-add options * 7314 Update package metadata * 7330 ipa-server-install --uninstall does not return error code on error * 7335 Integration tests are not collecting all logs * 7342 admins group is not including all permissions of Role "User Administrator" * 7357 IntegrationTests do not fail even if the uninstall process fails * 7359 [RFE] extend topology plugin to clean up a removed replica ldap/ principal * 7371 uninstalling replica leaves orphained data in ldap * 7374 IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed * 7380 Possible regression for limited OTP characters in host-add * 7383 user-add: user creation proceeds when password is wrong * 7389 F-27 upgrade to 4.6.3-1 fails with KRA update * 7390 cert-request: issuance of malformed certificate causes IPA Internal Error * 7393 Installing 4.6.3-1 in rawhide/F28 fails with DuplicateEntry enabling TLS in 389-ds * 7394 file conflicts between python2-mod_wsgi and freeipa-server * 7397 ipa host-add --ip-address... returns Internal error when forward-policy=none is defined * 7411 Simplify CA, TLS and bytes warning configuration of LDAP connections * 7424 Improve Realm Domains doc text * 7425 ipa-server-install with different IP fails on /usr/sbin/pkispawn -s CA * 7432 make fasttest fails on fresh clone. fedora26 * 7433 CRL url on replicas gets incorrectly redirected * 7436 ipa: Please log something after restarting the KDC * 7447 test_create_host_with_ip is not fully covering possible return errors * 7463 test_webui: add user life-cycles tests * 7468 test_host.py::test_host::test_crud is failing in nightly tests * 7472 ipa: ERROR: Could not get SOA serial interactively * 7473 ERROR: No valid Negotiate header in server response * 7474 ipa-server-install --uninstall on replica fails with "NoOptionError: No option 'ldap_uri' in section: 'global'" * 7485 Extending webui user group test * 7493 ipa-replica-install fails with ERROR 400 Client Error when master has httpd 2.4.33-2.fc27 * 7503 multiple occurrences of profileId in certprofile causes incorrect behaviour * 7505 WebUI tests: Extend netgroup tests * 7510 validate_selinuxuser does not allow a period in selinux user identifier * 7519 Adding SSH keys for AD users as I created overrides * 7520 ipa certmap-match throwing "ipa: ERROR: an internal error has occurred" * 7526 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain * 7535 ipa-restore fails because tmp/etc/ipa/ca.crt is missing * 7540 Extend WebUI test_krbpolicy suite with the following test cases: * 7542 CLI and Web UI allow to add more then one radius server into radius proxy * 7544 ui_tests: extend test_selinuxusermap.py suite * 7546 ui_tests: improve "field_validation" method * 7547 ui_tests: checkbox click fix * 7550 [WebUI] extend host test suite == Detailed changelog since 4.6.3 == === Alexander Bokovoy (7) === * group-del: add a warning to logs when password policy could not be removed * pylint3: workaround false positives reported for W1662 * idoverrideuser-add: allow adding ssh key in web ui * ACL: Allow hosts to remove services they manage * replication: support error messages from 389-ds 1.3.5 or later * upgrade: treat duplicate entry when updating as not an error * upgrade: Run configuration upgrade under empty ccache collection === Alexander Koksharov (2) === * Fix replica_promotion-domlevel0 test failures * preventing ldap principal to be deleted === Amit Kumar (3) === * ipa vault-archive overwrites an existing value without warning * Error message while adding idrange with untrusted domain * ipa-advise for smartcards updated === Aleksei Slaikovskii (3) === * Radius proxy multiservers fix * Enable and start oddjobd after ipa-restore if it's not running. * Fixing translation problems === Christian Heimes (27) === * Revert "Validate the Directory Manager password" * Load certificate files as binary data * Use single Custodia instance in installers * Add nsds5ReplicaReleaseTimeout to replica config * Provide ldap_uri in Custodia uninstaller * Defer import of ipaclient.csrgen * Require more recent glibc on F27 * More cleanup after uninstall * Pylint 1.8.3 fixes * Relax message check in test_create_host_with_ip * freeipa-server no longer supports i686 arch on F28 * Unified ldap_initialize() function * Fix multiple uninstallation of server * Fix i18n test for Chinese translation * Run API and ACI under Python 2 and 3 * Generate same API.txt under Python 2 and 3 * Replace wsgi package conflict with config file * Restart named-pkcs11 after KRA installation * Update existing 389-DS cn=RSA,cn=encryption config * Bump python-ldap version to fix syncrepl bug * Bump SELinux policy for DNSSEC * ipa-server-upgrade now checks custodia server keys * DNSSEC code cleanup * DNSSEC: Reformat lines to address PEP8 violations * Decode ODS commands * Run DNSSEC under Python 3 * More DNSSEC house keeping === Felipe Barreto (16) === * Adding xfail to failing tests * Fixing TestBackupAndRestore::test_full_backup_and_restore_with_removed_users * Adding GSSPROXY_CONF to be backed up on ipa-backup * Fixing cleanup process in test_caless * WebUI Tests: changing the ActionsChains.move_to_element to a new approach * WebUI Tests: fixing test_user.py::test_test_noprivate_posix * WebUI Tests: Changing how the initial load process is done * WebUI Tests: fixing test_range test case * WebUI Tests: changing how the login screen is detected * WebUI Tests: refactoring login method to be more readable * WebUI Tests: fixing test_navigation * WebUI Tests: fixing test_group * WebUI Tests: fixing test_hbac * Check if replication agreement exist before enable/disable it * Make IntegrationTest fail if an error happened during uninstall * IntegrationTests now collects logs from all test methods === Florence Blanc-Renaud (9) === * Test for 7526 * ipa-server-install: publish complete cert chain in /usr/share/ipa/html/ca.crt * ACI: grant access to admins group instead of admin user * ipa-replica-install: make sure that certmonger picks the right master * ipa-server-install: handle error when calling kdb5_util create * ipa host-add: do not raise exception when reverse record not added * 389-ds OTP lasttoken plugin: Add unit test * User must not be able to delete his last active otp token * ipa host-add --ip-address: properly handle NoNameservers === Fraser Tweedale (14) === * csrgen: fix when attribute shortname is lower case * csrgen: drive-by docstring * csrgen: support initialising OpenSSL adaptor with key object * py3: fix csrgen error handling * certprofile: add tests for config profileId scenarios * certprofile: reject config with multiple profileIds * install: configure dogtag status request timeout * Fix upgrade (update_replica_config) in single master mode * replica-install: warn when there is only one CA in topology * ldap2: fix implementation of can_add * ipaldap: allow GetEffectiveRights on individual operations * Update IPA CA issuer DN upon renewal * cert-request: avoid internal error when cert malformed * Improve warning message for malformed certificates === Ganna Kaihorodova (3) === * Fix trust tests for Posix Support * Fix in IPA's multihost fixture * Overide trust methods for integration tests === Martin Basti (2) === * py3: bindmgr: fix iteration over bytes * py3: ipa-dnskeysyncd: fix bytes issues === Michal Reznik (33) === * ui_tests: add click_undo_button() func * ui_tests: extend test_selinuxusermap.py suite * ui_tests: improve "field_validation" method * ui_tests: checkbox click fix * ui_tests: introduce new test_misc cases file * ui_driver: extension and modifications related to test_user * ui_tests: extend test_user suite * test_web_ui: extend ui_driver methods * test_webui: add user life-cycles tests * ui_tests: run ipa-get/rmkeytab command on UI host * ui_tests: select_combobox() fixes * ui_tests: test cancel and delete without button * ui_tests: make associations cancelable * ui_tests: add function to run cmd on UI host * ui_tests: add funcs to add/remove users public SSH key * ui_tests: add assert_field_required() * ui_tests: add assert_notification() * ui_tests: add more test cases * ui_tests: add more test cases to test_certification * ui_tests: add_service() support func in test_service * ui_tests: add_host() support func in test_service * ui_tests: change get_http_pkey() function * test_caless: adjust try/except to capture also IOError * ipa_tests: test signing request with subca on replica * test_caless: test PKINIT install and anchor update * tests: move CA related modules to pytest_plugins * test_external_ca: selfsigned->ext_ca->selfsigned * test_tasks: add sign_ca_and_transport() function * paths: add IPA_CACERT_MANAGE and IPA_CERTUPDATE constants * test_renewal_master: add ipa csreplica-manage test * test_help: test "help" command without cache * test_x509: test very long OID * ipa_tests: test subca key replication === Varun Mylaraiah (4) === * Extend WebUI test_krbpolicy suite with the following test cases: test_verifying_button (verify button's action in various scenarios) test_negative_value (verify invalid values) test_verifying_measurement_unit * WebUI tests: Extend netgroup tests with more scenarios * Fixed improper clean-up in test_host::test_kerberos_flags added closing the notification in kerberos flags * WebUI tests: Extend user group tests with more scenarios === Mohammad Rizwan Yusuf (5) === * Test to check second replica installation after master restore * Updated the TestExternalCA with the functions introduced for the steps of external CA installation. * When the dirsrv service, which gets started during the first ipa-server-install --external-ca phase, is not running when the second phase is run with --external-cert-file options, the ipa-server-install command fail. * Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-<instance>/ldif/<instance>-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root. * IANA reserved IP address can not be used as a forwarder. This test checks if ipa server installation throws an error when 0.0.0.0 is specified as forwarder IP address. === Nathaniel McCallum (3) === * Revert "Don't allow OTP or RADIUS in FIPS mode" * Increase the default token key size * Fix OTP validation in FIPS mode === Petr Čech (1) === * webui:tests: Add tests for realmd domains === Pavel Picka (2) === * Adding WebUI Host test cases * WebUI Hostgroups tests cases added === Petr Vobornik (8) === * Fix test_server_del::TestLastServices * server-del do not return early if CA renewal master cannot be changed * webui: refresh complex pages after modification * webui tests: fix test_host:test_crud failure * webui:tests: close big notifications in realm domains tests * webui:tests: realm domain add with DNS check * webui:tests: move DNS test data to separate file * fastcheck: do not test context in pycodestyle === Rob Crittenden (18) === * Disable Schema Compat plugin during server upgrade * Add tests for ipa-restore with DM password validation check * Validate the Directory Manager password before starting restore * Don't try to set Kerberos extradata when there is no principal * Require mod_nss 1.0.14-7 to fix reverse proxy in mod_nss * Validate the Directory Manager password before starting restore * Log service start/stop/restart message * Update project metadata in ipasetup.py.in * Redirect CRL requests to the http port, not the https port * Allow dot as a valid character in an selinux identity name * Break out of teardown in test_replica_promotion.py if no config * Remove the Continuous installer class, it is unused * Return a value if exceptions are raised in server uninstall * Don't try to backup CS.cfg during upgrade if CA is not configured * Don't return None on mismatched interactive passwords * Fix detection of KRA installation so upgrades can succeed * Move Requires: pythonX-sssdconfig into conditional === Robbie Harwood (2) === * Fix elements not being removed in otpd_queue_pop_msgid() * Log errors from NSS during FIPS OTP key import === Sumit Bose (2) === * ipa-kdb: update trust information in all workers * ipa-kdb: use magic value to check if ipadb is used === John L (1) === * Remove special characters in host_add random OTP generation === Stanislav Laznicka (7) === * Travis: ignore 'line break after binary operator' * Allow user administrator to change user homedir * Add absolute_import future imports * Travis: test IPA 4.6 on F27 * replica-install: pass --ip-address to client install * Remove py35 env from tox testing * vault: fix vault-retrieve to a file === Tomas Krizek (2) === * py3 dnssec: convert hexlify to str * py3: bindmgr: fix bytes issues

1 0

[freeipa PR#1994][opened] [Backport][ipa-4-6]Extended UI test for selfservice permission
by mrizwan93 12 Jun '18

12 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1994 Author: mrizwan93 Title: #1994: [Backport][ipa-4-6]Extended UI test for selfservice permission Action: opened PR body: """ Follwoing scenario added: - test_add_all_attr - test_add_and_add_another - test_add_and_edit - test_add_and_cancel - test_add_permission_undo - test_add_permission_reset - test_permission_negative - test_del_multiple_permission - test_permission_using_enter_key - test_reset_sshkey_permsission Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> Reviewed-By: Petr Vobornik <pvoborni(a)redhat.com> (cherry picked from commit 3927b0e7b1a6de1734d2e3b4e283dcc7d3f0a406) """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1994/head:pr1994 git checkout pr1994

2 1

[freeipa PR#1996][opened] Fix API Browser commands description
by stanislavlevin 12 Jun '18

12 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1996 Author: stanislavlevin Title: #1996: Fix API Browser commands description Action: opened PR body: """ On Web UI API Browser some commands have no translated description or have no description at all. To get list of such: 1) by curl receive JSON reply to json_metadata request 2) jq '.result.commands | keys[] as $k | "\($k), \(.[$k] | .doc)"' json-reply | grep -P '(, null|^[^а-яА-Я]*$)' Result: ``` batch command_defaults cosentry_add cosentry_del cosentry_find cosentry_mod cosentry_show dnsrecord_split_parts hbacrule_add_sourcehost hbacrule_remove_sourcehost i18n_messages kra_is_enabled schema vault_add_internal vault_archive_internal vault_mod_internal vault_retrieve_internal aci_add aci_del aci_find aci_mod aci_rename aci_show ca_is_enabled dns_is_enabled dnsrecord_delentry idrange_add idrange_mod join json_metadata permission_add_member permission_remove_member privilege_remove_member session_logout ``` Cause: the command description is taken from python docstring. Thus commands should have them and should include the callings of gettext to be translated. This patch fix it. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1996/head:pr1996 git checkout pr1996

2 1

[freeipa PR#2010][opened] [testing_master] Nightly PR
by freeipa-pr-ci 12 Jun '18

12 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2010 Author: freeipa-pr-ci Title: #2010: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2010/head:pr2010 git checkout pr2010

1 1

[freeipa PR#2017][opened] Split external_ca PR-CI into two jobs
by tiran 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2017 Author: tiran Title: #2017: Split external_ca PR-CI into two jobs Action: opened PR body: """ The external_ca job takes about 38 minutes of testing. Split the tests into TestExternalCA (~17 minutes) and TestSelfExternalSelf + TestExternalCAInstall (~20 minutes). Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2017/head:pr2017 git checkout pr2017

1 1

[freeipa PR#2016][opened] [Backport][ipa-4-6] Suppress missing cn=schema compat on installation
by tiran 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2016 Author: tiran Title: #2016: [Backport][ipa-4-6] Suppress missing cn=schema compat on installation Action: opened PR body: """ This PR was opened automatically because PR #2009 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2016/head:pr2016 git checkout pr2016

2 1

[freeipa PR#2015][opened] [Backport][ipa-4-6] Uninstall fix for named-pkcs11
by tiran 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2015 Author: tiran Title: #2015: [Backport][ipa-4-6] Uninstall fix for named-pkcs11 Action: opened PR body: """ This PR was opened automatically because PR #1987 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2015/head:pr2015 git checkout pr2015

1 1

[freeipa PR#2009][opened] Suppress missing cn=schema compat on installation
by rcritten 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2009 Author: rcritten Title: #2009: Suppress missing cn=schema compat on installation Action: opened PR body: """ The schema compat plugin is disabled on upgrades but it is possible that it is not configured at all and this will produce a rather nasty looking error message. Check to see if it is configured at all before trying to disable it. https://pagure.io/freeipa/issue/6610 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2009/head:pr2009 git checkout pr2009

2 1

[freeipa PR#1987][opened] Uninstall fix for named-pkcs11
by slaykovsky 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1987 Author: slaykovsky Title: #1987: Uninstall fix for named-pkcs11 Action: opened PR body: """ Sometimes named-pkcs11 is not being stopped or reloaded during uninstall and it causes a lot of problems while testing, for example, backup and restore tests are failing because of ipa-server-install fails on checking DNS step. Also reverting 415578a19 as it's not needed anymore and additional uninstall/install take a lot of time. Fixes backup/restore tests runs. Maybe something else. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1987/head:pr1987 git checkout pr1987

2 1

[freeipa PR#1976][opened] Make Python 2 build dependency optional
by tiran 11 Jun '18

11 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1976 Author: tiran Title: #1976: Make Python 2 build dependency optional Action: opened PR body: """ The specfile now uses three variables to determinate how to handle Python support. with_python2: build python2-ipa* packages with_python3: build python3-ipa* packages with_default_python: use Python 3 or 2 for commands and packages "with_default_python=3" is the default build flavor. "with_python3=1" implies "with_default_python=2". Python 2 packages are still built on Fedora by default. The patch also cleans up and fixes additional issues: * makeapi/makeaci require Python 3 * remove checks for unsupported distros like F27 * sort dependencies and remove duplicates * remove python3-memcached dependency * remove svrcore-devel dependency * don't assume that gcc, make, and pkgconfig are provided by default * fix packaging bug with ipa-test-* commands. Unversioned ipa-run-test were packages with Python 2 RPMs although they had a Python 3 shebang. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1565263 Fixes: https://pagure.io/freeipa/issue/7500 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1976/head:pr1976 git checkout pr1976

2 1

[freeipa PR#2012][opened] Use one Custodia peer to retrieve all secrets
by tiran 10 Jun '18

10 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2012 Author: tiran Title: #2012: Use one Custodia peer to retrieve all secrets Action: opened PR body: """ Fix 994f71ac8a1bb7ba6bc9caf0f6e4f59af44ad9c4 was incomplete. Under some circumstancs the DM hash and CA keys were still retrieved from two different machines. Custodia client now uses a single remote to upload keys and download all secrets. Fixes: https://pagure.io/freeipa/issue/7518 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2012/head:pr2012 git checkout pr2012

1 1

[freeipa PR#2011][opened] Use one Custodia peer to retrieve all secrets
by tiran 10 Jun '18

10 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2011 Author: tiran Title: #2011: Use one Custodia peer to retrieve all secrets Action: opened PR body: """ Fix 994f71ac8a1bb7ba6bc9caf0f6e4f59af44ad9c4 was incomplete. Under some circumstancs the DM hash and CA keys were still retrieved from two different machines. Custodia client now uses a single remote to upload keys and download all secrets. Fixes: https://pagure.io/freeipa/issue/7518 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2011/head:pr2011 git checkout pr2011

1 1

[freeipa PR#2001][opened] Use one Custodia peer to retrieve all secrets
by tiran 10 Jun '18

10 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2001 Author: tiran Title: #2001: Use one Custodia peer to retrieve all secrets Action: opened PR body: """ Fix 994f71ac8a1bb7ba6bc9caf0f6e4f59af44ad9c4 was incomplete. Under some circumstancs the DM hash and CA keys were still retrieved from two different machines. Custodia client now uses a single remote to upload keys and download all secrets. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2001/head:pr2001 git checkout pr2001

1 1

[freeipa PR#1998][opened] [testing_master] Nightly PR
by freeipa-pr-ci 09 Jun '18

09 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1998 Author: freeipa-pr-ci Title: #1998: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1998/head:pr1998 git checkout pr1998

1 1

[Design draft] Promoting replica to CRL master
by Standa Laznicka 08 Jun '18

08 Jun '18

Hello people of the freeipa-devel channel, Let me share a design that proposes a way of automating the way FreeIPA replicas would be promoted to become a CRL master. Since the configuration cannot be dynamically altered by modifying an entry in the LDAP database, the proposal is to create an ipa-advise extension that could handle this operation instead for now. Read all about it in the attachement. Looking forward to your comments, Stanislav Láznička -- Standa Láznička A Red Hat person PGP: 8B00 620A 713B 714E B4CB 4767 C98C 4149 36B1 A7F3

4 12

[DRAFT] IPA 4.6.4 release notes
by Rob Crittenden 08 Jun '18

08 Jun '18

{{ReleaseDate|2018-06-08}} The FreeIPA team would like to announce FreeIPA 4.6.4 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 27 will be available soon. == Highlights in 4.6.4 == * Several changes to upgrade process so it will be more robust: * The schema compat plugin is disabled during upgrades * Verify the Custodia keys * Handle entries that already exist when adding new ones * Run the upgrade in an empty ccache * Don't try to backup CS.cfg during upgrade if CA is not configured * Properly detect whether a KRA is configured * Updated translations * Set nsds5ReplicaReleaseTimeout to avoid monopolization of a master during replication === Bug fixes === FreeIPA 4.6.4 is a stabilization release for the features delivered as a part of 4.6.0. There are more than 100 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 5638 Port client code to Python 3 * 5776 webui: some data disappear from user details page after the save action is performed * 5813 ipa-kra-install disrupts bind-dyndb-ldap * 5922 ipa vault-archive overwrites an existing value without warning * 6525 makeapi & makeaci under Python 2/3 generate different files * 6531 Refactor the execution flow of `cert-request` command * 6609 A CA administrator fails to add CA for Insufficient 'add' privilege * 6721 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process * 6851 Don't use ctypes.util.find_library in ipaclient * 7012 Users can delete their last active OTP token * 7131 Finish Python3 support * 7136 ipa-restore command doesn't exit with failure if wrong directory manager's password is provided * 7240 ipa-dnskeysyncd broken (and ipactl doesn't tell) * 7313 trust integration tests need to override test_establish_trust method when using different trust-add options * 7314 Update package metadata * 7330 ipa-server-install --uninstall does not return error code on error * 7335 Integration tests are not collecting all logs * 7342 admins group is not including all permissions of Role "User Administrator" * 7357 IntegrationTests do not fail even if the uninstall process fails * 7359 [RFE] extend topology plugin to clean up a removed replica ldap/ principal * 7371 uninstalling replica leaves orphained data in ldap * 7374 IPA 'Generate OTP' option in web gui does not show OTP code when no reverse zone is managed * 7380 Possible regression for limited OTP characters in host-add * 7383 user-add: user creation proceeds when password is wrong * 7389 F-27 upgrade to 4.6.3-1 fails with KRA update * 7390 cert-request: issuance of malformed certificate causes IPA Internal Error * 7393 Installing 4.6.3-1 in rawhide/F28 fails with DuplicateEntry enabling TLS in 389-ds * 7394 file conflicts between python2-mod_wsgi and freeipa-server * 7397 ipa host-add --ip-address... returns Internal error when forward-policy=none is defined * 7411 Simplify CA, TLS and bytes warning configuration of LDAP connections * 7424 Improve Realm Domains doc text * 7425 ipa-server-install with different IP fails on /usr/sbin/pkispawn -s CA * 7432 make fasttest fails on fresh clone. fedora26 * 7433 CRL url on replicas gets incorrectly redirected * 7436 ipa: Please log something after restarting the KDC * 7447 test_create_host_with_ip is not fully covering possible return errors * 7463 test_webui: add user life-cycles tests * 7468 test_host.py::test_host::test_crud is failing in nightly tests * 7472 ipa: ERROR: Could not get SOA serial interactively * 7473 ERROR: No valid Negotiate header in server response * 7474 ipa-server-install --uninstall on replica fails with "NoOptionError: No option 'ldap_uri' in section: 'global'" * 7485 Extending webui user group test * 7493 ipa-replica-install fails with ERROR 400 Client Error when master has httpd 2.4.33-2.fc27 * 7503 multiple occurrences of profileId in certprofile causes incorrect behaviour * 7505 WebUI tests: Extend netgroup tests * 7510 validate_selinuxuser does not allow a period in selinux user identifier * 7519 Adding SSH keys for AD users as I created overrides * 7520 ipa certmap-match throwing "ipa: ERROR: an internal error has occurred" * 7526 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain * 7535 ipa-restore fails because tmp/etc/ipa/ca.crt is missing * 7540 Extend WebUI test_krbpolicy suite with the following test cases: * 7542 CLI and Web UI allow to add more then one radius server into radius proxy * 7544 ui_tests: extend test_selinuxusermap.py suite * 7546 ui_tests: improve "field_validation" method * 7547 ui_tests: checkbox click fix * 7550 [WebUI] extend host test suite == Detailed changelog since 4.6.3 == === Alexander Bokovoy (7) === * group-del: add a warning to logs when password policy could not be removed * pylint3: workaround false positives reported for W1662 * idoverrideuser-add: allow adding ssh key in web ui * ACL: Allow hosts to remove services they manage * replication: support error messages from 389-ds 1.3.5 or later * upgrade: treat duplicate entry when updating as not an error * upgrade: Run configuration upgrade under empty ccache collection === Alexander Koksharov (2) === * Fix replica_promotion-domlevel0 test failures * preventing ldap principal to be deleted === Amit Kumar (3) === * ipa vault-archive overwrites an existing value without warning * Error message while adding idrange with untrusted domain * ipa-advise for smartcards updated === Aleksei Slaikovskii (3) === * Radius proxy multiservers fix * Enable and start oddjobd after ipa-restore if it's not running. * Fixing translation problems === Christian Heimes (27) === * Revert "Validate the Directory Manager password" * Load certificate files as binary data * Use single Custodia instance in installers * Add nsds5ReplicaReleaseTimeout to replica config * Provide ldap_uri in Custodia uninstaller * Defer import of ipaclient.csrgen * Require more recent glibc on F27 * More cleanup after uninstall * Pylint 1.8.3 fixes * Relax message check in test_create_host_with_ip * freeipa-server no longer supports i686 arch on F28 * Unified ldap_initialize() function * Fix multiple uninstallation of server * Fix i18n test for Chinese translation * Run API and ACI under Python 2 and 3 * Generate same API.txt under Python 2 and 3 * Replace wsgi package conflict with config file * Restart named-pkcs11 after KRA installation * Update existing 389-DS cn=RSA,cn=encryption config * Bump python-ldap version to fix syncrepl bug * Bump SELinux policy for DNSSEC * ipa-server-upgrade now checks custodia server keys * DNSSEC code cleanup * DNSSEC: Reformat lines to address PEP8 violations * Decode ODS commands * Run DNSSEC under Python 3 * More DNSSEC house keeping === Felipe Barreto (16) === * Adding xfail to failing tests * Fixing TestBackupAndRestore::test_full_backup_and_restore_with_removed_users * Adding GSSPROXY_CONF to be backed up on ipa-backup * Fixing cleanup process in test_caless * WebUI Tests: changing the ActionsChains.move_to_element to a new approach * WebUI Tests: fixing test_user.py::test_test_noprivate_posix * WebUI Tests: Changing how the initial load process is done * WebUI Tests: fixing test_range test case * WebUI Tests: changing how the login screen is detected * WebUI Tests: refactoring login method to be more readable * WebUI Tests: fixing test_navigation * WebUI Tests: fixing test_group * WebUI Tests: fixing test_hbac * Check if replication agreement exist before enable/disable it * Make IntegrationTest fail if an error happened during uninstall * IntegrationTests now collects logs from all test methods === Florence Blanc-Renaud (9) === * Test for 7526 * ipa-server-install: publish complete cert chain in /usr/share/ipa/html/ca.crt * ACI: grant access to admins group instead of admin user * ipa-replica-install: make sure that certmonger picks the right master * ipa-server-install: handle error when calling kdb5_util create * ipa host-add: do not raise exception when reverse record not added * 389-ds OTP lasttoken plugin: Add unit test * User must not be able to delete his last active otp token * ipa host-add --ip-address: properly handle NoNameservers === Fraser Tweedale (14) === * csrgen: fix when attribute shortname is lower case * csrgen: drive-by docstring * csrgen: support initialising OpenSSL adaptor with key object * py3: fix csrgen error handling * certprofile: add tests for config profileId scenarios * certprofile: reject config with multiple profileIds * install: configure dogtag status request timeout * Fix upgrade (update_replica_config) in single master mode * replica-install: warn when there is only one CA in topology * ldap2: fix implementation of can_add * ipaldap: allow GetEffectiveRights on individual operations * Update IPA CA issuer DN upon renewal * cert-request: avoid internal error when cert malformed * Improve warning message for malformed certificates === Ganna Kaihorodova (3) === * Fix trust tests for Posix Support * Fix in IPA's multihost fixture * Overide trust methods for integration tests === Martin Basti (2) === * py3: bindmgr: fix iteration over bytes * py3: ipa-dnskeysyncd: fix bytes issues === Michal Reznik (33) === * ui_tests: add click_undo_button() func * ui_tests: extend test_selinuxusermap.py suite * ui_tests: improve "field_validation" method * ui_tests: checkbox click fix * ui_tests: introduce new test_misc cases file * ui_driver: extension and modifications related to test_user * ui_tests: extend test_user suite * test_web_ui: extend ui_driver methods * test_webui: add user life-cycles tests * ui_tests: run ipa-get/rmkeytab command on UI host * ui_tests: select_combobox() fixes * ui_tests: test cancel and delete without button * ui_tests: make associations cancelable * ui_tests: add function to run cmd on UI host * ui_tests: add funcs to add/remove users public SSH key * ui_tests: add assert_field_required() * ui_tests: add assert_notification() * ui_tests: add more test cases * ui_tests: add more test cases to test_certification * ui_tests: add_service() support func in test_service * ui_tests: add_host() support func in test_service * ui_tests: change get_http_pkey() function * test_caless: adjust try/except to capture also IOError * ipa_tests: test signing request with subca on replica * test_caless: test PKINIT install and anchor update * tests: move CA related modules to pytest_plugins * test_external_ca: selfsigned->ext_ca->selfsigned * test_tasks: add sign_ca_and_transport() function * paths: add IPA_CACERT_MANAGE and IPA_CERTUPDATE constants * test_renewal_master: add ipa csreplica-manage test * test_help: test "help" command without cache * test_x509: test very long OID * ipa_tests: test subca key replication === Varun Mylaraiah (4) === * Extend WebUI test_krbpolicy suite with the following test cases: test_verifying_button (verify button's action in various scenarios) test_negative_value (verify invalid values) test_verifying_measurement_unit * WebUI tests: Extend netgroup tests with more scenarios * Fixed improper clean-up in test_host::test_kerberos_flags added closing the notification in kerberos flags * WebUI tests: Extend user group tests with more scenarios === Mohammad Rizwan Yusuf (5) === * Test to check second replica installation after master restore * Updated the TestExternalCA with the functions introduced for the steps of external CA installation. * When the dirsrv service, which gets started during the first ipa-server-install --external-ca phase, is not running when the second phase is run with --external-cert-file options, the ipa-server-install command fail. * Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-<instance>/ldif/<instance>-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root. * IANA reserved IP address can not be used as a forwarder. This test checks if ipa server installation throws an error when 0.0.0.0 is specified as forwarder IP address. === Nathaniel McCallum (3) === * Revert "Don't allow OTP or RADIUS in FIPS mode" * Increase the default token key size * Fix OTP validation in FIPS mode === Petr Čech (1) === * webui:tests: Add tests for realmd domains === Pavel Picka (2) === * Adding WebUI Host test cases * WebUI Hostgroups tests cases added === Petr Vobornik (8) === * Fix test_server_del::TestLastServices * server-del do not return early if CA renewal master cannot be changed * webui: refresh complex pages after modification * webui tests: fix test_host:test_crud failure * webui:tests: close big notifications in realm domains tests * webui:tests: realm domain add with DNS check * webui:tests: move DNS test data to separate file * fastcheck: do not test context in pycodestyle === Rob Crittenden (18) === * Disable Schema Compat plugin during server upgrade * Add tests for ipa-restore with DM password validation check * Validate the Directory Manager password before starting restore * Don't try to set Kerberos extradata when there is no principal * Require mod_nss 1.0.14-7 to fix reverse proxy in mod_nss * Validate the Directory Manager password before starting restore * Log service start/stop/restart message * Update project metadata in ipasetup.py.in * Redirect CRL requests to the http port, not the https port * Allow dot as a valid character in an selinux identity name * Break out of teardown in test_replica_promotion.py if no config * Remove the Continuous installer class, it is unused * Return a value if exceptions are raised in server uninstall * Don't try to backup CS.cfg during upgrade if CA is not configured * Don't return None on mismatched interactive passwords * Fix detection of KRA installation so upgrades can succeed * Move Requires: pythonX-sssdconfig into conditional === Robbie Harwood (2) === * Fix elements not being removed in otpd_queue_pop_msgid() * Log errors from NSS during FIPS OTP key import === Sumit Bose (2) === * ipa-kdb: update trust information in all workers * ipa-kdb: use magic value to check if ipadb is used === John L (1) === * Remove special characters in host_add random OTP generation === Stanislav Laznicka (7) === * Travis: ignore 'line break after binary operator' * Allow user administrator to change user homedir * Add absolute_import future imports * Travis: test IPA 4.6 on F27 * replica-install: pass --ip-address to client install * Remove py35 env from tox testing * vault: fix vault-retrieve to a file === Tomas Krizek (2) === * py3 dnssec: convert hexlify to str * py3: bindmgr: fix bytes issues

1 0

[freeipa PR#2003][opened] [Backport][ipa-4-6] Adding xfail to failing tests
by stlaz 08 Jun '18

08 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2003 Author: stlaz Title: #2003: [Backport][ipa-4-6] Adding xfail to failing tests Action: opened PR body: """ The tests listed below are failing and we do not have time to debug them and understand why. Adding xfail to keep it green. TestInstallDNSSECLast::test_disable_reenable_signing_master TestInstallDNSSECLast::test_disable_reenable_signing_replica TestInstallDNSSECFirst::test_chain_of_trust """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2003/head:pr2003 git checkout pr2003

1 1

[freeipa PR#1999][opened] ui_tests: fixes for issues with sending key and focus on element
by Rezney 08 Jun '18

08 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1999 Author: Rezney Title: #1999: ui_tests: fixes for issues with sending key and focus on element Action: opened PR body: """ Fixes 2 issues in WebUI tests. One issue is that we are unable to confirm a dialog by "Enter" keyboard - "actions.click()" helps here to get focus on the page. Second issue is probbaly related to screen resolution as we cannot click to some of the action buttons (buttons which are having issue varies). """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1999/head:pr1999 git checkout pr1999

1 1

[freeipa PR#2002][opened] [Backport][ipa-4-6] Disable Schema Compat plugin during server upgrade
by rcritten 08 Jun '18

08 Jun '18

URL: https://github.com/freeipa/freeipa/pull/2002 Author: rcritten Title: #2002: [Backport][ipa-4-6] Disable Schema Compat plugin during server upgrade Action: opened PR body: """ This PR was opened automatically because PR #1971 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2002/head:pr2002 git checkout pr2002

2 1

[freeipa PR#1990][opened] Use replace instead of add to set new default ipaSELinuxUserMapOrder
by rcritten 08 Jun '18

08 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1990 Author: rcritten Title: #1990: Use replace instead of add to set new default ipaSELinuxUserMapOrder Action: opened PR body: """ The add was in effect replacing whatever data was already there causing any custom order to be lost on each run of ipa-server-upgrade. https://pagure.io/freeipa/issue/6610 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1990/head:pr1990 git checkout pr1990

2 1

[freeipa PR#1971][opened] Disable Schema Compat plugin during server upgrade
by rcritten 07 Jun '18

07 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1971 Author: rcritten Title: #1971: Disable Schema Compat plugin during server upgrade Action: opened PR body: """ If this is enabled it can cause a deadlock with SSSD trying to look up entries and it trying to get data on AD users from SSSD. When reading the entry from LDIF try to get the camel-case nsslapd-pluginEnabled and fall back to the all lower-case nsslapd-pluginenabled if that is not found. It would be nice if the fetch function was case sensitive but this is likely overkill as it is, but better safe than blowing up. Upon restoring it will always write the camel-case version. https://pagure.io/freeipa/issue/6721 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1971/head:pr1971 git checkout pr1971

1 1

[freeipa PR#1914][opened] Fixing DNSSEC tests with restarting named
by felipevolpone 07 Jun '18

07 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1914 Author: felipevolpone Title: #1914: Fixing DNSSEC tests with restarting named Action: opened PR body: """ This commit fixes: - TestInstallDNSSECLast::test_disable_reenable_signing_master - TestInstallDNSSECLast::test_disable_reenable_signing_replica - TestInstallDNSSECFirst::test_chain_of_trust https://pagure.io/freeipa/issue/5670 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1914/head:pr1914 git checkout pr1914

2 1

[freeipa PR#1993][opened] [Backport][ipa-4-6] Validate the Directory Manager password in ipa-restore (take 2)
by rcritten 06 Jun '18

06 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1993 Author: rcritten Title: #1993: [Backport][ipa-4-6] Validate the Directory Manager password in ipa-restore (take 2) Action: opened PR body: """ Validate the DM password before starting the actual restoration if /etc/ipa/default.conf exists AND dirsrv is running. If default.conf exists and dirsrv is not running raise an error. Add two tests to validate this behavior. https://pagure.io/freeipa/issue/7535 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1993/head:pr1993 git checkout pr1993

2 1

Translated text is formed incorrectly
by Олеся Герасименко 06 Jun '18

06 Jun '18

Found a problem with how translated text is formed in the UI (API Browser). The translations are taken from several different segments of PO-file instead of the appropriate segments containing full phrases. It's OK for the English language, but poses a problem for languages where words are inflected for case. The details of the problem (incl. a screenshot): https://pagure.io/freeipa/issue/7581 Best regards, Olesya Gerasimenko

2 2

[freeipa PR#1951][opened] Cosmetic changes for ipa pwpolicy command
by amitkumar50 05 Jun '18

05 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1951 Author: amitkumar50 Title: #1951: Cosmetic changes for ipa pwpolicy command Action: opened PR body: """ If you try to change the value of the password policy to the same value as it already has then you will get an error: ipa: ERROR: no modifications to be performed. PR changes this error message to: ipa: ERROR: Stored value is same as provided https://pagure.io/freeipa/issue/362 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1951/head:pr1951 git checkout pr1951

2 1

[freeipa PR#1931][opened] Install shared templates for client setup too
by abbra 05 Jun '18

05 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1931 Author: abbra Title: #1931: Install shared templates for client setup too Action: opened PR body: """ This patchset updates a spec file and our Make files to allow installing shared templates for the client build as well. So far we only have a single template for krb5.conf.d (freeipa.template) but there might be potentially more coming in. This is a proper solution -- in Fedora 28/29 builds downstream I'm copying the files manually to avoid re-spinning a tarball with 4.7.0rc2. We still need to filter out client side templates from the server side in the spec file, so there is not a single place to define all files, unfortunately, but that's good enough for now as we have only a single file used by the client side. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1931/head:pr1931 git checkout pr1931

2 1

[freeipa PR#1953][opened] Move client templates to separate directory
by tiran 05 Jun '18

05 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1953 Author: tiran Title: #1953: Move client templates to separate directory Action: opened PR body: """ PR https://github.com/freeipa/freeipa/pull/1747 added the first template for FreeIPA client package. The template file was added to server templates, which broke client-only builds. The template is now part of a new subdirectory for client package shared data. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1953/head:pr1953 git checkout pr1953

2 1

[freeipa PR#1421][opened] Modifying --subject field in 'ipa help cert_find'
by amitkumar50 05 Jun '18

05 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1421 Author: amitkumar50 Title: #1421: Modifying --subject field in 'ipa help cert_find' Action: opened PR body: """ ipa cert_find command has an option called --subject. The option is documented as --subject=STR Subject. It is expected that a --subject option searches by X.509 subject field but it does not do so. It searches for CN not cert subject. Hence changing content of --subject help option. Resolves: https://pagure.io/freeipa/issue/7322 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1421/head:pr1421 git checkout pr1421

2 1

[DESIGN] Certificate revocation behaviour standardisation
by Fraser Tweedale 04 Jun '18

04 Jun '18

Hi all, Pursuant to recent discussions, here is a draft design[1] that formalises and (as of initial draft) proposes some changes to FreeIPA's certificate revocation behaviours. Nothing is set in stone. Every change is up for debate. There are some open questions (search for **TODO** and **QUESTION** in the document). The general idea is to eliminate inconsistency, redundancy, potential confusion, and command complexity in how revocation is handled in IPA, so that the commands and behaviours are easy for operators to understand. With the creation of this design proposal and the corresponding ticket[2], the ticket and PR[3][4] that began the recent discussion have been closed. [1] https://www.freeipa.org/page/V4/Certificate_revocation_behaviour_standardis… [2] https://pagure.io/freeipa/issue/7580 [3] https://pagure.io/freeipa/issue/7482 [4] https://github.com/freeipa/freeipa/pull/1915 Thanks, Fraser

1 0

[freeipa PR#1915][opened] Revoke existing certificate when a new one is issued by IPA CA
by rcritten 04 Jun '18

04 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1915 Author: rcritten Title: #1915: Revoke existing certificate when a new one is issued by IPA CA Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1915/head:pr1915 git checkout pr1915

2 1

[freeipa PR#1988][opened] Add test for --external-cert-file points to a non-existing file or invalid file.
by amore17 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1988 Author: amore17 Title: #1988: Add test for --external-cert-file points to a non-existing file or invalid file. Action: opened PR body: """ Reverts freeipa/freeipa#1978 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1988/head:pr1988 git checkout pr1988

1 1

[freeipa PR#1978][opened] ipa-ca-install invalid input for option --external-cert-file
by amore17 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1978 Author: amore17 Title: #1978: ipa-ca-install invalid input for option --external-cert-file Action: opened PR body: """ Signed-off-by: Anuja More <amore(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1978/head:pr1978 git checkout pr1978

1 1

[freeipa PR#1968][opened] [testing_master] Nightly PR
by freeipa-pr-ci 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1968 Author: freeipa-pr-ci Title: #1968: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1968/head:pr1968 git checkout pr1968

2 1

[freeipa PR#1887][opened] [testing_master_f28] Nightly PR
by freeipa-pr-ci 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1887 Author: freeipa-pr-ci Title: #1887: [testing_master_f28] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1887/head:pr1887 git checkout pr1887

2 1

[freeipa PR#1941][opened] Extended UI test for selfservice permission.
by mrizwan93 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1941 Author: mrizwan93 Title: #1941: Extended UI test for selfservice permission. Action: opened PR body: """ Follwoing scenario added: - test_add_all_attr - test_add_and_add_another - test_add_and_edit - test_add_and_cancel - test_add_permission_undo - test_add_permission_reset - test_permission_negative - test_del_multiple_permission - test_permission_using_enter_key - test_reset_sshkey_permsission Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1941/head:pr1941 git checkout pr1941

2 1

[freeipa PR#1981][opened] Add missing space in error string
by frasertweedale 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1981 Author: frasertweedale Title: #1981: Add missing space in error string Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1981/head:pr1981 git checkout pr1981

2 1

[freeipa PR#1982][opened] [Backport][ipa-4-6]ipa-server-install: publish complete cert chain in /usr/share/ipa/html/ca.crt
by flo-renaud 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1982 Author: flo-renaud Title: #1982: [Backport][ipa-4-6]ipa-server-install: publish complete cert chain in /usr/share/ipa/html/ca.crt Action: opened PR body: """ Manual backport to ipa-4-6 for PR #1952. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1982/head:pr1982 git checkout pr1982

2 1

[freeipa PR#1985][opened] [Backport][ipa-4-6] Fix elements not being removed in otpd_queue_pop_msgid()
by rcritten 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1985 Author: rcritten Title: #1985: [Backport][ipa-4-6] Fix elements not being removed in otpd_queue_pop_msgid() Action: opened PR body: """ This PR was opened automatically because PR #1980 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1985/head:pr1985 git checkout pr1985

1 1

[freeipa PR#1986][opened] [Backport][ipa-4-5] Fix elements not being removed in otpd_queue_pop_msgid()
by rcritten 01 Jun '18

01 Jun '18

URL: https://github.com/freeipa/freeipa/pull/1986 Author: rcritten Title: #1986: [Backport][ipa-4-5] Fix elements not being removed in otpd_queue_pop_msgid() Action: opened PR body: """ This PR was opened automatically because PR #1980 was pushed to master and backport to ipa-4-5 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1986/head:pr1986 git checkout pr1986

1 1