January 2020 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#4061][opened] doc/designs: Add a design page for application-specific passwords
by RichardKalinec 07 Mar '21

07 Mar '21

URL: https://github.com/freeipa/freeipa/pull/4061 Author: RichardKalinec Title: #4061: doc/designs: Add a design page for application-specific passwords Action: opened PR body: """ This design page describes a new enhancement: application-specific passwords and permissions management for them. Users will be able to have additional passwords besides the primary one, and set permissions for them specifying what systems and services will each application-specific password have access to. Application-specific passwords will also be usable with other authentication mechanisms incorporating passwords, namely otp, radius and hardened. They will also be supported by ipa-kdb for Kerberos authentication. https://pagure.io/freeipa/issue/4510 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4061/head:pr4061 git checkout pr4061

2 1

[freeipa PR#3275][opened] Issue 7975 - Accept 389-ds JSON replication status messages
by marcus2376 01 Dec '20

01 Dec '20

URL: https://github.com/freeipa/freeipa/pull/3275 Author: marcus2376 Title: #3275: Issue 7975 - Accept 389-ds JSON replication status messages Action: opened PR body: """ Description: 389-ds now stores a replication agreement status message in a JSON string in a new attribute: replicaLastInitStatusJSON replicaLastUpdateStatusJSON The original status attributes' values are not changing at this time, but there are plans to do so eventually as the old status format is confusing. http://www.port389.org/docs/389ds/design/repl-agmt-status-design.html https://pagure.io/freeipa/issue/7975 Reviewed by: ? """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3275/head:pr3275 git checkout pr3275

3 2

[freeipa PR#3774][opened] [DNSSEC] WIP Allow using of a custom OpenSSL engine for BIND
by stanislavlevin 31 Aug '20

31 Aug '20

URL: https://github.com/freeipa/freeipa/pull/3774 Author: stanislavlevin Title: #3774: [DNSSEC] WIP Allow using of a custom OpenSSL engine for BIND Action: opened PR body: """ For now Debian, Fedora, RHEL, etc. build BIND with 'native PKCS11' support. Till recently, that was the strict requirement of DNSSEC. The problem is that this restricts cross-platform features of FreeIPA. With the help of libp11, which provides `pkcs11` engine plugin for the OpenSSL library for accessing PKCS11 modules in a semi- transparent way, FreeIPA could utilize OpenSSL version of BIND. BIND in turn provides ability to specify the OpenSSL engine on the command line of `named` and all the BIND `dnssec-*` tools by using the `-E engine_name`. Currently, this PR implements just an abstract ability. Actual configuration and tests results could be seen in my fork Azure Pipelines: https://dev.azure.com/slev0400/slev/_build/results?buildId=627&view=logs&j=… https://dev.azure.com/slev0400/slev/_build/results?buildId=627&view=logs&j=… Related: https://pagure.io/freeipa/issue/8094 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3774/head:pr3774 git checkout pr3774

2 1

[freeipa PR#3544][opened] [WIP] ipa-join: allowing call with jsonrpc into freeipa API
by mulatinho 09 Jul '20

09 Jul '20

URL: https://github.com/freeipa/freeipa/pull/3544 Author: mulatinho Title: #3544: [WIP] ipa-join: allowing call with jsonrpc into freeipa API Action: opened PR body: """ - Adding JSON-C and LibCURL library into configure.ac and Makefile.am - Creating a API call with option '-j' or '--jsonrpc' to make host join on FreeIPA with JSONRPC and libCURL. TODO: unenroll process with JSONRPC. To test the call: # kinit admin # ipa-join -s server.freeipa.ipadomain -j Debug: # ipa-join -s server.freeipa.ipadomain -j -d Related: https://pagure.io/freeipa/issue/7966 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3544/head:pr3544 git checkout pr3544

2 1

[freeipa PR#3832][opened] [WIP][PoC] Web UI: Use system jQuery bundle
by serg-cymbaluk 20 Apr '20

20 Apr '20

URL: https://github.com/freeipa/freeipa/pull/3832 Author: serg-cymbaluk Title: #3832: [WIP][PoC] Web UI: Use system jQuery bundle Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3832/head:pr3832 git checkout pr3832

1 1

[freeipa PR#4102][opened] [WIP] Debian: write out only one CA certificate per file
by yrro 08 Apr '20

08 Apr '20

URL: https://github.com/freeipa/freeipa/pull/4102 Author: yrro Title: #4102: [WIP] Debian: write out only one CA certificate per file Action: opened PR body: """ ca-certificates populates /etc/ssl/certs with symlinks to its input files and then runs 'openssl rehash' to create the symlinks that libssl uses to look up a CA certificate to see if it is trused. 'openssl rehash' ignores any files that contain more than one certificate: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945274>. With this change, we write out trusted CA certificates to /usr/local/share/ipa-ca, one certificate per file. Fixes: https://pagure.io/freeipa/issue/8106 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4102/head:pr4102 git checkout pr4102

2 1

[freeipa PR#3924][opened] ipatests: add test for sssd behavior with disabled trustdomains
by wladich 03 Apr '20

03 Apr '20

URL: https://github.com/freeipa/freeipa/pull/3924 Author: wladich Title: #3924: ipatests: add test for sssd behavior with disabled trustdomains Action: opened PR body: """ When a trusted subdomain is disabled in ipa, users from this domain should not be able to access resources ipa resources. Related to: https://pagure.io/SSSD/sssd/issue/4078 This PR also adds * utility function for getting sssd version on remore host * a context manager for declaring part of test as xfail """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3924/head:pr3924 git checkout pr3924

1 1

[freeipa PR#3487][opened] Allow rename of a host group
by abbra 31 Mar '20

31 Mar '20

URL: https://github.com/freeipa/freeipa/pull/3487 Author: abbra Title: #3487: Allow rename of a host group Action: opened PR body: """ Fixes: https://pagure.io/freeipa/issue/6783 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3487/head:pr3487 git checkout pr3487

1 1

[freeipa PR#4158][opened] Add pytest OpenSSH transport with password
by tiran 24 Mar '20

24 Mar '20

URL: https://github.com/freeipa/freeipa/pull/4158 Author: tiran Title: #4158: Add pytest OpenSSH transport with password Action: opened PR body: """ The pytest_multihost transport does not provide password-based authentication for OpenSSH transport. The OpenSSH command line tool has no API to pass in a password securely. The patch implements a custom transport that uses sshpass hack. It is not recommended for production but good enough for testing. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4158/head:pr4158 git checkout pr4158

2 1

[freeipa PR#2106][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by abbra 23 Mar '20

23 Mar '20

URL: https://github.com/freeipa/freeipa/pull/2106 Author: abbra Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2106/head:pr2106 git checkout pr2106

2 1

[freeipa PR#3724][opened] ipatests: Added testcase to check /var/log/ipahealthcheck directory contains healthcheck.log file
by menonsudhir 20 Mar '20

20 Mar '20

URL: https://github.com/freeipa/freeipa/pull/3724 Author: menonsudhir Title: #3724: ipatests: Added testcase to check /var/log/ipahealthcheck directory contains healthcheck.log file Action: opened PR body: """ ipatests: Added testcase to check /var/log/ipahealthcheck directory contains healthcheck.log file Issue: freeipa/freeipa-healthcheck#35 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3724/head:pr3724 git checkout pr3724

2 1

[freeipa PR#4078][opened] ipatests: lookup IPA object directly from LDAP on the IPA server
by amore17 17 Mar '20

17 Mar '20

URL: https://github.com/freeipa/freeipa/pull/4078 Author: amore17 Title: #4078: ipatests: lookup IPA object directly from LDAP on the IPA server Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4078/head:pr4078 git checkout pr4078

2 1

[freeipa PR#4000][opened] ipatests: Test if ipa-backup throws error if /var/lib/ipa/ runs out of space
by mrizwan93 16 Mar '20

16 Mar '20

URL: https://github.com/freeipa/freeipa/pull/4000 Author: mrizwan93 Title: #4000: ipatests: Test if ipa-backup throws error if /var/lib/ipa/ runs out of space Action: opened PR body: """ ipa-backup throws error when /var/lib/ipa runs out of space. Earlier the error was not so clear. Fix mentions about insufficient space. related : https://pagure.io/freeipa/issue/7647 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4000/head:pr4000 git checkout pr4000

1 1

[freeipa PR#3645][opened] ipatests: Added testcase to check that ipa-healthcheck tool displays warning if no range is set
by menonsudhir 12 Mar '20

12 Mar '20

URL: https://github.com/freeipa/freeipa/pull/3645 Author: menonsudhir Title: #3645: ipatests: Added testcase to check that ipa-healthcheck tool displays warning if no range is set Action: opened PR body: """ ipatests: Added testcase to check that ipa-healthcheck tool displays warning if no range is set. Issue: https://github.com/freeipa/freeipa-healthcheck/issues/60 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3645/head:pr3645 git checkout pr3645

2 3

[freeipa PR#3955][opened] ipatests: add test for SSSD updating expired cache items
by wladich 12 Mar '20

12 Mar '20

URL: https://github.com/freeipa/freeipa/pull/3955 Author: wladich Title: #3955: ipatests: add test for SSSD updating expired cache items Action: opened PR body: """ **Patch 1:** New test checks that sssd updates expired cahce values both for IPA domain and trusted AD domain. Related to: https://pagure.io/SSSD/sssd/issue/4012 **Patch 2:** ipatests: refactor sssd tests for cached_auth_timeout option No changes in test scenarios or coverage. Changes: * Renamed parameter user => user_origin for consistency with new tests * evaluate user name once per testcase to reduce copy-pastes * evauate wait time in a more natural way """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3955/head:pr3955 git checkout pr3955

2 1

[freeipa PR#3509][opened] [Backport][ipa-4-7] Profile-based system cert renewal
by frasertweedale 27 Feb '20

27 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3509 Author: frasertweedale Title: #3509: [Backport][ipa-4-7] Profile-based system cert renewal Action: opened PR body: """ Manual backport of #3316 to ipa-4-7. We may need to backport this change all the way to ipa-4-6 to allow us to change the IPA RA certificate profile on older releases. See also https://github.com/freeipa/freeipa/pull/3508 which is the ipa-4-7 backport PR. There were some trivial conflicts. There were substantive conflicts for two patches, but these were due to the switch from mod_nss to mod_ssl, and from NSSDB-based IPA RA cert to PEM files. Those patches were not relevant, and were dropped. https://pagure.io/freeipa/issue/7991 Do not rely on CI only; I will have to test this change myself so I'll add WIP label, and remove it when I'm satisfied. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3509/head:pr3509 git checkout pr3509

1 1

[freeipa PR#3508][opened] [Backport][ipa-4-7] Profile-based system cert renewal
by frasertweedale 27 Feb '20

27 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3508 Author: frasertweedale Title: #3508: [Backport][ipa-4-7] Profile-based system cert renewal Action: opened PR body: """ Manual backport of https://github.com/freeipa/freeipa/pull/3316 to ipa-4-7. We may need to backport this change all the way to ipa-4-6 to allow us to change the IPA RA certificate profile on older releases. Currently this change is on master and ipa-4-8, so ipa-4-7 is the next step. There were some trivial conflicts. The only substantive conflicts were in `dogtaginstance.py`. These were resolved by cherry-picking 8686cd3b4b69f725aee05c9cdd3034d7436055d3 ahead of the original patchset. https://pagure.io/freeipa/issue/7991 Do not rely on CI only; I will have to test this change myself so I'll add WIP label, and remove it when I'm satisfied. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3508/head:pr3508 git checkout pr3508

1 1

[freeipa PR#3976][opened] locations.py: fix divide by 0
by fcami 26 Feb '20

26 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3976 Author: fcami Title: #3976: locations.py: fix divide by 0 Action: opened PR body: """ If all IPA servers (or the first server) of a location have service weights == 0, the sum of the weights is zero leading to a division by zero in relative weight calculation. Detect the situation and set relative weight to 0 in this case. Fixes: https://pagure.io/freeipa/issue/8135 Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3976/head:pr3976 git checkout pr3976

2 1

[freeipa PR#4029][opened] Move modification of p11_child
by amore17 26 Feb '20

26 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4029 Author: amore17 Title: #4029: Move modification of p11_child Action: opened PR body: """ This PR is opened to debug time-out issue in nightly run : https://github.com/freeipa/freeipa/pull/4024 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4029/head:pr4029 git checkout pr4029

1 1

[freeipa PR#3849][opened] ipaserver/plugins/hbacrule: Add HBAC to memberservice_hbacsvc* labels
by t-woerner 24 Feb '20

24 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3849 Author: t-woerner Title: #3849: ipaserver/plugins/hbacrule: Add HBAC to memberservice_hbacsvc* labels Action: opened PR body: """ The labels for memberservice_hbacsvc and memberservice_hbacsvcgroup are only "Services" and "Service Groups" but they should be "HBAC Services" and "HBAC Service Groups". """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3849/head:pr3849 git checkout pr3849

2 1

[freeipa PR#4150][opened] ipatest: Test if certmonger reads the token in HSM
by mrizwan93 24 Feb '20

24 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4150 Author: mrizwan93 Title: #4150: ipatest: Test if certmonger reads the token in HSM Action: opened PR body: """ This is to ensure added HSM support for FreeIPA. This test adds certificate with sofhsm token and checks if certmonger is tracking it. related : https://pagure.io/certmonger/issue/125 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4150/head:pr4150 git checkout pr4150

2 1

[freeipa PR#3962][opened] Tests for backup-restore when pkg required missing
by kaleemsiddiqu 17 Feb '20

17 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3962 Author: kaleemsiddiqu Title: #3962: Tests for backup-restore when pkg required missing Action: opened PR body: """ Tests added for following bug https://pagure.io/freeipa/issue/7630 Signed-off-by: Kaleemullah Siddiqui <ksiddiqu(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3962/head:pr3962 git checkout pr3962

2 2

[freeipa PR#4052][opened] [Backport][ipa-4-6] ipatests: filter_users should be applied correctly if SSSD starts offline
by amore17 17 Feb '20

17 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4052 Author: amore17 Title: #4052: [Backport][ipa-4-6] ipatests: filter_users should be applied correctly if SSSD starts offline Action: opened PR body: """ This is manual back-port of : https://github.com/freeipa/freeipa/pull/3349 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4052/head:pr4052 git checkout pr4052

2 1

[freeipa PR#3896][opened] [WIP] Fix azure pipelines to use Fedora 31
by abbra 14 Feb '20

14 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3896 Author: abbra Title: #3896: [WIP] Fix azure pipelines to use Fedora 31 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3896/head:pr3896 git checkout pr3896

1 1

[freeipa PR#3999][opened] Fix typo in idrange.py docstring
by smartsammler 14 Feb '20

14 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3999 Author: smartsammler Title: #3999: Fix typo in idrange.py docstring Action: opened PR body: """ In my opinion the sentence makes more sense if one replaces this `id` with a `is`. If this is not what was meant, then I would be pleased if the sentence could be rephrased, so that I get it right. Thank you. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3999/head:pr3999 git checkout pr3999

2 1

[freeipa PR#4077][opened] Test paging
by amore17 14 Feb '20

14 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4077 Author: amore17 Title: #4077: Test paging Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4077/head:pr4077 git checkout pr4077

2 1

[freeipa PR#4149][opened] ipatests: Allow zero-length arguments
by stanislavlevin 14 Feb '20

14 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4149 Author: stanislavlevin Title: #4149: ipatests: Allow zero-length arguments Action: opened PR body: """ Currently, such arguments are eaten by 'ipa-run-tests' script as they are not quoted. For example, ```running ipa-run-tests -k ''``` results in the actual invocation would be like as: ``` ['/bin/sh', '--norc', '--noprofile', '-c', '--', "/usr/bin/python3 -c 'import sys,pytest;sys.exit(pytest.main())' -o " 'cache_dir=/tmp/pytest-of-root/pytest-12/test_ipa_run_tests_empty_expression0/.pytest_cache ' '--confcutdir=/usr/lib64/python3/site-packages/ipatests -k '] ``` Note: expressions or marks could be empty as a result of the building of command line args by more high-level tools, scripts, etc. So, a short-termed solution is the quotting of zero-length arguments. Fixes: https://pagure.io/freeipa/issue/8173 Signed-off-by: Stanislav Levin <slev(a)altlinux.org> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4149/head:pr4149 git checkout pr4149

2 1

[freeipa PR#3783][opened] Migrate xunit-style setups to fixtures
by stanislavlevin 12 Feb '20

12 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3783 Author: stanislavlevin Title: #3783: Migrate xunit-style setups to fixtures Action: opened PR body: """ This converts `setup*`/`teardown*` functions/methods to the powerfull pytest fixtures: ``` The purpose of test fixtures is to provide a fixed baseline upon which tests can reliably and repeatedly execute. pytest fixtures offer dramatic improvements over the classic xUnit style of setup/teardown functions: - fixtures have explicit names and are activated by declaring their use from test functions, modules, classes or whole projects. - fixtures are implemented in a modular manner, as each fixture name triggers a fixture function which can itself use other fixtures. - fixture management scales from simple unit to complex functional testing, allowing to parametrize fixtures and tests according to configuration and component options, or to re-use fixtures across function, class, module or whole test session scopes. ``` One of the transition patterns is as follows: ```diff class TestFooBar(XMLRPC_test): - @classmethod - def setup_class(cls): - super(TestFooBar, cls).setup_class() + @pytest.fixture(autouse=True, scope="class") + def foo_bar_setup(self, request, xmlrpc_setup): + cls = request.cls cls.beforemethod() - @classmethod - def teardown_class(cls): - cls.aftermethod() - super(TestFooBar, cls).teardown_class() + def fin(): + cls.aftermethod() + request.addfinalizer(fin) ``` To achieve predictable results for initialization and destroy of Pytest fixtures, ones have to employ the fixtures' interdependencies. This is the first part of the work to remove the mixing of test idioms in the IPA test suite. Related: https://pagure.io/freeipa/issue/7989 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3783/head:pr3783 git checkout pr3783

2 1

[freeipa PR#4179][opened] ipatests: update packages for rawhide and updates-testing nightlies
by flo-renaud 10 Feb '20

10 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4179 Author: flo-renaud Title: #4179: ipatests: update packages for rawhide and updates-testing nightlies Action: opened PR body: """ The nightly tests for rawhide and updates_testing are expected to set update_packages: True in all the job definitions to make sure that dnf/yum update is called before starting the tests. This tag was missing for some jobs, this commit fixes the issue. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4179/head:pr4179 git checkout pr4179

1 1

[freeipa PR#4162][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 09 Feb '20

09 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4162 Author: freeipa-pr-ci Title: #4162: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4162/head:pr4162 git checkout pr4162

1 1

[freeipa PR#3877][opened] [ipa-4-6] prci: bump template version
by netoarmando 05 Feb '20

05 Feb '20

URL: https://github.com/freeipa/freeipa/pull/3877 Author: netoarmando Title: #3877: [ipa-4-6] prci: bump template version Action: opened PR body: """ Template used: https://app.vagrantup.com/freeipa/boxes/ci-ipa-4-6-f27/versions/1.0.4 Installed packages updated, no other major change. Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3877/head:pr3877 git checkout pr3877

1 1

[freeipa PR#4180][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 05 Feb '20

05 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4180 Author: freeipa-pr-ci Title: #4180: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4180/head:pr4180 git checkout pr4180

1 1

[freeipa PR#4108][opened] Tier-1 test for ipa-healthcheck tool
by menonsudhir 04 Feb '20

04 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4108 Author: menonsudhir Title: #4108: Tier-1 test for ipa-healthcheck tool Action: opened PR body: """ Signed-off-by: sumenon <sumenon(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4108/head:pr4108 git checkout pr4108

2 1

[freeipa PR#4178][opened] "Unspecified GSS failure" should not be in log when mounted with krb5.
by amore17 04 Feb '20

04 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4178 Author: amore17 Title: #4178: "Unspecified GSS failure" should not be in log when mounted with krb5. Action: opened PR body: """ This is an integration test: When there is directory mounted on the ipa-client with sec=krb5 Then no "Unspecified GSS failure" should be in logs. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4178/head:pr4178 git checkout pr4178

2 1

[freeipa PR#4185][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 04 Feb '20

04 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4185 Author: freeipa-pr-ci Title: #4185: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4185/head:pr4185 git checkout pr4185

1 1

[freeipa PR#4161][opened] [testing_ipa-4.7] Nightly PR
by freeipa-pr-ci 02 Feb '20

02 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4161 Author: freeipa-pr-ci Title: #4161: [testing_ipa-4.7] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4161/head:pr4161 git checkout pr4161

1 1

[freeipa PR#4160][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 01 Feb '20

01 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4160 Author: freeipa-pr-ci Title: #4160: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4160/head:pr4160 git checkout pr4160

1 1

[freeipa PR#4183][opened] [Backport][ipa-4-8] Support KDB DAL version 8.0
by flo-renaud 01 Feb '20

01 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4183 Author: flo-renaud Title: #4183: [Backport][ipa-4-8] Support KDB DAL version 8.0 Action: opened PR body: """ This PR was opened automatically because PR #4126 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4183/head:pr4183 git checkout pr4183

2 1

[freeipa PR#4184][opened] DAL v8 fixups
by iboukris 01 Feb '20

01 Feb '20

URL: https://github.com/freeipa/freeipa/pull/4184 Author: iboukris Title: #4184: DAL v8 fixups Action: opened PR body: """ CC: @frozencemetery @abbra Per code review, untested. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4184/head:pr4184 git checkout pr4184

2 1

[freeipa PR#4175][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4175 Author: freeipa-pr-ci Title: #4175: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4175/head:pr4175 git checkout pr4175

1 1

[freeipa PR#4126][opened] Support KDB DAL version 8.0
by frozencemetery 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4126 Author: frozencemetery Title: #4126: Support KDB DAL version 8.0 Action: opened PR body: """ A krb5 build containing the 1.18 beta - which has this KDB version - can be found here for testing: https://koji.fedoraproject.org/koji/taskinfo?taskID=40498937 Note that samba isn't ready to go with KDB 8.0, so I don't think this can actually build. I've reached out to @iboukris to hopefully coordinate that. (This is based on #3842). """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4126/head:pr4126 git checkout pr4126

2 1

[freeipa PR#4167][opened] [Backport][ipa-4-6] Normalize test definations titles
by Gauravtalreja1 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4167 Author: Gauravtalreja1 Title: #4167: [Backport][ipa-4-6] Normalize test definations titles Action: opened PR body: """ Manual Backport of #4151 Signed-off-by: Gaurav Talreja <gtalreja(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4167/head:pr4167 git checkout pr4167

2 1

[freeipa PR#4168][opened] [Backport][ipa-4-7] Normalize test definations titles
by Gauravtalreja1 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4168 Author: Gauravtalreja1 Title: #4168: [Backport][ipa-4-7] Normalize test definations titles Action: opened PR body: """ Manual Backport of #4151 Signed-off-by: Gaurav Talreja <gtalreja(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4168/head:pr4168 git checkout pr4168

2 1

[freeipa PR#4169][opened] [Backport][ipa-4-8] Normalize test definations titles
by Gauravtalreja1 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4169 Author: Gauravtalreja1 Title: #4169: [Backport][ipa-4-8] Normalize test definations titles Action: opened PR body: """ Manual Backport of #4151 Signed-off-by: Gaurav Talreja <gtalreja(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4169/head:pr4169 git checkout pr4169

2 1

[freeipa PR#4182][opened] Test ipa-join using different options
by jayesh-garg 31 Jan '20

31 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4182 Author: jayesh-garg Title: #4182: Test ipa-join using different options Action: opened PR body: """ test ipa-join on client with passing differnt options like unenroll,hostname,bindpw. Signed-off-by: Jayesh Garg <jgarg(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4182/head:pr4182 git checkout pr4182

1 0

[freeipa PR#4166][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4166 Author: freeipa-pr-ci Title: #4166: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4166/head:pr4166 git checkout pr4166

1 1

[freeipa PR#4177][opened] [Backport][ipa-4-8] ipatests: add check for output contents of ipa-client-samba
by flo-renaud 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4177 Author: flo-renaud Title: #4177: [Backport][ipa-4-8] ipatests: add check for output contents of ipa-client-samba Action: opened PR body: """ This PR was opened automatically because PR #4164 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4177/head:pr4177 git checkout pr4177

1 1

[freeipa PR#4176][opened] [Backport][ipa-4-6] pkinit enable: use local dogtag only if host has CA
by flo-renaud 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4176 Author: flo-renaud Title: #4176: [Backport][ipa-4-6] pkinit enable: use local dogtag only if host has CA Action: opened PR body: """ Manual backport of PR #2076 to ipa-4-6 branch. Required because the issue https://pagure.io/freeipa/issue/7795 (ipa-pkinit-manage enable fails on replica if it doesn't host the CA) is also present on this branch. The fix was already backported to ipa-4-7+ branches. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4176/head:pr4176 git checkout pr4176

1 1

[freeipa PR#4174][opened] Normalize title of test external_ca in prci-defination
by Gauravtalreja1 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4174 Author: Gauravtalreja1 Title: #4174: Normalize title of test external_ca in prci-defination Action: opened PR body: """ Using external_ca titles make bit more sense rather than using external_ca1 and external_ca2 in prci-definations Issue : freeipa/freeipa-pr-ci#336 Signed-off-by: Gaurav Talreja <gauravtalreja1(a)gmail.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4174/head:pr4174 git checkout pr4174

2 2

[freeipa PR#4164][opened] ipatests: add check for output contents of ipa-client-samba
by wladich 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4164 Author: wladich Title: #4164: ipatests: add check for output contents of ipa-client-samba Action: opened PR body: """ Check that ipa-client-samba tool reports specific properties of domains: name, netbios name, sid and id range Related to https://pagure.io/freeipa/issue/8149 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4164/head:pr4164 git checkout pr4164

2 1

[freeipa PR#4172][opened] [Backport][ipa-4-6] Do not renew externally-signed CA as self-signed
by frasertweedale 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4172 Author: frasertweedale Title: #4172: [Backport][ipa-4-6] Do not renew externally-signed CA as self-signed Action: opened PR body: """ (manual backport of https://github.com/freeipa/freeipa/pull/4148) Commit 49cf5ec64b1b7a7437ca285430353473c215540e fixed a bug that prevented migration from externally-signed to self-signed IPA CA. But it introduced a subtle new issue: certmonger-initiated renewal renews an externally-signed IPA CA as a self-signed CA. To resolve this issue, introduce the `--force-self-signed' flag for the dogtag-ipa-ca-renew-agent script. Add another certmonger CA definition that calls this script with the `--force-self-signed' flag. Update dogtag-ipa-ca-renew-agent to only issue a self-signed CA certificate if the existing certificate is self-signed or if `--force-self-signed' was given. Update `ipa-cacert-manage renew' to supply `--force-self-signed' when appropriate. As a result of these changes, certmonger-initiated renewal of an externally-signed IPA CA certificate will not issue a self-signed certificate. Fixes: https://pagure.io/freeipa/issue/8176 Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4172/head:pr4172 git checkout pr4172

1 1

[freeipa PR#4171][opened] [Backport][ipa-4-7] Do not renew externally-signed CA as self-signed
by frasertweedale 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4171 Author: frasertweedale Title: #4171: [Backport][ipa-4-7] Do not renew externally-signed CA as self-signed Action: opened PR body: """ (manual backport of https://github.com/freeipa/freeipa/pull/4148) Commit 49cf5ec64b1b7a7437ca285430353473c215540e fixed a bug that prevented migration from externally-signed to self-signed IPA CA. But it introduced a subtle new issue: certmonger-initiated renewal renews an externally-signed IPA CA as a self-signed CA. To resolve this issue, introduce the `--force-self-signed' flag for the dogtag-ipa-ca-renew-agent script. Add another certmonger CA definition that calls this script with the `--force-self-signed' flag. Update dogtag-ipa-ca-renew-agent to only issue a self-signed CA certificate if the existing certificate is self-signed or if `--force-self-signed' was given. Update `ipa-cacert-manage renew' to supply `--force-self-signed' when appropriate. As a result of these changes, certmonger-initiated renewal of an externally-signed IPA CA certificate will not issue a self-signed certificate. Fixes: https://pagure.io/freeipa/issue/8176 Reviewed-By: Florence Blanc-Renaud <frenaud(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4171/head:pr4171 git checkout pr4171

1 1

[freeipa PR#4170][opened] [Backport][ipa-4-8] Do not renew externally-signed CA as self-signed
by frasertweedale 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4170 Author: frasertweedale Title: #4170: [Backport][ipa-4-8] Do not renew externally-signed CA as self-signed Action: opened PR body: """ This PR was opened automatically because PR #4148 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4170/head:pr4170 git checkout pr4170

1 1

[freeipa PR#4163][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 30 Jan '20

30 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4163 Author: freeipa-pr-ci Title: #4163: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4163/head:pr4163 git checkout pr4163

1 1

[freeipa PR#4173][opened] [Backport][ipa-4-6] ipatests: fix collection of tests from test_trust suite
by wladich 29 Jan '20

29 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4173 Author: wladich Title: #4173: [Backport][ipa-4-6] ipatests: fix collection of tests from test_trust suite Action: opened PR body: """ This is a manual backport of #4154 Commit 969b4c87 which added test_extdom_plugin case also mistakenly renamed class from TestTrust to BaseTestTrust. As pytest collects tests only from classes staring with "Test", no tests are now executed in test_trust module. Fixing by partially reverting said commit """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4173/head:pr4173 git checkout pr4173

1 1

[freeipa PR#4148][opened] Do not renew externally-signed CA as self-signed
by frasertweedale 29 Jan '20

29 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4148 Author: frasertweedale Title: #4148: Do not renew externally-signed CA as self-signed Action: opened PR body: """ Commit 49cf5ec64b1b7a7437ca285430353473c215540e fixed a bug that prevented migration from externally-signed to self-signed IPA CA. But it introduced a subtle new issue: certmonger-initiated renewal renews an externally-signed IPA CA as a self-signed CA. To resolve this issue, introduce the `--force-self-signed' flag for the dogtag-ipa-ca-renew-agent script. Add another certmonger CA definition that calls this script with the `--force-self-signed' flag. Update dogtag-ipa-ca-renew-agent to only issue a self-signed CA certificate if the existing certificate is self-signed or if `--force-self-signed' was given. Update `ipa-cacert-manage renew' to supply `--force-self-signed' when appropriate. As a result of these changes, certmonger-initiated renewal of an externally-signed IPA CA certificate will not issue a self-signed certificate. Fixes: https://pagure.io/freeipa/issue/8176 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4148/head:pr4148 git checkout pr4148

1 1

[freeipa PR#4145][opened] ipatests: fix collection of tests from test_trust suite
by wladich 29 Jan '20

29 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4145 Author: wladich Title: #4145: ipatests: fix collection of tests from test_trust suite Action: opened PR body: """ Commit 969b4c87 which added test_extdom_plugin case also mistakenly renamed class from TestTrust to BaseTestTrust. As pytest collects tests only from classes staring with "Test", no tests are now executed in test_trust module. Fixing by partially reverting said commit """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4145/head:pr4145 git checkout pr4145

1 1

[freeipa PR#4157][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 29 Jan '20

29 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4157 Author: freeipa-pr-ci Title: #4157: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4157/head:pr4157 git checkout pr4157

1 1

[freeipa PR#4165][opened] [Backport][ipa-4-8] Add delete option to ipa-cacert-manage to remove CA certificates
by rcritten 28 Jan '20

28 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4165 Author: rcritten Title: #4165: [Backport][ipa-4-8] Add delete option to ipa-cacert-manage to remove CA certificates Action: opened PR body: """ This PR was opened automatically because PR #4142 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4165/head:pr4165 git checkout pr4165

1 1

[freeipa PR#4142][opened] Add delete option to ipa-cacert-manage to remove CA certificates
by rcritten 28 Jan '20

28 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4142 Author: rcritten Title: #4142: Add delete option to ipa-cacert-manage to remove CA certificates Action: opened PR body: """ Before removing a CA re-verify all the other CAs to ensure that the chain is not broken. Provide a force option to handle cases where the CA is expired or verification fails for some other reason, or you really just want them gone. https://pagure.io/freeipa/issue/8124 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4142/head:pr4142 git checkout pr4142

1 1

[freeipa PR#4159][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 28 Jan '20

28 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4159 Author: freeipa-pr-ci Title: #4159: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4159/head:pr4159 git checkout pr4159

1 1

[freeipa PR#4151][opened] Normalize test definations titles
by Gauravtalreja1 27 Jan '20

27 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4151 Author: Gauravtalreja1 Title: #4151: Normalize test definations titles Action: opened PR body: """ This following test definations were having different titles in gating.yaml and nightly_latest_*.yaml, - test_caless.py::TestServerReplicaCALessToCAFull - test_dnssec.py::TestInstallDNSSECFirst - test_replica_promotion.py::TestSubCAkeyReplication Fix for : https://github.com/freeipa/freeipa-pr-ci/issues/336 Signed-off-by: Gaurav Talreja <gtalreja(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4151/head:pr4151 git checkout pr4151

2 1

[freeipa PR#4140][closed] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 25 Jan '20

25 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4140 Author: freeipa-pr-ci Title: #4140: [testing_ipa-4.8] Nightly PR Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4140/head:pr4140 git checkout pr4140

1 0

[freeipa PR#4153][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 25 Jan '20

25 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4153 Author: freeipa-pr-ci Title: #4153: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4153/head:pr4153 git checkout pr4153

1 1

[freeipa PR#4156][opened] [Backport][ipa-4-6] Add test_winsyncmigrate to nightly builds
by wladich 24 Jan '20

24 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4156 Author: wladich Title: #4156: [Backport][ipa-4-6] Add test_winsyncmigrate to nightly builds Action: opened PR body: """ This is a manual backport of #4113 The test suite test_winsyncmigrate was missing in nightly definitions because CI was lacking configuration needed for establishing winsync agreement: the Certificate Authority needs to be configured on Windows AD instance. Now that PR-CI is updated to include said changes, we can start executing this test suite. It is not reasonable to add it to gating as this suite is time consuming just like other tests requiring provisioning of AD instances. PRs with changes required for executing the test suite: freeipa/freeipa-pr-ci#323 freeipa/freeipa-pr-ci#335 Stability of the test suite was checked on a private prci runner: wladich#5 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4156/head:pr4156 git checkout pr4156

1 1

[freeipa PR#4155][opened] [Backport][ipa-4-7] Add test_winsyncmigrate to nightly builds
by wladich 24 Jan '20

24 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4155 Author: wladich Title: #4155: [Backport][ipa-4-7] Add test_winsyncmigrate to nightly builds Action: opened PR body: """ This is a manual backport of #4113 The test suite test_winsyncmigrate was missing in nightly definitions because CI was lacking configuration needed for establishing winsync agreement: the Certificate Authority needs to be configured on Windows AD instance. Now that PR-CI is updated to include said changes, we can start executing this test suite. It is not reasonable to add it to gating as this suite is time consuming just like other tests requiring provisioning of AD instances. PRs with changes required for executing the test suite: freeipa/freeipa-pr-ci#323 freeipa/freeipa-pr-ci#335 Stability of the test suite was checked on a private prci runner: wladich#5 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4155/head:pr4155 git checkout pr4155

1 1

[freeipa PR#4154][opened] [Backport][ipa-4-8] Add test_winsyncmigrate to nightly builds
by wladich 24 Jan '20

24 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4154 Author: wladich Title: #4154: [Backport][ipa-4-8] Add test_winsyncmigrate to nightly builds Action: opened PR body: """ This is a manual backport of #4113 The test suite test_winsyncmigrate was missing in nightly definitions because CI was lacking configuration needed for establishing winsync agreement: the Certificate Authority needs to be configured on Windows AD instance. Now that PR-CI is updated to include said changes, we can start executing this test suite. It is not reasonable to add it to gating as this suite is time consuming just like other tests requiring provisioning of AD instances. PRs with changes required for executing the test suite: freeipa/freeipa-pr-ci#323 freeipa/freeipa-pr-ci#335 Stability of the test suite was checked on a private prci runner: wladich#5 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4154/head:pr4154 git checkout pr4154

1 1

[freeipa PR#4135][opened] lite-setup: configure lite-server test env
by tiran 24 Jan '20

24 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4135 Author: tiran Title: #4135: lite-setup: configure lite-server test env Action: opened PR body: """ Introduce a script that configures a local testing environment with ipa default.conf, krb5.conf, and ca.crt from a server hostname. The lite server configuration allows easy and convenient testing of IPA server and client code. It uses an existing 389-DS and KRB5 KDC server on another machine: $ contrib/lite-setup.py master.ipa.example $ source ~/.ipa/activate.sh (ipaenv) $ kinit username (ipaenv) $ make lite-server IPA server UI is available on http://localhost:8888/ipa/ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4135/head:pr4135 git checkout pr4135

2 1

[freeipa PR#4147][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 24 Jan '20

24 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4147 Author: freeipa-pr-ci Title: #4147: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4147/head:pr4147 git checkout pr4147

1 1

[freeipa PR#4113][opened] temp commit
by wladich 23 Jan '20

23 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4113 Author: wladich Title: #4113: temp commit Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4113/head:pr4113 git checkout pr4113

1 1

[freeipa PR#4152][opened] [Backport][ipa-4-8] Make assert_error compatible with Python 3.6
by rcritten 23 Jan '20

23 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4152 Author: rcritten Title: #4152: [Backport][ipa-4-8] Make assert_error compatible with Python 3.6 Action: opened PR body: """ This PR was opened automatically because PR #4144 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4152/head:pr4152 git checkout pr4152

1 1

[freeipa PR#4106][opened] ipatests: fix compatibility with python2 (import ConfigParser)
by wladich 23 Jan '20

23 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4106 Author: wladich Title: #4106: ipatests: fix compatibility with python2 (import ConfigParser) Action: opened PR body: """ Patch ba4aaa73 backported remote_ini_file utility which requires `configparser` module. But in python2 this module was named ConfigParser. As we need to support both python2 and python3 in branch ipa-4-6, I have added try-except block to allow fallback to python2 verstion import. Related to: https://pagure.io/SSSD/sssd/issue/3937 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4106/head:pr4106 git checkout pr4106

1 1

[freeipa PR#4141][opened] [Backport][ipa-4-7] Fix occasional 'whoami.data is undefined' error in FreeIPA web UI
by serg-cymbaluk 23 Jan '20

23 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4141 Author: serg-cymbaluk Title: #4141: [Backport][ipa-4-7] Fix occasional 'whoami.data is undefined' error in FreeIPA web UI Action: opened PR body: """ Manual backport of https://github.com/freeipa/freeipa/pull/3138 'Metadata' phase (Web UI initialization flow) doesn't wait "whoami" response. It causes the error when on the next phase "whoami" data is undefined. To avoid this "whoami" request now has flag async = false, so init_metadata waits until it will be completed. Ticket: https://pagure.io/freeipa/issue/7917 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4141/head:pr4141 git checkout pr4141

1 1

[freeipa PR#4143][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 23 Jan '20

23 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4143 Author: freeipa-pr-ci Title: #4143: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4143/head:pr4143 git checkout pr4143

1 1

[freeipa PR#4144][opened] Make assert_error compatible with Python 3.6
by tiran 22 Jan '20

22 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4144 Author: tiran Title: #4144: Make assert_error compatible with Python 3.6 Action: opened PR body: """ The re.Pattern class was introduced in Python 3.7. Use duck-typing to distinguish between str and re pattern object. Fixes: https://pagure.io/freeipa/issue/8179 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4144/head:pr4144 git checkout pr4144

2 1

[freeipa PR#4134][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 22 Jan '20

22 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4134 Author: freeipa-pr-ci Title: #4134: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4134/head:pr4134 git checkout pr4134

1 1

[freeipa PR#4146][opened] ipatests: make assert_error function compatible with python version < 3.7
by wladich 21 Jan '20

21 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4146 Author: wladich Title: #4146: ipatests: make assert_error function compatible with python version < 3.7 Action: opened PR body: """ In 3d779b4 assert_error was changed to handle both strings and compiled regexp objects in argument `pattern`. For this it used expression `isinstance(pattern, re.Pattern)`. re.Pattern object was introduced in python 3.7, so the tests which call this function can not be executed with older versions of python though and for now we claim support for python 3.6+. Fixed by replacing the condition with duck-typing check. Fixes: https://pagure.io/freeipa/issue/8179 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4146/head:pr4146 git checkout pr4146

1 1

[freeipa PR#4139][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 21 Jan '20

21 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4139 Author: freeipa-pr-ci Title: #4139: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4139/head:pr4139 git checkout pr4139

1 1

[freeipa PR#4119][opened] [testing_ipa-4.7] Nightly PR
by freeipa-pr-ci 19 Jan '20

19 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4119 Author: freeipa-pr-ci Title: #4119: [testing_ipa-4.7] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4119/head:pr4119 git checkout pr4119

1 1

[freeipa PR#4133][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 18 Jan '20

18 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4133 Author: freeipa-pr-ci Title: #4133: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4133/head:pr4133 git checkout pr4133

1 1

[freeipa PR#4136][opened] [Backport][ipa-4-7] Print LDAP diagnostic messages on error
by tiran 17 Jan '20

17 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4136 Author: tiran Title: #4136: [Backport][ipa-4-7] Print LDAP diagnostic messages on error Action: opened PR body: """ This PR was opened automatically because PR #4114 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4136/head:pr4136 git checkout pr4136

2 1

[freeipa PR#4137][opened] [Backport][ipa-4-8] Print LDAP diagnostic messages on error
by tiran 17 Jan '20

17 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4137 Author: tiran Title: #4137: [Backport][ipa-4-8] Print LDAP diagnostic messages on error Action: opened PR body: """ This PR was opened automatically because PR #4114 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4137/head:pr4137 git checkout pr4137

2 1

[freeipa PR#4138][opened] Explain the effect of OPT_X_TLS_PROTOCOL_MIN
by tiran 17 Jan '20

17 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4138 Author: tiran Title: #4138: Explain the effect of OPT_X_TLS_PROTOCOL_MIN Action: opened PR body: """ OpenLDAP 2.4 sets minimum version with SSL_CTX_set_options(). The system-wide crypto-policies for TLS minimum version are applied with SSL_CTX_set_min_proto_version(). The set_option() call cannot not enable lower versions than allowed by crypto-policy, e.g. openssl.cnf MinProtocol=TLS1.2 + OPT_X_TLS_PROTOCOL_MIN=TLS1.0 result in TLS 1.2 as minimum protocol version. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4138/head:pr4138 git checkout pr4138

1 0

[freeipa PR#4114][opened] Print LDAP diagnostic messages on error
by tiran 17 Jan '20

17 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4114 Author: tiran Title: #4114: Print LDAP diagnostic messages on error Action: opened PR body: """ ipa_ldap_init(), ipa_tls_ssl_init(), and the bind operations of ipa-join and ipa-getkeytab now print LDAP error string and LDAP diagonstic messages to stderr. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4114/head:pr4114 git checkout pr4114

1 1

[freeipa PR#4131][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 17 Jan '20

17 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4131 Author: freeipa-pr-ci Title: #4131: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4131/head:pr4131 git checkout pr4131

1 1

[freeipa PR#4132][opened] [Backport][ipa-4-8] [KDB] various code hygiene fixes
by flo-renaud 16 Jan '20

16 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4132 Author: flo-renaud Title: #4132: [Backport][ipa-4-8] [KDB] various code hygiene fixes Action: opened PR body: """ This PR was opened automatically because PR #3842 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4132/head:pr4132 git checkout pr4132

1 1

[freeipa PR#4125][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 16 Jan '20

16 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4125 Author: freeipa-pr-ci Title: #4125: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4125/head:pr4125 git checkout pr4125

1 1

[freeipa PR#4128][opened] [Backport][ipa-4-6] ipa tests: fix backup and restore
by rcritten 15 Jan '20

15 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4128 Author: rcritten Title: #4128: [Backport][ipa-4-6] ipa tests: fix backup and restore Action: opened PR body: """ This PR was opened automatically because PR #4127 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4128/head:pr4128 git checkout pr4128

2 1

[freeipa PR#3842][opened] [KDB] various code hygiene fixes
by frozencemetery 15 Jan '20

15 Jan '20

URL: https://github.com/freeipa/freeipa/pull/3842 Author: frozencemetery Title: #3842: [KDB] various code hygiene fixes Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3842/head:pr3842 git checkout pr3842

2 1

[freeipa PR#4129][opened] [Backport][ipa-4-7] ipa tests: fix backup and restore
by rcritten 15 Jan '20

15 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4129 Author: rcritten Title: #4129: [Backport][ipa-4-7] ipa tests: fix backup and restore Action: opened PR body: """ This PR was opened automatically because PR #4127 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4129/head:pr4129 git checkout pr4129

2 1

[freeipa PR#4130][opened] [Backport][ipa-4-8] ipa tests: fix backup and restore
by rcritten 15 Jan '20

15 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4130 Author: rcritten Title: #4130: [Backport][ipa-4-8] ipa tests: fix backup and restore Action: opened PR body: """ This PR was opened automatically because PR #4127 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4130/head:pr4130 git checkout pr4130

2 1

can't access the web interface of freeIPA
by cyrine stambouli 15 Jan '20

15 Jan '20

Hello, I have a problem to access the freeIPA interface, well I have installed freeIPA in centos 7 server, the iinstallation was well done without any errors , but i am not able to access web interface , do you have any idea to fix that ? [root@ipa]# ipactl status Directory Service: RUNNING krb5kdc Service: RUNNING kadmin Service: RUNNING named Service: RUNNING httpd Service: RUNNING ipa-custodia Service: RUNNING ntpd Service: RUNNING pki-tomcatd Service: RUNNING ipa-otpd Service: RUNNING ipa-dnskeysyncd Service: RUNNING ipa: INFO: The ipactl command was successful Regards,

2 2

[freeipa PR#4112][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 15 Jan '20

15 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4112 Author: freeipa-pr-ci Title: #4112: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4112/head:pr4112 git checkout pr4112

1 1

[freeipa PR#4127][opened] ipa tests: fix backup and restore
by flo-renaud 14 Jan '20

14 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4127 Author: flo-renaud Title: #4127: ipa tests: fix backup and restore Action: opened PR body: """ The tests for backup_and_restore check that the ipa-backup command compresses the tar file AFTER restarting IPA services by reading the output and looking for a pattern with "gzip" before "Starting IPA service." As the tar file name is randomly created, it sometimes happen that the name contains gzip and in this case the test wrongly assumes that the gzip cmd was called. The fix makes a stricter comparison, looking for /bin/gzip. Fixes: https://pagure.io/freeipa/issue/8170 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4127/head:pr4127 git checkout pr4127

2 1

[freeipa PR#4109][opened] [Backport][ipa-4-7] Fix certificate revocation tests for Web UI
by serg-cymbaluk 14 Jan '20

14 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4109 Author: serg-cymbaluk Title: #4109: [Backport][ipa-4-7] Fix certificate revocation tests for Web UI Action: opened PR body: """ Manual backport of https://github.com/freeipa/freeipa/pull/2748 - correct revocation date before search - increase timeouts https://pagure.io/freeipa/issue/7834 https://pagure.io/freeipa/issue/8161 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4109/head:pr4109 git checkout pr4109

1 1

[freeipa PR#4117][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 14 Jan '20

14 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4117 Author: freeipa-pr-ci Title: #4117: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4117/head:pr4117 git checkout pr4117

1 1

[freeipa PR#4124][opened] [Backport][ipa-4-6] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
by rcritten 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4124 Author: rcritten Title: #4124: [Backport][ipa-4-6] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit Action: opened PR body: """ This PR was opened automatically because PR #4111 was pushed to master and backport to ipa-4-6 is required. Note that the backport tool failed to created this automatically but a cherry-pick merged cleanly so considering it an ack. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4124/head:pr4124 git checkout pr4124

1 1

[freeipa PR#4122][opened] [Backport][ipa-4-7] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
by rcritten 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4122 Author: rcritten Title: #4122: [Backport][ipa-4-7] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit Action: opened PR body: """ This PR was opened automatically because PR #4111 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4122/head:pr4122 git checkout pr4122

1 1

[freeipa PR#4123][opened] [Backport][ipa-4-8] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
by rcritten 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4123 Author: rcritten Title: #4123: [Backport][ipa-4-8] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit Action: opened PR body: """ This PR was opened automatically because PR #4111 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4123/head:pr4123 git checkout pr4123

1 1

[freeipa PR#4121][opened] [Backport][ipa-4-8] ipatests: Add xmlrpc test for valid/invalid inputs for kerberos ticket policy.
by flo-renaud 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4121 Author: flo-renaud Title: #4121: [Backport][ipa-4-8] ipatests: Add xmlrpc test for valid/invalid inputs for kerberos ticket policy. Action: opened PR body: """ This PR was opened automatically because PR #4089 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4121/head:pr4121 git checkout pr4121

1 1

[freeipa PR#4111][opened] Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
by rcritten 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4111 Author: rcritten Title: #4111: Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit Action: opened PR body: """ A "cookie" is used with certmonger to track the state of a request across multiple requests to a CA (in ca-cookie). This is used with the certmonger POLL operation to submit a request to the CA for the status of a certificate request. This, along with the profile, are passed to the certmonger CA helper scripts via environment variables when a request is made. It is cleared from the certmonger request once the certificate is issued. This CA helper can do a number of things: - SUBMIT new certicate requests (including the CA) - POLL for status of an existing certificate request - For non renewal masters, POLL to see if an updated cert is in LDAP A POLL operation requires a cookie so that the state about the request can be passed to the CA. For the case of retrieving an updated cert from LDAP there is no state to maintain. It just checks LDAP and returns either a cert or WAIT_WITH_DELAY if one is not yet available. There are two kinds of cookies in operation here: 1. The CERTMONGER_CA_COOKIE environment variable passed via certmonger to this helper which is a JSON object. 2. The cookie value within the JSON object which contains the URL to be passed to dogtag. For the purposes of clarity "cookie" here is the value within the JSON. The CERTMONGER_CA_COOKIE is deconstructed and reconstructed as the request is processed, doing double duty. It initially comes in as a JSON dict object with two keys: profile and cookie. In call_handler the CERTMONGER_CA_COOKIE is decomposed into a python object and the profile compared to the requested profile (and request rejected if they don't match) and the cookie key overrides the CERTMONGER_CA_COOKIE environment variable. This is then reversed at the end of the request when it again becomes a JSON object containing the profile and cookie. This script was previously enforcing that a cookie be available on all POLL requests, whether it is actually required or not. This patch relaxes that requirement. The first request of a non-renewal master for an updated certicate from LDAP is a SUBMIT operation. This is significant because it doesn't require a cookie: there is no state on a new request. If there is no updated cert in LDAP then the tracking request goes into the CA_WORKING state and certmonger will wait 8 hours (as returned by this script) and try again. Subsequent requests are done using POLL. This required a cookie so all such requests would fail with the ca-error Invalid cookie: u'' as it was empty (because there is no state). There is no need to fail early on a missing cookie. Enforcement will be done later if needed (and it isn't always needed). So if CERTMONGER_CA_COOKIE is an empty string then generate a new CERTMONGER_CA_COOKIE containing the requested profile and an empty cookie. It still will fail if certmonger doesn't set a cookie at all. An example of a cookie when retrieving a new RA Agent certificate is: {"profile": "caServerCert", "cookie": "state=retrieve&requestId=20"} This will result in this request to the CA: [09/Jan/2020:14:29:54 -0500] "GET /ca/ee/ca/displayCertFromRequest?requestId=20&importCert=true&xml=true HTTP/1.1" 200 9857 For a renewal, the reconstructed cookie will consist of: {"profile": "caServerCert", "cookie": ""} https://pagure.io/freeipa/issue/8164 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4111/head:pr4111 git checkout pr4111

1 1

[freeipa PR#4116][opened] [Backport][ipa-4-7] AD user without override receive InternalServerError with API
by flo-renaud 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4116 Author: flo-renaud Title: #4116: [Backport][ipa-4-7] AD user without override receive InternalServerError with API Action: opened PR body: """ This PR was opened automatically because PR #4110 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4116/head:pr4116 git checkout pr4116

1 1

[freeipa PR#4115][opened] [Backport][ipa-4-8] AD user without override receive InternalServerError with API
by flo-renaud 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4115 Author: flo-renaud Title: #4115: [Backport][ipa-4-8] AD user without override receive InternalServerError with API Action: opened PR body: """ This PR was opened automatically because PR #4110 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4115/head:pr4115 git checkout pr4115

1 1

[freeipa PR#4089][opened] ipatests: Add integration test for valid/invalid inputs for kerberos ticket policy.
by amore17 13 Jan '20

13 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4089 Author: amore17 Title: #4089: ipatests: Add integration test for valid/invalid inputs for kerberos ticket policy. Action: opened PR body: """ This checks that valid/invalid inputs for subtypes of authentication indicator kerberos ticket policy options. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4089/head:pr4089 git checkout pr4089

2 1

[freeipa PR#4120][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4120 Author: freeipa-pr-ci Title: #4120: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4120/head:pr4120 git checkout pr4120

1 0

[freeipa PR#4098][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4098 Author: freeipa-pr-ci Title: #4098: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4098/head:pr4098 git checkout pr4098

1 1

[freeipa PR#4097][opened] [testing_ipa-4.7] Nightly PR
by freeipa-pr-ci 12 Jan '20

12 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4097 Author: freeipa-pr-ci Title: #4097: [testing_ipa-4.7] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4097/head:pr4097 git checkout pr4097

1 1

[freeipa PR#4118][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 11 Jan '20

11 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4118 Author: freeipa-pr-ci Title: #4118: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4118/head:pr4118 git checkout pr4118

1 0

[freeipa PR#4096][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 11 Jan '20

11 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4096 Author: freeipa-pr-ci Title: #4096: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4096/head:pr4096 git checkout pr4096

1 1

[freeipa PR#4107][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 11 Jan '20

11 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4107 Author: freeipa-pr-ci Title: #4107: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4107/head:pr4107 git checkout pr4107

1 1

[freeipa PR#4110][opened] AD user without override receive InternalServerError with API
by flo-renaud 10 Jan '20

10 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4110 Author: flo-renaud Title: #4110: AD user without override receive InternalServerError with API Action: opened PR body: """ When ipa commands are used by an Active Directory user that does not have any idoverride-user set, they return the following error message which can be misleading: $ kinit aduser(a)ADDOMAIN.COM $ ipa ping ipa: ERROR: cannot connect to 'https://master.ipa.com/ipa/json': Internal Server Error The fix properly handles ACIError exception received when creating the context, and now the following message can be seen: $ kinit aduser(a)ADDOMAIN.COM $ ipa ping ipa: ERROR: cannot connect to 'https://master.ipa.com/ipa/json': Unauthorized with the following log in /var/log/httpd/error_log: ipa: INFO: 401 Unauthorized: Insufficient access: Invalid credentials Fixes: https://pagure.io/freeipa/issue/8163 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4110/head:pr4110 git checkout pr4110

1 1

[freeipa PR#4105][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 10 Jan '20

10 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4105 Author: freeipa-pr-ci Title: #4105: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4105/head:pr4105 git checkout pr4105

1 1

FreeIPA PR-CI down due to maintenance tasks.
by Francisco Triviño García 09 Jan '20

09 Jan '20

Hi All, Due to maintenance tasks our upstream infra will be down, FreeIPA PR-CI gating will not work. I'll send another email once it is up & running again. -Triviño.

1 1

[freeipa PR#4100][opened] [Backport][ipa-4-7]Test: Test to check whether ssh from ipa client to ipa master
by ssidhaye 09 Jan '20

09 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4100 Author: ssidhaye Title: #4100: [Backport][ipa-4-7]Test: Test to check whether ssh from ipa client to ipa master Action: opened PR body: """ is successful after adding ldap_deref_threshold=0 in sssd.conf Problem: After adding ldap_deref_threshold=0 setting for sssd on master for performance enhancement ssh from ipa client was failing Test Procedure: 1. setup a master 2. add ldap_deref_threshold=0 to sssd.conf on master 3. add an ipa user 4. ssh from controller to master using the user created in step 3 Signed-off-by: Sumedh Sidhaye <ssidhaye(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4100/head:pr4100 git checkout pr4100

2 1

[freeipa PR#4099][opened] [Backport][ipa-4-6]Test: Test to check whether ssh from ipa client to ipa master
by ssidhaye 09 Jan '20

09 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4099 Author: ssidhaye Title: #4099: [Backport][ipa-4-6]Test: Test to check whether ssh from ipa client to ipa master Action: opened PR body: """ is successful after adding ldap_deref_threshold=0 in sssd.conf Problem: After adding ldap_deref_threshold=0 setting for sssd on master for performance enhancement ssh from ipa client was failing Test Procedure: 1. setup a master 2. add ldap_deref_threshold=0 to sssd.conf on master 3. add an ipa user 4. ssh from controller to master using the user created in step 3 Signed-off-by: Sumedh Sidhaye <ssidhaye(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4099/head:pr4099 git checkout pr4099

2 1

[freeipa PR#4103][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 09 Jan '20

09 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4103 Author: freeipa-pr-ci Title: #4103: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4103/head:pr4103 git checkout pr4103

1 1

[freeipa PR#4094][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 08 Jan '20

08 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4094 Author: freeipa-pr-ci Title: #4094: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4094/head:pr4094 git checkout pr4094

1 1

[freeipa PR#4093][opened] [Backport][ipa-4-6] Test if ipactl starts services stopped by systemctl
by jayesh-garg 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4093 Author: jayesh-garg Title: #4093: [Backport][ipa-4-6] Test if ipactl starts services stopped by systemctl Action: opened PR body: """ This will first check if all services are running then it will stop few service. After that it will restart all services and then check the status and pid of services.It will also compare pid after ipactl start and restart in case of start it will remain unchanged on the other hand in case of restart it will change. Signed-off-by: Jayesh Garg <jgarg(a)redhat.com> Reviewed-By: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com> Reviewed-By: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4093/head:pr4093 git checkout pr4093

2 1

[freeipa PR#4104][opened] [Backport][ipa-4-7] Test if ipactl starts services stopped by systemctl
by jayesh-garg 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4104 Author: jayesh-garg Title: #4104: [Backport][ipa-4-7] Test if ipactl starts services stopped by systemctl Action: opened PR body: """ This will first check if all services are running then it will stop few service. After that it will restart all services and then check the status and pid of services.It will also compare pid after ipactl start and restart in case of start it will remain unchanged on the other hand in case of restart it will change. Signed-off-by: Jayesh Garg <jgarg(a)redhat.com> Reviewed-By: Christian Heimes <cheimes(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com> Reviewed-By: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4104/head:pr4104 git checkout pr4104

2 1

[freeipa PR#4092][opened] [Backport][ipa-4-8] Test for ipa-ca-install on replica
by jayesh-garg 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4092 Author: jayesh-garg Title: #4092: [Backport][ipa-4-8] Test for ipa-ca-install on replica Action: opened PR body: """ Test on replica for ipa-ca-install with options --no-host-dns,--skip-schema-check,done changes in ipatests/pytest_ipa/integration/tasks.py because wants to pass few arguments to install_ca method Signed-off-by: Jayesh <jgarg(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com> Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4092/head:pr4092 git checkout pr4092

2 1

[freeipa PR#4091][opened] [Backport][ipa-4-7] Test for ipa-ca-install on replica
by jayesh-garg 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4091 Author: jayesh-garg Title: #4091: [Backport][ipa-4-7] Test for ipa-ca-install on replica Action: opened PR body: """ Test on replica for ipa-ca-install with options --no-host-dns,--skip-schema-check,done changes in ipatests/pytest_ipa/integration/tasks.py because wants to pass few arguments to install_ca method Signed-off-by: Jayesh <jgarg(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com> Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4091/head:pr4091 git checkout pr4091

2 1

[freeipa PR#4090][opened] [Backport][ipa-4-6] Test for ipa-ca-install on replica
by jayesh-garg 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4090 Author: jayesh-garg Title: #4090: [Backport][ipa-4-6] Test for ipa-ca-install on replica Action: opened PR body: """ Test on replica for ipa-ca-install with options --no-host-dns,--skip-schema-check,done changes in ipatests/pytest_ipa/integration/tasks.py because wants to pass few arguments to install_ca method Signed-off-by: Jayesh <jgarg(a)redhat.com> Reviewed-By: Florence Blanc-Renaud <flo(a)redhat.com> Reviewed-By: Fraser Tweedale <ftweedal(a)redhat.com> Conflicts: ipatests/pytest_ipa/integration/tasks.py ipatests/test_integration/test_installation.py """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4090/head:pr4090 git checkout pr4090

2 1

[freeipa PR#4095][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 07 Jan '20

07 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4095 Author: freeipa-pr-ci Title: #4095: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4095/head:pr4095 git checkout pr4095

1 1

[freeipa PR#4101][opened] [Backport][ipa-4-8] ipaserver/plugins/dns.py: add "Dynamic Update" and "Bind update policy" to default dnszone* output
by rcritten 06 Jan '20

06 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4101 Author: rcritten Title: #4101: [Backport][ipa-4-8] ipaserver/plugins/dns.py: add "Dynamic Update" and "Bind update policy" to default dnszone* output Action: opened PR body: """ This PR was opened automatically because PR #4027 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4101/head:pr4101 git checkout pr4101

1 1

[freeipa PR#4027][opened] ipaserver/plugins/dns.py: add "Dynamic Update" and "Bind update policy" to default dnszone* output
by fcami 06 Jan '20

06 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4027 Author: fcami Title: #4027: ipaserver/plugins/dns.py: add "Dynamic Update" and "Bind update policy" to default dnszone* output Action: opened PR body: """ Displaying "Dynamic Update" and "Bind update policy" by default when 'ipa dnszone-show/find' are used would make client dns update failures easier to diagnose, so display them. Fixes: https://pagure.io/freeipa/issue/7938 Signed-off-by: François Cami <fcami(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4027/head:pr4027 git checkout pr4027

2 1

[PR4061][thesis] doc/designs: Add a design page for application-specific passwords
by Richard Kalinec 05 Jan '20

05 Jan '20

Good evening, I am a student of Faculty of Informatics of Masaryk University working on my master thesis with Red Hat. As a core of this thesis, I aim to extend FreeIPA (and SSSD) to allow multiple passwords for a single user (application-specific passwords) and ideally also some form of permissions management for them. For more information, see issue #4510: https://pagure.io/freeipa/issue/4510 I already created a PR #4061 with an initial design page: https://github.com/freeipa/freeipa/pull/4061 The design page is, however, far from complete, and everything needs to be carefully thought through and analyzed. Mr. Simo Sorce already provided valuable feedback; more feedback and discussion is highly appreciated. Best regards, Richard Kalinec

1 0

[freeipa PR#4085][opened] [testing_ipa-4.6] Nightly PR
by freeipa-pr-ci 05 Jan '20

05 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4085 Author: freeipa-pr-ci Title: #4085: [testing_ipa-4.6] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4085/head:pr4085 git checkout pr4085

1 1

[freeipa PR#4084][opened] [testing_ipa-4.7] Nightly PR
by freeipa-pr-ci 05 Jan '20

05 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4084 Author: freeipa-pr-ci Title: #4084: [testing_ipa-4.7] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4084/head:pr4084 git checkout pr4084

1 1

[freeipa PR#4083][opened] [testing_ipa-4.8] Nightly PR
by freeipa-pr-ci 04 Jan '20

04 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4083 Author: freeipa-pr-ci Title: #4083: [testing_ipa-4.8] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4083/head:pr4083 git checkout pr4083

1 1

[freeipa PR#4088][closed] [testing_master_latest] Nightly PR
by freeipa-pr-ci 04 Jan '20

04 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4088 Author: freeipa-pr-ci Title: #4088: [testing_master_latest] Nightly PR Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4088/head:pr4088 git checkout pr4088

1 0

[freeipa PR#4075][opened] prci: update packages for rawhide nightly runs
by netoarmando 03 Jan '20

03 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4075 Author: netoarmando Title: #4075: prci: update packages for rawhide nightly runs Action: opened PR body: """ This forces PR-CI to update the packages instead of using the versions already included in the vagrant image. Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4075/head:pr4075 git checkout pr4075

1 1

[freeipa PR#4056][opened] ipatests: Fix for PR#3773
by mrizwan93 03 Jan '20

03 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4056 Author: mrizwan93 Title: #4056: ipatests: Fix for PR#3773 Action: opened PR body: """ Issue identified in PR3845, Hence the fix. https://github.com/freeipa/freeipa/pull/3845 https://github.com/freeipa/freeipa/pull/3773 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4056/head:pr4056 git checkout pr4056

2 1

[freeipa PR#4087][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 03 Jan '20

03 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4087 Author: freeipa-pr-ci Title: #4087: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4087/head:pr4087 git checkout pr4087

1 1

[freeipa PR#4086][closed] [testing_master_latest] Nightly PR
by freeipa-pr-ci 02 Jan '20

02 Jan '20

URL: https://github.com/freeipa/freeipa/pull/4086 Author: freeipa-pr-ci Title: #4086: [testing_master_latest] Nightly PR Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4086/head:pr4086 git checkout pr4086

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel January 2020