March 2020 - FreeIPA-devel - Fedora Mailing-Lists

[freeipa PR#4417][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager

by rcritten

URL: https://github.com/freeipa/freeipa/pull/4417 Author: rcritten Title: #4417: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of cacert.p12. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy abokovoy(a)redhat.com [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10... Replaces https://github.com/freeipa/freeipa/pull/2106 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4417/head:pr4417 git checkout pr4417

4 years, 3 months

2
1
0 / 0

[freeipa PR#4435][opened] SELinux: Optional apache_manage_pid_files interface

by tiran

URL: https://github.com/freeipa/freeipa/pull/4435 Author: tiran Title: #4435: SELinux: Optional apache_manage_pid_files interface Action: opened PR body: """ SELinux policy on F30 doesn't have the interface apache_manage_pid_files(). Make use of the interface optional. Fixes: https://pagure.io/freeipa/issue/8241 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4435/head:pr4435 git checkout pr4435

4 years, 3 months

2
1
0 / 0

[freeipa PR#4434][opened] [backport][ipa-4-8] prepare translations to use Weblate

by abbra

URL: https://github.com/freeipa/freeipa/pull/4434 Author: abbra Title: #4434: [backport][ipa-4-8] prepare translations to use Weblate Action: opened PR body: """ Manual backport to ipa-4-8 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4434/head:pr4434 git checkout pr4434

4 years, 3 months

1
1
0 / 0

[freeipa PR#4437][opened] [Backport][ipa-4-7] ipatests: provide AD admin password when trying to establish trust

by wladich

URL: https://github.com/freeipa/freeipa/pull/4437 Author: wladich Title: #4437: [Backport][ipa-4-7] ipatests: provide AD admin password when trying to establish trust Action: opened PR body: """ This PR was opened automatically because PR #4399 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4437/head:pr4437 git checkout pr4437

4 years, 3 months

2
1
0 / 0

[freeipa PR#4436][opened] [Backport][ipa-4-8] ipatests: provide AD admin password when trying to establish trust

by wladich

URL: https://github.com/freeipa/freeipa/pull/4436 Author: wladich Title: #4436: [Backport][ipa-4-8] ipatests: provide AD admin password when trying to establish trust Action: opened PR body: """ This PR was opened automatically because PR #4399 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4436/head:pr4436 git checkout pr4436

4 years, 3 months

2
1
0 / 0

[freeipa PR#4420][opened] ipatests: always skip additional input for group-add-member --external

by abbra

URL: https://github.com/freeipa/freeipa/pull/4420 Author: abbra Title: #4420: ipatests: always skip additional input for group-add-member --external Action: opened PR body: """ 'ipa group-add-member groupname --external some-object' will attempt to ask interactive questions about other optional parameters (users and groups) if only external group member was specified. This leads to a timeout in the tests as there is no input provided. Do not wait for the entry that would never come by using 'ipa -n'. Related: https://pagure.io/freeipa/issue/8236 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4420/head:pr4420 git checkout pr4420

4 years, 3 months

1
1
0 / 0

[freeipa PR#4193][opened] [ACME] Add ipa-ca.$DOMAIN alias to IPA server HTTP certificates

by frasertweedale

URL: https://github.com/freeipa/freeipa/pull/4193 Author: frasertweedale Title: #4193: [ACME] Add ipa-ca.$DOMAIN alias to IPA server HTTP certificates Action: opened PR body: """ First PR for the ACME effort. This is needed so ACME clients can reach IPA ACME service via the ``ipa-ca.$DOMAIN`` DNS name (ACME requires TLS). This change is also reasonable, independent of the ACME effort. https://pagure.io/freeipa/issue/8186 ``` 83a5a3aa6 (Fraser Tweedale, 11 hours ago) upgrade: add ipa-ca.$DOMAIN alias to HTTP certificate If the HTTP certificate does not have the ipa-ca.$DOMAIN dNSName, resubmit the certificate request to add the name. This action is performed after the tracking request has already been updated. Note: due to https://pagure.io/certmonger/issue/143 the resubmitted request, if it does not immediately succeed and if the notAfter date of the current certificate is still far off, the request could get stuck in state CA_UNREACHABLE until a Certmonger restart. There is not much we can do about that in the middle of ipa-server-upgrade. Part of: https://pagure.io/freeipa/issue/8186 efe071539 (Fraser Tweedale, 12 hours ago) httpinstance: add ipa-ca.$DOMAIN alias in initial request For new server/replica installation, issue the HTTP server certificate with the 'ipa-ca.$DOMAIN' SAN dNSName. This is accomplished by adding the name to the Certmonger tracking request. Part of: https://pagure.io/freeipa/issue/8186 feea49420 (Fraser Tweedale, 3 days ago) cert-request: allow ipa-ca.$DOMAIN dNSName for IPA servers ACME support requires TLS and we want ACME clients to access the service via the ipa-ca.$DOMAIN DNS name. So we need to add the ipa-ca.$DOMAIN dNSName to IPA servers' HTTP certificates. To facilitiate this, add a special case to the cert-request command processing. The rule is: - if the dnsName being validated is "ipa-ca.$DOMAIN" - and the subject principal is an "HTTP/..." service - and the subject principal's hostname is an IPA server Then that name (i.e. "ipa-ca.$DOMAIN") is immediately allowed. Otherwise continue with the usual dnsName validation. Part of: https://pagure.io/freeipa/issue/8186 62129a44a (Fraser Tweedale, 3 days ago) httpinstance: add fqdn and ipa-ca alias to Certmonger request When (re-)tracking the HTTP certificate, explicitly add the server FQDN and ipa-ca.$DOMAIN DNS names to the Certmonger tracking request. Part of: https://pagure.io/freeipa/issue/8186 fe3489cf4 (Fraser Tweedale, 4 days ago) certmonger: support dnsname as request search criterion We need to be able to filter Certmonger tracking requests by the DNS names defined for the request. The goal is to add the 'ipa-ca.$DOMAIN' alias to the HTTP certificate tracking requests, so we will use that name as a search criterion. Implement support for this. As a result of this commit it will be easy to add support for subset match of other Certmonger request list properties. Just add the property name to the ARRAY_PROPERTIES list (and update the 'criteria' description in the module docstring!) Part of: https://pagure.io/freeipa/issue/8186 ea6d31bdf (Fraser Tweedale, 4 days ago) certmonger: move 'criteria' description to module docstring The 'criteria' parameter is used by several subroutines in the ipalib.install.certmonger module. It has incomplete documentation spread across several of these subroutines. Move the documentation to the module docstring and reference it where appropriate. Part of: https://pagure.io/freeipa/issue/8186 aa7b88ad6 (Fraser Tweedale, 4 days ago) certmonger: avoid mutable default argument certmonger._get_requests has a mutable default argument. Although at the present time it is never modified, this is an antipattern to be avoided. Part of: https://pagure.io/freeipa/issue/8186 ``` """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4193/head:pr4193 git checkout pr4193

4 years, 3 months

1
1
0 / 0

[freeipa PR#4439][opened] [debug] Troubleshoot PR-CI Windows AD test_trust

by netoarmando

URL: https://github.com/freeipa/freeipa/pull/4439 Author: netoarmando Title: #4439: [debug] Troubleshoot PR-CI Windows AD test_trust Action: opened PR body: """ Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4439/head:pr4439 git checkout pr4439

4 years, 3 months

1
0
0 / 0

[freeipa PR#4396][opened] [testing_master_previous] Nightly PR

by freeipa-pr-ci

URL: https://github.com/freeipa/freeipa/pull/4396 Author: freeipa-pr-ci Title: #4396: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4396/head:pr4396 git checkout pr4396

4 years, 3 months

1
1
0 / 0

[freeipa PR#4399][opened] ipatests: provide AD admin password when trying to establish trust

by wladich

URL: https://github.com/freeipa/freeipa/pull/4399 Author: wladich Title: #4399: ipatests: provide AD admin password when trying to establish trust Action: opened PR body: """ `ipa trust-add --password` command requires that user provides a password. Related to: https://pagure.io/freeipa/issue/7895 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4399/head:pr4399 git checkout pr4399

4 years, 3 months

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel March 2020