May 2021 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5724][opened] [Backport][ipa-4-9] ipatests: test to renew certs on replica using ipa-cert-fix
by flo-renaud 20 Aug '21

20 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5724 Author: flo-renaud Title: #5724: [Backport][ipa-4-9] ipatests: test to renew certs on replica using ipa-cert-fix Action: opened PR body: """ This PR was opened automatically because PR #5653 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5724/head:pr5724 git checkout pr5724

1 1

[freeipa PR#5738][opened] ipatests: wait while http/ldap/pkinit cert get renew on replica
by mrizwan93 19 Aug '21

19 Aug '21

URL: https://github.com/freeipa/freeipa/pull/5738 Author: mrizwan93 Title: #5738: ipatests: wait while http/ldap/pkinit cert get renew on replica Action: opened PR body: """ LDAP/HTTP/PKINIT certificates should be renewed on replica after moving system date. Test was failing because ipa-cert-fix ran while these cert was not renewed and it tried to fix it. Fixes: https://pagure.io/freeipa/issue/8815 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5738/head:pr5738 git checkout pr5738

2 1

[freeipa PR#5613][opened] ipa-kra-install: exit if ca_host is overriden
by antoniotorresm 27 Jul '21

27 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5613 Author: antoniotorresm Title: #5613: ipa-kra-install: exit if ca_host is overriden Action: opened PR body: """ `ipa-kra-install` should exit if `ca_host` line is present in `/etc/ipa/default.conf`, as it may lead to a misconfigured setup. Fixes: https://pagure.io/freeipa/issue/8245 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5613/head:pr5613 git checkout pr5613

1 1

[freeipa PR#5733][opened] Revert the way hosts/services certs are searched for
by rcritten 20 Jul '21

20 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5733 Author: rcritten Title: #5733: Revert the way hosts/services certs are searched for Action: opened PR body: """ Revert the way hosts/services certs are searched for This reverts a change that caused all service certs to be revoked if any other service was deleted. There is special handling when passing in host, service or user into cert_find. The _ldap_search method creates filters for the object which later in cert_find removes unrelated certificates. https://pagure.io/freeipa/issue/7835 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5733/head:pr5733 git checkout pr5733

1 1

[freeipa PR#5799][opened] ipatests: test_installation: Skip KRA test if lib389 cannot be imported
by miskopo 13 Jul '21

13 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5799 Author: miskopo Title: #5799: ipatests: test_installation: Skip KRA test if lib389 cannot be imported Action: opened PR body: """ KRA instance import depends on lib389 package, which is not always installed and that results in failure. This fix skips relevant test if thei mport is not possible. Signed-off-by: Michal Polovka <mpolovka(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5799/head:pr5799 git checkout pr5799

1 1

[freeipa PR#5713][opened] Add support subordinate user/group ids as separate entries
by tiran 09 Jul '21

09 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5713 Author: tiran Title: #5713: Add support subordinate user/group ids as separate entries Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5713/head:pr5713 git checkout pr5713

2 1

[freeipa PR#5391][opened] Translations update from Weblate
by weblate 07 Jul '21

07 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5391 Author: weblate Title: #5391: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/freeipa/ipa-4-8/) for freeipa/ipa-4-8. Current translation status: ![Weblate translation status](https://translate.fedoraproject.org/widgets/freeipa/-/ipa-4-8/horiz… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5391/head:pr5391 git checkout pr5391

2 1

[freeipa PR#5617][opened] Add checks to prevent adding auth indicators to internal IPA services
by antoniotorresm 05 Jul '21

05 Jul '21

URL: https://github.com/freeipa/freeipa/pull/5617 Author: antoniotorresm Title: #5617: Add checks to prevent adding auth indicators to internal IPA services Action: opened PR body: """ Authentication indicators should not be enforced against internal IPA services, since not all users of those servers are able to produce Kerberos tickets with all the auth indicator options. This includes `host`, `ldap`, `HTTP` and `cifs` in IPA server and `host` and `cifs` in IPA clients. Fixes: https://pagure.io/freeipa/issue/8206 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5617/head:pr5617 git checkout pr5617

2 1

[freeipa PR#4909][opened] Add unauthenticated nsupdate
by fcami 28 Jun '21

28 Jun '21

URL: https://github.com/freeipa/freeipa/pull/4909 Author: fcami Title: #4909: Add unauthenticated nsupdate Action: opened PR body: """ ipa-client-install: update sssd.conf if nsupdate requires -g If dynamic DNS updates are selected, sssd will use GSS-TSIG by default for nsupdate. When ipa-client-install notices that plain nsupdate is required, switch sssd to use no authentication for dynamic updates too. Fixes: https://pagure.io/freeipa/issue/8402 + ipa-client-install: invoke nsupdate twice (GSS-TSIG, plain) ipa-client-install invokes nsupdate with GSS-TSIG at client enrollment time. If that fails, no retry is done. Change that behavior to try again without GSS-TSIG. Fixes: https://pagure.io/freeipa/issue/8402 #### This is purely WIP: - it needs a proper test - there are more nsupdate calls that should be adapted. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/4909/head:pr4909 git checkout pr4909

2 1

[freeipa PR#5637][opened] ipatests: Test to check that ResponseNotReady error is not displayed when user session cache is deleted
by menonsudhir 22 Jun '21

22 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5637 Author: menonsudhir Title: #5637: ipatests: Test to check that ResponseNotReady error is not displayed when user session cache is deleted Action: opened PR body: """ This testcase checks that http.client.ResponseNotReady error is not displayed when user session cache is deleted. https://pagure.io/freeipa/issue/7752 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5637/head:pr5637 git checkout pr5637

2 1

[freeipa PR#5325][opened] LDAP autobind authenticateAsDN for BIND named
by tiran 15 Jun '21

15 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5325 Author: tiran Title: #5325: LDAP autobind authenticateAsDN for BIND named Action: opened PR body: """ Use new nsslapd-ldapiautoauthdnattr feature to switch BIND named from GSSAPI bind to EXTERNAL LDAPI bind. Requires 389-DS build https://copr.fedorainfracloud.org/coprs/build/1811023 - [ ] Requires new build of 389-DS - [ ] Add new OIDs to FreeIPA's OID registry Fixes: https://pagure.io/freeipa/issue/8544 See: https://github.com/389ds/389-ds-base/issues/4381 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5325/head:pr5325 git checkout pr5325

2 1

[freeipa PR#5734][opened] Design doc to allow LDAP bind using the RADIUS auth type
by rcritten 11 Jun '21

11 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5734 Author: rcritten Title: #5734: Design doc to allow LDAP bind using the RADIUS auth type Action: opened PR body: """ The RADIUS auth type is only supported with Kerberos currently. This design proposes a way to make it work with LDAP binds as well without relying ok workarounds. Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5734/head:pr5734 git checkout pr5734

1 1

Framework execute callback feedback
by Rob Crittenden 10 Jun '21

10 Jun '21

Currently the framework has four types of methods: - pre_callback: called before any real work is done. Usually used to tune up incoming options - execute: does the brute work. For most CRUD plugins this is all done in baseldap.py in the LDAP* classes - post_callback: supposed to be data cleanup for presentation to the caller but in some cases actual work is being done. user-add calls ldap.add_entry_to_group for example. - exc_callback: special case handling for exceptions If you have "work" to be done that would normally be done in execute there is no way to do it other than to abuse post_callback to get it done. Overriding execute is only an option if you want to completely replace the call, otherwise order execution is going to be strange. Say for example in user_add you want to do work after the execute() is done so you'd do something like: class user_add() def execute(stuff): result = super(user_add, self).execute(stuff) # some extra work return result The order of execution is: user_add:pre_callback user_add:execute() LDAPCreate:execute() user_add:post_callback() user_add:execute() This is because the LDAP* baseldap methods handle the pre/post/exc callbacks directly. So in order to be able to insert more "work" in execute itself we'd need another callback type. Why do I want this? One feature of post_callback is that for add/mod methods ldap.get_entry() is called so we can prepare the final results to be returned to the user for display. There are cases where the user doesn't need or case to see that result. We could save an least one LDAP query by returning only errors in this case. The use case is mostly around bulk operations where the user doesn't care about seeing the UID of all users added, for example. To do this I think we can skip post_callback altogether, assuming it does no real "work". In the case of user_add/mod skipping post_callback would save three queries: fetch the user, has_keytab and has_password. But before re-architecting this I'd like to get some opinions on it. I can do a full-blown design if desired. rob

2 4

[freeipa PR#5739][opened] Replace DS replication plugin name
by mreynolds389 07 Jun '21

07 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5739 Author: mreynolds389 Title: #5739: Replace DS replication plugin name Action: opened PR body: """ In efforts to remove problematic language, like master and slave, DS is replacing "master" with "supplier" in the replication plugin entry under cn=config. DS should be able handle upgrades correctly as well. relates: https://pagure.io/freeipa/issue/8799 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5739/head:pr5739 git checkout pr5739

1 1

[freeipa PR#5801][opened] [ipa-4-9] ipatests: Bump PR-CI boxes
by netoarmando 07 Jun '21

07 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5801 Author: netoarmando Title: #5801: [ipa-4-9] ipatests: Bump PR-CI boxes Action: opened PR body: """ Update Fedora 34 and 33 boxes to include new packages. Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5801/head:pr5801 git checkout pr5801

2 1

[freeipa PR#5722][opened] workshop: Use default fedora cloud image
by netoarmando 07 Jun '21

07 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5722 Author: netoarmando Title: #5722: workshop: Use default fedora cloud image Action: opened PR body: """ Use publicly available Fedora cloud box, removing the necessity of building custom boxes with preinstalled packages. This removes the burden of maintaining boxes up-to-date, in the other hand one must fetch the packages for all hosts in the topology before starting the curriculum. Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5722/head:pr5722 git checkout pr5722

2 1

[freeipa PR#5800][opened] [master] ipatests: Bump PR-CI boxes
by netoarmando 04 Jun '21

04 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5800 Author: netoarmando Title: #5800: [master] ipatests: Bump PR-CI boxes Action: opened PR body: """ Update Fedora 34 and 33 boxes to include new packages Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5800/head:pr5800 git checkout pr5800

2 1

[freeipa PR#5793][opened] [Backport][ipa-4-8] azure: bump F32->F34
by stanislavlevin 03 Jun '21

03 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5793 Author: stanislavlevin Title: #5793: [Backport][ipa-4-8] azure: bump F32->F34 Action: opened PR body: """ This PR was opened manually because PR #5790 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5793/head:pr5793 git checkout pr5793

2 1

[freeipa PR#5769][opened] WebUI: Add support of 'ipaautoprivategroups' LDAP attribute on 'ID Ranges' page
by serg-cymbaluk 03 Jun '21

03 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5769 Author: serg-cymbaluk Title: #5769: WebUI: Add support of 'ipaautoprivategroups' LDAP attribute on 'ID Ranges' page Action: opened PR body: """ Add 'Auto private groups' field on 'Add ID range' form with the following options: true, false, hybrid. The field is optional and can be omitted. Its value can be also modified on 'Range Settings' page after the range is added. Ticket: https://pagure.io/freeipa/issue/8837 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5769/head:pr5769 git checkout pr5769

2 1

Preparing for FreeIPA 4.9.4 release
by Alexander Bokovoy 02 Jun '21

02 Jun '21

Hi, I am planning to do FreeIPA 4.9.4 release, hopefully, this week. As usual, current release notes draft is at https://vda.li/drafts/freeipa-4.9.4-release-notes-final.html We have around 30 tickets resolved: #2575 (rhbz#952756) [RFE] Installer wizard should prompt for DNS #2692 (rhbz#817071) ipa-server-install ignores --hostname #4011 (rhbz#1026434) ipa-server-install crashes when AD subpackage is not installed #4166 (rhbz#1059135) Backup CS.cfg before modifying it #4751 (rhbz#1851835) Implement ACME certificate enrolment #6587 ipa-otpd: systemctl reports "degraded" for "is-system-running" after todays CentOS updates #7835 (rhbz#1658280) Cert revocation for services and hosts is inefficient #8203 (rhbz#1835853) User page on WebUi only has half the information in CA-less install #8361 Add support for managing subuids and subgids in FreeIPA #8534 Nightly test failure in test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion::test_hidden_replica_promote #8582 Nightly test failure in test_replica_promotion.py::TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica - ClonesConnectivyAndDataCheck #8632 [CA-less] user fails to login via WebUI in case of `--no-pkinit` #8641 Random failure in test_webui/test_user.py::TestLifeCycles::test_life_cycles #8676 (rhbz#1955440) [Tracker] Multiple nightly test failure in test_integration/test_ntp_options/TestNTPoptions #8738 (rhbz#1934991) ACME fails to generate a cert on migrated RHEL8.4 server #8767 (rhbz#1943151) ipa-server-install displays debug output when --debug output is not specified. #8784 RFE: Reduce number of LDAP operations during hbacrule-del #8785 Nightly test failure in test_integration/test_commands.py/TestIPACommand/test_proxycommand_invalid_shell #8787 Add pkey_only to the service_find calls in the host plugin #8792 Random nightly test failure in test_replica_promotion.py::TestRenewalMaster::test_automatic_renewal_master_transfer_ondelete #8794 (rhbz#1948034) Failure to deploy FreeIPA domain controller in Rawhide with systemd-resolved 248-1.fc35 #8797 Cache the value of ca_is_enabled in the request context #8798 (rhbz#1953656) RFE: Cache LDAP data within a request #8801 user-mod requires two searches for a user entry #8802 IPA test failing with long serial numbers #8807 (rhbz#1688267) [RFE] IPA to allow setting a new range type. #8809 RFE: A tool to collect and analyze etimes from IPA logs #8814 Use Dogtag's CryptographyCryptoProvider instead of NSSCryptoProvider for KRAClient() #8818 new pylint 2.8 and astroid 2.5.5 #8830 [azure] performance instability #8831 update_dna_shared_config may not update all entries #8832 (rhbz#1957768) ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4 I would wait for F34 Azure CI patches but this is not strictly necessary, we can do another release once they are ready. We need to figure out what else is worth waiting for. Right now following PRs have ipa-4-9 label: 5769 WebUI: Add support of 'ipaautoprivategroups' LDAP WebUI ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5769 5749 pkispawn: override the AJP address ipa-4-9 https://github.com/freeipa/freeipa/pull/5749 5733 Revert the way hosts/services certs are searched f WIP ipa-4-9 needs rebase https://github.com/freeipa/freeipa/pull/5733 5662 ipatests: add test for login with FAST armoring en ipa-4-8 ipa-4-9 https://github.com/freeipa/freeipa/pull/5662 5656 [ipatests] Add basic support for remote ipaplatfor ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5656 5637 ipatests: Test to check that ResponseNotReady erro ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/5637 5617 Add checks to prevent adding auth indicators to in ipa-4-9 https://github.com/freeipa/freeipa/pull/5617 5387 Raise RuntimeError when kinit_armor fails ipa-4-9 stale https://github.com/freeipa/freeipa/pull/5387 4909 Add unauthenticated nsupdate ipa-4-9 needs review https://github.com/freeipa/freeipa/pull/4909 389-ds did rename Multimaster replication plugin to Multisupplier and we need to be able to install with both old and new plugin names. May be someone could pick up the work Mark Reynolds did in https://github.com/freeipa/freeipa/pull/5739 and add support for both ways? -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 2

[freeipa PR#5798][opened] ds: Support renaming of a replication plugin in 389-ds
by abbra 01 Jun '21

01 Jun '21

URL: https://github.com/freeipa/freeipa/pull/5798 Author: abbra Title: #5798: ds: Support renaming of a replication plugin in 389-ds Action: opened PR body: """ IPA topology plugin depends on the replication plugin but 389-ds cannot handle older alias querying in the plugin configuration with 'nsslapd-plugin-depends-on-named: ..' attribute See https://github.com/389ds/389-ds-base/issues/4786 for details Fixes: https://pagure.io/freeipa/issue/8799 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5798/head:pr5798 git checkout pr5798

1 1

[freeipa PR#5797][opened] [Backport][ipa-4-9] Add --keyfile option to ipa-otptoken-import.1
by abbra 29 May '21

29 May '21

URL: https://github.com/freeipa/freeipa/pull/5797 Author: abbra Title: #5797: [Backport][ipa-4-9] Add --keyfile option to ipa-otptoken-import.1 Action: opened PR body: """ This PR was opened automatically because PR #5791 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5797/head:pr5797 git checkout pr5797

1 1

[freeipa PR#5796][opened] [Backport][ipa-4-9] Update IRC links to point to Libera.chat
by abbra 29 May '21

29 May '21

URL: https://github.com/freeipa/freeipa/pull/5796 Author: abbra Title: #5796: [Backport][ipa-4-9] Update IRC links to point to Libera.chat Action: opened PR body: """ This PR was opened automatically because PR #5795 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5796/head:pr5796 git checkout pr5796

1 1

[freeipa PR#5791][opened] Add --keyfile option to ipa-otptoken-import.1
by miztake 27 May '21

27 May '21

URL: https://github.com/freeipa/freeipa/pull/5791 Author: miztake Title: #5791: Add --keyfile option to ipa-otptoken-import.1 Action: opened PR body: """ ipa-otptoken-import.1 describes the -k option. However, the long option --keyfile option is also available. Therefore, add the --keyfile option to ipa-otptoken-import.1. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5791/head:pr5791 git checkout pr5791

2 1

[freeipa PR#5795][opened] Update IRC links to point to Libera.chat
by abbra 27 May '21

27 May '21

URL: https://github.com/freeipa/freeipa/pull/5795 Author: abbra Title: #5795: Update IRC links to point to Libera.chat Action: opened PR body: """ Update documentation now that we moved IRC channels #freeipa and #sssd to Libera.chat network. Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5795/head:pr5795 git checkout pr5795

1 1

[freeipa PR#5794][opened] [Backport][ipa-4-9] pkispawn: override the AJP address
by abbra 27 May '21

27 May '21

URL: https://github.com/freeipa/freeipa/pull/5794 Author: abbra Title: #5794: [Backport][ipa-4-9] pkispawn: override the AJP address Action: opened PR body: """ This PR was opened automatically because PR #5749 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5794/head:pr5794 git checkout pr5794

1 1

[freeipa PR#5749][opened] ipatests: define localhost4 and localhost6 in /etc/hosts
by flo-renaud 26 May '21

26 May '21

URL: https://github.com/freeipa/freeipa/pull/5749 Author: flo-renaud Title: #5749: ipatests: define localhost4 and localhost6 in /etc/hosts Action: opened PR body: """ The /etc/hosts file currently defines the following: 127.0.0.1 localhost ::1 localhost but pki defines AJP connectors using localhost4 and localhost6: <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost4" name="Connector1" secret="..."/> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="localhost6" name="Connector2" secret="..."/> (since commit 1906afbeb3c8b7140601be7f9bee2f7fef5b0a5e, in order to fix rhbz#1780082) Configure /etc/hosts with the following instead: 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5749/head:pr5749 git checkout pr5749

2 1

[freeipa PR#5792][opened] [Backport][ipa-4-9] azure: bump F32->F34
by abbra 25 May '21

25 May '21

URL: https://github.com/freeipa/freeipa/pull/5792 Author: abbra Title: #5792: [Backport][ipa-4-9] azure: bump F32->F34 Action: opened PR body: """ This PR was opened automatically because PR #5790 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5792/head:pr5792 git checkout pr5792

1 1

[freeipa PR#5631][opened] azure: use Fedora 34 as a baseline
by abbra 25 May '21

25 May '21

URL: https://github.com/freeipa/freeipa/pull/5631 Author: abbra Title: #5631: azure: use Fedora 34 as a baseline Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5631/head:pr5631 git checkout pr5631

1 1

[freeipa PR#5504][opened] Test on Fedora 33
by tiran 25 May '21

25 May '21

URL: https://github.com/freeipa/freeipa/pull/5504 Author: tiran Title: #5504: Test on Fedora 33 Action: opened PR body: """ 389-DS on Fedora 32 does not have new DS feature. Update to temmplate 0.0.5 with updated DS. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5504/head:pr5504 git checkout pr5504

1 1

[freeipa PR#5780][opened] ipatests: dnssec: Add alternative approach for checking chain of trust
by stanislavlevin 25 May '21

25 May '21

URL: https://github.com/freeipa/freeipa/pull/5780 Author: stanislavlevin Title: #5780: ipatests: dnssec: Add alternative approach for checking chain of trust Action: opened PR body: """ drill is currently broken on F34. Fortunately, there are another tools for checking DNSSEC trust. One of them is `delv`: delv is a tool for sending DNS queries and validating the results, using the same internal resolver and validator logic as named. delv sends to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, queries for DNSKEY, and DS records to establish a chain of trust for DNSSEC validation. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding. - mark as XFAIL `test_chain_of_trust_drill` on F34 - conditionally skip `test_chain_of_trust_delv` (requires delv > 9.15.4 for `+yaml`) Related: https://pagure.io/freeipa/issue/8793 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5780/head:pr5780 git checkout pr5780

1 1

[freeipa PR#5790][opened] azure: bump F32->F34
by stanislavlevin 25 May '21

25 May '21

URL: https://github.com/freeipa/freeipa/pull/5790 Author: stanislavlevin Title: #5790: azure: bump F32->F34 Action: opened PR body: """ Bundle of changes required for F34 on Azure. Shuffling of tests between envs may still be required (under testing for stability). Fixes: https://pagure.io/freeipa/issue/8848 Opened here for preview. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5790/head:pr5790 git checkout pr5790

2 1

[freeipa PR#5789][opened] [Backport][ipa-4-9] ipatests: kinit on server for test_proxycommand_invalid_shell
by flo-renaud 21 May '21

21 May '21

URL: https://github.com/freeipa/freeipa/pull/5789 Author: flo-renaud Title: #5789: [Backport][ipa-4-9] ipatests: kinit on server for test_proxycommand_invalid_shell Action: opened PR body: """ This PR was opened automatically because PR #5767 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5789/head:pr5789 git checkout pr5789

1 1

[freeipa PR#5785][opened] [Backport][ipa-4-9] Add argument for --entry option in ipa-managed-entries.1
by rcritten 21 May '21

21 May '21

URL: https://github.com/freeipa/freeipa/pull/5785 Author: rcritten Title: #5785: [Backport][ipa-4-9] Add argument for --entry option in ipa-managed-entries.1 Action: opened PR body: """ This PR was opened automatically because PR #5783 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5785/head:pr5785 git checkout pr5785

2 1

[freeipa PR#5786][opened] [Backport][ipa-4-9] Remove -s option from ipa-ldap-updater usage
by rcritten 21 May '21

21 May '21

URL: https://github.com/freeipa/freeipa/pull/5786 Author: rcritten Title: #5786: [Backport][ipa-4-9] Remove -s option from ipa-ldap-updater usage Action: opened PR body: """ This PR was opened automatically because PR #5782 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5786/head:pr5786 git checkout pr5786

2 1

[freeipa PR#5787][opened] [Backport][ipa-4-9] Add ability to search on certificate revocation status
by rcritten 21 May '21

21 May '21

URL: https://github.com/freeipa/freeipa/pull/5787 Author: rcritten Title: #5787: [Backport][ipa-4-9] Add ability to search on certificate revocation status Action: opened PR body: """ This is a manual backport of one commit from PR https://github.com/freeipa/freeipa/pull/5701 This adds the ability to search for certificates based on status. The other commit from that PR is in the process of being reverted. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5787/head:pr5787 git checkout pr5787

2 1

[freeipa PR#5767][opened] ipatests: kinit on server for test_proxycommand_invalid_shell
by rcritten 21 May '21

21 May '21

URL: https://github.com/freeipa/freeipa/pull/5767 Author: rcritten Title: #5767: ipatests: kinit on server for test_proxycommand_invalid_shell Action: opened PR body: """ We've seen some intermittent failures of this test with warnings about passwords about to expire. We suspect there may be a time difference between the client and server so set the passwords on the server instead to be sure that time is correct. https://pagure.io/freeipa/issue/8785 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5767/head:pr5767 git checkout pr5767

2 1

[freeipa PR#5788][opened] WIP: Bronze Bit KDB fixes
by frozencemetery 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5788 Author: frozencemetery Title: #5788: WIP: Bronze Bit KDB fixes Action: opened PR body: """ A WIP PR for this branch as requested. It is expected to not pass CI, which is for two reasons. First, it needs the [krb5 branch](https://github.com/krb5/krb5/pull/1159). Second, because the krb5 branch isn't all tested good - RBCD doesn't work right, and I'm still trying to get testing against local AD working. (If anyone is up for providing feedback on that, it would be appreciated.) And if I'm being honest, this code is probably buggy too, so that's three reasons. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5788/head:pr5788 git checkout pr5788

1 0

[freeipa PR#5784][opened] Revert "Only request VALID certs when revoking certs for a host/service"
by rcritten 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5784 Author: rcritten Title: #5784: Revert "Only request VALID certs when revoking certs for a host/service" Action: opened PR body: """ This reverts commit aa1350384ad6a7d6b2f6056d99fbb43c5c5a6be7. The search for certificates is a complex, three-step process, which filters results in subsequent searches. This filters out non-relevant certificates when deleting a host or service. This patch breaks that so deleting one service of a host will revoke *all* certificates for that host. Another attempt will be made separately to implement this. https://pagure.io/freeipa/issue/7835 Signed-off-by: Rob Crittenden rcritten(a)redhat.com """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5784/head:pr5784 git checkout pr5784

1 1

[freeipa PR#5723][opened] [Backport][ipa-4-9] Only request VALID certs when revoking certs for a host/service
by flo-renaud 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5723 Author: flo-renaud Title: #5723: [Backport][ipa-4-9] Only request VALID certs when revoking certs for a host/service Action: opened PR body: """ This PR was opened automatically because PR #5701 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5723/head:pr5723 git checkout pr5723

2 1

[freeipa PR#5782][opened] Remove -s option from ipa-ldap-updater usage
by miztake 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5782 Author: miztake Title: #5782: Remove -s option from ipa-ldap-updater usage Action: opened PR body: """ The -s option no longer exists, so remove it from the command usage. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5782/head:pr5782 git checkout pr5782

2 1

[freeipa PR#5783][opened] Add argument for --entry option in ipa-managed-entries.1
by miztake 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5783 Author: miztake Title: #5783: Add argument for --entry option in ipa-managed-entries.1 Action: opened PR body: """ There are no arguments in the --entry option, but DN for the managed entry definition must actually be specified. Therefore, add MANAGED_ENTRY as an argument. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5783/head:pr5783 git checkout pr5783

2 1

[freeipa PR#5781][opened] [Backport][ipa-4-9] Add argument for --schema-file option in ipa-ldap-updater.1
by flo-renaud 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5781 Author: flo-renaud Title: #5781: [Backport][ipa-4-9] Add argument for --schema-file option in ipa-ldap-updater.1 Action: opened PR body: """ This PR was opened automatically because PR #5779 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5781/head:pr5781 git checkout pr5781

1 1

[freeipa PR#5779][opened] Add argument for --schema-file option in ipa-ldap-updater.1
by miztake 20 May '21

20 May '21

URL: https://github.com/freeipa/freeipa/pull/5779 Author: miztake Title: #5779: Add argument for --schema-file option in ipa-ldap-updater.1 Action: opened PR body: """ There are no arguments in the --schema-file option, but the Schema file in LDIF format must actually be specified. Therefore, add FILE.ldif as an argument. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5779/head:pr5779 git checkout pr5779

2 1

[freeipa PR#5778][opened] [Backport][ipa-4-9] Add ACME profile on replica install in non-ACME environment
by flo-renaud 19 May '21

19 May '21

URL: https://github.com/freeipa/freeipa/pull/5778 Author: flo-renaud Title: #5778: [Backport][ipa-4-9] Add ACME profile on replica install in non-ACME environment Action: opened PR body: """ This PR was opened automatically because PR #5605 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5778/head:pr5778 git checkout pr5778

1 1

[freeipa PR#5777][opened] [Backport][ipa-4-9] Add arguments to the description of OPTIONS in ipa-winsync-migrate.1
by flo-renaud 19 May '21

19 May '21

URL: https://github.com/freeipa/freeipa/pull/5777 Author: flo-renaud Title: #5777: [Backport][ipa-4-9] Add arguments to the description of OPTIONS in ipa-winsync-migrate.1 Action: opened PR body: """ This PR was opened automatically because PR #5773 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5777/head:pr5777 git checkout pr5777

1 1

[freeipa PR#5776][opened] [Backport][ipa-4-9] Fix the option to match in the ipa-client-automount usage and man-page
by flo-renaud 19 May '21

19 May '21

URL: https://github.com/freeipa/freeipa/pull/5776 Author: flo-renaud Title: #5776: [Backport][ipa-4-9] Fix the option to match in the ipa-client-automount usage and man-page Action: opened PR body: """ This PR was opened automatically because PR #5770 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5776/head:pr5776 git checkout pr5776

1 1

[freeipa PR#5775][opened] [Backport][ipa-4-9] Add -d option to match in the ipa-client-samba usage and man-page
by flo-renaud 19 May '21

19 May '21

URL: https://github.com/freeipa/freeipa/pull/5775 Author: flo-renaud Title: #5775: [Backport][ipa-4-9] Add -d option to match in the ipa-client-samba usage and man-page Action: opened PR body: """ This PR was opened automatically because PR #5771 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5775/head:pr5775 git checkout pr5775

1 1

[freeipa PR#5774][opened] [Backport][ipa-4-9] man: fix typos in ipa-epn.1
by flo-renaud 19 May '21

19 May '21

URL: https://github.com/freeipa/freeipa/pull/5774 Author: flo-renaud Title: #5774: [Backport][ipa-4-9] man: fix typos in ipa-epn.1 Action: opened PR body: """ This PR was opened automatically because PR #5772 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5774/head:pr5774 git checkout pr5774

1 1

[freeipa PR#5605][opened] Add ACME profile on replica install in non-ACME environment
by rcritten 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5605 Author: rcritten Title: #5605: Add ACME profile on replica install in non-ACME environment Action: opened PR body: """ Always import the default certificate profiles The default certificate profiles were not imported for in a promoted client installation. This could lead to missing profiles, as was seen in the ACME case, while upgrading from older versions. The sequence was: 1. Install a non-ACME IPA server 2. Install an ipa client 3. On the client promote to a server with a build that supports ACME. The resulting installation is missing the acmeIPAServerCert profile because it is provided in INCLUDED_PROFILES which isn't loaded during promotions. There is already handling to handle issues if the profile already exists so it is safe to call this on every installation. https://pagure.io/freeipa/issue/8738 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5605/head:pr5605 git checkout pr5605

2 1

[freeipa PR#5766][opened] [Backport][ipa-4-9] Fix update_dna_shared_config to wait for both entries
by rcritten 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5766 Author: rcritten Title: #5766: [Backport][ipa-4-9] Fix update_dna_shared_config to wait for both entries Action: opened PR body: """ This PR was opened automatically because PR #5752 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5766/head:pr5766 git checkout pr5766

2 1

[freeipa PR#5773][opened] Add arguments to the description of OPTIONS in ipa-winsync-migrate.1
by miztake 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5773 Author: miztake Title: #5773: Add arguments to the description of OPTIONS in ipa-winsync-migrate.1 Action: opened PR body: """ ipa-winsync-migrate.1 has an explanation of options, but no arguments. Therefore, add the arguments for --realm and --server. Also, add a short option -U for --unattended. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5773/head:pr5773 git checkout pr5773

2 1

[freeipa PR#5770][opened] Fix the option to match in the ipa-client-automount usage and man-page
by miztake 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5770 Author: miztake Title: #5770: Fix the option to match in the ipa-client-automount usage and man-page Action: opened PR body: """ The command usage and man-page options may not match. In ipa-client-automount, fix to match usage and man-page. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5770/head:pr5770 git checkout pr5770

2 1

[freeipa PR#5771][opened] Add -d option to match in the ipa-client-samba usage and man-page
by miztake 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5771 Author: miztake Title: #5771: Add -d option to match in the ipa-client-samba usage and man-page Action: opened PR body: """ The ipa-client-samba man-page describes the -d option, but the -d option cannot actually be used. Fix ipa-client-samba to enable the -d option. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5771/head:pr5771 git checkout pr5771

2 1

[freeipa PR#5772][opened] man: fix typos in ipa-epn.1
by miztake 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5772 Author: miztake Title: #5772: man: fix typos in ipa-epn.1 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5772/head:pr5772 git checkout pr5772

2 1

[freeipa PR#5768][opened] [Backport][ipa-4-9] ipatests: increase timeout for test_commands up to 1.5 hours
by wladich 18 May '21

18 May '21

URL: https://github.com/freeipa/freeipa/pull/5768 Author: wladich Title: #5768: [Backport][ipa-4-9] ipatests: increase timeout for test_commands up to 1.5 hours Action: opened PR body: """ This is a manual backport of #5748 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5768/head:pr5768 git checkout pr5768

1 1

How to promote replicated master server in freeIPA, if lost first master?
by Anubhav Gupta 17 May '21

17 May '21

I have replicated multi-master environment of freeIPA server. Suppose I have follwoing master server of freeIPA- First Master - ipa-server.xyz.com Replicated master - ipa-replica.xyz.com My all application like Jenkins, GitLab etc use ipa-server.xyz.com to authenticate. Now I lost my first master server. How can i use my replicated master server in place of first one ?

2 1

[freeipa PR#5748][opened] ipatests: increase timeout for test_commands up to 1.5 hours
by wladich 13 May '21

13 May '21

URL: https://github.com/freeipa/freeipa/pull/5748 Author: wladich Title: #5748: ipatests: increase timeout for test_commands up to 1.5 hours Action: opened PR body: """ Normally it takes 50 minutes for test_commands test suite to complete. But due to fluctuations in virtualized environment sometimes it exceeds 60 minutes which produces random failures in nightly runs. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5748/head:pr5748 git checkout pr5748

1 1

[freeipa PR#5765][opened] [Backport][ipa-4-8] Fix update_dna_shared_config to wait for both entries
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5765 Author: rcritten Title: #5765: [Backport][ipa-4-8] Fix update_dna_shared_config to wait for both entries Action: opened PR body: """ This PR was opened automatically because PR #5752 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5765/head:pr5765 git checkout pr5765

1 1

[freeipa PR#5762][opened] [ipa-4-9] ipatests: Bump PR-CI templates to Fedora 34
by netoarmando 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5762 Author: netoarmando Title: #5762: [ipa-4-9] ipatests: Bump PR-CI templates to Fedora 34 Action: opened PR body: """ Move 'latest' to Fedora 34 and 'previous' Fedora 33 for nightly runs. Keep gating on Fedora 33 for now. --- Known issues blocking gating to move to F34: - `test_cert` timed out, blocked in the step `[8/11]: upgrading server`, under investigation with 389-ds - `test_dnssec_TestInstallDNSSECFirst` reported at [8793](https://pagure.io/freeipa/issue/8793) Gating run + some other jobs on Fedora 34: https://github.com/freeipa-pr-ci2/freeipa/pull/897 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5762/head:pr5762 git checkout pr5762

1 1

[freeipa PR#5761][opened] [master] ipatests: Bump PR-CI templates to Fedora 34
by netoarmando 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5761 Author: netoarmando Title: #5761: [master] ipatests: Bump PR-CI templates to Fedora 34 Action: opened PR body: """ Move 'latest' to Fedora 34 and 'previous' Fedora 33 for nightly runs. Keep gating on Fedora 33 for now. --- Known issue blocking gating to move to F34: - `test_dnssec_TestInstallDNSSECFirst` is a known issue, [8793](https://pagure.io/freeipa/issue/8793) Gating run + some other jobs on Fedora 34: https://github.com/freeipa-pr-ci2/freeipa/pull/898 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5761/head:pr5761 git checkout pr5761

1 1

[freeipa PR#5752][opened] Fix update_dna_shared_config to wait for both entries
by tiran 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5752 Author: tiran Title: #5752: Fix update_dna_shared_config to wait for both entries Action: opened PR body: """ update_dna_shared_config plugin now waits for presence of both ``dnaHostname=fqdn+dnaPortNum=0`` and ``dnaHostname=fqdn+dnaPortNum=389`` entries before it updates the entries. The commit also refactors the code of update_dna_shared_config for subordinate id support. Fixes: https://pagure.io/freeipa/issue/8831 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5752/head:pr5752 git checkout pr5752

2 1

[freeipa PR#5647][opened] WIP: check on some performance changes
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5647 Author: rcritten Title: #5647: WIP: check on some performance changes Action: opened PR body: """ Exercise some changes that should reduce the number of queries performed for some operations, mostly host and user related. The execution time patches will be replaced by Antonio's patch at some point. Running in CI to see if anything is terribly broken. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5647/head:pr5647 git checkout pr5647

1 1

[freeipa PR#5764][opened] [Backport][ipa-4-9] Implement simple LDAP cache layer
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5764 Author: rcritten Title: #5764: [Backport][ipa-4-9] Implement simple LDAP cache layer Action: opened PR body: """ This PR was opened automatically because PR #5681 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5764/head:pr5764 git checkout pr5764

1 1

[freeipa PR#5763][opened] [Backport][ipa-4-9] Only attempt to upgrade ACME configuration files if deployed
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5763 Author: rcritten Title: #5763: [Backport][ipa-4-9] Only attempt to upgrade ACME configuration files if deployed Action: opened PR body: """ This PR was opened automatically because PR #5756 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5763/head:pr5763 git checkout pr5763

1 1

[freeipa PR#5681][opened] Implement simple LDAP cache layer
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5681 Author: rcritten Title: #5681: Implement simple LDAP cache layer Action: opened PR body: """ Pretty straightforward caching except for the attribute handling. We probably won't want to cache the entire entry since that could be expensive (userCertificate, ssh keys, etc) but not storing it could lead to multiple requests for the same thing. Also, requesting * vs a set of attributes may not return all a plugin needs, as it will skip operational attributes. Still, this saves 20-50% of queries in my limited testing. Mar 29: initial implementation works about 80% of the time. I guarantee the xmlrpc tests will fail. We'll see about the integration tests. There are still corner cases to find and the member modlist stuff is a mess. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5681/head:pr5681 git checkout pr5681

1 1

[freeipa PR#5756][opened] Only attempt to upgrade ACME configuration files if deployed
by rcritten 12 May '21

12 May '21

URL: https://github.com/freeipa/freeipa/pull/5756 Author: rcritten Title: #5756: Only attempt to upgrade ACME configuration files if deployed Action: opened PR body: """ This can happen on upgrades from older deployments that lack an ACME installation and don't meet the minimum requirements to deploy one automatically. Also don't consider missing ACME schema a total failure, just log and skip it. https://pagure.io/freeipa/issue/8832 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> TESTING: Testing is difficult because on upgrade IPA will deploy ACME if it isn't already configured. One way to avoid this is to twiddle with /usr/share/pki/VERSION and set the value < 10.10.0. If ACME is already deployed you can remove it with: # pki-server acme-undeploy # rm -rf /etc/pki/pki-tomcat/acme """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5756/head:pr5756 git checkout pr5756

1 1

LDAP caching patch
by Rob Crittenden 11 May '21

11 May '21

Just a heads-up, I'm going to merge the LDAP caching patch later today, PR https://github.com/freeipa/freeipa/pull/5681 Caching is enabled by default and some metrics will be visible in the Apache log when the server is in debug mode, like: ipa: DEBUG: FINAL: Hits 1 Misses 3 Size 2 There is a very simple log parser to determine cache usage in contrib/cachelog if you want to check on how much/if the layer helps. Let me know if you see anything really odd happen. To disable the cache add ldap_cache=False to /etc/ipa/server.conf and restart httpd. rob

1 0

[freeipa PR#5760][opened] ipatests: Tests for RFE auto-private-groups cli option
by menonsudhir 11 May '21

11 May '21

URL: https://github.com/freeipa/freeipa/pull/5760 Author: menonsudhir Title: #5760: ipatests: Tests for RFE auto-private-groups cli option Action: opened PR body: """ This patch tests the various values available for the option auto-private-groups for the idrange-mod command and ensure that the CLI displays the correct result when the value is changed. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5760/head:pr5760 git checkout pr5760

1 0

[freeipa PR#5758][opened] [Backport][ipa-4-9] Spec file: bump augeas-libs version
by rcritten 07 May '21

07 May '21

URL: https://github.com/freeipa/freeipa/pull/5758 Author: rcritten Title: #5758: [Backport][ipa-4-9] Spec file: bump augeas-libs version Action: opened PR body: """ This PR was opened automatically because PR #5745 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5758/head:pr5758 git checkout pr5758

2 1

[freeipa PR#5757][opened] [Backport][ipa-4-9] Parse Apache log etime and display average per command
by rcritten 07 May '21

07 May '21

URL: https://github.com/freeipa/freeipa/pull/5757 Author: rcritten Title: #5757: [Backport][ipa-4-9] Parse Apache log etime and display average per command Action: opened PR body: """ This PR was opened automatically because PR #5717 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5757/head:pr5757 git checkout pr5757

2 1

[freeipa PR#5759][opened] [Backport][ipa-4-9] hbacrule: reduce number of LDAP searches during deletion
by rcritten 07 May '21

07 May '21

URL: https://github.com/freeipa/freeipa/pull/5759 Author: rcritten Title: #5759: [Backport][ipa-4-9] hbacrule: reduce number of LDAP searches during deletion Action: opened PR body: """ This PR was opened automatically because PR #5689 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5759/head:pr5759 git checkout pr5759

2 1

[freeipa PR#5753][opened] [Backport][ipa-4-9] ipatests: test_installation: add install test scenarios
by miskopo 07 May '21

07 May '21

URL: https://github.com/freeipa/freeipa/pull/5753 Author: miskopo Title: #5753: [Backport][ipa-4-9] ipatests: test_installation: add install test scenarios Action: opened PR body: """ This PR was opened automatically because PR #5610 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5753/head:pr5753 git checkout pr5753

1 1

[freeipa PR#5689][opened] hbacrule: reduce number of LDAP searches during deletion
by antoniotorresm 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5689 Author: antoniotorresm Title: #5689: hbacrule: reduce number of LDAP searches during deletion Action: opened PR body: """ The `hbacrule` module performs a call to `selinuxusermap-find` during entry deletion. This can be optimized by performing a direct LDAP search instead. Related: https://pagure.io/freeipa/issue/8784 Signed-off-by: Antonio Torres <antorres(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5689/head:pr5689 git checkout pr5689

2 1

[freeipa PR#5747][opened] [Backport][ipa-4-9] Constrain pylint to supported versions
by flo-renaud 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5747 Author: flo-renaud Title: #5747: [Backport][ipa-4-9] Constrain pylint to supported versions Action: opened PR body: """ This PR was opened automatically because PR #5740 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5747/head:pr5747 git checkout pr5747

2 1

[freeipa PR#5746][opened] [Backport][ipa-4-9] ipatests: Test if ACME renews the issued cert with cerbot
by flo-renaud 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5746 Author: flo-renaud Title: #5746: [Backport][ipa-4-9] ipatests: Test if ACME renews the issued cert with cerbot Action: opened PR body: """ This PR was opened automatically because PR #5557 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5746/head:pr5746 git checkout pr5746

2 1

[freeipa PR#5745][opened] Spec file: bump augeas-libs version
by flo-renaud 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5745 Author: flo-renaud Title: #5745: Spec file: bump augeas-libs version Action: opened PR body: """ Older augeas does not support new options provided by chrony: sourcedir /run/chrony-dhcp ntsdumpdir /var/lib/chrony and is failing to update /etc/chrony.conf in ipa installer. Bump augeas-libs version to require the fix: 1.12.0-6 on fedora 33+ 1.12.0-3 otherwise Fixes: https://pagure.io/freeipa/issue/8676 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5745/head:pr5745 git checkout pr5745

2 1

[freeipa PR#5717][opened] Parse Apache log etime and display average per command
by rcritten 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5717 Author: rcritten Title: #5717: Parse Apache log etime and display average per command Action: opened PR body: """ Including execution time (etim) was added in commit 4d716d3fbc69760bc0f7bd1a7c83ab14f1a62f18 This is a parser that will collect API executions and average them by command. If > 5 requests of the same type then the fastest and slowest results will be dropped to try to smooth the average. These averages will be used for two purposes: 1. Identify potential bottlenecks in API performance 2. Provide a baseline so that future performance changes can be measured. It is included in contrib because this is not going to be shipped with a distribution but is useful to have with the code. A sample execution is: Mean user_show: 12234152.5 of 2 executions Mean command_defaults: 3284363.0 of 3 executions Mean user_add: 594369554.5 of 2 executions The parselog command was successful Times are in nanoseconds. https://pagure.io/freeipa/issue/8809 Signed-off-by: Rob Crittenden <rcritten(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5717/head:pr5717 git checkout pr5717

1 1

[freeipa PR#5755][opened] [Backport][ipa-4-8] pkispawn: Make timeout consistent with IPA's startup_timeout
by rcritten 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5755 Author: rcritten Title: #5755: [Backport][ipa-4-8] pkispawn: Make timeout consistent with IPA's startup_timeout Action: opened PR body: """ This PR was opened automatically because PR #5751 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5755/head:pr5755 git checkout pr5755

1 1

[freeipa PR#5754][opened] [Backport][ipa-4-9] pkispawn: Make timeout consistent with IPA's startup_timeout
by rcritten 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5754 Author: rcritten Title: #5754: [Backport][ipa-4-9] pkispawn: Make timeout consistent with IPA's startup_timeout Action: opened PR body: """ This PR was opened automatically because PR #5751 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5754/head:pr5754 git checkout pr5754

1 1

Azure test failures
by Rob Crittenden 06 May '21

06 May '21

Looks a lot of IPA PRs have been failing the last few days due to one or more tests in Azure failing. I cherry-picked a few and they all look like CA startup failures during server installation, replication creation, ipa-ca-install, etc. In the one test I did a deeper dive into the CA debug log the start up looks quite benign with no errors reported and it finishes up at 19:33:27 The IPA installer kicked off the restart at 19:32:11 and gave up at 19:35:23. The journal logs a suspect (why this isn't in the CA debug log I don't know): Apr 30 19:32:35 master1.ipa.test server[3589]: SEVERE: Failed to initialize component [Connector[AJP/1.3-8009]] Apr 30 19:32:35 master1.ipa.test server[3589]: org.apache.catalina.LifecycleException: Protocol handler initialization failed Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.connector.Connector.initInternal(Connector.java:1042) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.core.StandardService.initInternal(StandardService.java:533) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1057) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.startup.Catalina.load(Catalina.java:724) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.startup.Catalina.load(Catalina.java:746) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) Apr 30 19:32:35 master1.ipa.test server[3589]: at java.lang.reflect.Method.invoke(Method.java:498) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472) Apr 30 19:32:35 master1.ipa.test server[3589]: Caused by: java.net.BindException: Address already in use Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.nio.ch.Net.bind0(Native Method) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.nio.ch.Net.bind(Net.java:461) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.nio.ch.Net.bind(Net.java:453) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:222) Apr 30 19:32:35 master1.ipa.test server[3589]: at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:85) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.tomcat.util.net.NioEndpoint.initServerSocket(NioEndpoint.java:228) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:211) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1141) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1154) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:581) Apr 30 19:32:35 master1.ipa.test server[3589]: at org.apache.catalina.connector.Connector.initInternal(Connector.java:1039) Apr 30 19:32:35 master1.ipa.test server[3589]: ... 13 more and the journal is full of the expected HTTP connect issues trying to verify that the CA is fully up. The full logs are available at https://dev.azure.com/freeipa/freeipa/_build/results?buildId=8758&view=arti… Right click the three-dot thinger at the end of logs-GATING-sudo_1_to_5_8758-1-1-3-Linux-X86 and select Download artifacts. rob

5 10

[freeipa PR#5751][opened] test-only: Pass down startup delay for pkispawn
by stanislavlevin 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5751 Author: stanislavlevin Title: #5751: test-only: Pass down startup delay for pkispawn Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5751/head:pr5751 git checkout pr5751

2 1

[freeipa PR#5610][opened] ipatests: test_installation: add install test scenarios
by miskopo 06 May '21

06 May '21

URL: https://github.com/freeipa/freeipa/pull/5610 Author: miskopo Title: #5610: ipatests: test_installation: add install test scenarios Action: opened PR body: """ - test_hostname_parameter: Test for #2692 ipa-server-install ignores --hostname - check whether hostname provided in `--hostname` parameter is being taken into account and set as new hostname without prompting for it again - test_ad_subpackage_dependency: Test for #4011 ipa-server-install crashes when AD subpackage is not installed - test if ipa-server installation succeeds without `freeipa-ipa-server-trust-ad` installed - test_backup_of_cs_cfg_should_be_created: Test for #4166 Backup CS.cfg before modifying it - test if ipa-server installer backs up CS.cfg before modifying it - test_update_krb5_conf_template_with_keyring_default_ccache_name: Test for #4013 Update krb5.conf.template to support KEYRING default_ccache_name - test if krb5.conf is updated with permanent ccache after installation Related: https://pagure.io/freeipa/issue/2692 Related: https://pagure.io/freeipa/issue/4011 Related: https://pagure.io/freeipa/issue/4166 Related: https://pagure.io/freeipa/issue/4013 Signed-off-by: Michal Polovka <mpolovka(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5610/head:pr5610 git checkout pr5610

1 1

[freeipa PR#5750][opened] azure: Re-group test envs
by stanislavlevin 05 May '21

05 May '21

URL: https://github.com/freeipa/freeipa/pull/5750 Author: stanislavlevin Title: #5750: azure: Re-group test envs Action: opened PR body: """ This is the experimental fix to workaround the issue with PKI component, which is sensitive to slow systems(at least, appropriate delays and timeouts should be adjusted for such). Somehow Azure's test envs became slower then they were earlier (for example, CA subsystem start changed ~(20-30)sec -> ~(45-60)sec). This triggered various issues with subsystems of PKI. To release CPU resources(Azure VM provides 2 cores, 1 thread per core) the extreme usage of swap was reduced to the limits provided by Azure(7Gb + 4Gb swap). Server/replica container consumes ~2Gb, client one ~0.5Gb. Also this increases the number of Azure's Gating jobs from 4 to 6. Related: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahost… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5750/head:pr5750 git checkout pr5750

1 1

[freeipa PR#5740][opened] Constrain pylint to supported versions
by tiran 03 May '21

03 May '21

URL: https://github.com/freeipa/freeipa/pull/5740 Author: tiran Title: #5740: Constrain pylint to supported versions Action: opened PR body: """ Two, three times a year PR-CI starts failing because tox tests pull in a newer version of pylint with new warnings. To reduce breakage this change constraints pylint (and indirectly astroid) to latest tested minor version. The constraint should be updated when FreeIPA starts to support a new Fedora version with more recent pylint. Related: pagure.io/freeipa/issue/8818 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5740/head:pr5740 git checkout pr5740

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel May 2021