- FreeIPA-devel - Fedora mailing-lists

ipa radius proxy
by Giuseppe Calo 20 Dec '22

20 Dec '22

Hi all, I installed simple freeradius (not enabled particular module),I configured radisu client, one simple user (only password) and added RADIUS-proxy in FreeIPA, but my RADIUS-server do not get requests from remote client. But test-util "radtest" from this server work fine. What am I doing wrong? Can somebody explain better the utility ipa radius proxy? Thanks

4 8

Update documentation of "Windows authentication against FreeIPA"
by Alejo Diaz 18 Dec '22

18 Dec '22

Currently, if I follow the steps I can't get working Windows 10 or 11 (both 22H2) with FreeIPA v4.10.1. Please, update/add this steps: 1. The algorithm "arcfour-hmac" isn't necessary in this versions (I don't know in others versions). Just skip the "-e" option or specify with "-e aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96". 2. Enforce use of TCP when use Kerberos in Windows running the follows commands after the step 5 of "Configure Windows (ksetup)" section. This steps helps when you logged via VPN or when the packet size is > 1500 (MTU limited!). ``` reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v "MaxPacketSize" /t REG_DWORD /d 1 /f ksetup /setrealmflags [REALM_NAME] tcpsupported ``` 3. Ensure the `permitted_enctypes` in `/etc/krb5.conf` configuration on FreeIPA servers (and replicas). Next, delete `/etc/krb5.conf.d/crypto-policies` (I don't test if updating this file from a tool works). This ensure that every ticket sended from FreeIPA kdc always use the `permitted_enctypes` algorithms. ``` [libdefaults] permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 ``` After change, run the followed commands in FreeIPA servers and replicas: ``` systemctl stop sssd.service sss_cache -E systemctl restart krb5kdc.service systemctl start sssd.service ``` 4. The step 8 from "Configure Windows (ksetup)" section isn't necessary. Windows creates the user automatically. 5. If you don't want type <user>@<domain> for every uncached user, run the followed command to hard-coded domain in logon (add after step 5 of "Configure Windows (ksetup)" section?): ``` reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DefaultLogonDomain /t REG_SZ /d "[REALM_NAME]" /f ``` 6. The step 1 of "Configure Windows (ksetup)" section changes from "/setdomain" to "/setrealm". Actually, both works but I don't know if in the future this command changes.

2 2

additional info: nsslapd-maxdescriptors: invalid value "65536", maximum file descriptors must range from 1 to 8192 (the current process limit). Server will use a setting of 8192.
by roy liang 16 Dec '22

16 Dec '22

my freeipa 4.3 May I ask, this parameter cannot be increased, this limit refers to where the limit?Can the system see if it can reach 262140, or is there another configuration limit in the service? apt list | grep 389-ds 389-ds/xenial,xenial 1.3.4.9-1 all .... ldapmodify -x -H "ldaps://xx.com:636" -D "cn=directory manager" -w xxx dn: cn=config changetype: modify replace: nsslapd-maxdescriptors nsslapd-maxdescriptors: 65536 modifying entry "cn=config" ldap_modify: Server is unwilling to perform (53) additional info: nsslapd-maxdescriptors: invalid value "65536", maximum file descriptors must range from 1 to 8192 (the current process limit). Server will use a setting of 8192. ----- ulimit -aH core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 512646 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited open files (-n) 262140 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) unlimited cpu time (seconds, -t) unlimited max user processes (-u) 512646 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited ulimit -Hn 262140

3 4

Announcement: FreeIPA/IdM Web UI moving to PatternFly 4
by Brian Dellascio 09 Dec '22

09 Dec '22

Hello everyone: We are currently working on a new web user interface (UI) using PatternFly 4, you can find the early source code | https://github.com/freeipa/freeipa-webui A more complete description of this effort was posted under the discussions tab in that repo | https://github.com/freeipa/freeipa-webui/discussions/34 Please feel free to use the discussion commenting feature to post any questions, reactions, or feedback you may have. Thanks so much!

1 0

FreeIPA 4.9.11
by Antonio Torres 26 Nov '22

26 Nov '22

1 0

FreeIPA 4.10.1
by Antonio Torres 25 Nov '22

25 Nov '22

1 0

[DRAFT] FreeIPA 4.9.11 Release Notes
by Antonio Torres 07 Nov '22

07 Nov '22

{{ReleaseDate|2022-11-03}} The FreeIPA team would like to announce FreeIPA 4.9.11 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.9.11 == '''TODO RELEASE NOTES - put release notes (if any) to proper categories''' * 1539: [RFE] Add code to check password expiration on ldap bind :: User can no longer do LDAP BIND operation with expired password. -------- * 3226: [RFE] ipa sudorule-add-user should accept more types of characters -------- * 8361: Add support for managing subuids and subgids in FreeIPA :: IPA is now able to centrally store ID sub-ranges for users/groups. More details can be found in the design document: https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html -------- * 8404: Detect and fail if not enough memory is available for installation :: FreeIPA server now requires at least 1.2 GiB RAM for installation to prevent performance degradation. -------- * 8528: Use separate logs for AD Trust and DNS installer :: ipa-adtrust-install and ipa-dns-install commands now log their activity into separate log files. -------- * 8655: Allow to establish trust to Active Directory in FIPS mode :: When IPA is deployed in FIPS mode, it is now possible to establish trust to Active Directory forest. -------- * 8803: Add support for managing IdP references :: FreeIPA can now authenticate users with the help of OAuth 2.0 identity providers supporting OAuth 2.0 Device Authorization Flow. IdPs known to work are Keycloak, Microsoft Azure, Google, Github, and Okta. Details on how to use Keycloak can be found in FreeIPA workshop: https://freeipa.readthedocs.io/en/latest/workshop/12-external-idp-support.h… -------- * 9150: Remove 'Remove' button from subid page :: subid ranges cannot be removed. A button in Web UI subid management page to remove the range was removed to not confuse users -------- * 9159: [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf :: IPA installers now provide the ability to configure SSSD as datasource for subid -------- * 9187: [UX] Preserving a user account produces output saying it was deleted :: Previously, the command to preserve a user account used to display a confusing output "Deleted user: <user>" although the user was preserved and not deleted. The command now displays "Preserved user: <user>" for preserved users. -------- * 9228: ipa-client-install does not maintain server affinity during installation :: ipa-client-install will use a single server for the duration of the installation process, either one discovered or provided on the command-line. Previously it would use a temporary configuration to do enrollment, then switch to a final one for the remaining operations. This could lead to the installer talking with multiple servers. If the client installer is faster than replication this could lead to errors. -------- * 9237: Show order in sudo rule list in web interface :: In the 'sudo rules' page, the WebUI is now displaying a 'sudo order' column so that the users can easily see which rules override other rules based on their order. -------- * 9258: Do not add TLS CA configuration to ldap.conf anymore :: FreeIPA client installer does not add explicit TLS CA configuration to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA configuration is not required as OpenLDAP uses the default CA store provided by OpenSSL and IPA CA is installed in the default store by the installer already. -------- '''END TODO''' === Enhancements === * 8361: Add support for managing subuids and subgids in FreeIPA :: IPA is now able to centrally store ID sub-ranges for users/groups. More details can be found in the design document: https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html -------- === Known Issues === === Bug fixes === FreeIPA 4.9.11 is a stabilization release for the features delivered as a part of 4.9 version series. There are more than 50 bug-fixes since FreeIPA 4.9.10 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on libera.chat. == Resolved tickets == * [https://pagure.io/freeipa/issue/1539 #1539] ([https://bugzilla.redhat.com/show_bug.cgi?id=782917 rhbz#782917]) [RFE] Add code to check password expiration on ldap bind * [https://pagure.io/freeipa/issue/3226 #3226] ([https://bugzilla.redhat.com/show_bug.cgi?id=871208 rhbz#871208]) [RFE] ipa sudorule-add-user should accept more types of characters * [https://pagure.io/freeipa/issue/8361 #8361] Add support for managing subuids and subgids in FreeIPA * [https://pagure.io/freeipa/issue/8404 #8404] Detect and fail if not enough memory is available for installation * [https://pagure.io/freeipa/issue/8452 #8452] update samba configuration on IPA master to explicitly use 'server role' setting * [https://pagure.io/freeipa/issue/8501 #8501] Unify how FreeIPA gets FQDN of current host * [https://pagure.io/freeipa/issue/8519 #8519] Fedora container platform is incomplete * [https://pagure.io/freeipa/issue/8524 #8524] ([https://bugzilla.redhat.com/show_bug.cgi?id=1851835 rhbz#1851835]) Deploy & manage the ACME service topology wide from a single system * [https://pagure.io/freeipa/issue/8528 #8528] Use separate logs for AD Trust and DNS installer * [https://pagure.io/freeipa/issue/8584 #8584] ACME communication with dogtag REST endpoints should be using the cookie it creates * [https://pagure.io/freeipa/issue/8647 #8647] ([https://bugzilla.redhat.com/show_bug.cgi?id=1912556 rhbz#1912556]) Incorrect DNSKEY created when DNSSEC enabled for zone * [https://pagure.io/freeipa/issue/8655 #8655] ([https://bugzilla.redhat.com/show_bug.cgi?id=1860129 rhbz#1860129]) Allow to establish trust to Active Directory in FIPS mode * [https://pagure.io/freeipa/issue/8803 #8803] Add support for managing IdP references * [https://pagure.io/freeipa/issue/8804 #8804] Extend supported user authentication methods in IPA to allow IdP auth * [https://pagure.io/freeipa/issue/8805 #8805] Extend `ipa-otpd` daemon to recognize IdP references * [https://pagure.io/freeipa/issue/8832 #8832] ([https://bugzilla.redhat.com/show_bug.cgi?id=1957768 rhbz#1957768]) ipa-server-upgrade is failing while upgrading rhel8.3 to rhel8.4 * [https://pagure.io/freeipa/issue/8923 #8923] ([https://bugzilla.redhat.com/show_bug.cgi?id=1970168 rhbz#1970168]) Trust controller role should pull sssd-winbind-idmap package * [https://pagure.io/freeipa/issue/8951 #8951] Test for RFE ipa-healthcheck tool can include check to see if the system is FIPS enabled or not * [https://pagure.io/freeipa/issue/8972 #8972] ([https://bugzilla.redhat.com/show_bug.cgi?id=1998129 rhbz#1998129]) AVC denied { read } comm="ipa-custodia" on aarch64 during installation of ipa-server * [https://pagure.io/freeipa/issue/8984 #8984] ([https://bugzilla.redhat.com/show_bug.cgi?id=1999992 rhbz#1999992]) ipa migrate-ds command fails to warn when compat plugin is enabled * [https://pagure.io/freeipa/issue/9062 #9062] [ipatests] SID generation and test_xmlrpc/test_user_plugin.py * [https://pagure.io/freeipa/issue/9127 #9127] ([https://bugzilla.redhat.com/show_bug.cgi?id=2062379 rhbz#2062379]) Use new getorigby{user|group}name() calls in extdom plugin * [https://pagure.io/freeipa/issue/9150 #9150] ([https://bugzilla.redhat.com/show_bug.cgi?id=2063155 rhbz#2063155]) Remove 'Remove' button from subid page * [https://pagure.io/freeipa/issue/9158 #9158] Internal error when setting dnsconfig or dnsforwardzone forwarders. * [https://pagure.io/freeipa/issue/9159 #9159] ([https://bugzilla.redhat.com/show_bug.cgi?id=2068088 rhbz#2068088]) [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf * [https://pagure.io/freeipa/issue/9160 #9160] cryptography.utils.register_interface is scheduled for removal * [https://pagure.io/freeipa/issue/9161 #9161] Nightly test failure in test_selinuxusermap.py::test_selinuxusermap::test_misc * [https://pagure.io/freeipa/issue/9178 #9178] idviews: use cached ipaOriginalUid value when resolving ID override anchor * [https://pagure.io/freeipa/issue/9183 #9183] Timeout issue in test_installation.py when using interactive mode * [https://pagure.io/freeipa/issue/9185 #9185] Fix missing parameter for Suse ipaplatform task * [https://pagure.io/freeipa/issue/9187 #9187] ([https://bugzilla.redhat.com/show_bug.cgi?id=2022028 rhbz#2022028]) [UX] Preserving a user account produces output saying it was deleted * [https://pagure.io/freeipa/issue/9188 #9188] ([https://bugzilla.redhat.com/show_bug.cgi?id=2098187 rhbz#2098187]) Add warning for empty targetattr when creating ACI with RBAC * [https://pagure.io/freeipa/issue/9189 #9189] ipatests: Fix test_idp.py for downstream idm-ci * [https://pagure.io/freeipa/issue/9190 #9190] ipatests.test_ipaserver.test_secure_ajp_connector failing with python 3.6.8 with: TypeError: a bytes-like object is required, not 'str' * [https://pagure.io/freeipa/issue/9192 #9192] ([https://bugzilla.redhat.com/show_bug.cgi?id=2094672 rhbz#2094672]) IdM WebUI Pagination Size should not allow empty value * [https://pagure.io/freeipa/issue/9198 #9198] [Tracker] nightly failure: after ipa trust-add, cred cache contains cifs/master.ipa.test(a)IPA.TEST instead of admin principal * [https://pagure.io/freeipa/issue/9204 #9204] [Tracker] In ipa-server-upgrade ca_upgrade_schema() results in unnecessary pki restarts * [https://pagure.io/freeipa/issue/9206 #9206] ([https://bugzilla.redhat.com/show_bug.cgi?id=2109236 rhbz#2109236]) ldap bind occurs when admin user changes password with gracelimit=0 * [https://pagure.io/freeipa/issue/9207 #9207] Failure in AzurePipeline.freeipa (GATING InstallDNSSECFirst_1_to_5) * [https://pagure.io/freeipa/issue/9208 #9208] ap: Doc build fails against Sphinx 5.1.0 * [https://pagure.io/freeipa/issue/9211 #9211] ([https://bugzilla.redhat.com/show_bug.cgi?id=2109243 rhbz#2109243]) RFE: Allow grace login limit to be set in IPA WebUI. * [https://pagure.io/freeipa/issue/9212 #9212] ([https://bugzilla.redhat.com/show_bug.cgi?id=2115475 rhbz#2115475]) Nightly test failure in test_user.py::test_user::test_password_expiration_notification * [https://pagure.io/freeipa/issue/9214 #9214] Nightly failure in webui test test_subid.py::test_subid::test_subid_range_deletion_not_allowed * [https://pagure.io/freeipa/issue/9216 #9216] [Tracker] Nightly failure: zone not signed * [https://pagure.io/freeipa/issue/9218 #9218] ([https://bugzilla.redhat.com/show_bug.cgi?id=2116966 rhbz#2116966]) Random failure in test-winsyncmigrate * [https://pagure.io/freeipa/issue/9225 #9225] pytest library module rename from quarkus to keycloak * [https://pagure.io/freeipa/issue/9226 #9226] ([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547]) Infinite redirect loop in the WebUI for user root * [https://pagure.io/freeipa/issue/9228 #9228] ipa-client-install does not maintain server affinity during installation * [https://pagure.io/freeipa/issue/9230 #9230] build failure against gcc < 11 * [https://pagure.io/freeipa/issue/9231 #9231] /run/ipa/ccaches uses all available tmpfs space * [https://pagure.io/freeipa/issue/9237 #9237] Show order in sudo rule list in web interface * [https://pagure.io/freeipa/issue/9243 #9243] ([https://bugzilla.redhat.com/show_bug.cgi?id=2127833 rhbz#2127833]) Password Policy Grace login limit allows invalid maximum value * [https://pagure.io/freeipa/issue/9245 #9245] ([https://bugzilla.redhat.com/show_bug.cgi?id=2117167 rhbz#2117167]) `extdom` plugin can return object from a wrong domain. * [https://pagure.io/freeipa/issue/9246 #9246] Nightly test failure in test_user_permissions.TestInstallClientNoAdmin * [https://pagure.io/freeipa/issue/9248 #9248] ([https://bugzilla.redhat.com/show_bug.cgi?id=2124369 rhbz#2124369]) OTP token sync always returns OK even with random numbers * [https://pagure.io/freeipa/issue/9249 #9249] ([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630]) Deprecated feature idnssoaserial in IdM appears when creating reverse dns zones * [https://pagure.io/freeipa/issue/9252 #9252] ([https://bugzilla.redhat.com/show_bug.cgi?id=2129895 rhbz#2129895]) [DDF] The Examples in the RHEL ipa(1) man page show "ipa help commands" with content for "ipa halp topics" and "ipa hel * [https://pagure.io/freeipa/issue/9254 #9254] Exclude installed policy module file from RPM verification * [https://pagure.io/freeipa/issue/9255 #9255] ipapython.dn_ctypes is not compatible with libldap 2.6 * [https://pagure.io/freeipa/issue/9258 #9258] ([https://bugzilla.redhat.com/show_bug.cgi?id=2094673 rhbz#2094673]) Do not add TLS CA configuration to ldap.conf anymore == Detailed changelog since 4.9.10 == === Armando Neto (1) === * webui: Do not allow empty pagination size [https://pagure.io/freeipa/c/991849cf58fa990ad4540a61214b5ab4fcd4baa1 commit] [https://pagure.io/freeipa/issue/9192 #9192] === Alexander Bokovoy (3) === * ipaclient: do not set TLS CA options in ldap.conf anymore [https://pagure.io/freeipa/c/d9a56b51bbb350219d0f5cb0ea6b3cc00230d437 commit] [https://pagure.io/freeipa/issue/9258 #9258] * fix canonicalization issue in Web UI [https://pagure.io/freeipa/c/109cd579e3b089b7fad4c92bf25594eba1af8a21 commit] [https://pagure.io/freeipa/issue/9226 #9226] * ipa-otpd: initialize local pointers and handle gcc 10 [https://pagure.io/freeipa/c/9290aa5500f752d0eedabdfc92c9fe6c0ee743b8 commit] [https://pagure.io/freeipa/issue/9230 #9230] === Anuja More (4) === * ipatests : Test query to AD specific attributes is successful. [https://pagure.io/freeipa/c/21cb86a8e571ac7aa0304c57961881ca9c4aeacb commit] [https://pagure.io/freeipa/issue/9127 #9127] * ipatests: Fix install_master for test_idp.py [https://pagure.io/freeipa/c/15f454f6f8d25275c9570e2cc3a97c4e030fc581 commit] [https://pagure.io/freeipa/issue/9189 #9189] * ipatests: update prci definitions for test_idp.py [https://pagure.io/freeipa/c/50b4d9ab3fcb2e63edc8d20346e4a8a79f15692d commit] * Add end to end integration tests for external IdP [https://pagure.io/freeipa/c/857713c5a9c8e0b62c06dd92e69c09eeb34b2e99 commit] [https://pagure.io/freeipa/issue/8803 #8803], [https://pagure.io/freeipa/issue/8804 #8804], [https://pagure.io/freeipa/issue/8805 #8805] === Antonio Torres (1) === * Back to git snapshots [https://pagure.io/freeipa/c/3e90842b3d94268f2ccd42c8decd0eecbcf88f1f commit] === Alexey Tikhonov (3) === * extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper() returns object from a wrong domain (performance optimization) [https://pagure.io/freeipa/c/a07cece0c006b3a89fc467284244f979d39f0209 commit] * extdom: make sure result doesn't miss domain part [https://pagure.io/freeipa/c/3de618f75416afd6c087c243fe35755739d229a4 commit] [https://pagure.io/freeipa/issue/9245 #9245] * extdom: internal functions should be static [https://pagure.io/freeipa/c/666357649f4dfb8254cb3707e97e12c69e6714f7 commit] === Carla Martinez (7) === * Update API and VERSION [https://pagure.io/freeipa/c/856edcc8d3c9fe64eff532db669536a0a78ba70d commit] [https://pagure.io/freeipa/issue/9249 #9249] * webui: Set 'SOA serial' field as read-only [https://pagure.io/freeipa/c/9f8c9a4d96877bab1cb474615d77aca2fa586ece commit] [https://pagure.io/freeipa/issue/9249 #9249] * ipatest: Remove warning message for 'idnssoaserial' [https://pagure.io/freeipa/c/76604df09d8b62795f4e2d1fbc99af9ed55ec5cd commit] [https://pagure.io/freeipa/issue/9249 #9249] * Set 'idnssoaserial' to deprecated [https://pagure.io/freeipa/c/e9048daac53e24759a33e2031c8b4224a80a0e54 commit] [https://pagure.io/freeipa/issue/9249 #9249] * webui: Show 'Sudo order' column [https://pagure.io/freeipa/c/0513a83a4fcd5626168cb45132af8cd1b4a9ee03 commit] [https://pagure.io/freeipa/issue/9237 #9237] * Set pkeys in test_selinuxusermap.py::test_misc::delete_record [https://pagure.io/freeipa/c/cefa8f1e5f5b01e6863d07e9f3849dfd4c485f22 commit] [https://pagure.io/freeipa/issue/9161 #9161] * webui: Allow grace login limit [https://pagure.io/freeipa/c/ade5093b08f92b279c200f341e96972a74f644d8 commit] [https://pagure.io/freeipa/issue/9211 #9211] === Jan Kuparinen (20) === * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/841e0c673b222e686083cb96c210a55da6e09ff8 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/4d92e67a45b0caf72ce5028f8bbba06f4d63fb7f commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/e6accc7b3f39e0140e0d1dc3ee6bfcf6636d214d commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/20bcd69f38fb734dc80e5052cb2ed91c19b12994 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/49a41249e1d8cf6b349f895ba88c7490081ab462 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/20269ac630c451734dffef50298cba823ffe2624 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/1853d934d1e93dbf07d50799406ac12995a1d977 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/7037e5389006f1eeea0299918cbbae57893ef125 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/9df1672f479bee01efcd53c46e800e789762bc97 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/eb1a1f35849c1f2e43c282c555b62f7d12962e37 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/216cced00a1973f2103cf678ed94ef3b6c204190 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/e98691b491ae2a8d41c3eb6e7028f6e731dbdbae commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/4d306ee7ebe90275a47b4f182f66bc87bc397170 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/2203f3627f28ff4c81ab9fd24eed31669ae34ff5 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/15457a6d9fdb19466405f6882fbbc9e29510d40e commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/5dcb614691ed31a660edc936612b525b1be0ccae commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/c2061cf9c505c4821c7812a71c464afa367300b5 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/9d6d2e2dc9cfb7c1ef1e400ba90b27474866380f commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/6bdd02db7ace58cbb16d45d5c6dbfb1945e2bb43 commit] * Added translation using Weblate (Finnish) [https://pagure.io/freeipa/c/6169eb47e1ea42c81ad6022ab02ef3222566f70f commit] === David Pascual (2) === * ipatest: fix prci checker target masked return code & add pylint [https://pagure.io/freeipa/c/6483f33389c7bb1d185f2b39d68f407e131a282c commit] * ipatests: Checker script for prci definitions [https://pagure.io/freeipa/c/f33266c2ba9d794a5a1e9994e5fa029d2fa5de70 commit] === Erik (1) === * ipatests: healthcheck: test if system is FIPS enabled [https://pagure.io/freeipa/c/f962a0c2832619100046c923d15f21e8c10fce96 commit] [https://pagure.io/freeipa/issue/8951 #8951] === Florence Blanc-Renaud (11) === * Spec file: bump the selinux-policy version [https://pagure.io/freeipa/c/58ad9f2eec0afe494c57015c4449ae39748117e4 commit] [https://pagure.io/freeipa/issue/9198 #9198] * webui tests: fix test_subid suite [https://pagure.io/freeipa/c/58e12bd93a9b7b1c9a39981ee0c6a724040e164f commit] [https://pagure.io/freeipa/issue/9214 #9214] * ipa man page: format the EXAMPLES section [https://pagure.io/freeipa/c/64ef2b9c07ec0b1b316555739ff9f98229258838 commit] [https://pagure.io/freeipa/issue/9252 #9252] * ipatests: add negative test for otptoken-sync [https://pagure.io/freeipa/c/895a800e90a34f55f5d2789ece6e7bc8e6f5c0a6 commit] [https://pagure.io/freeipa/issue/9248 #9248] * ipa otptoken-sync: return error when sync fails [https://pagure.io/freeipa/c/4cc94cd3b929ee1878767d23f98ad5e755583c6b commit] [https://pagure.io/freeipa/issue/9248 #9248] * gitignore: add install/oddjob/org.freeipa.server.config-enable-sid [https://pagure.io/freeipa/c/a7369944d8b68032eddcc4577b0cc5f9f603cda9 commit] * ipatests: Fix expected object classes [https://pagure.io/freeipa/c/2385d1d90aa91d34c4b36842a17e72aa2399a733 commit] [https://pagure.io/freeipa/issue/9062 #9062] * check_repl_update: in progress is a boolean [https://pagure.io/freeipa/c/05a298f56485222583cb7dd4f6a3a4c5c77fc8cf commit] [https://pagure.io/freeipa/issue/9218 #9218] * azure tests: disable TestInstallDNSSECFirst [https://pagure.io/freeipa/c/d40fd287836dc8440f69314d77ccb461c7e6ccea commit] [https://pagure.io/freeipa/issue/9216 #9216] * xmlrpc tests: updated expected output for preserved user [https://pagure.io/freeipa/c/4984ff210a169129e4e56b10e54e9c795520855c commit] [https://pagure.io/freeipa/issue/9187 #9187] * Preserve user: fix the confusing summary [https://pagure.io/freeipa/c/ff4152539b96d309dcceaf854a3e0a49f435acff commit] [https://pagure.io/freeipa/issue/9187 #9187] === Fraser Tweedale (2) === * install: suggest --skip-mem-check when mem check fails [https://pagure.io/freeipa/c/cbf2614d8acc11a1b41558a45dac8ec98b032732 commit] [https://pagure.io/freeipa/issue/8404 #8404] * man: add --skip-mem-check to man pages [https://pagure.io/freeipa/c/585cebb1a9673e2fc083dd3c9545a6c080e171e3 commit] [https://pagure.io/freeipa/issue/8404 #8404] === Matthew Davis (1) === * Add missing parameter to Suse modify_nsswitch_pam_stack [https://pagure.io/freeipa/c/4f15804270590fdf0f339fc53ed63bf440361b7b commit] [https://pagure.io/freeipa/issue/9185 #9185] === Jesse Sandberg (1) === * Fix ipa-ccache-sweeper activation timer and clean up service file [https://pagure.io/freeipa/c/358924455d87b67db6cd743f3cfe15522b4c0d91 commit] [https://pagure.io/freeipa/issue/9231 #9231] === Michal Polovka (3) === * ipatests: Healthcheck use subject base from IPA not REALM [https://pagure.io/freeipa/c/afa94c7995f236c5eff516652f31c1a956466cf7 commit] * ipatests: Healthcheck should ignore pki errors when CA is not configured [https://pagure.io/freeipa/c/206e08d811c43ba8295816e609d4cb7148a774a3 commit] * ipatests: Increase expect timeout for interactive mode [https://pagure.io/freeipa/c/a6a6781284658e77f36c07cb7fd35b43240946a2 commit] [https://pagure.io/freeipa/issue/9183 #9183] === Marcin Stanclik (1) === * Translated using Weblate (Polish) [https://pagure.io/freeipa/c/d198a35cb885b6cc1622bf99b8546675b98c8aed commit] === Nikola Knazekova (1) === * Exclude installed policy module file from RPM verification [https://pagure.io/freeipa/c/c977cefa101e145b13b5c19ae5369e5ca7ef1ef8 commit] [https://pagure.io/freeipa/issue/9254 #9254] === Piotr Drąg (1) === * Translated using Weblate (Polish) [https://pagure.io/freeipa/c/3b0c1cafc16dc927449231a7a70b2876770ba962 commit] === Hela Basa (3) === * Added translation using Weblate (Korean) [https://pagure.io/freeipa/c/0a6246ea971282a2f1fc0b5fe3f09f7d656bbf2f commit] * Translated using Weblate (Sinhala) [https://pagure.io/freeipa/c/696a72f7aef3df7c0f619f0d67e5fe259cc80c37 commit] * Added translation using Weblate (Sinhala) [https://pagure.io/freeipa/c/f9590de2e0bc1d2dde4f6a78c72b6a69f773bd99 commit] === Rob Crittenden (11) === * Move client certificate request after krb5.conf is created [https://pagure.io/freeipa/c/762d786bf7a3043fd56877949f02bccd077e2711 commit] [https://pagure.io/freeipa/issue/9246 #9246] * Defer creating the final krb5.conf on clients [https://pagure.io/freeipa/c/69413325158a3ea06d1491acd77ee6e0955ee89a commit] [https://pagure.io/freeipa/issue/9228 #9228] * Fix upper bound of password policy grace limit [https://pagure.io/freeipa/c/91a02174a0a9694fd5611c071913ad4720be5ac9 commit] [https://pagure.io/freeipa/issue/9243 #9243] * Set default on group pwpolicy with no grace limit in upgrade [https://pagure.io/freeipa/c/a4ddaaf3048c4e8d78a1807af7266ee40ab3a30b commit] [https://pagure.io/freeipa/issue/9212 #9212] * Set default gracelimit on group password policies to -1 [https://pagure.io/freeipa/c/497a57e7a6872fa30d1855a1d91a455bfdbf9300 commit] [https://pagure.io/freeipa/issue/9212 #9212] * doc: Update LDAP grace period design with default values [https://pagure.io/freeipa/c/434620ee342ac4767beccec647a318bfa7743dfa commit] [https://pagure.io/freeipa/issue/9212 #9212] * upgrades: Don't restart the CA on ACME and profile schema change [https://pagure.io/freeipa/c/aaf57185a2701b34948105e8b54075afe048ff18 commit] [https://pagure.io/freeipa/issue/9204 #9204] * Disabling gracelimit does not prevent LDAP binds [https://pagure.io/freeipa/c/1316cd8b2252c2543cf2ef2186956a8833037b1e commit] [https://pagure.io/freeipa/issue/9206 #9206] * Warn for permissions with read/write/search/compare and no attrs [https://pagure.io/freeipa/c/b31631ad69f72fb42b5091375df8021580f8139a commit] [https://pagure.io/freeipa/issue/9188 #9188] * Only calculate LDAP password grace when the password is expired [https://pagure.io/freeipa/c/3675bd1d7aca443832bb9bb2f521cc4d3a088aec commit] [https://pagure.io/freeipa/issue/1539 #1539] * Fix test_secure_ajp_connector.py failing with Python 3.6.8 [https://pagure.io/freeipa/c/de64d6724e028a1882c3a8be31c2752bebdd41fd commit] [https://pagure.io/freeipa/issue/9190 #9190] === Ricky Tigg (4) === * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/91b63fcae0a588fc174cf865b4e0135c8c0e48ec commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/e6451fe15acf406aa741d4eed296ab6eff7e9313 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/3392f31afe04e5b6b0d49d4e2f2906bc90b3643c commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/a8a2b2cf97bbf8b2b80acce08d0903b6c91c5f98 commit] === Sumit Bose (1) === * ipa-kdb: do not fail if certmap rule cannot be added [https://pagure.io/freeipa/c/e51a0c927db4a4c9b3e1ab0c6dffca545532a2b4 commit] === 김인수 (44) === * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/b8c39cca34b75a4ed3ed77a468836778f670027b commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/2c555646dd71911d1bcf860e6c3acbcfd3050ad2 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/53e4e7212b5b6fe0dceb809aaddc83158f8dfef4 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/29dba19aa8862ea7b3185dcc0dba789b8e4af5b8 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/425894153a17de0cdb827a83fad599343e2d3656 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/7f9588f36a2b82df3fd9ef7dd286886021e0ffa6 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/c07e0ec7a5acedef693b0f79fdc68529e64aa023 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/e6e638aea7fda83beb47fa6c2f75772673d351c2 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/994c43513950b4c82dd9e1ed38b56232f3efffaa commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/fd538803cf6c098b2a3386ecc1f4b1e3a27b9a88 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/aef749b632fd636e6d6b920757e13d64303da9d4 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/64b2c0ebfeb7035b8c9d9e38c2a75e046e855f62 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/a24adeab5ca162b3c79358128fcdee22d0bd18f2 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/b70041d904926e9d33423fe1f7b48ca0c3791718 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/246604ec696255674e8716610c387f0f2ef93d73 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/07a1cc5424760a4ef43ffc6734c901f1cc446909 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/e98e21709e2205c8c019cc7006d3f9ded94432ae commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/fe60d1f6f386734b7cb052f34fb798341130052a commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/5bd77e606cb6be3b3a133294027e284f5604b447 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/2c0924f38694603777bcbdab804d9b3331efa239 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/067cae55eced1c1c7bcdbbb0dd56a16d7127488c commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/aa00e7c3cff81e79a1dfce2c1e5348af9f3a3438 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/b5d6616aed77a46de2db53b3395aeaf531537df3 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/7ca1befe7e8ca463052f8b24f6c9b37093dabbaa commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/b2cf29ae168661a12a426bf72e98f43d769fb132 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/8b3ceace34a55fadb560a758c02632efa87ec96f commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/7d12b30e2c6762eda93eb66a1dab2e52770d94aa commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/20006cc713c7666c373804cd7d6415f9af6a6d27 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/9e2f7d041c1c72b329fdacac232451e57a4d0516 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/cf9f35e3eb2c90cb3b07a2c5ed33fdd2f3bfa0b3 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/d6ff8af62ee12517d438d9f3ff02f25219166da4 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/1e65336b3513cf7c6579ac5714c50cb4a965fd96 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/548afe9eed0696ceb4e8abdc3331b3f1f0fad6f2 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/715043df4ea1d416e64ce50b0e141faf36f6c45d commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/18346d99b214f6060ab7f6c83e02f2c4d56ec799 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/9658dbd3c31ad22e175e613f3c51073eb196c72c commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/27dba4a7c3605a1ab03c55458ad4bb47b7c4dbc7 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/d5726f04b6b73d6c1de183ee5b6b7bd96d590db5 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/eac046fd82d02105d3388af1f04527813546e6f7 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/77feee852ed01502c0a0e48d4d4e546332827885 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/00eba1f70445a5faf27db461fb762a030b0b5789 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/101460521cb228f68a52a934acf97eddcbbb9928 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/23fb8a4709af35db3e760159de405adad343c042 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/fd81a77d78423293dee4e117b58f2f9077cb0cbf commit] === Stanislav Levin (6) === * ipapython: Support openldap 2.6 [https://pagure.io/freeipa/c/7e93f46c589ba0a68c039d65ea3c0872644a0eb0 commit] [https://pagure.io/freeipa/issue/9255 #9255] * x509: Replace removed register_interface with subclassing [https://pagure.io/freeipa/c/89fe83b03ac3b046685389ee1059ca75c73e53b0 commit] [https://pagure.io/freeipa/issue/9160 #9160] * ap: Constrain supported docutils [https://pagure.io/freeipa/c/1ada42e3bce58a729e689377b1a41b6cfa90b508 commit] [https://pagure.io/freeipa/issue/9208 #9208] * ap: Rearrange overloaded jobs [https://pagure.io/freeipa/c/b59baf31bc097821ff7787ecd75affb27ea2a7c3 commit] [https://pagure.io/freeipa/issue/9207 #9207] * ap: Disable azure's security daemon [https://pagure.io/freeipa/c/98c6e96e8db3d5bdc0315094b8a7bf81d196479b commit] [https://pagure.io/freeipa/issue/9207 #9207] * ap: Raise dbus timeout [https://pagure.io/freeipa/c/e77b0b08d78d4d5ae7632ef23aebc577848ea507 commit] [https://pagure.io/freeipa/issue/9207 #9207] === Scott Poore (1) === * ipatests: Rename create_quarkus to create_keycloak [https://pagure.io/freeipa/c/88ea19b9a53d9c209105af049a1df100d07e081a commit] [https://pagure.io/freeipa/issue/9225 #9225] === Sudhir Menon (2) === * ipatests: WebUI: do not allow subid range deletion [https://pagure.io/freeipa/c/58b026716c973f422b1b98e27eb9536e59919d82 commit] [https://pagure.io/freeipa/issue/9150 #9150] * ipatests: ipa-client-install --subid adds entry in nsswitch.conf [https://pagure.io/freeipa/c/a5762621ef3ed1e699306a8d2eef634bc927a6fc commit] [https://pagure.io/freeipa/issue/9159 #9159] === Timo Aaltonen (2) === * ipaplatform/debian: Drop the path for ldap.so [https://pagure.io/freeipa/c/56c827099708d8613e194052857e121612fbd768 commit] * ipaplatform/debian: Use multiarch path for libsofthsm2.so [https://pagure.io/freeipa/c/c39c2ee80db056296f6826746b5b7a5bf7ba7cc4 commit] === Thomas Woerner (1) === * DNSResolver: Fix use of nameservers with ports [https://pagure.io/freeipa/c/5e2e4664aec641886923c2bec61ce25b96edb62a commit] [https://pagure.io/freeipa/issue/9158 #9158] === Yuri Chornoivan (3) === * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/61dea74b405d251ea2778e209b03a167064b1bf6 commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/842a6457fda382d78a11bce626b2ef0ef3749aa0 commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/6353e45b5dd446b7acc46244d8bb10c38c39f9ce commit]

3 4

[DRAFT] FreeIPA 4.10.1 Release Notes
by Antonio Torres 04 Nov '22

04 Nov '22

{{ReleaseDate|2022-11-03}} The FreeIPA team would like to announce FreeIPA 4.10.1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.10.1 == '''TODO RELEASE NOTES - put release notes (if any) to proper categories''' * 1539: [RFE] Add code to check password expiration on ldap bind :: User can no longer do LDAP BIND operation with expired password. -------- * 2016: [RFE] Support random serial numbers in IPA certificates -------- * 8404: Detect and fail if not enough memory is available for installation :: FreeIPA server now requires at least 1.2 GiB RAM for installation to prevent performance degradation. -------- * 9150: Remove 'Remove' button from subid page :: subid ranges cannot be removed. A button in Web UI subid management page to remove the range was removed to not confuse users -------- * 9159: [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf :: IPA installers now provide the ability to configure SSSD as datasource for subid -------- * 9228: ipa-client-install does not maintain server affinity during installation :: ipa-client-install will use a single server for the duration of the installation process, either one discovered or provided on the command-line. Previously it would use a temporary configuration to do enrollment, then switch to a final one for the remaining operations. This could lead to the installer talking with multiple servers. If the client installer is faster than replication this could lead to errors. -------- * 9237: Show order in sudo rule list in web interface :: In the 'sudo rules' page, the WebUI is now displaying a 'sudo order' column so that the users can easily see which rules override other rules based on their order. -------- * 9258: Do not add TLS CA configuration to ldap.conf anymore :: FreeIPA client installer does not add explicit TLS CA configuration to OpenLDAP's ldap.conf anymore. Since OpenLDAP 2.4.45, explicit CA configuration is not required as OpenLDAP uses the default CA store provided by OpenSSL and IPA CA is installed in the default store by the installer already. -------- '''END TODO''' === Enhancements === === Known Issues === === Bug fixes === FreeIPA 4.10.1 is a stabilization release for the features delivered as a part of 4.10 version series. There are more than 40 bug-fixes since FreeIPA 4.10.0 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on libera.chat. == Resolved tickets == * [https://pagure.io/freeipa/issue/1539 #1539] ([https://bugzilla.redhat.com/show_bug.cgi?id=782917 rhbz#782917]) [RFE] Add code to check password expiration on ldap bind * [https://pagure.io/freeipa/issue/2016 #2016] ([https://bugzilla.redhat.com/show_bug.cgi?id=747959 rhbz#747959]) [RFE] Support random serial numbers in IPA certificates * [https://pagure.io/freeipa/issue/8404 #8404] Detect and fail if not enough memory is available for installation * [https://pagure.io/freeipa/issue/8951 #8951] Test for RFE ipa-healthcheck tool can include check to see if the system is FIPS enabled or not * [https://pagure.io/freeipa/issue/9062 #9062] [ipatests] SID generation and test_xmlrpc/test_user_plugin.py * [https://pagure.io/freeipa/issue/9083 #9083] Support MIT Kerberos KDB version 9 * [https://pagure.io/freeipa/issue/9127 #9127] ([https://bugzilla.redhat.com/show_bug.cgi?id=2062379 rhbz#2062379]) Use new getorigby{user|group}name() calls in extdom plugin * [https://pagure.io/freeipa/issue/9150 #9150] ([https://bugzilla.redhat.com/show_bug.cgi?id=2063155 rhbz#2063155]) Remove 'Remove' button from subid page * [https://pagure.io/freeipa/issue/9158 #9158] Internal error when setting dnsconfig or dnsforwardzone forwarders. * [https://pagure.io/freeipa/issue/9159 #9159] ([https://bugzilla.redhat.com/show_bug.cgi?id=2068088 rhbz#2068088]) [RFE] ipa-client-install should provide option to enable subid: sss in /etc/nsswitch.conf * [https://pagure.io/freeipa/issue/9160 #9160] cryptography.utils.register_interface is scheduled for removal * [https://pagure.io/freeipa/issue/9161 #9161] Nightly test failure in test_selinuxusermap.py::test_selinuxusermap::test_misc * [https://pagure.io/freeipa/issue/9179 #9179] test_caless_TestServerCALessToExternalCA_RSN fails in teardown * [https://pagure.io/freeipa/issue/9188 #9188] ([https://bugzilla.redhat.com/show_bug.cgi?id=2098187 rhbz#2098187]) Add warning for empty targetattr when creating ACI with RBAC * [https://pagure.io/freeipa/issue/9192 #9192] ([https://bugzilla.redhat.com/show_bug.cgi?id=2094672 rhbz#2094672]) IdM WebUI Pagination Size should not allow empty value * [https://pagure.io/freeipa/issue/9198 #9198] [Tracker] nightly failure: after ipa trust-add, cred cache contains cifs/master.ipa.test(a)IPA.TEST instead of admin principal * [https://pagure.io/freeipa/issue/9204 #9204] [Tracker] In ipa-server-upgrade ca_upgrade_schema() results in unnecessary pki restarts * [https://pagure.io/freeipa/issue/9206 #9206] ([https://bugzilla.redhat.com/show_bug.cgi?id=2109236 rhbz#2109236]) ldap bind occurs when admin user changes password with gracelimit=0 * [https://pagure.io/freeipa/issue/9207 #9207] Failure in AzurePipeline.freeipa (GATING InstallDNSSECFirst_1_to_5) * [https://pagure.io/freeipa/issue/9208 #9208] ap: Doc build fails against Sphinx 5.1.0 * [https://pagure.io/freeipa/issue/9211 #9211] ([https://bugzilla.redhat.com/show_bug.cgi?id=2109243 rhbz#2109243]) RFE: Allow grace login limit to be set in IPA WebUI. * [https://pagure.io/freeipa/issue/9212 #9212] ([https://bugzilla.redhat.com/show_bug.cgi?id=2115475 rhbz#2115475]) Nightly test failure in test_user.py::test_user::test_password_expiration_notification * [https://pagure.io/freeipa/issue/9214 #9214] Nightly failure in webui test test_subid.py::test_subid::test_subid_range_deletion_not_allowed * [https://pagure.io/freeipa/issue/9216 #9216] [Tracker] Nightly failure: zone not signed * [https://pagure.io/freeipa/issue/9218 #9218] ([https://bugzilla.redhat.com/show_bug.cgi?id=2116966 rhbz#2116966]) Random failure in test-winsyncmigrate * [https://pagure.io/freeipa/issue/9225 #9225] pytest library module rename from quarkus to keycloak * [https://pagure.io/freeipa/issue/9226 #9226] ([https://bugzilla.redhat.com/show_bug.cgi?id=2124547 rhbz#2124547]) Infinite redirect loop in the WebUI for user root * [https://pagure.io/freeipa/issue/9227 #9227] Need test for Keycloak Bridge authentication * [https://pagure.io/freeipa/issue/9228 #9228] ipa-client-install does not maintain server affinity during installation * [https://pagure.io/freeipa/issue/9230 #9230] build failure against gcc < 11 * [https://pagure.io/freeipa/issue/9231 #9231] /run/ipa/ccaches uses all available tmpfs space * [https://pagure.io/freeipa/issue/9234 #9234] [Tracker] Nightly failure (f37+) calling sssctl domain-status * [https://pagure.io/freeipa/issue/9237 #9237] Show order in sudo rule list in web interface * [https://pagure.io/freeipa/issue/9238 #9238] Nightly test failure (rawhide) in test_ipahealthcheck.py::TestIpaHealthCheck::test_ds_configcheck_passwordstorage * [https://pagure.io/freeipa/issue/9243 #9243] ([https://bugzilla.redhat.com/show_bug.cgi?id=2127833 rhbz#2127833]) Password Policy Grace login limit allows invalid maximum value * [https://pagure.io/freeipa/issue/9244 #9244] Nightly test failure in test_commands.py::TestIPACommand::test_ipa_cacert_manage_prune * [https://pagure.io/freeipa/issue/9245 #9245] ([https://bugzilla.redhat.com/show_bug.cgi?id=2117167 rhbz#2117167]) `extdom` plugin can return object from a wrong domain. * [https://pagure.io/freeipa/issue/9246 #9246] Nightly test failure in test_user_permissions.TestInstallClientNoAdmin * [https://pagure.io/freeipa/issue/9248 #9248] ([https://bugzilla.redhat.com/show_bug.cgi?id=2124369 rhbz#2124369]) OTP token sync always returns OK even with random numbers * [https://pagure.io/freeipa/issue/9249 #9249] ([https://bugzilla.redhat.com/show_bug.cgi?id=2108630 rhbz#2108630]) Deprecated feature idnssoaserial in IdM appears when creating reverse dns zones * [https://pagure.io/freeipa/issue/9250 #9250] Add basic test for authenticating as Keycloak user on IPA client * [https://pagure.io/freeipa/issue/9252 #9252] ([https://bugzilla.redhat.com/show_bug.cgi?id=2129895 rhbz#2129895]) [DDF] The Examples in the RHEL ipa(1) man page show "ipa help commands" with content for "ipa halp topics" and "ipa hel * [https://pagure.io/freeipa/issue/9254 #9254] Exclude installed policy module file from RPM verification * [https://pagure.io/freeipa/issue/9255 #9255] ipapython.dn_ctypes is not compatible with libldap 2.6 * [https://pagure.io/freeipa/issue/9258 #9258] ([https://bugzilla.redhat.com/show_bug.cgi?id=2094673 rhbz#2094673]) Do not add TLS CA configuration to ldap.conf anymore == Detailed changelog since 4.10.0 == === Armando Neto (1) === * webui: Do not allow empty pagination size [https://pagure.io/freeipa/c/02d3fb8266d8199fd1ed983de6c57b269546df82 commit] [https://pagure.io/freeipa/issue/9192 #9192] === Alexander Bokovoy (10) === * ipa-kdb: fix comment to make sure we talk about krb5 1.20 or later [https://pagure.io/freeipa/c/d3c7a4faae8fd58a8d08bf6191d47fefe276ddba commit] * ipa-kdb: fix PAC requester check [https://pagure.io/freeipa/c/88c1293f3a92451b6d5d5f7cb1a81d55a789b793 commit] [https://pagure.io/freeipa/issue/9083 #9083] * ipa-kdb: handle empty S4U proxy in allowed_to_delegate [https://pagure.io/freeipa/c/1d4db340461298fed66607bde5fb0ca0f033c5aa commit] [https://pagure.io/freeipa/issue/9083 #9083] * ipa-kdb: handle cross-realm TGT entries when generating PAC [https://pagure.io/freeipa/c/a5ca25003da5906703e8bd12b0759d48bc52e6b2 commit] [https://pagure.io/freeipa/issue/9083 #9083] * ipa-kdb: add krb5 1.20 support [https://pagure.io/freeipa/c/e9ae0e350dcee5c9bbcd5a6932b4eb0daa90fea7 commit] [https://pagure.io/freeipa/issue/9083 #9083] * ipa-kdb: refactor MS-PAC processing to prepare for krb5 1.20 [https://pagure.io/freeipa/c/f0c72dcb87f86b9b00d0c087a959e64ce10eea98 commit] [https://pagure.io/freeipa/issue/9083 #9083] * ipaclient: do not set TLS CA options in ldap.conf anymore [https://pagure.io/freeipa/c/93b0e6a96a1aea45adc0d4c8bb26b226ce683573 commit] [https://pagure.io/freeipa/issue/9258 #9258] * Remove empty translation for 'si' which breaks linter [https://pagure.io/freeipa/c/41ba166c77ca8011a35f80f2791a211c429a271e commit] * fix canonicalization issue in Web UI [https://pagure.io/freeipa/c/a0928fe164712303a7c24ee61500ac7326bd9e4a commit] [https://pagure.io/freeipa/issue/9226 #9226] * ipa-otpd: initialize local pointers and handle gcc 10 [https://pagure.io/freeipa/c/9441d7ed1ac67dc74ca6177b474d10da97b06a2f commit] [https://pagure.io/freeipa/issue/9230 #9230] === Anuja More (1) === * ipatests : Test query to AD specific attributes is successful. [https://pagure.io/freeipa/c/db7cd79858ec8fad7d094ca883d8b7d82c7c1ac1 commit] [https://pagure.io/freeipa/issue/9127 #9127] === Andika Triwidada (1) === * Translated using Weblate (Indonesian) [https://pagure.io/freeipa/c/3885bd6fd75e984f990dc0e0f760f61815139181 commit] === Antonio Torres (1) === * Back to git snapshots [https://pagure.io/freeipa/c/c9d9fb3a3a63f66d60541f21f2f3466b6d9a89b3 commit] === Alexey Tikhonov (3) === * extdom: avoid sss_nss_getorigby*() calls when get*_r_wrapper() returns object from a wrong domain (performance optimization) [https://pagure.io/freeipa/c/1360c8b09f0862fe961fbb015f55d6b3cbd9aee9 commit] * extdom: make sure result doesn't miss domain part [https://pagure.io/freeipa/c/4685f9d881c09fa317cb68fba1b94c29e48a7a8b commit] [https://pagure.io/freeipa/issue/9245 #9245] * extdom: internal functions should be static [https://pagure.io/freeipa/c/113cb8d715cf7bed8bcc36845940acc20fed8e60 commit] === Carla Martinez (7) === * Update API and VERSION [https://pagure.io/freeipa/c/48b9cc3345f8596904bce14d580cd4b19bfbda15 commit] [https://pagure.io/freeipa/issue/9249 #9249] * webui: Set 'SOA serial' field as read-only [https://pagure.io/freeipa/c/9b274bc5d01c58806f18e549b566d93e25b40214 commit] [https://pagure.io/freeipa/issue/9249 #9249] * ipatest: Remove warning message for 'idnssoaserial' [https://pagure.io/freeipa/c/3d34673b8c04c9ec849f8276876fd8bbd4fe2234 commit] [https://pagure.io/freeipa/issue/9249 #9249] * Set 'idnssoaserial' to deprecated [https://pagure.io/freeipa/c/242ed2e500510f33f4595fb1b29adb25b1517982 commit] [https://pagure.io/freeipa/issue/9249 #9249] * webui: Show 'Sudo order' column [https://pagure.io/freeipa/c/54b81617674be79577b8c3abf0949725d9a428c7 commit] [https://pagure.io/freeipa/issue/9237 #9237] * Set pkeys in test_selinuxusermap.py::test_misc::delete_record [https://pagure.io/freeipa/c/ea792e11eb85a5b05b2b78f0215c147a52d2d265 commit] [https://pagure.io/freeipa/issue/9161 #9161] * webui: Allow grace login limit [https://pagure.io/freeipa/c/7a1e1d9f1cb13679c28f12d05b156a08bcc4d856 commit] [https://pagure.io/freeipa/issue/9211 #9211] === Jan Kuparinen (14) === * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/d4b9203376115508f596c6469c9c3be24d719ff2 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/242a0dadcf86bb27efccdc1be1946c39f0ba2931 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/98e80985bae7fa7104d8dd621c73c2b848630417 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/2b0c9d91285282df5f545fc6c331b5b9a219048e commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/dbe49df1b3d2fb254315ed26190792c8aaf89c38 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/0caffa37c01a7a77301368413854473520e5e055 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/63fceacb176162210cd5d64f73ecf10b1bf8d402 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/606ce6d52aa4b29e1af787c7830d30d6846c932e commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/10a51197f27d90fab78bdf6a4a0cae6779589299 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/1c1187beedb23f91614f131fda15c6c6f6264556 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/a1c0031c9044135ae00ac9f3e22beb22bd5fbb07 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/bcc5819830e23867a5c1471f3a37576d705ce8d8 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/3452c6fcf0730351b45ecbeb7d89ff318319f7c0 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/a4202264936dca51b476178f5061692cd569373b commit] === David Pascual (2) === * ipatest: fix prci checker target masked return code & add pylint [https://pagure.io/freeipa/c/51f1321b9c2263edd3f725abe3f90e56678adf94 commit] * ipatests: Checker script for prci definitions [https://pagure.io/freeipa/c/3d827979d2688607bd5376501ef71c2b63124603 commit] === Erik (1) === * ipatests: healthcheck: test if system is FIPS enabled [https://pagure.io/freeipa/c/c55185d3dc3c6cd2ffebab77fbf8caa40a32bcd1 commit] [https://pagure.io/freeipa/issue/8951 #8951] === Endi Sukma Dewata (1) === * Remove pki_restart_configured_instance [https://pagure.io/freeipa/c/79f765586e8f18e37f3dbe036b12715bef49e442 commit] === Florence Blanc-Renaud (15) === * Spec file: bump the selinux-policy version [https://pagure.io/freeipa/c/4e201ec97e5c54ad8d5fa02285e628d1a36d9ea7 commit] [https://pagure.io/freeipa/issue/9198 #9198] * webui tests: fix test_subid suite [https://pagure.io/freeipa/c/9936379c9f0d6c888785ccca8766ed7074054270 commit] [https://pagure.io/freeipa/issue/9214 #9214] * ipatests: mark xfail tests using dnssec [https://pagure.io/freeipa/c/3d093c66f21c57afeb8cfc242390d0d032509ab3 commit] [https://pagure.io/freeipa/issue/9216 #9216] * ipatests: mark xfail tests using sssctl domain-status [https://pagure.io/freeipa/c/40b9c6fc4746cfa32d8bf7c2038745cc037c673b commit] [https://pagure.io/freeipa/issue/9234 #9234] * Tests: test on f37 and f36 [https://pagure.io/freeipa/c/a6485d6325585d0f80b659c473b3675728556ce1 commit] * ipa man page: format the EXAMPLES section [https://pagure.io/freeipa/c/1546c0b206e02902b4aba631ee83f2f7ba5acb1f commit] [https://pagure.io/freeipa/issue/9252 #9252] * ipatests: add negative test for otptoken-sync [https://pagure.io/freeipa/c/d9f33b7cd7e336be90d889e2db4c4bce18753918 commit] [https://pagure.io/freeipa/issue/9248 #9248] * ipa otptoken-sync: return error when sync fails [https://pagure.io/freeipa/c/221768f882784755c6449ff70f291fab780cce16 commit] [https://pagure.io/freeipa/issue/9248 #9248] * ipa-cacert-manage prune: remove all expired certs [https://pagure.io/freeipa/c/c5bcaab8f1e09ab7a0464f5a532f154d43ffcadb commit] [https://pagure.io/freeipa/issue/9244 #9244] * gitignore: add install/oddjob/org.freeipa.server.config-enable-sid [https://pagure.io/freeipa/c/458dcebd2542de70c987ca89fe49f15d3f40ee82 commit] * ipatests: Fix expected object classes [https://pagure.io/freeipa/c/b6520bef2ef05dd87636d8b57e3247d451af81d8 commit] [https://pagure.io/freeipa/issue/9062 #9062] * check_repl_update: in progress is a boolean [https://pagure.io/freeipa/c/2003eb6b3d4a27a5de5eaa79418f115dd99886cd commit] [https://pagure.io/freeipa/issue/9218 #9218] * azure tests: disable TestInstallDNSSECFirst [https://pagure.io/freeipa/c/eb9f606ffd1ad3ccd846173c152c52a171be8f86 commit] [https://pagure.io/freeipa/issue/9216 #9216] * Nightly tests: fix template for nightly_ipa-4-10_latest.yaml [https://pagure.io/freeipa/c/4499c7379b5531501bb1a5ea58ab575bf3b08907 commit] * ipatests: add nightly definitions for ipa-4-10 branch [https://pagure.io/freeipa/c/6c6a43c9090b5f61726512182a36958cbdafc9a4 commit] === Fraser Tweedale (2) === * install: suggest --skip-mem-check when mem check fails [https://pagure.io/freeipa/c/cebfb8792006af1a41c4c26c49372f0ea822dbaf commit] [https://pagure.io/freeipa/issue/8404 #8404] * man: add --skip-mem-check to man pages [https://pagure.io/freeipa/c/e7bee5b668fee083d8ada167f307857761c25d80 commit] [https://pagure.io/freeipa/issue/8404 #8404] === Jesse Sandberg (1) === * Fix ipa-ccache-sweeper activation timer and clean up service file [https://pagure.io/freeipa/c/f6a661bdaf0560eac99ca63ffb25ec739281a19a commit] [https://pagure.io/freeipa/issue/9231 #9231] === Nikola Knazekova (1) === * Exclude installed policy module file from RPM verification [https://pagure.io/freeipa/c/ad7bdd46fb64c3fbb8104a9599459795fc193389 commit] [https://pagure.io/freeipa/issue/9254 #9254] === Weblate (5) === * Update translation files [https://pagure.io/freeipa/c/357dd550ce3568e37edebd4bb3394a706eb81182 commit] * Update translation files [https://pagure.io/freeipa/c/c8c4e93fd64329df76b4754f74d70cfceed6c452 commit] * Update translation files [https://pagure.io/freeipa/c/921fdd2ca879b8d6c1e601a17eb3eb9b197f9797 commit] * Update translation files [https://pagure.io/freeipa/c/3500d05f8904d7bab84d950c81563d9bfb6d1474 commit] * Update translation files [https://pagure.io/freeipa/c/d0b336025fd0408e1f81811330cac6682ba0bed6 commit] === Piotr Drąg (2) === * Translated using Weblate (Polish) [https://pagure.io/freeipa/c/31f7860d089a628a4ccfaf8db507ecadfaa75805 commit] * Translated using Weblate (Polish) [https://pagure.io/freeipa/c/f9419bdad41a87aa4454fcb1d725988b27c634a1 commit] === Rob Crittenden (10) === * Move client certificate request after krb5.conf is created [https://pagure.io/freeipa/c/f3c861b9fcbf7815161b46e5eab582813c1021dc commit] [https://pagure.io/freeipa/issue/9246 #9246] * Defer creating the final krb5.conf on clients [https://pagure.io/freeipa/c/3cbf2b25422100cc4105dfb09ee8c7bf87232198 commit] [https://pagure.io/freeipa/issue/9228 #9228] * Fix upper bound of password policy grace limit [https://pagure.io/freeipa/c/3c4386ce057a0fd50c7494db43c71405c9674b8f commit] [https://pagure.io/freeipa/issue/9243 #9243] * Set default on group pwpolicy with no grace limit in upgrade [https://pagure.io/freeipa/c/de6f074538f6641fd9d84bed204a3d4d50eccbe5 commit] [https://pagure.io/freeipa/issue/9212 #9212] * Set default gracelimit on group password policies to -1 [https://pagure.io/freeipa/c/45e6d49b94da78cd82eb016b3266a17a1359a087 commit] [https://pagure.io/freeipa/issue/9212 #9212] * doc: Update LDAP grace period design with default values [https://pagure.io/freeipa/c/1aa39529cda4ab9620539dbad705cedd23c21b42 commit] [https://pagure.io/freeipa/issue/9212 #9212] * upgrades: Don't restart the CA on ACME and profile schema change [https://pagure.io/freeipa/c/459b81b196b7bf36100aa2f4e5c4d36b1e4526f6 commit] [https://pagure.io/freeipa/issue/9204 #9204] * Disabling gracelimit does not prevent LDAP binds [https://pagure.io/freeipa/c/1bb4ff9ed2313fb3c2bd1418258c5bcec557b6a5 commit] [https://pagure.io/freeipa/issue/9206 #9206] * Warn for permissions with read/write/search/compare and no attrs [https://pagure.io/freeipa/c/499f71729b8689d40608d9c99db703eb2c00a934 commit] [https://pagure.io/freeipa/issue/9188 #9188] * Only calculate LDAP password grace when the password is expired [https://pagure.io/freeipa/c/33cd62e0daa68fa6a9b3ca495d97ac5ce8713349 commit] [https://pagure.io/freeipa/issue/1539 #1539] === Ricky Tigg (3) === * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/67c54ce7a9b7c11a56475e1d8de586b18abce228 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/86f828a7e52ee09ae6e666dce11183c0dd091540 commit] * Translated using Weblate (Finnish) [https://pagure.io/freeipa/c/4b10b6dab45c87472bb1fe0baeeee987ae1b23ba commit] === Sumit Bose (1) === * ipa-kdb: do not fail if certmap rule cannot be added [https://pagure.io/freeipa/c/ae445f72a009d14135e11ff932eded2dc2dc9c86 commit] === 김인수 (4) === * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/d5ea8d6c9f7208a2ae8b5379c88ae36e7c4f62e6 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/4ea9b5ef0f3ee1361a59622e4d6c3274cf2e7ad4 commit] * Translated using Weblate (Korean) [https://pagure.io/freeipa/c/9d1541f17d44cbb38bc9a477c5e88eaee71ce6d8 commit] * Added translation using Weblate (Korean) [https://pagure.io/freeipa/c/f420c19bb62fb3c735563cb462fd6be7b8018691 commit] === Stanislav Levin (6) === * ipapython: Support openldap 2.6 [https://pagure.io/freeipa/c/51c31e0ad3387c07aad1035f00871bdcc201812a commit] [https://pagure.io/freeipa/issue/9255 #9255] * x509: Replace removed register_interface with subclassing [https://pagure.io/freeipa/c/a7beaa0b4de6b6b00ee1b5b770f0d2e72fad58df commit] [https://pagure.io/freeipa/issue/9160 #9160] * ap: Constrain supported docutils [https://pagure.io/freeipa/c/e5f7356e7e83b605a821ece9f242ac924925f27e commit] [https://pagure.io/freeipa/issue/9208 #9208] * ap: Rearrange overloaded jobs [https://pagure.io/freeipa/c/8ff0c1a5ee33946202031a8bc83e855216cd0c95 commit] [https://pagure.io/freeipa/issue/9207 #9207] * ap: Disable azure's security daemon [https://pagure.io/freeipa/c/acd1d127938aa9feefbbc7ee325963a2e44ef3c3 commit] [https://pagure.io/freeipa/issue/9207 #9207] * ap: Raise dbus timeout [https://pagure.io/freeipa/c/260d6378ec59d244e5f247f4af81f7ae8c72ac87 commit] [https://pagure.io/freeipa/issue/9207 #9207] === Scott Poore (4) === * ipatests: add keycloak user login to ipa test [https://pagure.io/freeipa/c/e197c743f3ea1a98d444c0eb01339cc22eab64d5 commit] [https://pagure.io/freeipa/issue/9250 #9250] * ipatests: add prci definitions for test_sso jobs [https://pagure.io/freeipa/c/db1d05176d8072b05fea179af2ac97caaeb65dd1 commit] * ipatests: add Keycloak Bridge test [https://pagure.io/freeipa/c/ac776987d30ecd3444a9b25f49a714fddc3c4232 commit] [https://pagure.io/freeipa/issue/9227 #9227] * ipatests: Rename create_quarkus to create_keycloak [https://pagure.io/freeipa/c/a0a104a42c2ccd89394e48c2375bb0eb95183c5b commit] [https://pagure.io/freeipa/issue/9225 #9225] === Sumedh Sidhaye (3) === * With the commit #99a74d7, 389-ds changed the message returned in ipa-healthcheck. [https://pagure.io/freeipa/c/5477a07d91ef2c506cc943699612e5e27d0c93e4 commit] [https://pagure.io/freeipa/issue/9238 #9238] * Additional tests for RSN v3 [https://pagure.io/freeipa/c/bfe074ed478c20a9537dc2a714bba50dbc2cd34f commit] [https://pagure.io/freeipa/issue/2016 #2016] * Added a check while removing 'cert_dir'. The teardown method is called even if all the tests are skipped since the required PKI version is not present. The teardown is trying to remove a non-existent directory. [https://pagure.io/freeipa/c/aca97507cd119ad55e0c3c18ca65087cb5576c82 commit] [https://pagure.io/freeipa/issue/9179 #9179] === Sudhir Menon (2) === * ipatests: ipa-client-install --subid adds entry in nsswitch.conf [https://pagure.io/freeipa/c/a39af6b7228d8ba85b9e97aa5decbc056d081c77 commit] [https://pagure.io/freeipa/issue/9159 #9159] * ipatests: WebUI: do not allow subid range deletion [https://pagure.io/freeipa/c/38e5bcf719a0e7c7550837ffb14300db8efe09e4 commit] [https://pagure.io/freeipa/issue/9150 #9150] === Temuri Doghonadze (4) === * Translated using Weblate (Georgian) [https://pagure.io/freeipa/c/3379aa0aa85ca40fbce94f9d2307c6b501054c5a commit] * Translated using Weblate (Georgian) [https://pagure.io/freeipa/c/054bd14bcfe999e7722c812e7509c31e6f012bb3 commit] * Translated using Weblate (Georgian) [https://pagure.io/freeipa/c/a1e66f5c050d8c9226f23af9b7d0c68bfd32a4d9 commit] * Added translation using Weblate (Georgian) [https://pagure.io/freeipa/c/a30db2030c730d835e28ceb8cdc3c64d18edb4f9 commit] === Thomas Woerner (1) === * DNSResolver: Fix use of nameservers with ports [https://pagure.io/freeipa/c/6c5530c509793f66a162ed4153d5425a0eda02d6 commit] [https://pagure.io/freeipa/issue/9158 #9158] === Viacheslav Sychov (1) === * fix: Handle /proc/1/sched missing error [https://pagure.io/freeipa/c/7aa845730999951c8f340f43ed5872c54458c6a3 commit] === Yuri Chornoivan (6) === * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/6846b953361bc96b322734e23e566c93a1879046 commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/867a38a4636915df62a28b61855780b02ff55d56 commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/6de25a0f201f0591bc551503b95f8d22c79fe7aa commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/63d332ff9ebbdd59fac65748025f8eea4270704d commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/d6d7c5d28bcf7ed341f0a5d4e1b0f167a195a4c2 commit] * Translated using Weblate (Ukrainian) [https://pagure.io/freeipa/c/a21bf7fe8213c6b041ab500ab533e2a5888d1c3e commit]

2 1

Set OTP defaults
by Kjell Cornelius Nicolaysen 07 Sep '22

07 Sep '22

Hey, I'm trying to figure out how to set the default policy for OTP tokens as we've just got a new requirement. Creating a TOTP token as an admin I can set the secure hash, time window and number of digits, but when adding a token as a regular user it defaults to SHA-1 with 6 digits and a 30 seconds window. Would anyone be able to point to where I can change the defaults? Thank you in advance for any help. -- Mvh, Kjell C. Nicolaysen Bitfrost AS PGP Public key available on request. Current key (at time of this email) fingerprint: 3F59 7410 AFD5 FC22 F2F1 EEC9 980A 8C9E C126 6716

2 1

FreeIPA Client does not update user info
by Lucas Blom 16 Aug '22

16 Aug '22

Hello, I'am a new FreeIPA user and most things are working fine, except when I update a user on the IPA server the client does not update it's information. Greetings, Lucas

4 3

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel