5:01 a.m.
The FreeIPA team would like to announce FreeIPA 4.7.2 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 29 and Fedora 28 will be available in the official
[https://copr.fedorainfracloud.org/coprs/g/freeipa/freeipa-4-7/ COPR
repository] and also published to Fedora 28 and Fedora 29 updates.
== Highlights in 4.7.2 ==
Bugfixes to make FreeIPA 4.7 work well on Fedora 29 and RHEL 8.0 beta.
=== Known Issues ===
=== Bug fixes ===
FreeIPA 4.7.2 is a stabilization release for the features delivered as a
part of 4.7 release series.
There are more than 10 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list
(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 7779 Update PR-CI definitions to use Fedora 29
* 7776 authselect 1.0.2 fails on unknown feature
* 7772 pylint 2.2.0 violations
* 7769 Installer does not detect that kadmin port 749/UDP is blocked
* 7767 make fasttest errors because of missing python3-lib389
* 7758 pylint-2.1.1 errors on Fedora 29
* 7754 Replace archaic term messagebus with dbus
* 7753 CID 323644: logically dead code in ipaserver.install.adtrust.py
* 7741 Smart card advise script uses hard-coded Python interpreter
* 7729 Bad output on failed client installation rollback
* 7728 RFE: Validation and better error messages when novajoin fails because of SSL
errors
* 7723 NTP options fails on ipa replica
* 7671 Remove --no-sssd and --noac options
* 7658 [RFE] sysadm_r should be included in default SELinux user map order
* 7651 ipa-replica-install --setup-kra broken on DL1
* 7408 ipa-replica-install command should display proper message on the console.
* 5378 Incorrect error message at wrong password from private key file
== Detailed changelog since 4.7.1 ==
=== Alexander Bokovoy (6) ===
* Become IPA 4.7.2
* ipa-kdb: reduce LDAP operations timeout to 30 seconds
* ipa-4-7: merge translations from zanata
* ipaserver.install.adtrust: fix CID 323644
* net groupmap: force using empty config when mapping Guests
* adtrust: define Guests mapping after creating cifs/ principal
=== Adam Williamson (1) ===
* Fix authselect invocations to work with 1.0.2
=== Christian Heimes (35) ===
* Update temp commit template to F29
* Increase debugging for blocked port 749 and 464
* Address misc pylint issues in CLI scripts
* pylint: also verify scripts
* pylint: Fix duplicate-string-formatting-argument
* pylint 2.2: Fix unnecessary pass statement
* PR-CI: Restart rpcbind when it blocks kadmin port
* Fix pytest deprecation warning
* certdb: validate server cert signature
* Require pylint 2.1.1-2
* Silence comparison-with-itself in tests
* Fix raising-format-tuple
* Fix various dict related pylint warnings
* Fix Module 'pytest' has no 'config' member
* Fix useless-import-alias
* Fix comparison-with-callable
* Address consider-using-in
* Ignore consider-using-enumerate for now
* Address inconsistent-return-statements
* Address pylint violations in lite-server
* Ignore W504 code style like in travis config
* Fix test_cli_fsencoding on Python 3.7, take 2
* Replace messagebus with modern name dbus
* Copy-paste error in permssions plugin, CID 323649
* Allow ipaapi user to access SSSD's info pipe
* Fix test_cli_fsencoding on Python 3.7
* ipapwd_pre_mod: NULL ptr deref
* ipadb_mspac_get_trusted_domains: NULL ptr deref
* has_krbprincipalkey: avoid double free
* Require Dogtag 10.6.7-3
* Use tasks.install_master() in external_ca tests
* Keep Dogtag's client db in external CA step 1
* Replace hard-coded interpreter with sys.executable
* Don't abuse strncpy() length limitation
* Fix ipadb_multires resource handling
=== François Cami (3) ===
* Add a "Find enabled services" ACI in 20-aci.update so that all users can find
IPA servers and services. ACI suggested by Christian Heimes.
* Add a shared-vault-retrieve test
* Add sysadm_r to default SELinux user map order
=== Florence Blanc-Renaud (19) ===
* ipatests: add upgrade test for double-encoded cacert
* ipa upgrade: handle double-encoded certificates
* ipatests: add xmlrpc test for user|host-find --certificate
* ipaldap.py: fix method creating a ldap filter for IPACertificate
* ipatests: fix test_replica_uninstall_deletes_ruvs
* ipatests: add test for ipa-replica-install options
* ipa-replica-install: password and admin-password options mutually exclusive
* freeipa.spec.in: add BuildRequires for python3-lib389
* ipatests: add integration test for "Read radius servers" perm
* radiusproxy: add permission for reading radius proxy servers
* tests: add xmlrpc test for ipa user-add --radius-username
* ipa user-add: add optional objectclass for radius-username
* ipatest: add functional test for ipa-backup
* ipa-backup: restart services before compressing the backup
* ipa-replica-install --setup-adtrust: check for package ipa-server-trust-ad
* ipatests: fix path in expected error message
* Bump requires 389-ds-base
* ipa tests: CA less
* certdb: provide meaningful err msg for wrong PIN
=== Francisco Trivino (2) ===
* PR-CI: Move to Fedora 29 template, version 0.2.0
* prci_definitions: update vagrant memory topology requirements
=== Fraser Tweedale (6) ===
* certdb: validate certificate signatures
* Print correct subject on CA cert verification failure
* certdb: ensure non-empty Subject Key Identifier
* ipaldap: avoid invalid modlist when attribute encoding differs
* rpc: always read response
* Restore KRA clone installation integration test
=== Varun Mylaraiah (1) ===
* Added test for ipa-client-install with a non-standard ldap.conf file Ticket:
https://pagure.io/freeipa/issue/7418
=== Petr Vobornik (1) ===
* ipa-advise: update url of cacerdir_rehash tool
=== Rob Crittenden (10) ===
* Add support for multiple certificates/formats to ipa-cacert-manage
* Add tests for ipa-cacert-manage install
* Enable replica install info logging to match ipa-server-install
* Demote log message in custodia _wait_keys to debug
* Pass a list of values into add_master_dns_records
* Collect the client and server uninstall logs in tests
* Fix misleading errors during client install rollback
* Remove the authselect profile warning if sssd was not configured.
* Handle NTP configuration in a replica server installation
* Enable LDAP debug output in client to display TLS errors in join
=== Stanislav Levin (1) ===
* Move ipa's systemd tmpfiles from /var/run to /run
=== Sergey Orlov (2) ===
* ipatests: add test for ipa-restore in multi-master configuration
* ipatests: add test for ipa-advise for enabling sudo for admins group
=== sudharsanomprakash (1) ===
* Don't use deprecated Apache Access options.
=== Thomas Woerner (5) ===
* Fix ressource leak in daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_netlogon.c
ipa_cldap_netlogon
* Fix ressource leak in client/config.c get_config_entry
* Update annobin to fix continuous-integration/travis-ci/pr issues
* Find orphan automember rules
* ipaclient: Remove --no-sssd and --no-ac options
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland