FreeIPA 4.9.9

[Antonio Torres]

The FreeIPA team would like to announce FreeIPA 4.9.9 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds
for Fedora distributions will be available from the official repository
soon.

== Highlights in 4.9.9

* 6524: Vault key archival using AES

    The vault plugin now uses AES-128-CBC as default wrapping algorithm
    for the transport of secrets.


* 9084: ipa-client-automount --no-sssd broken with authselect 1.3.0

    The command ipa-client-automount does not support any more the
    --no-sssd option. As a consequence, the command always configures
    the client to use SSSD for automount.


* 9095: After ipa-restore, a hidden server is not made visible

    When a hidden server is restored using ipa-restore, it is now always
    made visible by marking all its services as enabled instead of
    hidden.


* 9106: Nightly failure (rawhide) when calling kinit admin

    OpenLDAP 2.6+ removed -h and -p options from OpenLDAP command line
    utilities (ldapadd/ldapmodify/...). FreeIPA now uses only -H url
    option to specify the target server and protocol to use.


* 9107: Enable ipa-ccache-sweep.timer during server installation

    New installations of IPA now enable the ipa-ccache-sweep.timer that
    is removing expired credential caches from the filesystem.


=== Bug fixes

FreeIPA 4.9.9 is a stabilization release for the features delivered as a
part of 4.9 version series.

There are more than 50 bug-fixes since FreeIPA 4.9.8 release. Details of
the bug-fixes can be seen in the list of resolved tickets below.

== Upgrading

Upgrade instructions are available on Upgrade page.

== Feedback

Please provide comments, bugs and other feedback via the freeipa-users
mailing list
(https://lists.fedoraproject.org/archives/list/[e-mail]...)
or #freeipa channel on libera.chat.

== Resolved tickets

* https://pagure.io/freeipa/issue/6524[#6524] Vault key archival using
AES
* https://pagure.io/freeipa/issue/7671[#7671] Remove --no-sssd and
--noac options
* https://pagure.io/freeipa/issue/8001[#8001] Need default
authentication indicators for SPAKE, PKINIT and encrypted challenge
preauth
* https://pagure.io/freeipa/issue/8361[#8361] Add support for managing
subuids and subgids in FreeIPA
* https://pagure.io/freeipa/issue/8506[#8506]
(https://bugzilla.redhat.com/show_bug.cgi?id=1930038[rhbz#1930038])
Nightly failure in ipa-server-install --uninstall:
org.freedesktop.DBus.Error.NoReply
* https://pagure.io/freeipa/issue/8582[#8582] Nightly test failure in
test_replica_promotion.py::TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica
- ClonesConnectivyAndDataCheck
* https://pagure.io/freeipa/issue/8605[#8605]
(https://bugzilla.redhat.com/show_bug.cgi?id=1903250[rhbz#1903250])
backtrace using ipa-replica-manage
* https://pagure.io/freeipa/issue/8807[#8807]
(https://bugzilla.redhat.com/show_bug.cgi?id=1688267[rhbz#1688267])
[RFE] IPA to allow setting a new range type.
* https://pagure.io/freeipa/issue/8865[#8865] [Tracker]
ipa-replica-install fails on 2nd run (f35+)
* https://pagure.io/freeipa/issue/8899[#8899]
(https://bugzilla.redhat.com/show_bug.cgi?id=2061957[rhbz#2061957])
healthcheck 0.9 warns about permissions of /var/log/ipaupgrade.log
* https://pagure.io/freeipa/issue/8906[#8906]
(https://bugzilla.redhat.com/show_bug.cgi?id=1731484[rhbz#1731484])
support for SHA384withRSA signing algo missing
* https://pagure.io/freeipa/issue/8962[#8962]
(https://bugzilla.redhat.com/show_bug.cgi?id=1966289[rhbz#1966289]) Info
about searchrecordslimit set search limit to 10,000 after upgrade
* https://pagure.io/freeipa/issue/9004[#9004] Can't use --delattr with a
date value
* https://pagure.io/freeipa/issue/9009[#9009] Nightly failure (rawhide)
in webui_tests: yaml.load() now requires Loader
* https://pagure.io/freeipa/issue/9014[#9014]
'init/tmpfilesd/ipa.conf.in' hardcodes apache group
* https://pagure.io/freeipa/issue/9024[#9024] Nightly failure
(updates-testing) in test_fips.py::TestInstallFIPS
* https://pagure.io/freeipa/issue/9031[#9031] Harden FreeIPA KDC
processing of PAC buffers
* https://pagure.io/freeipa/issue/9038[#9038]
(https://bugzilla.redhat.com/show_bug.cgi?id=1825010[rhbz#1825010])
Concerns regarding 'ipa pwpolicy-mod --minlife 24 --maxlife 1'
* https://pagure.io/freeipa/issue/9044[#9044] Random nightly failure in
test_otp.py::TestOTPToken::test_check_otpd_after_idle_timeout
* https://pagure.io/freeipa/issue/9047[#9047] Add automation for
ipa-replica-conncheck in upstream tests
* https://pagure.io/freeipa/issue/9051[#9051] Nightly test failure
(selinux/updates-testing) in ipa-restore
* https://pagure.io/freeipa/issue/9052[#9052] Nightly test failure
(updates-testing) in test_ipa_cert_fix.py::TestCertFixReplica teardown
* https://pagure.io/freeipa/issue/9054[#9054] [ipatests] ipa-healthcheck
and URI RRs
* https://pagure.io/freeipa/issue/9063[#9063]
(https://bugzilla.redhat.com/show_bug.cgi?id=2031825[rhbz#2031825])
Changing default pac type to 'nfs:NONE and MS-PAC' doesnot display error
'ipa: ERROR: no modifications to be performed'
* https://pagure.io/freeipa/issue/9065[#9065]
(https://bugzilla.redhat.com/show_bug.cgi?id=2033342[rhbz#2033342])
Can't log in after ipa user-mod USER --user-auth-type=hardened
* https://pagure.io/freeipa/issue/9067[#9067] Nightly test failure
(rawhide) in
test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd
* https://pagure.io/freeipa/issue/9068[#9068] --desc in
automember-default-group-set and automember-default-group-remove
* https://pagure.io/freeipa/issue/9069[#9069] Nightly test failure
(updates-testing) in test_winsyncmigrate.py::TestWinsyncMigrate
* https://pagure.io/freeipa/issue/9080[#9080]
(https://bugzilla.redhat.com/show_bug.cgi?id=2032701[rhbz#2032701])
Build against OpenLDAP 2.6
* https://pagure.io/freeipa/issue/9083[#9083] Support MIT Kerberos KDB
version 9
* https://pagure.io/freeipa/issue/9084[#9084] ipa-client-automount
--no-sssd broken with authselect 1.3.0
* https://pagure.io/freeipa/issue/9085[#9085] ipa-client-install fails
if pre-existing NIS domain contains a "%"
* https://pagure.io/freeipa/issue/9087[#9087] cifs mounts fails with
error: cifs filesystem not supported by the system
* https://pagure.io/freeipa/issue/9095[#9095] After ipa-restore, a
hidden server is not made visible
* https://pagure.io/freeipa/issue/9096[#9096] Nightly test failure in
testing_master_pki: certificate not retrieved on replica
* https://pagure.io/freeipa/issue/9099[#9099]
(https://bugzilla.redhat.com/show_bug.cgi?id=2049167[rhbz#2049167]) KRA
GetStatus service blocked by IPA proxy
* https://pagure.io/freeipa/issue/9100[#9100]
(https://bugzilla.redhat.com/show_bug.cgi?id=2022483[rhbz#2022483])
Unable to join RHEL 8.5 Replica to RHEL 7.9 Master for migration
purposes
* https://pagure.io/freeipa/issue/9101[#9101]
(https://bugzilla.redhat.com/show_bug.cgi?id=2032806[rhbz#2032806])
Error replacing a replica with CentOS Stream 9
* https://pagure.io/freeipa/issue/9103[#9103]
(https://bugzilla.redhat.com/show_bug.cgi?id=2048558[rhbz#2048558])
ipa-join tests are failing due to changes in expected output
* https://pagure.io/freeipa/issue/9106[#9106]
(https://bugzilla.redhat.com/show_bug.cgi?id=2050921[rhbz#2050921])
Nightly failure (rawhide) when calling kinit admin
* https://pagure.io/freeipa/issue/9107[#9107]
(https://bugzilla.redhat.com/show_bug.cgi?id=2051575[rhbz#2051575])
Enable ipa-ccache-sweep.timer during server installation
* https://pagure.io/freeipa/issue/9108[#9108] ipatests: remove
additional check for failed units.
* https://pagure.io/freeipa/issue/9110[#9110]
(https://bugzilla.redhat.com/show_bug.cgi?id=2032738[rhbz#2032738]) IPA
LDAP plugin ipa-cldap memory leak
* https://pagure.io/freeipa/issue/9111[#9111] Server host name not saved
by the script ?
* https://pagure.io/freeipa/issue/9117[#9117] Pylint 2.12 issues
* https://pagure.io/freeipa/issue/9119[#9119]
(https://bugzilla.redhat.com/show_bug.cgi?id=2057471[rhbz#2057471]) KRB
instance: make provision to work with crypto policy without SHA-1 HMAC
types
* https://pagure.io/freeipa/issue/9123[#9123] Random nightly test
failure in
test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring
* https://pagure.io/freeipa/issue/9126[#9126] allow overriding
systemd-tmpfiles program
* https://pagure.io/freeipa/issue/9127[#9127]
(https://bugzilla.redhat.com/show_bug.cgi?id=2062379[rhbz#2062379]) Use
new getorigby\{user|group}name() calls in extdom plugin
* https://pagure.io/freeipa/issue/9129[#9129] Remove Python warning
about PROTOCOL_SSLv23
* https://pagure.io/freeipa/issue/9133[#9133] Nightly test failure in
test_fips.py::TestInstallFIPS::test_basic
* https://pagure.io/freeipa/issue/9134[#9134] Nightly test failure
(rawhide) while establishing two-way trust
* https://pagure.io/freeipa/issue/9137[#9137]
test_replica_install_after_restore is performing reinit in the wrong
direction
* https://pagure.io/freeipa/issue/9141[#9141] ipatests: fix xfail
assertion in auto private group tests

== Detailed changelog since 4.9.8

=== Alexander Bokovoy (20)

* ipatests: collect samba logs when setting up trust to AD
https://pagure.io/freeipa/c/ee6472cee20ff99d16cde1a97c3dd5167b7cd893[commit]
* ipa-sam: retrieve trusted domain account credential from the TDO
itself
https://pagure.io/freeipa/c/91d083c36e1daf88686bf8096691b3913d2ad23c[commit]
https://pagure.io/freeipa/issue/9134[#9134]
* ipa-pwd-extop: allow ipasam to request RC4-HMAC in Kerberos keys for
trusted domain objects
https://pagure.io/freeipa/c/710314a794eb3446f0467d33133d70d2425fbf65[commit]
https://pagure.io/freeipa/issue/9134[#9134]
* ipatests: fix check for AD topology being present
https://pagure.io/freeipa/c/b6b5f6073bf4e12b8357a6ec9f5a4f6bb683437f[commit]
https://pagure.io/freeipa/issue/9133[#9133]
* tests: ensure AD-SUPPORT subpolicy is active in more cases
https://pagure.io/freeipa/c/09481117b58f1a237bb1048d3fe8d44caf9e167f[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* ipalib/util.py: switch to ssl.PROTOCOL_TLS_CLIENT by default
https://pagure.io/freeipa/c/3e8a355dd49a6c080103a030ced03597ee4baece[commit]
https://pagure.io/freeipa/issue/9129[#9129]
* test_krbtpolicy: skip SPAKE-related tests in FIPS mode
https://pagure.io/freeipa/c/2e70535f74e7d9dd76e728eca1119ce522fd138a[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* test_otp: do not use paramiko unless it is really needed
https://pagure.io/freeipa/c/3baae8d1bd0a0c4c707314524289e86e6ecbc0df[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* Kerberos instance: default to AES256-SHA2 for master key encryption
https://pagure.io/freeipa/c/3e54c4362490b4da1b6cb3e141bb6e08fecc58c0[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* freeipa.spec: bump crypto-policies dependency for CentOS 9 Stream
https://pagure.io/freeipa/c/ee39de46a1c1ea96bbe524f159ae435319b2d072[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* ipatests: extend AES keyset to SHA2-based ones
https://pagure.io/freeipa/c/49d9147e38c5b50c52a1ebc7283753c779c2f81f[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* tests: ensure AD-SUPPORT subpolicy is active
https://pagure.io/freeipa/c/b016683552a58f9cc2a05cf628cc467234eaf599[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* KRB instance: make provision to work with crypto policy without SHA-1
HMAC types
https://pagure.io/freeipa/c/a51900819bd5332bc05ec9d513f062844b3a7763[commit]
https://pagure.io/freeipa/issue/9119[#9119]
* translations: regenerate translations after changes in help message in
sudorule
https://pagure.io/freeipa/c/0d034d7fd409a8dbbc48a7307ad6d042a4098a74[commit]
https://pagure.io/freeipa/issue/9106[#9106]
* pylint: workaround incorrect pylint detection of a local function
https://pagure.io/freeipa/c/10d32d43e4640f61aa3d021b3e8136ca6132e493[commit]
* OpenLDAP 2.6+: use only -H option to specify LDAP url
https://pagure.io/freeipa/c/85ce7acb733e09ea7916a8a26d42fb3d4b5fe3bd[commit]
https://pagure.io/freeipa/issue/9106[#9106]
* ipa-kdb: refactor KDB driver to prepare for KDB version 9
https://pagure.io/freeipa/c/ace0bbfdc8eb02a4ba47f8293809ff4734856ab8[commit]
https://pagure.io/freeipa/issue/9083[#9083]
* Support building against OpenLDAP 2.6+
https://pagure.io/freeipa/c/ce112e68bd711199baee1f7103d31a4bb0c5ad97[commit]
https://pagure.io/freeipa/issue/9080[#9080]
* ipa-kdb: fix requester SID check according to MS-KILE and MS-SFU
updates
https://pagure.io/freeipa/c/7d93bda31ce0b4e0e22c6e464c9138800dcf8b1c[commit]
https://pagure.io/freeipa/issue/9031[#9031]
* ipa-kdb: issue PAC_REQUESTER_SID only for TGTs
https://pagure.io/freeipa/c/669f3d71161741c676ddd6a08bd08d4a4ccd495b[commit]
https://pagure.io/freeipa/issue/9031[#9031]

=== Anuja More (6)

* Mark xfail
test_gidnumber_not_corresponding_existing_group[true,hybrid]
https://pagure.io/freeipa/c/7ad500e5d3f7d9af81e8a3137158672c6fafb0b4[commit]
* mark xfail for test_idoverride_with_auto_private_group[hybrid]
https://pagure.io/freeipa/c/84381001d2e114b1f29fe89e16155c040b56b80f[commit]
* ipatests: Tests for Autoprivate group.
https://pagure.io/freeipa/c/6b70e3c49acc55b5553101cf850fc40978861979[commit]
https://pagure.io/freeipa/issue/8807[#8807]
* ipatests: remove additional check for failed units.
https://pagure.io/freeipa/c/b36bcf4ea5ed93baa4dc63f8e2be542d678211fb[commit]
https://pagure.io/freeipa/issue/9108[#9108]
* ipatests: webui: Tests for subordinate ids.
https://pagure.io/freeipa/c/edbd8f692a28fc999b92e9032614d366511db323[commit]
https://pagure.io/freeipa/issue/8361[#8361]
* ipatests: Test default value of nsslapd-sizelimit.
https://pagure.io/freeipa/c/465f1669a6c5abc72da1ecaf9aefa8488f80806c[commit]
https://pagure.io/freeipa/issue/8962[#8962]

=== Antonio Torres (1)

* Back to git snapshots
https://pagure.io/freeipa/c/8042bdc90c0ca8080f94c9baf54b713e08873232[commit]

=== Brian Turek (1)

* ipalib: Handle percent signs in saved values
https://pagure.io/freeipa/c/837702199c0bc8df1b2a29defaebed083c51d7b2[commit]
https://pagure.io/freeipa/issue/9085[#9085]

=== Christian Heimes (1)

* Support AES for KRA archival wrapping
https://pagure.io/freeipa/c/895e99b6843c2fa2274acab824607c33c1a560a4[commit]
https://pagure.io/freeipa/issue/6524[#6524]

=== Florence Blanc-Renaud (14)

* ipatests: fix wrong condition in xfail_context for auto private grp
https://pagure.io/freeipa/c/5ba5143f9ed55e94668501123969e64a9ec180d2[commit]
https://pagure.io/freeipa/issue/9141[#9141]
* ipatests: Fix a call to run_command with wildcard
https://pagure.io/freeipa/c/85b2c8191b8622a5cfe3c8c6e3811ef5e1eee0eb[commit]
https://pagure.io/freeipa/issue/8506[#8506]
* ipatests: remove certmonger tracking before uninstall
https://pagure.io/freeipa/c/12785a3657996def6c7c142898c6a61b2edc16fe[commit]
https://pagure.io/freeipa/issue/9123[#9123]
* ipatests: add missing test in the nightly defs
https://pagure.io/freeipa/c/42f41ff637452e5025b205396638b26dfaae77e1[commit]
* Commit template: use either Fixes or Related
https://pagure.io/freeipa/c/f2731107db5703efbba12cd608b738347a987649[commit]
* ipatests: update images for f34 and f35
https://pagure.io/freeipa/c/896d0f351646e6a7c96037cb13957b7be0408776[commit]
https://pagure.io/freeipa/issue/9051[#9051],
https://pagure.io/freeipa/issue/9069[#9069]
* ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus
https://pagure.io/freeipa/c/9bae5492270d8b695999cd82831cbee62b04626b[commit]
https://pagure.io/freeipa/issue/8582[#8582],
https://pagure.io/freeipa/issue/9099[#9099]
* ipatests: fix expected automount config in nsswitch.conf
https://pagure.io/freeipa/c/cd8e9ce173303e192e848e4973aaf2c7bd31ee0a[commit]
https://pagure.io/freeipa/issue/9067[#9067]
* ipatests: update images for f34 and f35
https://pagure.io/freeipa/c/d8a7f15e32e9fb62125aa910e18c32117285d672[commit]
https://pagure.io/freeipa/issue/9087[#9087]
* config plugin: add a test ensuring EmptyModlist is returned
https://pagure.io/freeipa/c/cd735099e86304294217147ed578ac902fcf3dd3[commit]
https://pagure.io/freeipa/issue/9063[#9063]
* Config plugin: return EmptyModlist when no change is applied
https://pagure.io/freeipa/c/b9c42fed9b6f60801f908c368d0d97a2a69f7bb2[commit]
https://pagure.io/freeipa/issue/9063[#9063]
* automember default group: remove --desc parameter
https://pagure.io/freeipa/c/6ff7491172961fe210a6ec51b556231af9e123ba[commit]
https://pagure.io/freeipa/issue/9068[#9068]
* ipatests: update images for f34 and f35
https://pagure.io/freeipa/c/1efdda078e502e1d67a047ccd06e8b7f555f8802[commit]
https://pagure.io/freeipa/issue/8865[#8865],
https://pagure.io/freeipa/issue/9024[#9024]
* ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout
https://pagure.io/freeipa/c/4c54e9d6ddb72eab6f654bf3dc2d29f27498ac96[commit]
https://pagure.io/freeipa/issue/9044[#9044]

=== Francisco Trivino (3)

* Set AES as default for KRA archival wrapping
https://pagure.io/freeipa/c/984190eea01ac42cd1f97567a67dd9446e5b0bf9[commit]
https://pagure.io/freeipa/issue/6524[#6524]
* ipa_cldap: fix memory leak
https://pagure.io/freeipa/c/186ebe311bc9545d7a9860cd5e8c748131bbe41e[commit]
https://pagure.io/freeipa/issue/9110[#9110]
* Custodia: use a stronger encryption algo when exporting keys
https://pagure.io/freeipa/c/653a7fe02880c168755984133ee143567cc7bb4e[commit]
https://pagure.io/freeipa/issue/9101[#9101]

=== Fraser Tweedale (1)

* allow overriding systemd-tmpfiles program
https://pagure.io/freeipa/c/b413a327f33c5d97a1f830fe7a9a8aef39c847c1[commit]
https://pagure.io/freeipa/issue/9126[#9126]

=== jh23453 (1)

* Remove deprecation warning when installing a CA replica
https://pagure.io/freeipa/c/e11cf7f489d34adeca990a5f58d9c6d247b33ec1[commit]

=== Julien Rische (2)

* ipatests: add case for hardened-only ticket policy
https://pagure.io/freeipa/c/294ae35a61e6ca8816b261c57508e4be21221864[commit]
* ipa-kdb: do not remove keys for hardened auth-enabled users
https://pagure.io/freeipa/c/6d70421f57d0eca066a922e09416ef7195ee96d4[commit]
https://pagure.io/freeipa/issue/8001[#8001],
https://pagure.io/freeipa/issue/9065[#9065]

=== Michal Polovka (2)

* ipatests: webui: Use safe-loader for loading YAML configuration file
https://pagure.io/freeipa/c/419d7fd6e5a9ed2d356ad05eef1043309f5646ef[commit]
https://pagure.io/freeipa/issue/9009[#9009]
* pr-ci definitions: add web-ui subid-related jobs
https://pagure.io/freeipa/c/878859f4a27aa03c905b82f68327815825ceb1fa[commit]
https://pagure.io/freeipa/issue/8361[#8361]

=== Mohammad Rizwan (8)

* ipatests: extend find_segment with suffix param
https://pagure.io/freeipa/c/de1f4467fb1bd9be857b8c95b2b7398962656342[commit]
* ipatests: fix the topologysegment-reinitialize command
https://pagure.io/freeipa/c/c3bd6908fa29b479fbd5e8e785c7237c477e29a2[commit]
https://pagure.io/freeipa/issue/9137[#9137]
* ipatests: Check maxlife error message where minlife > maxlife
specified
https://pagure.io/freeipa/c/83551693b36c852ba455185469e4e459de435f0e[commit]
https://pagure.io/freeipa/issue/9038[#9038]
* Test ipa-ccache-sweep.timer enabled by default during installation
https://pagure.io/freeipa/c/0d9eb3d515385412abefe9c33e0099ea14f33cbc[commit]
https://pagure.io/freeipa/issue/9107[#9107]
* PEP8 Fixes
https://pagure.io/freeipa/c/5444da016edc416c0c9481c660c013053dbb93b5[commit]
* Test cases for ipa-replica-conncheck command
https://pagure.io/freeipa/c/1d19b860d4cd3bd65a4b143b588425d9a64237fd[commit]
https://pagure.io/freeipa/issue/9047[#9047]
* ipatests: Test empty cert request doesn't force certmonger to segfault
https://pagure.io/freeipa/c/cbd9ac6ab07dfb60f67da762fdd70856ad35c230[commit]
* ipatests: Fix test_ipa_cert_fix.py::TestCertFixReplica teardown
https://pagure.io/freeipa/c/ba7ec71ba96280da3841ebe47df2a6dc1cd6341e[commit]
https://pagure.io/freeipa/issue/9052[#9052]

=== Rob Crittenden (11)

* Remove the --no-sssd option from ipa-client-automount
https://pagure.io/freeipa/c/c46ea21ed33f606a6ca5c3c6aad9f8cd1ae1f796[commit]
https://pagure.io/freeipa/issue/7671[#7671],
https://pagure.io/freeipa/issue/9084[#9084]
* Convert values using _SYNTAX_MAPPING with --delattr
https://pagure.io/freeipa/c/bd8748f6b7bf5edc3f5a2023393e503ee4399f8c[commit]
https://pagure.io/freeipa/issue/9004[#9004]
* ipatests: Give the subCA more time to be loaded by the CA
https://pagure.io/freeipa/c/3a4238ba96e7f4ad5790d65ec4123983062b28a1[commit]
https://pagure.io/freeipa/issue/9096[#9096]
* Strip off trailing period of a user-provided FQDN in installer
https://pagure.io/freeipa/c/57de18e914e5b448402c18ffe938538cbac5e0a3[commit]
https://pagure.io/freeipa/issue/9111[#9111]
* Verify the user-provided hostname in the server installer
https://pagure.io/freeipa/c/7ac8e9696ea1eae9f20640102c0d83fee89db9fa[commit]
https://pagure.io/freeipa/issue/9111[#9111]
* ipa-restore: Mark a restored server as enabled
https://pagure.io/freeipa/c/ab9e7dac4138ba222c86d0594937ff4d663ba060[commit]
https://pagure.io/freeipa/issue/9095[#9095]
* Set the mode on ipaupgrade.log during RPM %post snipppet
https://pagure.io/freeipa/c/d8174b0ca60ef123f268f34f47b8be123b8d1c89[commit]
https://pagure.io/freeipa/issue/8899[#8899]
* ipatests: Remove certmonger tracking before uninstall in cert tests
https://pagure.io/freeipa/c/cc2348aedbee3e59b31df75a23aa14d1c6bbe10c[commit]
https://pagure.io/freeipa/issue/8506[#8506]
* Enable the ccache sweep timer during installation
https://pagure.io/freeipa/c/9b6d0bb1245c4891ccc270f360d0f72a4b1444c1[commit]
https://pagure.io/freeipa/issue/9107[#9107]
* Remove ipa-join errors from behind the debug option
https://pagure.io/freeipa/c/7c5540bb47799b4db95673d22f61995ad5c56440[commit]
https://pagure.io/freeipa/issue/9103[#9103]
* Don't always override the port in import_included_profiles
https://pagure.io/freeipa/c/edb216849e4f47d6cae95981edf0c3fe2653fd7a[commit]
https://pagure.io/freeipa/issue/9100[#9100]

=== Sumit Bose (2)

* ipa-kdb: fix make check
https://pagure.io/freeipa/c/9cd48d1854b19a40a2026891f9e28c1b79af2637[commit]
https://pagure.io/freeipa/issue/9083[#9083]
* extdom: user getorigby\{user|group}name if available
https://pagure.io/freeipa/c/cedca75f4fbae3293b2f2443fa6ee479d59a8ef1[commit]
https://pagure.io/freeipa/issue/9127[#9127]

=== Stanislav Levin (34)

* azure: Bump supported Pylint
https://pagure.io/freeipa/c/1e2cf55150e9e4a44c29193e764a709cfec0fa08[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip false-positive invalid-sequence-index
https://pagure.io/freeipa/c/b58ec49da983bcd25473ef6ae246eaadf32cd174[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix useless-suppression
https://pagure.io/freeipa/c/6202a7d85bea2b8717e19fc2f09cca66276dcd9d[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix format-string-without-interpolation
https://pagure.io/freeipa/c/c5b4657869738d6173eaff310bc243df0fff289e[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip unsupported-assignment-operation
https://pagure.io/freeipa/c/bfb233185a7bb863dd94a65674489890c79f6f2f[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix deprecated-method for threading
https://pagure.io/freeipa/c/fd99e4d47a4bb1518686b55e4cf04636d76128ca[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip deprecated-method for match_hostname
https://pagure.io/freeipa/c/1f17ade67f21bfde9eda4d810394577f5a28906d[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix consider-using-in
https://pagure.io/freeipa/c/3ea0e1bd8d25c2f553852c1a0882618d2da86dd3[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix arguments-renamed
https://pagure.io/freeipa/c/a960adc6c26fb4fc9d8f5f4f10029419d8fc3b69[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip use-implicit-booleaness-not-comparison
https://pagure.io/freeipa/c/03cd914381de3fbcd9dbfe228a569fab6a6d62a9[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Enable useless-suppression
https://pagure.io/freeipa/c/2db2c6cb323014580baa5cb2aa4fdbe179327bc8[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip raising-bad-type
https://pagure.io/freeipa/c/bb515f41b384b3947451bef454acd7c355d67084[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix consider-using-dict-items
https://pagure.io/freeipa/c/322d08921a126183358b8d68d350c33e37453871[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip not-callable
https://pagure.io/freeipa/c/13e5720d184b1f6e31e65be5435cdcca8229b319[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix unused-variable
https://pagure.io/freeipa/c/76c2c08fdb47b5692d3023ebf0a1b9b35a528518[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix no-member
https://pagure.io/freeipa/c/08f2db78555ff1da56122c58275680fd98916c4d[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip isinstance-second-argument-not-valid-type
https://pagure.io/freeipa/c/afba414770ad01a6fe4aec6015e2722860764c2f[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix deprecated-decorator
https://pagure.io/freeipa/c/054376c1a0aa0f600458ad6415e72f2198c7339e[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix unnecessary-dict-index-lookup
https://pagure.io/freeipa/c/d3b384b5ca18a555b54ce4385bcca603ad7251b9[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix deprecated-class
https://pagure.io/freeipa/c/ccf9334da9c51aa9a379141fd2fead0a5b5bf55d[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Remove unused __convert_iter
https://pagure.io/freeipa/c/0ebf09e061b79e12f3b80fbc224e3aac49608c21[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Drop no longer used __home
https://pagure.io/freeipa/c/91ff7b87d9b3231ec1145ffec0f8bb072130b701[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix unused-private-member
https://pagure.io/freeipa/c/4da897c3dc71f99911878e0f05ed8ed386867dec[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip unused-private-member for unsupported cases
https://pagure.io/freeipa/c/bffde84c813ddd45ec7971c96c74c2e5b54e3d72[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip unused-private-member for property case
https://pagure.io/freeipa/c/9ca818b1797e03dd41f05eb14d9181546995c246[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Drop no longer used __finalized
https://pagure.io/freeipa/c/dfa1ceac6f70e32184d2ef19706cd2c582df1cc7[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Drop never used __remove_lightweight_ca_key_retrieval_custodia
https://pagure.io/freeipa/c/3c77949ab458d6e5f8250fe7c2a8757091f8da76[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Clean up __convert_to_gssapi_replication
https://pagure.io/freeipa/c/04c4032370dddafe5c8c5bd6e26882a24c597628[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Fix use-maxsplit-arg
https://pagure.io/freeipa/c/6fd75de5a72e5f5889c33cdcc802d93dc6f067f3[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip unspecified-encoding
https://pagure.io/freeipa/c/106d011e5f39eea73b4d5db62c82398144a61ec8[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip use-dict-literal/use-list-literal
https://pagure.io/freeipa/c/40ee6a47ac62419caf302882914f2df885abd589[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip consider-using-f-string
https://pagure.io/freeipa/c/b5fc2eeff9779cb868ff56edefd7e3355fcd5bca[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* pylint: Skip redundant-u-string-prefix
https://pagure.io/freeipa/c/7f8b4f036859db570b2874b6c87ba3ba4de70eb1[commit]
https://pagure.io/freeipa/issue/9117[#9117]
* ipatests: healthcheck: Sync the expected system RRs
https://pagure.io/freeipa/c/86b98b86f62fae195c0f84fa9a5891166f69c786[commit]
https://pagure.io/freeipa/issue/9054[#9054]

=== Sumedh Sidhaye (3)

* Added nightly job definitions
https://pagure.io/freeipa/c/ef43ea03ef90cd34f2ce55a946df9a1d8e17badf[commit]
* Added test automation for SHA384withRSA CSR support
https://pagure.io/freeipa/c/0edf915efbb39fac45c784171dd715ec6b28861a[commit]
https://pagure.io/freeipa/issue/8906[#8906]
* Extend test to see if replica is not shown when running
`ipa-replica-manage list -v `
https://pagure.io/freeipa/c/8b22ee018c3bb7f58a1b6694a7fd611688f8e74f[commit]
https://pagure.io/freeipa/issue/8605[#8605]

=== Sudhir Menon (1)

* ipatests: Test for pki.server.healthcheck.clones.connectivity_and_data
https://pagure.io/freeipa/c/98eb661fd8eed87119e7b299379cba48bde0f387[commit]

=== Timo Aaltonen (7)

* configure: Use HTTPD_GROUP in init/tmpfiles/ipa.conf.in
https://pagure.io/freeipa/c/69f5f319d1b8bf1b18a8798149d2fcffa43642ec[commit]
https://pagure.io/freeipa/issue/9014[#9014]
* ipaplatform: Modify paths to fips-mode-setup and systemd-tmpfiles
https://pagure.io/freeipa/c/739d3566951e50b6467c80835945b2697fab8576[commit]
* ipatests/test_ipaplatform: Skip test_ipa_version on Debian
https://pagure.io/freeipa/c/e99870f7d0b58d88e9c18ad8ecc7edc1adb16051[commit]
* ipaplatform/debian: Fix ntpd service name
https://pagure.io/freeipa/c/dcdc31b6f9f750b617b23717f7c39ec560133c2d[commit]
* ipaplatform/debian: Fix named keytab name
https://pagure.io/freeipa/c/da9be70f7030dfa8c99efd6952dfa0f24b590fc5[commit]
* ipaplatform: Add support for recognizing systemd-timesyncd
https://pagure.io/freeipa/c/cf9c4cc7dabace4f7971a810bbdde4c258d7a4be[commit]
* ipaplatform/debian: Fix HTTPD_ALIAS_DIR, and drop some obsolete paths.
https://pagure.io/freeipa/c/a0eb02cfb6635eff82482b297965ff5348c660cd[commit]