August 2019 - FreeIPA-users - Fedora mailing-lists

LDAP error while installing IPA client
by Elhamsadat Azarian 18 Aug '19

18 Aug '19

Hi i installed ipa server but when i try to install ipa-client, this error was showed: Error checking LDAP: Operation error: 000004DC: LdapErr: DSID-0C0907c2, comment: In order to perform this operation a successful bind must be completed on the connection. it shows FQDN of my windows DNS Server instead of IPA server FQDN. and produced an error that is attached. Additional info: i have a windows DNS server. Log file of ipaclient_intsall.log 2019-08-18T10:00:08Z DEBUG Logging to /var/log/ipaclient-install.log 2019-08-18T10:00:08Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': False, 'firefox_dir': None, 'unattended': False, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False} 2019-08-18T10:00:08Z DEBUG IPA version 4.6.4-10.el7.centos.3 2019-08-18T10:00:08Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index' 2019-08-18T10:00:08Z DEBUG Starting external process 2019-08-18T10:00:08Z DEBUG args=/usr/sbin/selinuxenabled 2019-08-18T10:00:08Z DEBUG Process finished, return code=0 2019-08-18T10:00:08Z DEBUG stdout= 2019-08-18T10:00:08Z DEBUG stderr= 2019-08-18T10:00:08Z DEBUG Starting external process 2019-08-18T10:00:08Z DEBUG args=/bin/systemctl is-enabled chronyd.service 2019-08-18T10:00:08Z DEBUG Process finished, return code=1 2019-08-18T10:00:08Z DEBUG stdout=disabled 2019-08-18T10:00:08Z DEBUG stderr= 2019-08-18T10:00:08Z DEBUG Starting external process 2019-08-18T10:00:08Z DEBUG args=/bin/systemctl is-active chronyd.service 2019-08-18T10:00:08Z DEBUG Process finished, return code=3 2019-08-18T10:00:08Z DEBUG stdout=inactive 2019-08-18T10:00:08Z DEBUG stderr= 2019-08-18T10:00:08Z DEBUG [IPA Discovery] 2019-08-18T10:00:08Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=ipacli-irvlt01.shs.dc 2019-08-18T10:00:08Z DEBUG Start searching for LDAP SRV record in "shs.dc" (domain of the hostname) and its sub-domains 2019-08-18T10:00:08Z DEBUG Search DNS for SRV record of _ldap._tcp.shs.dc 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp02.shs.dc. 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp01.shs.dc. 2019-08-18T10:00:10Z DEBUG [Kerberos realm search] 2019-08-18T10:00:10Z DEBUG Search DNS for TXT record of _kerberos.shs.dc 2019-08-18T10:00:10Z DEBUG DNS record not found: NXDOMAIN 2019-08-18T10:00:10Z DEBUG Search DNS for SRV record of _kerberos._udp.shs.dc 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 88 dc-irvwp01.shs.dc. 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 88 dc-irvwp02.shs.dc. 2019-08-18T10:00:10Z DEBUG [LDAP server check] 2019-08-18T10:00:10Z DEBUG Verifying that dc-irvwp02.shs.dc (realm None) is an IPA server 2019-08-18T10:00:10Z DEBUG Init LDAP connection to: ldap://dc-irvwp02.shs.dc:389 2019-08-18T10:00:10Z DEBUG Search LDAP server for IPA base DN 2019-08-18T10:00:10Z DEBUG Check if naming context 'DC=SHS,DC=DC' is for IPA 2019-08-18T10:00:10Z DEBUG Unhandled LDAPError: OPERATIONS_ERROR: {'info': '000004DC: LdapErr: DSID-0C0907C2, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580', 'desc': 'Operations error'} 2019-08-18T10:00:10Z ERROR Error checking LDAP: Operations error: 000004DC: LdapErr: DSID-0C0907C2, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580 2019-08-18T10:00:10Z DEBUG Cannot connect to LDAP server. Check that minssf is not enabled 2019-08-18T10:00:10Z DEBUG Assuming realm is the same as domain: SHS.DC 2019-08-18T10:00:10Z DEBUG Generated basedn from realm: dc=shs,dc=dc 2019-08-18T10:00:10Z DEBUG Discovery result: NO_TLS_LDAP; server=None, domain=shs.dc, kdc=dc-irvwp01.shs.dc,dc-irvwp02.shs.dc, basedn=dc=shs,dc=dc 2019-08-18T10:00:10Z DEBUG Validated servers: dc-irvwp02.shs.dc 2019-08-18T10:00:10Z DEBUG will use discovered domain: shs.dc 2019-08-18T10:00:10Z DEBUG Start searching for LDAP SRV record in "shs.dc" (Validating DNS Discovery) and its sub-domains 2019-08-18T10:00:10Z DEBUG Search DNS for SRV record of _ldap._tcp.shs.dc 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp01.shs.dc. 2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp02.shs.dc. 2019-08-18T10:00:10Z DEBUG DNS validated, enabling discovery 2019-08-18T10:00:10Z DEBUG will use discovered server: dc-irvwp02.shs.dc 2019-08-18T10:00:10Z INFO Discovery was successful! 2019-08-18T10:00:10Z DEBUG will use discovered realm: SHS.DC 2019-08-18T10:00:10Z DEBUG will use discovered basedn: dc=shs,dc=dc 2019-08-18T10:00:10Z INFO Client hostname: ipacli-irvlt01.shs.dc 2019-08-18T10:00:10Z DEBUG Hostname source: Machine's FQDN 2019-08-18T10:00:10Z INFO Realm: SHS.DC 2019-08-18T10:00:10Z DEBUG Realm source: Assumed same as domain 2019-08-18T10:00:10Z INFO DNS Domain: shs.dc 2019-08-18T10:00:10Z DEBUG DNS Domain source: Discovered LDAP SRV records from shs.dc (domain of the hostname) 2019-08-18T10:00:10Z INFO IPA Server: dc-irvwp02.shs.dc 2019-08-18T10:00:10Z DEBUG IPA Server source: Discovered LDAP SRV records from shs.dc (domain of the hostname) 2019-08-18T10:00:10Z INFO BaseDN: dc=shs,dc=dc 2019-08-18T10:00:10Z DEBUG BaseDN source: Generated from Kerberos realm 2019-08-18T10:00:15Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute return_value = self.run() File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run return cfgr.run() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in run self.validate() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 371, in validate for _nothing in self._validator(): File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure next(validator) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner exc_handler(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception self._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception six.reraise(exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner step() File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda> step = lambda: next(self.__gen) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from six.reraise(*exc_info) File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from value = gen.send(prev_value) File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install for unused in self._installer(self.parent): File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3630, in main install_check(self) File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2312, in install_check raise ScriptError(rval=CLIENT_INSTALL_ERROR) 2019-08-18T10:00:15Z DEBUG The ipa-client-install command failed, exception: ScriptError: 2019-08-18T10:00:15Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

2 1

Re: Could not chdir to home directory: Permission denied
by Selman Keskin 17 Aug '19

17 Aug '19

Any idea? Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10

1 0

external DNS
by Elhamsadat Azarian 17 Aug '19

17 Aug '19

Hi i installed Ipa-server without internal DNS and i set it to user a windows DNS server in network. when install process finished it note that: "please add records in this file to your DNS system" now i dont know what i must do? i must add them into "windows DNS server" or in "Network part of ipa server GUI"? can u tell me what should i do with this file?

2 1

samba migrate userbase to IPA - is everything needed?
by lejeczek 17 Aug '19

17 Aug '19

hi guys while migrating userbase from Samba to IPA - my guess is that not the whole lot is needed since IPA's Samba is purely a workgroup - do we need all things Samba domain created and kept in ldap to migrate over? More specifically groups, such as: Domain Admins, Domain Users, etc.. - these must be redundant(for IPA to function), right? I'm trying to keep it to bare minimum, thus seeking a confirmation. ps. does regex work for/with --exclude-groups ? many thanks, L.

1 0

external DNS
by Elhamsadat Azarian 17 Aug '19

17 Aug '19

Hi i installed Ipa-server without internal DNS and i set it to user a windows DNS server in network. when install process finished it note that: "please add records in this file to your DNS system" now i dont know what i must do? i must add them into "windows DNS server" or in "Network part of ipa server GUI"? can u tell me what should i do with this file?

1 0

External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk 16 Aug '19

16 Aug '19

I have an FreeIPA domain (ipa.engr.tamu.edu) that has a one-way trust with an AD domain (engr.tamu.edu) I've created a POSIX group called 'linux_team' that contains an external group called 'linux_team_ext', which itself contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain). When I perform a 'getent group linux_team', I get no results. When looking at the debug logs, I see that SSSD does fetch all of the users from the group: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-william.luke(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-andrew.eggleston@engr .tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-blake.dworaczyk@engr. tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-david.miller(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid]. However, I ultimately see this line: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete group object for linux_team(a)engr.tamu.edu[0]! Skipping I've tested the trust relationship and it appears to work fine; I am able to create view overrides and fetch users from the domain without any problem. The complete logs are here: https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?usp=…

2 4

External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk 16 Aug '19

16 Aug '19

I have an IPA domain (ipa.engr.tamu.edu) that has a one-way trust with an AD domain (engr.tamu.edu) I've created a POSIX group called 'linux_team' that contains an external group called 'linux_team_ext', which itself contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain). When I run a 'getent group linux_team', I get nothing back at all. However, it seems that from the logs it does fetch all of the group members: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-william.luke(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-andrew.eggleston@engr .tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-blake.dworaczyk@engr. tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-david.miller(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid]. Ultimately I see this log entry: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete group object for linux_team(a)engr.tamu.edu[0]! Skipping I've tested the trust relationship and it seems to work fine. I've also added a user override to the 'Default Trust View' and I'm able to fetch the user without a problem. Everything except for group membership from the trusted AD domain seems to be working. Here are the complete logs: https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?usp=… -- ------------------------------ Blake Dworaczyk Linux Team Lead College of Engineering Texas A&M University

1 0

External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk 16 Aug '19

16 Aug '19

I have an IPA domain (ipa.engr.tamu.edu) that has a one-way trust with an AD domain (engr.tamu.edu) I've created a POSIX group called 'linux_team' that contains an external group called 'linux_team_ext', which itself contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain). When I run a 'getent group linux_team', I get nothing back at all. However, it seems that from the logs it does fetch all of the group members: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-william.luke(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-andrew.eggleston@engr .tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-blake.dworaczyk@engr. tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-david.miller(a)engr.tam u.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid]. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available. (Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid]. Ultimately I see this log entry: (Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete group object for linux_team(a)engr.tamu.edu[0]! Skipping I've tested the trust relationship and it seems to work fine. I've also added a user override to the 'Default Trust View' and I'm able to fetch the user without a problem. Everything except for group membership from the trusted AD domain seems to be working. Here are the complete logs: https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?usp=…

1 0

Create kerberos keytab
by Boyd Ako 16 Aug '19

16 Aug '19

So, I tried doing the test section in the V4 doc below. However, I get an error. https://www.freeipa.org/page/V4/Keytab_Retrieval ===================== [root@ipa home]# ipa-getkeytab -r -s ipa.neverland.ddns.me -p NFS/abyss.neverland.ddns.me -k abyss-nfs.keytab Failed to parse result: Insufficient access rights Failed to get keytab

3 7

[Announce] FreeIPA 4.8.1 released
by Alexander Bokovoy 14 Aug '19

14 Aug '19

Hello! The FreeIPA team would like to announce FreeIPA 4.8.1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora 30 will be available in the official Fedora repository soon. == Highlights in 4.8.1 == * 5608: [RFE] Add Dogtag configuration extensions It is now possible to tune Dogtag configuration when creating a CA by passing an overlay configuration file with --pki-config-override option. Not all options are supported yet and documentation is being worked on. -------- * Release tarball corrections FreeIPA 4.8.0 release tarball did lack two update files. This release adds them back. The files existed in git but weren't installed when building distribution packages. -------- * 8040: ipa migrade-ds regression FreeIPA 4.8.0 tightened access to LDAP connections to disallow passing plainttext credentials over an insecure connection. This broke 'ipa migrate-ds' functionality where in order to migrate to FreeIPA one often needs to connect to a legacy LDAP server which might not be using TLS certificates. FreeIPA 4.8.1 restores ability to use insecure LDAP connections in 'ipa migrate-ds' for migration purposes only. === Enhancements === * 7932 and 7933: index certmap attributes and allow altSecurityIdentities in schema For certificate mapping operations it is possible to specify altSecurityIdentities in the certification mapping filters. The filter is applied by SSSD at both FreeIPA and Active Directory LDAP servers. While nothing is using altSecurityIdentities in FreeIPA now, the schema allows to optimize queries better at LDAP server side. Additionally, other certificate mapping attributes are now indexed to allow faster operations for environments with a large set of mapping rules. -------- * 7991: Profile-based renewal of system certificates FreeIPA-specific certificates tracked by certmonger can now be renewed with preservation of a certificate profile used to issue them. It is also possible to change the certificate profile during update. This is required to allow updating certain profile-specific attributes of the system certificates in future. -------- === Known Issues === === Bug fixes === FreeIPA 4.8.1 is a stabilization release for the features delivered as a part of FreeIPA 4.8 series. There are more than 30 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets == * 5608 [RFE] Add Dogtag configuration extensions * 7305 PKINIT status not displayed in the web UI (IPA Server > Configuration) * 7329 update_ra_cert_store does not remove private key from NSSDB * 7548 Need integration test for --external-ca-type=ms-cs * 7597 IPA: IDM drops all custom attributes when moving account from preserved to stage * 7677 HSM: ipa ca-add fails with error in ipa-pki-retrieve-key * 7810 [F28] Require NSS with fix for p11-kit issue. * 7902 389-ds-base-1.4.0.22-1 breaks TestAutomemberFindOrphans.test_find_orphan_automember_rules * 7908 Write tests for interactive prompt for NTP options. * 7929 ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled * 7932 FreeIPA queries rely on missing attribute altsecurityidentities * 7933 FreeIPA must index certmap attributes. * 7949 test_integration/test_nfs.py fails at cleanup * 7991 Use profile-based renewal for system certificates * 7996 `test_selinuxusermap_plugin` fails against not default SELinux settings * 8004 RHEL 8 uses nis-domainname instead of rhel-domainname * 8005 User field separator uses '$$' within ipaSELinuxUserMapOrder * 8007 Not stable nodeids within pytest * 8008 Azure Pipeline slicing * 8009 Missing execution bit on `ipa-run-tests` within virtualenv * 8012 test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view failure * 8013 ipa service-find does not list cifs service created by ipa-client-samba * 8015 p11helper: insufficient logging when loading LIBSOFTHSM2_SO * 8019 repeated uninstallation of ipa-client-samba crashes * 8021 ipa-client-samba can not install samba after uninstallation * 8022 azure pipeline: fail if dnf builddep exits on failure * 8024 [WebUI] test_webui/test_trust.py failed because of request timeout * 8026 Update pr-ci definitions with master_3client topology * 8027 test_nfs.py: migrate to master_3client * 8029 ipa host-find --pkey-only includes SSH keys in output * 8030 azure pipelines fail at "Install prerequisites" of Tox job * 8040 ipa migrate-ds fails with internal error. == Detailed changelog since 4.8.0 == === Armando Neto (1) === * travis: update container used for testing ipa-4-8 branch === Alexander Bokovoy (14) === * Update translation and code contributors for FreeIPA 4.8.1 * Switch ipa-4-8 branch to track Zanata ipa-4-8 branch * Update translations for FreeIPA 4.8 branch * Add Theodor van Nahl to the Contributors.txt * Update translations for FreeIPA 4.8.1 * Restore SELinux context for p11-kit config overrides * Change RA agent certificate profile to caSubsystemCert * certmaprule: add negative test for altSecurityIdentities * certmap rules: altSecurityIdentities should only be used for trusted domains * Create indexes for altSecurityIdentities and ipaCertmapData attributes * Add altSecurityIdentities attribute from MS-WSPP schema definition * Use stage and phase attempt counters when saving test artifacts * Use any nodejs version instead of forcing a version before nodejs 11 * Fix rpmlint errors for Rawhide === Christian Heimes (6) === * Allow insecure binds for migration * Don't move keys when key backup is disabled * Update comments to explain caSubsystemCert switch * Test external CA with DNS name constraints * Add PKCS#11 module name to p11helper errors * Use nis-domainname.service on all RH platforms === François Cami (11) === * azure-pipelines.yml: switch to Python 3.7 * test_nfs.py: switch to master_3repl * ipatests: rename config_replica_resolvconf_with_master_data() * test_nfs.py: switch to tasks.config_replica_resolvconf_with_master_data() * prci_definitions: add master_3client topology * ipapython/admintool.py: use SERVER_NOT_CONFIGURED * ipa-client-samba: remove state on uninstall * ipatests: test ipa-client-samba after --uninstall * ipa-client-samba: remove and restore smb.conf only on first uninstall * ipatests: test multiple invocations of ipa-client-samba --uninstall * ipatests/azure: display actual dnf repo URLs === Florence Blanc-Renaud (6) === * Nightly test definition: add missing tests * xmlrpc test: add test for preserved > stage user * user-stage: transfer all attributes from preserved to stage user * test_xmlrpc: fix TestAutomemberFindOrphans.test_find_orphan_automember_rules * Azure pipeline: report failure in prepare-build step * upgrade: remove ipaCert and key from /etc/httpd/alias === Fraser Tweedale (20) === * Add more tests for --external-ca-profile handling * dsinstance: add proflie when tracking certificate * ipatests: test ipa-server-upgrade in CA-less deployment * Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constants * cainstance: add profile to IPA RA tracking request * upgrade: fix spurious certmonger re-tracking * upgrade: log missing/misconfigured tracking requests * upgrade: update KRA tracking requests * upgrade: always add profile to tracking requests * dogtaginstance: avoid special cases for Server-Cert * dogtag-ipa-ca-renew-agent: always use profile-based renewal * certmonger: use long options when invoking dogtag-ipa-renew-agent * upgrade: add profile to Dogtag tracking requests * dogtaginstance: add profile to tracking requests * ci: add --external-ca-profile tests to gating * ci: add --external-ca-profile tests to nightly * Collapse --external-ca-profile tests into single class * Fix use of incorrect variable * install: fix --external-ca-profile option * move MSCSTemplate classes to ipalib === Christian Hermann (1) === * configure.ac: don't rely on bashisms === Rob Crittenden (3) === * Don't return SSH keys with ipa host-find --pkey-only * httpinstance: add pinfile when tracking certificate * Remove posixAccount from service_find search filter === Stanislav Levin (4) === * Avoid use of '/tmp' for pip operations * Make use of Azure Pipeline slicing * Simplify ipa-run-tests script * Fix `test_webui.test_selinuxusermap` === Sergey Orlov (3) === * ipatests: new test for trust with partially unreachable AD topology * ipatests: mark test_domain_resolution_order as expectedly failing * ipatests: add test for sudo with runAsUser and domain resolution order. === Sumedh Sidhaye (2) === * Test: Test to check whether ssh from ipa client to ipa master is successful after adding ldap_deref_threshold=0 in sssd.conf * Test: To check ipa replica-manage del <FQDN> does not fail === Serhii Tsymbaliuk (3) === * WebUI tests: Fix request timeout for test_trust * WebUI: Add PKINIT status field to 'Configuration' page * WebUI tests: Fix timeout issues for reset password tests === Tibor Dudlák (4) === * Increase ntp_options test timeout * ipatests: refactor TestNTPoptions * ipatests: Add tests for interactive chronyd config * ipatests: Update test tasks for client to be interactive === Timo Aaltonen (1) === * install: Add missing scripts to app_DATA. === Theodor van Nahl (1) === * Fix UnboundLocalError in ipa-replica-manage on errors -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users August 2019