November 2017 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#1339][opened] Bump 389-ds-base to 1.3.7.8-1
by stlaz 07 Feb '18

07 Feb '18

URL: https://github.com/freeipa/freeipa/pull/1339 Author: stlaz Title: #1339: Bump 389-ds-base to 1.3.7.8-1 Action: opened PR body: """ Bump 389-ds-version due to problems with replication and connections not being closed. https://pagure.io/freeipa/issue/7165 https://pagure.io/freeipa/issue/7228 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1339/head:pr1339 git checkout pr1339

2 1

[freeipa PR#837][opened] ca-add: fix permission issue
by frasertweedale 05 Feb '18

05 Feb '18

URL: https://github.com/freeipa/freeipa/pull/837 Author: frasertweedale Title: #837: ca-add: fix permission issue Action: opened PR body: """ The ca-add command pre_callback uses ldap.can_add() to check whether the user has permission to add CAs. Alas, the GetEffectiveRights control used by ldap.can_add() doesn't correctly interpret ACIs with 'targetfilter' constraints, and returns a false-negative for non-admin users, even when they have the 'System: Add CA' permission. To work around this, add the CA object to FreeIPA before attempting to create the CA in Dogtag. If the CA creation in Dogtag succeds, the user then updates the FreeIPA object with the Authority ID and other authoritative data returned by Dogtag. If the CA creation in Dogtag fails, the user cleans up by deleting the newly-created CA object from FreeIPA. This modified procedure ensures that the user certainly has the 'System: Add CA' permission before the CA creation in Dogtag is attempted. But it also means that the user must have 'write' and 'delete' permission on 'ipaca' objects in FreeIPA, so that it can complete the object after CA creation in Dogtag, or clean up if that step fails. Therefore, update the 'System: Add CA' permission to confer 'write' and 'delete' access on 'ipaca' objects, as well as 'add' access. Fixes: https://pagure.io/freeipa/issue/6609 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/837/head:pr837 git checkout pr837

2 7

[freeipa PR#1326][opened] [WIP] Fixing translation problems
by slaykovsky 24 Jan '18

24 Jan '18

URL: https://github.com/freeipa/freeipa/pull/1326 Author: slaykovsky Title: #1326: [WIP] Fixing translation problems Action: opened PR body: """ Hello guys! So I'm having some progress with this weird translation related bug and I already achieved the following behaviour: ``` # LANG=de_DE.UTF-8 ipa user-find admin -------------- 1 user matched -------------- Anmeldename: admin Nachname: Administrator Home-Verzeichnis: /home/admin Anmeldeshell: /bin/bash Principal alias: admin(a)DOM-023.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM UID: 1026200000 Gruppen-ID: 1026200000 Konto ist deaktiviert: False ------------------------------------- Anzahl der zurückgegebenen Einträge 1 ------------------------------------- # LANG=zh_CN.UTF-8 ipa user-find admin -------------- 1 user matched -------------- 用户登录名: admin 姓: Administrator 主目录: /home/admin 登录shell: /bin/bash 主体别名: admin(a)DOM-023.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM UID: 1026200000 GID: 1026200000 禁用账户: False -------- 返回的条目数 1 -------- # LANG=en_US.UTF-8 ipa user-find admin -------------- 1 user matched -------------- User login: admin Last name: Administrator Home directory: /home/admin Login shell: /bin/bash Principal alias: admin(a)DOM-023.ABC.IDM.LAB.ENG.BRQ.REDHAT.COM UID: 1026200000 GID: 1026200000 Account disabled: False ---------------------------- Number of entries returned 1 ---------------------------- ``` As you can see now I don't need as a user to clean `~/.cache/ipa` to get the information in my native locale. But, there is this summary (in this case it's `1 user matched`) which is getting generated on the server and I'm kind of struggling with it now as I removed this `LANG` changing piece of code from rpcserver. Any help, review and comment are needed and very appreciated. :) pagure: https://pagure.io/freeipa/issue/7238 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1326/head:pr1326 git checkout pr1326

1 1

[freeipa PR#1282][opened] Log contents of config files when updating/writing them
by rcritten 04 Jan '18

04 Jan '18

URL: https://github.com/freeipa/freeipa/pull/1282 Author: rcritten Title: #1282: Log contents of config files when updating/writing them Action: opened PR body: """ This was originally going to be a PR to log the contents of default.conf for debugging purposes, mostly for replicas where in DL1 it gets written several times. Given that other config files like nsswitch.conf also use the same functions we get even more output as an extra benefit. The file sizes are currently not that big so it doesn't bloat the logs too much IMHO. One patch adds the logging and the other patch changes the server installer to use the configuration writing too rather than manually creating the file. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1282/head:pr1282 git checkout pr1282

2 1

[freeipa PR#1135][opened] [Backport][ipa-4-6] tests_py3: decode get_file_contents() result
by stlaz 24 Dec '17

24 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1135 Author: stlaz Title: #1135: [Backport][ipa-4-6] tests_py3: decode get_file_contents() result Action: opened PR body: """ This PR was opened automatically because PR #1118 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1135/head:pr1135 git checkout pr1135

1 1

[freeipa PR#1116][opened] Enable ephemeral KRA requests
by rcritten 14 Dec '17

14 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1116 Author: rcritten Title: #1116: Enable ephemeral KRA requests Action: opened PR body: """ Enabling ephemeral KRA requests will reduce the amount of LDAP write operations and improve overall performance. https://pagure.io/freeipa/issue/6703 NOTE: I'm not 100% sure on the upgrade for existing instances. My logic is that tomcat is always stopped and then within that block the CA (if any) will be updated. Given that the KRA runs in the same service that is why I stuck that update code there. It worked in my testing. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1116/head:pr1116 git checkout pr1116

2 1

[freeipa PR#1332][opened] Enable WebUI unit tests
by pvomacka 14 Dec '17

14 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1332 Author: pvomacka Title: #1332: Enable WebUI unit tests Action: opened PR body: """ - Update QUnit to the newest version - Fix tests according to new version of QUnit - remove one tests which is old and does not correspond with our code any more - Create new dependencies in package.json - grunt, grunt-contrib-qunit - those packages allows us to run WebUI unit tests from command line in PhantomJS - Create Gruntfile which specifies Grunt tasks - Updated README about how to run WebUI unit tests - Edit TravisCI config files to run WebUI unit tests - Update JSLint files """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1332/head:pr1332 git checkout pr1332

2 1

[freeipa PR#1327][opened] ensuring 389-ds plugins are enabled after install
by akokshar 14 Dec '17

14 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1327 Author: akokshar Title: #1327: ensuring 389-ds plugins are enabled after install Action: opened PR body: """ To avoid problems caused by desabled plugins on 389-ds side explicitly enable plugins required by IPA https://pagure.io/freeipa/issue/7271 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1327/head:pr1327 git checkout pr1327

2 1

[freeipa PR#1011][opened] py3: dnssec
by tomaskrizek 12 Dec '17

12 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1011 Author: tomaskrizek Title: #1011: py3: dnssec Action: opened PR body: """ This PR is a partial fix that should allow DNSSEC installation for master. Keys will not be distributed to replicas. With my limited DNSSEC/IPA knowledge, I wasn't able to verify the data stored in LDAP are actually correct. In case they are not, this would prevent installation of DNSSEC replicas in the future. Our DNSSEC tests are not passing, thus we can't use them to verify this PR. Given these circumstances, I propose to officially discourage DNSSEC installation in 4.6.0. This PR supersedes #898. For review, it is highly recommended to rebase on #999. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1011/head:pr1011 git checkout pr1011

3 3

[freeipa PR#1343][opened] Don't use admin cert during KRA installation
by frasertweedale 12 Dec '17

12 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1343 Author: frasertweedale Title: #1343: Don't use admin cert during KRA installation Action: opened PR body: """ KRA installation currently imports the admin cert. FreeIPA does not track this cert and it may be expired, causing installation to fail. Do not import the existing admin cert, and discard the new admin cert that gets created during KRA installation. Part of: https://pagure.io/freeipa/issue/7287 ----- How to test: **NOTE** this also requires fix https://github.com/freeipa/freeipa/pull/1334 1. Install ipa master 2. get expiration date from /root/ca-agent.p12: ``` openssl pkcs12 -in ca-agent.p12 -out ca-agent.pem -nodes cat ca-agent.pem | openssl x509 -noout -enddate ``` 3. Move date forward to 20 days before ca-agent.p12 expires 4. Wait for certs to be renewed (watch with ``getcert list``). You could ``systemctl restart certmonger`` to hurry it along a bit. 5. After resetting the system time and certificates have been renewed, execute ``pki-server subsystem-cert-update ca sslserver``. You will need give it the ``internal`` password from ``/etc/pki/pki-tomcat/password.conf``. This is needed because of a missing parameter in Dogtag CA's ``CS.cfg``. It will be dealt with as a separate issue (possibly to fix in Dogtag itself). 6. Move system time to AFTER ca-agent.p12 `notAfter` date. 7. ``ipactl restart`` 8. ``ipa-kra-install`` """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1343/head:pr1343 git checkout pr1343

2 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel November 2017