December 2017 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#1352][opened] [Backport][ipa-4-6] test_batch_plugin: fix py2/3 failing assertion
by tiran 07 Dec '17

07 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1352 Author: tiran Title: #1352: [Backport][ipa-4-6] test_batch_plugin: fix py2/3 failing assertion Action: opened PR body: """ This PR was opened automatically because PR #1345 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1352/head:pr1352 git checkout pr1352

1 1

[freeipa PR#379][closed] Packaging: Add IPA commands package
by tiran 07 Dec '17

07 Dec '17

URL: https://github.com/freeipa/freeipa/pull/379 Author: tiran Title: #379: Packaging: Add IPA commands package Action: closed To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/379/head:pr379 git checkout pr379

1 0

[freeipa PR#1362][opened] Travis CI failures: Revert PR#1047
by tomaskrizek 07 Dec '17

07 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1362 Author: tomaskrizek Title: #1362: Travis CI failures: Revert PR#1047 Action: opened PR body: """ PR#1047 was recently merged, but it was tested 2 months ago. The Travis CI passed, because it used older docker image. Once this was merged, it started to cause failures with the new image. It is causing failures in Travis CI in our master branch. This is an attempt to hotfix the issue. If merged, we should reopen #1047 and test it properly (rebase, fix issues etc.). """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1362/head:pr1362 git checkout pr1362

1 1

[freeipa PR#1356][opened] Update to python-ldap 3.0.0
by tiran 06 Dec '17

06 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1356 Author: tiran Title: #1356: Update to python-ldap 3.0.0 Action: opened PR body: """ Also replace python3-pyldap with python3-ldap. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1356/head:pr1356 git checkout pr1356

1 1

FreeIPA Planet - migrating to OCP
by Martin Kosek 06 Dec '17

06 Dec '17

Hello all, I have finished preparations for moving our FreeIPA Planet from the OpenShift v2 platform (EOL Dec 31st [1]) into the new OpenShift v3 container environment. Just like with our wiki, the FreeIPA Planet app source code is hosted openly in FreeIPA GitHub organization [2], including a standard issue tracker or Pull Requests ability. The proposed version of the new Planet is running in [3]. The FreeIPA Planet container in OpenShift v3 is set to rebuild automatically when [2] is updated, to make Planet Configuration easier even for people not having access to our OpenShift console or to merged Pull Requests. The Planet container is also set to rebuild every day, to catch new blog posts. If there are any major concerns about this migration, let me know. If not, I will just get DNS "planet.freeipa.org" updated in next days. [1] https://blog.openshift.com/migrate-to-v3-v2-eol/ [2] https://github.com/freeipa/freeipa-planet [3] http://freeipa-org-planet-freeipa.b9ad.pro-us-east-1.openshiftapps.com/ -- Martin Kosek <mkosek(a)redhat.com> Manager, Software Engineering - Identity Management Team Red Hat, Inc.

2 2

Re: [Freeipa-users] ipa-client-install (3.0.2 on Wheezy) fails after root certificate change via ipa-cacert-manage
by Harald Dunkel 06 Dec '17

06 Dec '17

repost on freeipa-devel: Hi folks, its always worth reading the code. ipa-client-install of freeipa 3.0.2 uses wget http://ipa1.example.de/ipa/config/ca.crt to grab the CA certificate. It seems that ipa-cacert-manage (CentOS 7.3) did not upgrade /usr/share/ipa/html/ca.crt on the servers when I migrated to the new root CA. Would anybody mind to fix? Thanx very much Harri On 11/16/17 9:28 AM, Harald Dunkel via FreeIPA-users wrote: > Hi folks, > > a few months ago I had replaced the externally signed root > certificate on my servers (CentOS 7.3) using ipa-cacert-manage. > Problem: > > ipa-client-install on a freshly bootstrapped Debian 7 (Wheezy, > freeipa 3.0.2) fails. Apparently it stumbles over the old root > certificate: > > # ipa-client-install --domain=example.de --realm=EXAMPLE.DE --no-ssh --no-sshd --no-ntp > Discovery was successful! > Hostname: pobde7i001.vs.example.de > Realm: EXAMPLE.DE > DNS Domain: example.de > IPA Server: ipa1.example.de > BaseDN: dc=example,dc=de > > Continue to configure the system with these values? [no]: yes > User authorized to enroll computers: admin > Synchronizing time with KDC... > Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened. > Password for admin(a)EXAMPLE.DE: > Enrolled in IPA realm EXAMPLE.DE > Created /etc/ipa/default.conf > Domain example.de is already configured in existing SSSD config, creating a new one. > The old /etc/sssd/sssd.conf is backed up and will be restored during uninstall. > Configured /etc/sssd/sssd.conf > Configured /etc/krb5.conf for IPA realm EXAMPLE.DE > trying https://ipa1.example.de/ipa/xml > cert validation failed for "CN=ipa1.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) > trying https://ipa2.example.de/ipa/xml > cert validation failed for "CN=ipa2.example.de,O=example AG,C=DE" ((SEC_ERROR_UNTRUSTED_ISSUER) Peer's certificate issuer has been marked as not trusted by the user.) > Cannot connect to the server due to generic error: cannot connect to Gettext('any of the configured servers', domain='ipa', localedir=None): https://ipa1.example.de/ipa/xml, https://ipa2.example.de/ipa/xml > Installation failed. Rolling back changes. > > > /etc/ipa/ca.crt on the client shows it somehow picked up the old > certificate. On the servers /etc/ipa/ca.crt is the new root cert. > "getcert list" on the servers shows only certificates based upon > the new root ca, too. I wonder where ipa-client-install picked up > the unwanted certificate? > > Of course I tried putting the new ca.crt into place before running > ipa-client-install, but it was overwritten. > > Of course there is no such problem for ipa 4.4.4 on Stretch. > > > Every heplful hint is highly appreciated > Harri > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org >

2 4

[CI] Failing Travis jobs
by Tomas Krizek 06 Dec '17

06 Dec '17

Hi, I've noticed Travis CI started to fail on our master branch. I've identified the following issues: - tox tests 'test_rpcclient_context' fail with "AttributeError: 'API' object has no attribute 'Backend'" These were added by a recently pushed PR#1047 [1]. The tests passed for the PR, but they were executed 2 months! ago [2]. In the mean time, the docker image used by Travis was updated to F27, and it was therefore never tested with this version. I guess that's the reason we're seeing these failures. - python2 jobs are failing I haven't tracked down this issue, but I have a feeling it might be related to the PR above as well. There are BytesWarnings in the httpd log. I propose we revert PR#1047 if it is indeed causing the failures. I've opened a revert PR [3] to trigger tests. [1] - https://github.com/freeipa/freeipa/pull/1047 [2] - https://travis-ci.org/freeipa/freeipa/builds/283291175?utm_source=github_st… [3] - https://github.com/freeipa/freeipa/pull/1362 -- Tomas Krizek PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869

1 0

[freeipa PR#1338][opened] [Backport][ipa-4-6] tests: Mark failing tests as failing
by Tiboris 06 Dec '17

06 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1338 Author: Tiboris Title: #1338: [Backport][ipa-4-6] tests: Mark failing tests as failing Action: opened PR body: """ This PR was opened automatically because PR #1120 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1338/head:pr1338 git checkout pr1338

1 1

[freeipa PR#1047][opened] Use the user-provided CA chain file in connections & check for file existence
by rcritten 04 Dec '17

04 Dec '17

URL: https://github.com/freeipa/freeipa/pull/1047 Author: rcritten Title: #1047: Use the user-provided CA chain file in connections & check for file existence Action: opened PR body: """ The user now may provide their own CA chain to the make API commands but it isn't honored. The value is also not checked for existence throwing a generic "no such file" error rather than "file <foo> doesn't exist" """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1047/head:pr1047 git checkout pr1047

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel December 2017