September 2018 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2106][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by abbra 23 Mar '20

23 Mar '20

URL: https://github.com/freeipa/freeipa/pull/2106 Author: abbra Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2106/head:pr2106 git checkout pr2106

2 1

[freeipa PR#2331][opened] Installation of replica against a specific server
by mrizwan93 07 Oct '19

07 Oct '19

URL: https://github.com/freeipa/freeipa/pull/2331 Author: mrizwan93 Title: #2331: Installation of replica against a specific server Action: opened PR body: """ Test to check replica install against specific server. It uses master and replica1 without CA and having custodia service stopped. Then try to install replica2 from replica1 so that replica2 will fetch secrets from master as custodia service is not running on replica1. related ticket: https://pagure.io/freeipa/issue/7566 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2331/head:pr2331 git checkout pr2331

2 1

[freeipa PR#2065][opened] BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning
by menonsudhir 21 Aug '19

21 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2065 Author: menonsudhir Title: #2065: BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2065/head:pr2065 git checkout pr2065

1 1

[freeipa PR#2147][opened] Add a skeleton kdcpolicy plugin
by frozencemetery 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2147 Author: frozencemetery Title: #2147: Add a skeleton kdcpolicy plugin Action: opened PR body: """ Signed-off-by: Robbie Harwood <rharwood(a)redhat.com> Back in krb5-1.16 (and in RHEL-7.5), I added the [kdcpolicy plugin](http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/kdcpolicy.html) to krb5. This interface allows a module to hook all AS and TGS requests, potentially reject them, and manipulate ticket lifetimes. This PR is a basic implementation of the interface, with all the plumbing IPA needs to get it loaded and installed. There are two use cases I had in mind, though of course many more are possible (this is a very powerful place to have a hook into the KDC): - Reduced ticket lifetimes based on [auth indicator](http://web.mit.edu/kerberos/krb5-devel/doc/admin/auth_indicator.… - Adding (well, subtracting) random jitter from certain principal lifetimes to reduce contention from groups of tickets all needing renewal simultaneously Since presumably we don't want any of that to be hardcoded behavior, the difficult part is now making it all configurable. (As well as figuring out any behavior we want to control at the moment). Per IRC conversation, I'm opening this PR so that we have something to look at while we discuss that. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2147/head:pr2147 git checkout pr2147

1 1

[freeipa PR#2307][opened] Use pki config file template
by tiran 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2307 Author: tiran Title: #2307: Use pki config file template Action: opened PR body: """ WIP For HSM support and more flexible options. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2307/head:pr2307 git checkout pr2307

1 1

[freeipa PR#1441][opened] Removing ipaCert Private key & certificate after ipa upgrade
by amitkumar50 08 Jul '19

08 Jul '19

URL: https://github.com/freeipa/freeipa/pull/1441 Author: amitkumar50 Title: #1441: Removing ipaCert Private key & certificate after ipa upgrade Action: opened PR body: """ `# yum install ipa-server -y {IPA 4.4}` `# ipa-server-install` `#yum update ipa-* -y` `# ls -ltr /etc/httpd/alias` Presently "-D" option only removes Cert. **`certutil ... -D -n ipaCert`** Using '-F' option to remove Private key and cert both **`certutil ... -F -n ipaCert`** Resolves: https://pagure.io/freeipa/issue/7329 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1441/head:pr1441 git checkout pr1441

2 1

[freeipa PR#919][opened] client.py: Using Augeas to configure krb5.conf
by Tiboris 02 Jul '19

02 Jul '19

URL: https://github.com/freeipa/freeipa/pull/919 Author: Tiboris Title: #919: client.py: Using Augeas to configure krb5.conf Action: opened PR body: """ Using Augeas should avoid issues like https://pagure.io/freeipa/issue/5912. Resolves: https://pagure.io/freeipa/issue/5913 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/919/head:pr919 git checkout pr919

1 1

[freeipa PR#2291][opened] Update CA signing certificate default key size to 4096
by abbra 26 Apr '19

26 Apr '19

URL: https://github.com/freeipa/freeipa/pull/2291 Author: abbra Title: #2291: Update CA signing certificate default key size to 4096 Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2291/head:pr2291 git checkout pr2291

1 1

[freeipa PR#1726][opened] [RFE] IPA server installation with successful message
by amitkumar50 29 Mar '19

29 Mar '19

URL: https://github.com/freeipa/freeipa/pull/1726 Author: amitkumar50 Title: #1726: [RFE] IPA server installation with successful message Action: opened PR body: """ This PR updates IPA success installation message as this: ============================================= IPA server installation successful You can access Web UI using https://ipaserver1.testrelm.test/ipa/ui Obtain a Kerberos Ticket for issuing IPA command 'kinit admin' Server is installed with following roles : * Directory Server * Kerbeors Server * Httpd Server * CA Server * DNS Server For troubleshooting and errors : Please visit : https://www.redhat.com/en For documentation : Please visit : https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/ht… Resolves: https://pagure.io/freeipa/issue/6355 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1726/head:pr1726 git checkout pr1726

2 1

[freeipa PR#2163][opened] Make ipaclient.csrgen optional
by tiran 27 Mar '19

27 Mar '19

URL: https://github.com/freeipa/freeipa/pull/2163 Author: tiran Title: #2163: Make ipaclient.csrgen optional Action: opened PR body: """ ipaclient's csrgen plugin has been turned into an optional dependency. The ipaclient plugin, helper modules like ipaclient.csrgen and templates are shipped conditionally. The ipaclient cert plugin and ipatests handle missing csrgen gracefully. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2163/head:pr2163 git checkout pr2163

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel September 2018