March 2019 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2106][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by abbra 23 Mar '20

23 Mar '20

URL: https://github.com/freeipa/freeipa/pull/2106 Author: abbra Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2106/head:pr2106 git checkout pr2106

2 1

[freeipa PR#2812][opened] Require secure-binds for password login
by tiran 26 Nov '19

26 Nov '19

URL: https://github.com/freeipa/freeipa/pull/2812 Author: tiran Title: #2812: Require secure-binds for password login Action: opened PR body: """ nsslapd-require-secure-binds restricts password based simple binds to secure connections. It does not prevent a careless user from transmitting a password in plain text. But it makes it obvious that he did something bad. Password based bind attempts over an insecure connections are refused with: Confidentiality required: Operation requires a secure connection Secure connections are: * LDAP connections on port 389 with STARTTLS * LDAPS connections in port 636 * LDAPI connections to a local Unix sockets Anonymous bind (simple_bind with empty DN and password) and GSSAPI bind operations are not affected. nsslapd-require-secure-binds is enabled after 389-DS is configured for TLS/SSL. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> **NOTE** The change may cause compatibility issues with applications that don't perform secure binds. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2812/head:pr2812 git checkout pr2812

1 1

[freeipa PR#2331][opened] Installation of replica against a specific server
by mrizwan93 07 Oct '19

07 Oct '19

URL: https://github.com/freeipa/freeipa/pull/2331 Author: mrizwan93 Title: #2331: Installation of replica against a specific server Action: opened PR body: """ Test to check replica install against specific server. It uses master and replica1 without CA and having custodia service stopped. Then try to install replica2 from replica1 so that replica2 will fetch secrets from master as custodia service is not running on replica1. related ticket: https://pagure.io/freeipa/issue/7566 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2331/head:pr2331 git checkout pr2331

2 1

[freeipa PR#2766][opened] Fix ipatests test_ntp_options to configure the firewall where needed
by t-woerner 05 Sep '19

05 Sep '19

URL: https://github.com/freeipa/freeipa/pull/2766 Author: t-woerner Title: #2766: Fix ipatests test_ntp_options to configure the firewall where needed Action: opened PR body: """ The firewall has not been configured before replicas and after masters have been installed using the command line tools and not the available methods from tasks. This resulted in failed tests as for example in test_replica_promotion_without_ntp. Configuration of the firewall has been added to the methods install_replica, test_replica_promotion_with_ntp_options and test_replica_promotion_without_ntp. In the case of testing command line options that may not be used together for replica installation, a comment has been added that it is theoretical no need to configure the firewall in this case, because the installation will not succeed. But it has been added to make sure that the test will not fail because of the missing firewall configuration if the options will not conflict. This is the method test_replica_promotion_with_ntp_options. In the case where conflicting command line options are tested for the server installation a comment has been added that it is not needed to configure the firewall as it is configured after successful server installation normally. This is the method test_server_client_install_mixed_options. tasks.uninstall_master is used to cleanup replica installations and test remains, therefore the firewall configuration is reverted afterwards again. See: https://pagure.io/freeipa/issue/7719 Signed-off-by: Thomas Woerner <twoerner(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2766/head:pr2766 git checkout pr2766

2 1

[freeipa PR#2065][opened] BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning
by menonsudhir 21 Aug '19

21 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2065 Author: menonsudhir Title: #2065: BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2065/head:pr2065 git checkout pr2065

1 1

[freeipa PR#2147][opened] Add a skeleton kdcpolicy plugin
by frozencemetery 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2147 Author: frozencemetery Title: #2147: Add a skeleton kdcpolicy plugin Action: opened PR body: """ Signed-off-by: Robbie Harwood <rharwood(a)redhat.com> Back in krb5-1.16 (and in RHEL-7.5), I added the [kdcpolicy plugin](http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/kdcpolicy.html) to krb5. This interface allows a module to hook all AS and TGS requests, potentially reject them, and manipulate ticket lifetimes. This PR is a basic implementation of the interface, with all the plumbing IPA needs to get it loaded and installed. There are two use cases I had in mind, though of course many more are possible (this is a very powerful place to have a hook into the KDC): - Reduced ticket lifetimes based on [auth indicator](http://web.mit.edu/kerberos/krb5-devel/doc/admin/auth_indicator.… - Adding (well, subtracting) random jitter from certain principal lifetimes to reduce contention from groups of tickets all needing renewal simultaneously Since presumably we don't want any of that to be hardcoded behavior, the difficult part is now making it all configurable. (As well as figuring out any behavior we want to control at the moment). Per IRC conversation, I'm opening this PR so that we have something to look at while we discuss that. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2147/head:pr2147 git checkout pr2147

1 1

[freeipa PR#2307][opened] Use pki config file template
by tiran 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2307 Author: tiran Title: #2307: Use pki config file template Action: opened PR body: """ WIP For HSM support and more flexible options. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2307/head:pr2307 git checkout pr2307

1 1

[freeipa PR#2852][opened] Add more tests for --external-ca-profile handling
by frasertweedale 17 Jul '19

17 Jul '19

URL: https://github.com/freeipa/freeipa/pull/2852 Author: frasertweedale Title: #2852: Add more tests for --external-ca-profile handling Action: opened PR body: """ Add tests for remaining untested scenarios of --external-ca-profile handling in ipa-server-install. ipa-ca-install and ipa-cacert-manage remain untested at present. Fixes: https://pagure.io/freeipa/issue/7548 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2852/head:pr2852 git checkout pr2852

2 1

[freeipa PR#1441][opened] Removing ipaCert Private key & certificate after ipa upgrade
by amitkumar50 08 Jul '19

08 Jul '19

URL: https://github.com/freeipa/freeipa/pull/1441 Author: amitkumar50 Title: #1441: Removing ipaCert Private key & certificate after ipa upgrade Action: opened PR body: """ `# yum install ipa-server -y {IPA 4.4}` `# ipa-server-install` `#yum update ipa-* -y` `# ls -ltr /etc/httpd/alias` Presently "-D" option only removes Cert. **`certutil ... -D -n ipaCert`** Using '-F' option to remove Private key and cert both **`certutil ... -F -n ipaCert`** Resolves: https://pagure.io/freeipa/issue/7329 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/1441/head:pr1441 git checkout pr1441

2 1

[freeipa PR#919][opened] client.py: Using Augeas to configure krb5.conf
by Tiboris 02 Jul '19

02 Jul '19

URL: https://github.com/freeipa/freeipa/pull/919 Author: Tiboris Title: #919: client.py: Using Augeas to configure krb5.conf Action: opened PR body: """ Using Augeas should avoid issues like https://pagure.io/freeipa/issue/5912. Resolves: https://pagure.io/freeipa/issue/5913 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/919/head:pr919 git checkout pr919

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel March 2019