May 2019 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2106][opened] ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
by abbra 23 Mar '20

23 Mar '20

URL: https://github.com/freeipa/freeipa/pull/2106 Author: abbra Title: #2106: ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager Action: opened PR body: """ Password changes performed by cn=Directory Manager are excluded from password policy checks according to [1]. This is correctly handled by ipa-pwd-extop in case of a normal Kerberos principal in IPA. However, non-kerberos accounts were not excluded from the check. As result, password updates for PKI CA admin account in o=ipaca were failing if a password policy does not allow a password reuse. We are re-setting the password for PKI CA admin in ipa-replica-prepare in case the original directory manager's password was updated since creation of `cacert.p12`. Do password policy check for non-Kerberos accounts only if it was set by a regular user or admin. Changes performed by a cn=Directory Manager and passsync managers should be excluded from the policy check. Fixes: https://pagure.io/freeipa/issue/7181 Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com> [1] https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/h… """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2106/head:pr2106 git checkout pr2106

2 1

[freeipa PR#3183][opened] Require a SASL SSF of >= 56 on client side
by tiran 26 Nov '19

26 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3183 Author: tiran Title: #3183: Require a SASL SSF of >= 56 on client side Action: opened PR body: """ SSF_MINX 56 level ensures data integrity and confidentiality for SASL GSSAPI and SASL GSS SPNEGO connections. Although at least AES128 is enforced pretty much everywhere, 56 is required. The origianl commit 350954589774499d99bf87cb5631c664bb0707c4 added minimum SSF on LDAP client and LDAP server. Some LDAP consumers like realmd are not compatible with strong SSF yet. Related: https://pagure.io/freeipa/issue/7140 Related: https://pagure.io/freeipa/issue/4580 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3183/head:pr3183 git checkout pr3183

1 1

[freeipa PR#2812][opened] Require secure-binds for password login
by tiran 26 Nov '19

26 Nov '19

URL: https://github.com/freeipa/freeipa/pull/2812 Author: tiran Title: #2812: Require secure-binds for password login Action: opened PR body: """ nsslapd-require-secure-binds restricts password based simple binds to secure connections. It does not prevent a careless user from transmitting a password in plain text. But it makes it obvious that he did something bad. Password based bind attempts over an insecure connections are refused with: Confidentiality required: Operation requires a secure connection Secure connections are: * LDAP connections on port 389 with STARTTLS * LDAPS connections in port 636 * LDAPI connections to a local Unix sockets Anonymous bind (simple_bind with empty DN and password) and GSSAPI bind operations are not affected. nsslapd-require-secure-binds is enabled after 389-DS is configured for TLS/SSL. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> **NOTE** The change may cause compatibility issues with applications that don't perform secure binds. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2812/head:pr2812 git checkout pr2812

1 1

[freeipa PR#3039][opened] Add temporary directory manager
by tiran 15 Nov '19

15 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3039 Author: tiran Title: #3039: Add temporary directory manager Action: opened PR body: """ The temporary directory manager simplifies the handling of temporary files that are shared with other processes or kept through out the life time of the current process. It should only be used in case tempfile.NamedTemporaryFile is not up for the task. The manager creates a new temporary directory for each user. The directory and all its files are accessible by the target user and the root group ($uid:root / 0o770 / 0o660) to avoid DAC override capability. The temporary directory is automatically removed on process exit. Related: https://pagure.io/freeipa/issue/7911 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3039/head:pr3039 git checkout pr3039

1 1

[freeipa PR#3102][opened] Workaround for AJP to bind on IPv6 localhost
by tiran 15 Nov '19

15 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3102 Author: tiran Title: #3102: Workaround for AJP to bind on IPv6 localhost Action: opened PR body: """ Tomcat's AJP connector binds to IPv4 localhost only. This causes issues with IPv6-only environment. The installer now detects if localhost6 is available and working, then configures Dogtag's Tomcat to use localhost6. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3102/head:pr3102 git checkout pr3102

1 1

[freeipa PR#2331][opened] Installation of replica against a specific server
by mrizwan93 07 Oct '19

07 Oct '19

URL: https://github.com/freeipa/freeipa/pull/2331 Author: mrizwan93 Title: #2331: Installation of replica against a specific server Action: opened PR body: """ Test to check replica install against specific server. It uses master and replica1 without CA and having custodia service stopped. Then try to install replica2 from replica1 so that replica2 will fetch secrets from master as custodia service is not running on replica1. related ticket: https://pagure.io/freeipa/issue/7566 Signed-off-by: Mohammad Rizwan Yusuf <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2331/head:pr2331 git checkout pr2331

2 1

[freeipa PR#2766][opened] Fix ipatests test_ntp_options to configure the firewall where needed
by t-woerner 05 Sep '19

05 Sep '19

URL: https://github.com/freeipa/freeipa/pull/2766 Author: t-woerner Title: #2766: Fix ipatests test_ntp_options to configure the firewall where needed Action: opened PR body: """ The firewall has not been configured before replicas and after masters have been installed using the command line tools and not the available methods from tasks. This resulted in failed tests as for example in test_replica_promotion_without_ntp. Configuration of the firewall has been added to the methods install_replica, test_replica_promotion_with_ntp_options and test_replica_promotion_without_ntp. In the case of testing command line options that may not be used together for replica installation, a comment has been added that it is theoretical no need to configure the firewall in this case, because the installation will not succeed. But it has been added to make sure that the test will not fail because of the missing firewall configuration if the options will not conflict. This is the method test_replica_promotion_with_ntp_options. In the case where conflicting command line options are tested for the server installation a comment has been added that it is not needed to configure the firewall as it is configured after successful server installation normally. This is the method test_server_client_install_mixed_options. tasks.uninstall_master is used to cleanup replica installations and test remains, therefore the firewall configuration is reverted afterwards again. See: https://pagure.io/freeipa/issue/7719 Signed-off-by: Thomas Woerner <twoerner(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2766/head:pr2766 git checkout pr2766

2 1

[freeipa PR#3085][opened] tasks.py :: prepare_reverse_zone : Using '--skip-overlap-check' option during dnszone creation
by ndehadrai 04 Sep '19

04 Sep '19

URL: https://github.com/freeipa/freeipa/pull/3085 Author: ndehadrai Title: #3085: tasks.py :: prepare_reverse_zone : Using '--skip-overlap-check' option during dnszone creation Action: opened PR body: """ Currently when the test_replica_promotion tests are run in CI, it returns warning message 'ipa: WARNING: ipa: ERROR: DNS zone with name <xyz> already exists'. Using the above option would force dnszone-add creation. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3085/head:pr3085 git checkout pr3085

1 1

[freeipa PR#2065][opened] BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning
by menonsudhir 21 Aug '19

21 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2065 Author: menonsudhir Title: #2065: BZ1339129 - Automate ipa vault-archive overwrites an existing value without warning Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2065/head:pr2065 git checkout pr2065

1 1

[freeipa PR#2147][opened] Add a skeleton kdcpolicy plugin
by frozencemetery 19 Aug '19

19 Aug '19

URL: https://github.com/freeipa/freeipa/pull/2147 Author: frozencemetery Title: #2147: Add a skeleton kdcpolicy plugin Action: opened PR body: """ Signed-off-by: Robbie Harwood <rharwood(a)redhat.com> Back in krb5-1.16 (and in RHEL-7.5), I added the [kdcpolicy plugin](http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/kdcpolicy.html) to krb5. This interface allows a module to hook all AS and TGS requests, potentially reject them, and manipulate ticket lifetimes. This PR is a basic implementation of the interface, with all the plumbing IPA needs to get it loaded and installed. There are two use cases I had in mind, though of course many more are possible (this is a very powerful place to have a hook into the KDC): - Reduced ticket lifetimes based on [auth indicator](http://web.mit.edu/kerberos/krb5-devel/doc/admin/auth_indicator.… - Adding (well, subtracting) random jitter from certain principal lifetimes to reduce contention from groups of tickets all needing renewal simultaneously Since presumably we don't want any of that to be hardcoded behavior, the difficult part is now making it all configurable. (As well as figuring out any behavior we want to control at the moment). Per IRC conversation, I'm opening this PR so that we have something to look at while we discuss that. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2147/head:pr2147 git checkout pr2147

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel May 2019