- FreeIPA-devel - Fedora mailing-lists

Set OTP defaults
by Kjell Cornelius Nicolaysen 07 Sep '22

07 Sep '22

Hey, I'm trying to figure out how to set the default policy for OTP tokens as we've just got a new requirement. Creating a TOTP token as an admin I can set the secure hash, time window and number of digits, but when adding a token as a regular user it defaults to SHA-1 with 6 digits and a 30 seconds window. Would anyone be able to point to where I can change the defaults? Thank you in advance for any help. -- Mvh, Kjell C. Nicolaysen Bitfrost AS PGP Public key available on request. Current key (at time of this email) fingerprint: 3F59 7410 AFD5 FC22 F2F1 EEC9 980A 8C9E C126 6716

2 1

FreeIPA Client does not update user info
by Lucas Blom 16 Aug '22

16 Aug '22

Hello, I'am a new FreeIPA user and most things are working fine, except when I update a user on the IPA server the client does not update it's information. Greetings, Lucas

4 3

FreeIPA 4.10.0
by Antonio Torres 01 Jul '22

01 Jul '22

The FreeIPA team would like to announce FreeIPA 4.10.0 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.10.0 * 2016: [RFE] Support random serial numbers in IPA certificates RSN can be enabled in new server installations. * 7404: Incorrect certs are being updated with "ipa-certupdate" ipa-cacert-manage command now supports the "prune" subcommand, that allows to remove the expired CA certificates. === Bug fixes FreeIPA 4.10.0 is a stabilization release for the features delivered as a part of 4.10 version series. There are 7 bug-fixes since FreeIPA 4.9.10 release. Details of the bug-fixes can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on libera.chat. == Resolved tickets * https://pagure.io/freeipa/issue/2016[#2016] [RFE] Support random serial numbers in IPA certificates * https://pagure.io/freeipa/issue/2278[#2278] IPA needs better sudo option validation or better documentation * https://pagure.io/freeipa/issue/7404[#7404] Incorrect certs are being updated with "ipa-certupdate" * https://pagure.io/freeipa/issue/8544[#8544] After reboot: Replication bind with GSSAPI auth failed * https://pagure.io/freeipa/issue/8684[#8684] [WebUI] test_hostgroup::test_names_and_button - timeout reached * https://pagure.io/freeipa/issue/9035[#9035] Nightly failure (rawhide) in test_installation_client.py::TestInstallClient * https://pagure.io/freeipa/issue/9105[#9105] Review usage of quiet flag in ipa-join == Detailed changelog since 4.9.10 === Rob Crittenden (9) * Fix test_secure_ajp_connector.py failing with Python 3.6.8 https://pagure.io/freeipa/c/9a97f9b40[commit] * Add tests for Random Serial Number v3 support https://pagure.io/freeipa/c/d241d7405[commit] https://pagure.io/freeipa/issue/2016[#2016] * Add support for Random Serial Numbers v3 https://pagure.io/freeipa/c/beaa0562d[commit] https://pagure.io/freeipa/issue/2016[#2016] * Add a new parameter type, SerialNumber, as a subclass of Str https://pagure.io/freeipa/c/83be923ac[commit] https://pagure.io/freeipa/issue/2016[#2016] * doc/designs: add Random Serial Numbers v3 support https://pagure.io/freeipa/c/d3481449e[commit] https://pagure.io/freeipa/issue/2016[#2016] * Design for IPA-to-IPA migration https://pagure.io/freeipa/c/d4859db4e[commit] * Re-work the quiet option in ipa-join to not suppress errors https://pagure.io/freeipa/c/61650c577[commit] https://pagure.io/freeipa/issue/9105[#9105] * Improve sudooption docs, make the option multi-value https://pagure.io/freeipa/c/47fbe05f7[commit] https://pagure.io/freeipa/issue/2278[#2278] * Design doc to allow LDAP bind using the RADIUS auth type https://pagure.io/freeipa/c/16ab690bf[commit] === Matthew Davis (1) * Add missing parameter to Suse modify_nsswitch_pam_stack https://pagure.io/freeipa/c/6d6b135ff[commit] === Anuja More (3) * ipatests: Fix install_master for test_idp.py https://pagure.io/freeipa/c/ef091c99f[commit] * Add end to end integration tests for external IdP https://pagure.io/freeipa/c/bd57ff356[commit] * ipatests: update prci definitions for test_idp.py https://pagure.io/freeipa/c/a80a98194[commit] === Timo Aaltonen (2) * ipaplatform/debian: Drop the path for ldap.so https://pagure.io/freeipa/c/808ac46ba[commit] * ipaplatform/debian: Use multiarch path for libsofthsm2.so https://pagure.io/freeipa/c/92d718dbf[commit] === Michal Polovka (5) * ipatests: Healthcheck use subject base from IPA not REALM https://pagure.io/freeipa/c/d3c11f762[commit] * ipatests: Increase expect timeout for interactive mode https://pagure.io/freeipa/c/40b3c11bd[commit] * ipatests: Healthcheck should ignore pki errors when CA is not configured https://pagure.io/freeipa/c/b2bbf8165[commit] * test_webui: test_hostgroup: Wait for modal dialog to appear https://pagure.io/freeipa/c/d0269f236[commit] https://pagure.io/freeipa/issue/8684[#8684] * WebUI: Test if links are opened in new tab correctly https://pagure.io/freeipa/c/89c846a1f[commit] === Florence Blanc-Renaud (9) * xmlrpc tests: updated expected output for preserved user https://pagure.io/freeipa/c/3732349bc[commit] * Preserve user: fix the confusing summary https://pagure.io/freeipa/c/cbc18ff8c[commit] * ipatests: update packages in rawhide test test_installation_client.py https://pagure.io/freeipa/c/4c61b9266[commit] https://pagure.io/freeipa/issue/9035[#9035] * ipatests: revert wrong commit on gating definition https://pagure.io/freeipa/c/4b665ccf2[commit] * Design: Integrate SID configuration into base IPA installers https://pagure.io/freeipa/c/bacddb828[commit] * Doc: add a design template https://pagure.io/freeipa/c/5edf144a7[commit] * ipatests: add test_acme.py in nightly previous https://pagure.io/freeipa/c/96a297f3b[commit] * ipatests: fix incomplete nightly def in nightly_previous https://pagure.io/freeipa/c/296f27dce[commit] * ipatests: fix discrepancies in nightly defs https://pagure.io/freeipa/c/9b2c05aff[commit] === Armando Neto (8) * ipatests: update prci template https://pagure.io/freeipa/c/b3085b830[commit] * ipatests: update definitions for custom COPR nightlies https://pagure.io/freeipa/c/1101b22b5[commit] * ipatests: bump PR-CI rawhide template https://pagure.io/freeipa/c/c780504d4[commit] * ipatests: bump rawhide template for PR-CI https://pagure.io/freeipa/c/d6d413628[commit] * ipatests: Bump PR-CI rawhide template https://pagure.io/freeipa/c/c14d52f43[commit] * ipatests: Bump PR-CI Rawhide template https://pagure.io/freeipa/c/c572697d9[commit] * ipatests: Update gating to Fedora 33 https://pagure.io/freeipa/c/a6b487130[commit] * ipatests: update PR-CI templates to Fedora 33 https://pagure.io/freeipa/c/3e8e83654[commit] === Alexander Bokovoy (3) * Fix use of comparison functions to avoid GCC bug 95189 https://pagure.io/freeipa/c/9043b8d53[commit] * doc/designs: fix formatting in LDAPI autobind design https://pagure.io/freeipa/c/3d809c706[commit] * Contributors: add new contributors to the list https://pagure.io/freeipa/c/bef78d16e[commit] === Mohammad Rizwan (1) * ipatest: Test ipa-cert-fix fails when startup directive is missing from CS.cfg https://pagure.io/freeipa/c/16057898a[commit] === Christian Heimes (2) * Add design for LDAPI autobind https://pagure.io/freeipa/c/5b8f37f88[commit] https://pagure.io/freeipa/issue/8544[#8544] * LDAP autobind authenticateAsDN for BIND named https://pagure.io/freeipa/c/16e1cbdc5[commit] https://pagure.io/freeipa/issue/8544[#8544] === François Cami (1) * ipatests: fix nightly_latest_testing_selinux template https://pagure.io/freeipa/c/87304c78a[commit] === Antonio Torres (2) * ipatests: add test for ipa-cacert-manage prune https://pagure.io/freeipa/c/8a2e6ec32[commit] https://pagure.io/freeipa/issue/7404[#7404] * ipa-cacert-manage: add prune option https://pagure.io/freeipa/c/5d8cb1dd1[commit] https://pagure.io/freeipa/issue/7404[#7404] === Peter Keresztes Schmidt (3) * configure: Do not set -Wno-strict-aliasing -Wno-sign-compare https://pagure.io/freeipa/c/f9357cb98[commit] * build: Unify compiler warning flags used https://pagure.io/freeipa/c/a355646c3[commit] * configure: Fix source tree detection to enable more warnings https://pagure.io/freeipa/c/54b42f72f[commit]

3 3

FreeIPA 4.9.10
by Antonio Torres 15 Jun '22

15 Jun '22

1 0

Potential API change for FreeIPA plugin writers
by Alexander Bokovoy 06 Jun '22

06 Jun '22

Hi, as you have probably noticed in a thread we had with Leo on freeipa-users@ about FreeIPA plugin development, we hadn't had consistency in handling boolean types between LDAP and IPA Python API level. A change is coming that would make 'native' boolean types used in both worlds. If your plugins rely on Bool() parameter handling in FreeIPA, your code might be affected. If your scripts using output of IPA API rely on case-sensitive output, you might need to adjust your code. If not, you can skip this email. Pull request https://github.com/freeipa/freeipa/pull/6294 turns handling of boolean types to be native to each side: - in LDAP, TRUE and FALSE strings used to represent the values - in Python, native True and False constants of bool type will be used to represent an LDAP boolean. Prior to PR#6294, when an LDAP attribute with a boolean syntax was read from LDAP, its representation in IPA Python code was either 'TRUE' or 'FALSE' string. This created a bit of inconvenience: - Python code had to explicitly compare a value to 'TRUE' or 'FALSE', - Web UI JavaScript code had to use a radio-box where a simple checkbox would be enough - JavaScript plugin code would need to handle all types of 'TRUE', 'FALSE', 1, 0, true, false, none in every place where a boolean type would be enough After PR#6294 is merged, IPA Python code will use Python bool type. JSON-RPC response to an IPA API command request would produce a simple 'true' or 'false' instead of ["TRUE"] or ["FALSE"] elements. This means, for example, that in the following command ipa dnszone-show ipa.test instead of "idnsallowdynupdate": [ "TRUE" ], one would get "idnsallowdynupdate": [ true ], and the output of 'ipa dnszone-show ipa.test' would have 'True' instead of 'TRUE' (and False instead of 'FALSE'): $ ipa dnszone-show ipa.test Zone name: ipa.test. Active zone: True Authoritative nameserver: idm.ipa.test. Administrator e-mail address: hostmaster.ipa.test. SOA serial: 1654159048 SOA refresh: 3600 SOA retry: 900 SOA expire: 1209600 SOA minimum: 3600 BIND update policy: grant IPA.TEST krb5-self * A; grant IPA.TEST krb5-self * AAAA; grant IPA.TEST krb5-self * SSHFP; Dynamic update: True Allow query: any; Allow transfer: none; If your scripts rely on the case-sensitive output, you'd need to fix them. IPA tools already able to handle the changes so they are backward-compatible. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

FreeIPA 4.9.9
by Antonio Torres 26 Apr '22

26 Apr '22

1 0

To post
by Masoud Shokohi 27 Mar '22

27 Mar '22

To post mailing lists

1 0

[I] Azure CI parallel jobs limit restored
by Alexander Bokovoy 15 Feb '22

15 Feb '22

Hi, Azure CI jobs limit was restored yesterday to 10 parallel jobs. Thanks to Microsoft for handling the request quickly. I restarted Azure CI in Rob's pull request https://github.com/freeipa/freeipa/pull/6184 to see how it goes. One thing I noticed this morning is that Build / Tox / WebUI unit test phases do not work anymore with Fedora 34 as nodejs cannot be installed: Error: Problem: cannot install the best candidate for the job - nothing provides /usr/bin/pwsh needed by nodejs-1:14.19.0-2.fc34.x86_64 This is definitely a Fedora issue but it is a reminder that we should actually switch to Fedora 35 or even Fedora 36 in Azure CI. Fedora 36 was recently branched and will go to Beta stage in March, so we should be able to test-drive it. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 4

[freeipa PR#6145][opened] [Backport][ipa-4-9][manual] ipatests: Added test automation for SHA384withRSA CSR support
by ssidhaye 17 Jan '22

17 Jan '22

URL: https://github.com/freeipa/freeipa/pull/6145 Author: ssidhaye Title: #6145: [Backport][ipa-4-9][manual] ipatests: Added test automation for SHA384withRSA CSR support Action: opened PR body: """ Scenario 1: Setup master with --ca-signing-algorithm=SHA384withRSA Run certutil and check Signing Algorithm Scenario 2: Setup a master Stop services Modify default.params.signingAlg in CS.cfg Restart services Resubmit cert (Resubmitted cert should have new Algorithm) Pagure Link: https://pagure.io/freeipa/issue/8906 Signed-off-by: Sumedh Sidhaye <ssidhaye(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6145/head:pr6145 git checkout pr6145

2 1

[freeipa PR#6146][opened] [Backport][ipa-4-9] Remove deprecation warning when installing a CA replica
by flo-renaud 17 Jan '22

17 Jan '22

URL: https://github.com/freeipa/freeipa/pull/6146 Author: flo-renaud Title: #6146: [Backport][ipa-4-9] Remove deprecation warning when installing a CA replica Action: opened PR body: """ This PR was opened automatically because PR #6122 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6146/head:pr6146 git checkout pr6146

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel