LDAP error while installing IPA client
by Elhamsadat Azarian
Hi
i installed ipa server but when i try to install ipa-client, this error was showed:
Error checking LDAP: Operation error: 000004DC: LdapErr: DSID-0C0907c2, comment: In order to perform this operation a successful bind must be completed on the connection.
it shows FQDN of my windows DNS Server instead of IPA server FQDN. and produced an error that is attached.
Additional info:
i have a windows DNS server.
Log file of ipaclient_intsall.log
2019-08-18T10:00:08Z DEBUG Logging to /var/log/ipaclient-install.log
2019-08-18T10:00:08Z DEBUG ipa-client-install was invoked with arguments [] and options: {'no_dns_sshfp': False, 'force': False, 'verbose': False, 'ip_addresses': None, 'configure_firefox': False, 'realm_name': None, 'force_ntpd': False, 'on_master': False, 'no_nisdomain': False, 'ssh_trust_dns': False, 'principal': None, 'keytab': None, 'no_ntp': False, 'domain_name': None, 'request_cert': False, 'fixed_primary': False, 'no_ac': False, 'no_sudo': False, 'ca_cert_files': None, 'all_ip_addresses': False, 'kinit_attempts': None, 'ntp_servers': None, 'enable_dns_updates': False, 'no_sshd': False, 'no_sssd': False, 'no_krb5_offline_passwords': False, 'servers': None, 'no_ssh': False, 'force_join': False, 'firefox_dir': None, 'unattended': False, 'quiet': False, 'nisdomain': None, 'prompt_password': False, 'host_name': None, 'permit': False, 'automount_location': None, 'preserve_sssd': False, 'mkhomedir': True, 'log_file': None, 'uninstall': False}
2019-08-18T10:00:08Z DEBUG IPA version 4.6.4-10.el7.centos.3
2019-08-18T10:00:08Z DEBUG Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
2019-08-18T10:00:08Z DEBUG Starting external process
2019-08-18T10:00:08Z DEBUG args=/usr/sbin/selinuxenabled
2019-08-18T10:00:08Z DEBUG Process finished, return code=0
2019-08-18T10:00:08Z DEBUG stdout=
2019-08-18T10:00:08Z DEBUG stderr=
2019-08-18T10:00:08Z DEBUG Starting external process
2019-08-18T10:00:08Z DEBUG args=/bin/systemctl is-enabled chronyd.service
2019-08-18T10:00:08Z DEBUG Process finished, return code=1
2019-08-18T10:00:08Z DEBUG stdout=disabled
2019-08-18T10:00:08Z DEBUG stderr=
2019-08-18T10:00:08Z DEBUG Starting external process
2019-08-18T10:00:08Z DEBUG args=/bin/systemctl is-active chronyd.service
2019-08-18T10:00:08Z DEBUG Process finished, return code=3
2019-08-18T10:00:08Z DEBUG stdout=inactive
2019-08-18T10:00:08Z DEBUG stderr=
2019-08-18T10:00:08Z DEBUG [IPA Discovery]
2019-08-18T10:00:08Z DEBUG Starting IPA discovery with domain=None, servers=None, hostname=ipacli-irvlt01.shs.dc
2019-08-18T10:00:08Z DEBUG Start searching for LDAP SRV record in "shs.dc" (domain of the hostname) and its sub-domains
2019-08-18T10:00:08Z DEBUG Search DNS for SRV record of _ldap._tcp.shs.dc
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp02.shs.dc.
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp01.shs.dc.
2019-08-18T10:00:10Z DEBUG [Kerberos realm search]
2019-08-18T10:00:10Z DEBUG Search DNS for TXT record of _kerberos.shs.dc
2019-08-18T10:00:10Z DEBUG DNS record not found: NXDOMAIN
2019-08-18T10:00:10Z DEBUG Search DNS for SRV record of _kerberos._udp.shs.dc
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 88 dc-irvwp01.shs.dc.
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 88 dc-irvwp02.shs.dc.
2019-08-18T10:00:10Z DEBUG [LDAP server check]
2019-08-18T10:00:10Z DEBUG Verifying that dc-irvwp02.shs.dc (realm None) is an IPA server
2019-08-18T10:00:10Z DEBUG Init LDAP connection to: ldap://dc-irvwp02.shs.dc:389
2019-08-18T10:00:10Z DEBUG Search LDAP server for IPA base DN
2019-08-18T10:00:10Z DEBUG Check if naming context 'DC=SHS,DC=DC' is for IPA
2019-08-18T10:00:10Z DEBUG Unhandled LDAPError: OPERATIONS_ERROR: {'info': '000004DC: LdapErr: DSID-0C0907C2, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580', 'desc': 'Operations error'}
2019-08-18T10:00:10Z ERROR Error checking LDAP: Operations error: 000004DC: LdapErr: DSID-0C0907C2, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
2019-08-18T10:00:10Z DEBUG Cannot connect to LDAP server. Check that minssf is not enabled
2019-08-18T10:00:10Z DEBUG Assuming realm is the same as domain: SHS.DC
2019-08-18T10:00:10Z DEBUG Generated basedn from realm: dc=shs,dc=dc
2019-08-18T10:00:10Z DEBUG Discovery result: NO_TLS_LDAP; server=None, domain=shs.dc, kdc=dc-irvwp01.shs.dc,dc-irvwp02.shs.dc, basedn=dc=shs,dc=dc
2019-08-18T10:00:10Z DEBUG Validated servers: dc-irvwp02.shs.dc
2019-08-18T10:00:10Z DEBUG will use discovered domain: shs.dc
2019-08-18T10:00:10Z DEBUG Start searching for LDAP SRV record in "shs.dc" (Validating DNS Discovery) and its sub-domains
2019-08-18T10:00:10Z DEBUG Search DNS for SRV record of _ldap._tcp.shs.dc
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp01.shs.dc.
2019-08-18T10:00:10Z DEBUG DNS record found: 0 100 389 dc-irvwp02.shs.dc.
2019-08-18T10:00:10Z DEBUG DNS validated, enabling discovery
2019-08-18T10:00:10Z DEBUG will use discovered server: dc-irvwp02.shs.dc
2019-08-18T10:00:10Z INFO Discovery was successful!
2019-08-18T10:00:10Z DEBUG will use discovered realm: SHS.DC
2019-08-18T10:00:10Z DEBUG will use discovered basedn: dc=shs,dc=dc
2019-08-18T10:00:10Z INFO Client hostname: ipacli-irvlt01.shs.dc
2019-08-18T10:00:10Z DEBUG Hostname source: Machine's FQDN
2019-08-18T10:00:10Z INFO Realm: SHS.DC
2019-08-18T10:00:10Z DEBUG Realm source: Assumed same as domain
2019-08-18T10:00:10Z INFO DNS Domain: shs.dc
2019-08-18T10:00:10Z DEBUG DNS Domain source: Discovered LDAP SRV records from shs.dc (domain of the hostname)
2019-08-18T10:00:10Z INFO IPA Server: dc-irvwp02.shs.dc
2019-08-18T10:00:10Z DEBUG IPA Server source: Discovered LDAP SRV records from shs.dc (domain of the hostname)
2019-08-18T10:00:10Z INFO BaseDN: dc=shs,dc=dc
2019-08-18T10:00:10Z DEBUG BaseDN source: Generated from Kerberos realm
2019-08-18T10:00:15Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/cli.py", line 319, in run
return cfgr.run()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 362, in run
self.validate()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 371, in validate
for _nothing in self._validator():
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 636, in _configure
next(validator)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 434, in __runner
exc_handler(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 458, in _handle_validate_exception
self._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 521, in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 518, in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 453, in _handle_exception
six.reraise(exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 424, in __runner
step()
File "/usr/lib/python2.7/site-packages/ipapython/install/core.py", line 421, in <lambda>
step = lambda: next(self.__gen)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 81, in run_generator_with_yield_from
six.reraise(*exc_info)
File "/usr/lib/python2.7/site-packages/ipapython/install/util.py", line 59, in run_generator_with_yield_from
value = gen.send(prev_value)
File "/usr/lib/python2.7/site-packages/ipapython/install/common.py", line 65, in _install
for unused in self._installer(self.parent):
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 3630, in main
install_check(self)
File "/usr/lib/python2.7/site-packages/ipaclient/install/client.py", line 2312, in install_check
raise ScriptError(rval=CLIENT_INSTALL_ERROR)
2019-08-18T10:00:15Z DEBUG The ipa-client-install command failed, exception: ScriptError:
2019-08-18T10:00:15Z ERROR The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information
4 years, 8 months
external DNS
by Elhamsadat Azarian
Hi
i installed Ipa-server without internal DNS and i set it to user a windows DNS server in network.
when install process finished it note that: "please add records in this file to your DNS system"
now i dont know what i must do? i must add them into "windows DNS server" or in "Network part of ipa server GUI"?
can u tell me what should i do with this file?
4 years, 8 months
samba migrate userbase to IPA - is everything needed?
by lejeczek
hi guys
while migrating userbase from Samba to IPA - my guess is that not the
whole lot is needed since IPA's Samba is purely a workgroup - do we need
all things Samba domain created and kept in ldap to migrate over?
More specifically groups, such as: Domain Admins, Domain Users, etc.. -
these must be redundant(for IPA to function), right? I'm trying to keep
it to bare minimum, thus seeking a confirmation.
ps. does regex work for/with --exclude-groups ?
many thanks, L.
4 years, 8 months
external DNS
by Elhamsadat Azarian
Hi
i installed Ipa-server without internal DNS and i set it to user a windows DNS server in network.
when install process finished it note that: "please add records in this file to your DNS system"
now i dont know what i must do? i must add them into "windows DNS server" or in "Network part of ipa server GUI"?
can u tell me what should i do with this file?
4 years, 8 months
External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk
I have an FreeIPA domain (ipa.engr.tamu.edu) that has a one-way trust with an AD domain (engr.tamu.edu). I've created a POSIX group called 'linux_team' that contains an external group called 'linux_team_ext', which itself contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain). When I perform a 'getent group linux_team', I get no results. When looking at the debug logs, I see that SSSD does fetch all of the users from the group:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-william.luke(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-andrew.eggleston@engr
.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-blake.dworaczyk@engr.
tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-david.miller(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid].
However, I ultimately see this line:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete group object for linux_team(a)engr.tamu.edu[0]! Skipping
I've tested the trust relationship and it appears to work fine; I am able to create view overrides and fetch users from the domain without any problem.
The complete logs are here:
https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?us...
4 years, 8 months
External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk
I have an IPA domain (ipa.engr.tamu.edu) that has a one-way trust with an
AD domain (engr.tamu.edu). I've created a POSIX group called 'linux_team'
that contains an external group called 'linux_team_ext', which itself
contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain).
When I run a 'getent group linux_team', I get nothing back at all. However,
it seems that from the logs it does fetch all of the group members:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-william.luke(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-andrew.eggleston@engr
.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-blake.dworaczyk@engr.
tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-david.miller(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides]
(0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid].
Ultimately I see this log entry:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete
group object for linux_team(a)engr.tamu.edu[0]! Skipping
I've tested the trust relationship and it seems to work fine. I've also
added a user override to the 'Default Trust View' and I'm able to fetch the
user without a problem. Everything except for group membership from the
trusted AD domain seems to be working.
Here are the complete logs:
https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?us...
--
------------------------------
Blake Dworaczyk
Linux Team Lead
College of Engineering
Texas A&M University
4 years, 8 months
External groups from AD trust fail with "Incomplete group object for ...[0]! Skipping" (although in the logs all members seem to be fetched)
by Blake Dworaczyk
I have an IPA domain (ipa.engr.tamu.edu) that has a one-way trust with an AD domain (engr.tamu.edu). I've created a POSIX group called 'linux_team' that contains an external group called 'linux_team_ext', which itself contains the AD group linux_team(a)engr.tamu.edu (from the trusted domain). When I run a 'getent group linux_team', I get nothing back at all. However, it seems that from the logs it does fetch all of the group members:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-william.luke(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-andrew.eggleston@engr
.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-blake.dworaczyk@engr.
tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-david.miller(a)engr.tam
u.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-j.polasek(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-matthew.mjelde(a)engr.tamu.edu] to [overridememberUid].
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): No override name available.
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [sysdb_add_group_member_overrides] (0x4000): Added [coe-steve.herring(a)engr.tamu.edu] to [overridememberUid].
Ultimately I see this log entry:
(Fri Aug 16 16:16:37 2019) [sssd[nss]] [nss_get_grent] (0x0040): Incomplete group object for linux_team(a)engr.tamu.edu[0]! Skipping
I've tested the trust relationship and it seems to work fine. I've also added a user override to the 'Default Trust View' and I'm able to fetch the user without a problem. Everything except for group membership from the trusted AD domain seems to be working.
Here are the complete logs:
https://drive.google.com/file/d/164_zRBreVtA4P9-MZ0r8MIx-ElFOful-/view?us...
4 years, 8 months
Create kerberos keytab
by Boyd Ako
So, I tried doing the test section in the V4 doc below. However, I get an error.
https://www.freeipa.org/page/V4/Keytab_Retrieval
=====================
[root@ipa home]# ipa-getkeytab -r -s ipa.neverland.ddns.me -p NFS/abyss.neverland.ddns.me -k abyss-nfs.keytab
Failed to parse result: Insufficient access rights
Failed to get keytab
4 years, 8 months
[Announce] FreeIPA 4.8.1 released
by Alexander Bokovoy
Hello!
The FreeIPA team would like to announce FreeIPA 4.8.1 release!
It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for
Fedora 30 will be available in the official Fedora repository soon.
== Highlights in 4.8.1 ==
* 5608: [RFE] Add Dogtag configuration extensions
It is now possible to tune Dogtag configuration when creating a CA by passing
an overlay configuration file with --pki-config-override option. Not all
options are supported yet and documentation is being worked on.
--------
* Release tarball corrections
FreeIPA 4.8.0 release tarball did lack two update files. This release adds
them back. The files existed in git but weren't installed when building
distribution packages.
--------
* 8040: ipa migrade-ds regression
FreeIPA 4.8.0 tightened access to LDAP connections to disallow passing
plainttext credentials over an insecure connection. This broke 'ipa migrate-ds'
functionality where in order to migrate to FreeIPA one often needs to connect
to a legacy LDAP server which might not be using TLS certificates.
FreeIPA 4.8.1 restores ability to use insecure LDAP connections in 'ipa
migrate-ds' for migration purposes only.
=== Enhancements ===
* 7932 and 7933: index certmap attributes and allow altSecurityIdentities in schema
For certificate mapping operations it is possible to specify
altSecurityIdentities in the certification mapping filters. The filter is
applied by SSSD at both FreeIPA and Active Directory LDAP servers. While
nothing is using altSecurityIdentities in FreeIPA now, the schema allows to
optimize queries better at LDAP server side. Additionally, other certificate
mapping attributes are now indexed to allow faster operations for environments
with a large set of mapping rules.
--------
* 7991: Profile-based renewal of system certificates
FreeIPA-specific certificates tracked by certmonger can now be renewed with
preservation of a certificate profile used to issue them. It is also possible
to change the certificate profile during update. This is required to allow
updating certain profile-specific attributes of the system certificates in
future.
--------
=== Known Issues ===
=== Bug fixes ===
FreeIPA 4.8.1 is a stabilization release for the features delivered as a
part of FreeIPA 4.8 series.
There are more than 30 bug-fixes details of which can be seen in
the list of resolved tickets below.
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Resolved tickets ==
* 5608 [RFE] Add Dogtag configuration extensions
* 7305 PKINIT status not displayed in the web UI (IPA Server > Configuration)
* 7329 update_ra_cert_store does not remove private key from NSSDB
* 7548 Need integration test for --external-ca-type=ms-cs
* 7597 IPA: IDM drops all custom attributes when moving account from preserved to stage
* 7677 HSM: ipa ca-add fails with error in ipa-pki-retrieve-key
* 7810 [F28] Require NSS with fix for p11-kit issue.
* 7902 389-ds-base-1.4.0.22-1 breaks TestAutomemberFindOrphans.test_find_orphan_automember_rules
* 7908 Write tests for interactive prompt for NTP options.
* 7929 ERROR: invalid 'PKINIT enabled server': all masters must have IPA master role enabled
* 7932 FreeIPA queries rely on missing attribute altsecurityidentities
* 7933 FreeIPA must index certmap attributes.
* 7949 test_integration/test_nfs.py fails at cleanup
* 7991 Use profile-based renewal for system certificates
* 7996 `test_selinuxusermap_plugin` fails against not default SELinux settings
* 8004 RHEL 8 uses nis-domainname instead of rhel-domainname
* 8005 User field separator uses '$$' within ipaSELinuxUserMapOrder
* 8007 Not stable nodeids within pytest
* 8008 Azure Pipeline slicing
* 8009 Missing execution bit on `ipa-run-tests` within virtualenv
* 8012 test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view failure
* 8013 ipa service-find does not list cifs service created by ipa-client-samba
* 8015 p11helper: insufficient logging when loading LIBSOFTHSM2_SO
* 8019 repeated uninstallation of ipa-client-samba crashes
* 8021 ipa-client-samba can not install samba after uninstallation
* 8022 azure pipeline: fail if dnf builddep exits on failure
* 8024 [WebUI] test_webui/test_trust.py failed because of request timeout
* 8026 Update pr-ci definitions with master_3client topology
* 8027 test_nfs.py: migrate to master_3client
* 8029 ipa host-find --pkey-only includes SSH keys in output
* 8030 azure pipelines fail at "Install prerequisites" of Tox job
* 8040 ipa migrate-ds fails with internal error.
== Detailed changelog since 4.8.0 ==
=== Armando Neto (1) ===
* travis: update container used for testing ipa-4-8 branch
=== Alexander Bokovoy (14) ===
* Update translation and code contributors for FreeIPA 4.8.1
* Switch ipa-4-8 branch to track Zanata ipa-4-8 branch
* Update translations for FreeIPA 4.8 branch
* Add Theodor van Nahl to the Contributors.txt
* Update translations for FreeIPA 4.8.1
* Restore SELinux context for p11-kit config overrides
* Change RA agent certificate profile to caSubsystemCert
* certmaprule: add negative test for altSecurityIdentities
* certmap rules: altSecurityIdentities should only be used for trusted domains
* Create indexes for altSecurityIdentities and ipaCertmapData attributes
* Add altSecurityIdentities attribute from MS-WSPP schema definition
* Use stage and phase attempt counters when saving test artifacts
* Use any nodejs version instead of forcing a version before nodejs 11
* Fix rpmlint errors for Rawhide
=== Christian Heimes (6) ===
* Allow insecure binds for migration
* Don't move keys when key backup is disabled
* Update comments to explain caSubsystemCert switch
* Test external CA with DNS name constraints
* Add PKCS#11 module name to p11helper errors
* Use nis-domainname.service on all RH platforms
=== François Cami (11) ===
* azure-pipelines.yml: switch to Python 3.7
* test_nfs.py: switch to master_3repl
* ipatests: rename config_replica_resolvconf_with_master_data()
* test_nfs.py: switch to tasks.config_replica_resolvconf_with_master_data()
* prci_definitions: add master_3client topology
* ipapython/admintool.py: use SERVER_NOT_CONFIGURED
* ipa-client-samba: remove state on uninstall
* ipatests: test ipa-client-samba after --uninstall
* ipa-client-samba: remove and restore smb.conf only on first uninstall
* ipatests: test multiple invocations of ipa-client-samba --uninstall
* ipatests/azure: display actual dnf repo URLs
=== Florence Blanc-Renaud (6) ===
* Nightly test definition: add missing tests
* xmlrpc test: add test for preserved > stage user
* user-stage: transfer all attributes from preserved to stage user
* test_xmlrpc: fix TestAutomemberFindOrphans.test_find_orphan_automember_rules
* Azure pipeline: report failure in prepare-build step
* upgrade: remove ipaCert and key from /etc/httpd/alias
=== Fraser Tweedale (20) ===
* Add more tests for --external-ca-profile handling
* dsinstance: add proflie when tracking certificate
* ipatests: test ipa-server-upgrade in CA-less deployment
* Use RENEWAL_CA_NAME and RA_AGENT_PROFILE constants
* cainstance: add profile to IPA RA tracking request
* upgrade: fix spurious certmonger re-tracking
* upgrade: log missing/misconfigured tracking requests
* upgrade: update KRA tracking requests
* upgrade: always add profile to tracking requests
* dogtaginstance: avoid special cases for Server-Cert
* dogtag-ipa-ca-renew-agent: always use profile-based renewal
* certmonger: use long options when invoking dogtag-ipa-renew-agent
* upgrade: add profile to Dogtag tracking requests
* dogtaginstance: add profile to tracking requests
* ci: add --external-ca-profile tests to gating
* ci: add --external-ca-profile tests to nightly
* Collapse --external-ca-profile tests into single class
* Fix use of incorrect variable
* install: fix --external-ca-profile option
* move MSCSTemplate classes to ipalib
=== Christian Hermann (1) ===
* configure.ac: don't rely on bashisms
=== Rob Crittenden (3) ===
* Don't return SSH keys with ipa host-find --pkey-only
* httpinstance: add pinfile when tracking certificate
* Remove posixAccount from service_find search filter
=== Stanislav Levin (4) ===
* Avoid use of '/tmp' for pip operations
* Make use of Azure Pipeline slicing
* Simplify ipa-run-tests script
* Fix `test_webui.test_selinuxusermap`
=== Sergey Orlov (3) ===
* ipatests: new test for trust with partially unreachable AD topology
* ipatests: mark test_domain_resolution_order as expectedly failing
* ipatests: add test for sudo with runAsUser and domain resolution order.
=== Sumedh Sidhaye (2) ===
* Test: Test to check whether ssh from ipa client to ipa master is successful after adding ldap_deref_threshold=0 in sssd.conf
* Test: To check ipa replica-manage del <FQDN> does not fail
=== Serhii Tsymbaliuk (3) ===
* WebUI tests: Fix request timeout for test_trust
* WebUI: Add PKINIT status field to 'Configuration' page
* WebUI tests: Fix timeout issues for reset password tests
=== Tibor Dudlák (4) ===
* Increase ntp_options test timeout
* ipatests: refactor TestNTPoptions
* ipatests: Add tests for interactive chronyd config
* ipatests: Update test tasks for client to be interactive
=== Timo Aaltonen (1) ===
* install: Add missing scripts to app_DATA.
=== Theodor van Nahl (1) ===
* Fix UnboundLocalError in ipa-replica-manage on errors
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4 years, 8 months
