diff --git a/.gitignore b/.gitignore index d9c893f..3912c13 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/freeipa-4.9.8.tar.gz +SOURCES/freeipa-4.9.10.tar.gz diff --git a/.ipa.metadata b/.ipa.metadata index 15ef586..81f398b 100644 --- a/.ipa.metadata +++ b/.ipa.metadata @@ -1 +1 @@ -38641a7f95779ba35089fcc10e25ec82a9b0248e SOURCES/freeipa-4.9.8.tar.gz +8f2b6a7f52348421fa7c67048dd5ae454f2642fb SOURCES/freeipa-4.9.10.tar.gz diff --git a/README.debrand b/README.debrand deleted file mode 100644 index 01c46d2..0000000 --- a/README.debrand +++ /dev/null @@ -1,2 +0,0 @@ -Warning: This package was configured for automatic debranding, but the changes -failed to apply. diff --git a/SOURCES/0001-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch b/SOURCES/0001-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch deleted file mode 100644 index 943e986..0000000 --- a/SOURCES/0001-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 0d44e959e5bbe822b51137a8e7cf48fa25533805 Mon Sep 17 00:00:00 2001 -From: Rafael Guterres Jeffman -Date: Fri, 10 Dec 2021 12:15:36 -0300 -Subject: [PATCH] Revert "freeipa.spec: depend on bind-dnssec-utils" - -This reverts commit f89d59b6e18b54967682f6a37ce92ae67ab3fcda. ---- - freeipa.spec.in | 4 +--- - ipaplatform/base/paths.py | 2 +- - ipaplatform/fedora/paths.py | 1 + - ipaserver/dnssec/bindmgr.py | 1 - - 4 files changed, 3 insertions(+), 5 deletions(-) - -diff --git a/freeipa.spec.in b/freeipa.spec.in -index 8f5c370e5..e20edb7bc 100755 ---- a/freeipa.spec.in -+++ b/freeipa.spec.in -@@ -576,11 +576,9 @@ Requires: %{name}-server = %{version}-%{release} - Requires: bind-dyndb-ldap >= 11.2-2 - Requires: bind >= %{bind_version} - Requires: bind-utils >= %{bind_version} --# bind-dnssec-utils is required by the OpenDNSSec integration --# https://pagure.io/freeipa/issue/9026 --Requires: bind-dnssec-utils >= %{bind_version} - %if %{with bind_pkcs11} - Requires: bind-pkcs11 >= %{bind_version} -+Requires: bind-pkcs11-utils >= %{bind_version} - %else - Requires: softhsm >= %{softhsm_version} - Requires: openssl-pkcs11 >= %{openssl_pkcs11_version} -diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py -index 7d21367ec..42a47f1df 100644 ---- a/ipaplatform/base/paths.py -+++ b/ipaplatform/base/paths.py -@@ -259,7 +259,7 @@ class BasePathNamespace: - IPA_PKI_RETRIEVE_KEY = "/usr/libexec/ipa/ipa-pki-retrieve-key" - IPA_HTTPD_PASSWD_READER = "/usr/libexec/ipa/ipa-httpd-pwdreader" - IPA_PKI_WAIT_RUNNING = "/usr/libexec/ipa/ipa-pki-wait-running" -- DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel" -+ DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel-pkcs11" - GETSEBOOL = "/usr/sbin/getsebool" - GROUPADD = "/usr/sbin/groupadd" - USERMOD = "/usr/sbin/usermod" -diff --git a/ipaplatform/fedora/paths.py b/ipaplatform/fedora/paths.py -index 4e993c063..92a948966 100644 ---- a/ipaplatform/fedora/paths.py -+++ b/ipaplatform/fedora/paths.py -@@ -36,6 +36,7 @@ class FedoraPathNamespace(RedHatPathNamespace): - NAMED_CRYPTO_POLICY_FILE = "/etc/crypto-policies/back-ends/bind.config" - if HAS_NFS_CONF: - SYSCONFIG_NFS = '/etc/nfs.conf' -+ DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel" - - - paths = FedoraPathNamespace() -diff --git a/ipaserver/dnssec/bindmgr.py b/ipaserver/dnssec/bindmgr.py -index 0c79cc03d..a15c0e601 100644 ---- a/ipaserver/dnssec/bindmgr.py -+++ b/ipaserver/dnssec/bindmgr.py -@@ -127,7 +127,6 @@ class BINDMgr: - ) - cmd = [ - paths.DNSSEC_KEYFROMLABEL, -- '-E', 'pkcs11', - '-K', workdir, - '-a', attrs['idnsSecAlgorithm'][0], - '-l', uri --- -2.31.1 - diff --git a/SOURCES/0001-ipa-otpd-Fix-build-on-older-versions-of-gcc.patch b/SOURCES/0001-ipa-otpd-Fix-build-on-older-versions-of-gcc.patch new file mode 100644 index 0000000..4852df8 --- /dev/null +++ b/SOURCES/0001-ipa-otpd-Fix-build-on-older-versions-of-gcc.patch @@ -0,0 +1,33 @@ +From ff54fe2fdfbab11e08a138cdfd0da900ee865e3d Mon Sep 17 00:00:00 2001 +From: Rafael Guterres Jeffman +Date: Fri, 17 Jun 2022 11:22:32 -0300 +Subject: [PATCH] ipa-otpd: Fix build on older versions of gcc. + +Older versions of gcc do not support unnamed parameters. + +This patch fixes the build on older gcc by applying the same idiom for +unsued parameters as used by other functions in the same module. + +Signed-off-by: Rafael Guterres Jeffman +--- + daemons/ipa-otpd/oauth2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/daemons/ipa-otpd/oauth2.c b/daemons/ipa-otpd/oauth2.c +index df1ffd50d..11d5c135f 100644 +--- a/daemons/ipa-otpd/oauth2.c ++++ b/daemons/ipa-otpd/oauth2.c +@@ -319,8 +319,9 @@ static int check_access_token_reply(struct child_ctx *child_ctx, + return ret; + } + +-static void oauth2_on_child_readable(verto_ctx *, verto_ev *ev) ++static void oauth2_on_child_readable(verto_ctx *vctx, verto_ev *ev) + { ++ (void)vctx; /* Unused */ + static char buf[10240]; + ssize_t io = 0; + struct child_ctx *child_ctx = NULL; +-- +2.36.1 + diff --git a/SOURCES/0002-Config-plugin-return-EmptyModlist-when-no-change-is-applied_rhbz#2031825.patch b/SOURCES/0002-Config-plugin-return-EmptyModlist-when-no-change-is-applied_rhbz#2031825.patch deleted file mode 100644 index f5f3cf3..0000000 --- a/SOURCES/0002-Config-plugin-return-EmptyModlist-when-no-change-is-applied_rhbz#2031825.patch +++ /dev/null @@ -1,75 +0,0 @@ -From b9c42fed9b6f60801f908c368d0d97a2a69f7bb2 Mon Sep 17 00:00:00 2001 -From: Florence Blanc-Renaud -Date: Wed, 15 Dec 2021 10:47:02 +0100 -Subject: [PATCH] Config plugin: return EmptyModlist when no change is applied - -When ipa config-mod is called with the option --enable-sid, -the code needs to trap EmptyModlist exception (it is expected -that no LDAP attribute is modified by this operation). -The code had a flaw and was checking: - 'enable_sid' in options -instead of - options['enable_sid'] - -"'enable_sid' in options" always returns true as this option -is a Flag with a default value, hence always present even if -not specified on the command line. - -Fixes: https://pagure.io/freeipa/issue/9063 -Reviewed-By: Rob Crittenden ---- - ipaserver/plugins/config.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py -index eae401fc3..24446beb0 100644 ---- a/ipaserver/plugins/config.py -+++ b/ipaserver/plugins/config.py -@@ -707,7 +707,7 @@ class config_mod(LDAPUpdate): - if (isinstance(exc, errors.EmptyModlist) and - call_func.__name__ == 'update_entry' and - ('ca_renewal_master_server' in options or -- 'enable_sid' in options)): -+ options['enable_sid'])): - return - - super(config_mod, self).exc_callback( --- -2.34.1 - -From cd735099e86304294217147ed578ac902fcf3dd3 Mon Sep 17 00:00:00 2001 -From: Florence Blanc-Renaud -Date: Wed, 15 Dec 2021 10:51:05 +0100 -Subject: [PATCH] config plugin: add a test ensuring EmptyModlist is returned - -Add a test to test_config_plugin, that calls ipa config-mod -with the same value as already present in LDAP. -The call must return EmptyModlist. - -Related: https://pagure.io/freeipa/issue/9063 -Reviewed-By: Rob Crittenden ---- - ipatests/test_xmlrpc/test_config_plugin.py | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/ipatests/test_xmlrpc/test_config_plugin.py b/ipatests/test_xmlrpc/test_config_plugin.py -index e981bb4a0..a8ec9f0e5 100644 ---- a/ipatests/test_xmlrpc/test_config_plugin.py -+++ b/ipatests/test_xmlrpc/test_config_plugin.py -@@ -312,4 +312,13 @@ class test_config(Declarative): - 'value': None, - }, - ), -+ dict( -+ desc='Set the value to the already set value, no modifications', -+ command=( -+ 'config_mod', [], { -+ 'ipasearchrecordslimit': u'100', -+ }, -+ ), -+ expected=errors.EmptyModlist(), -+ ), - ] --- -2.34.1 - diff --git a/SOURCES/0002-webui-IdP-Remove-arrow-notation-due-to-uglify-js-lim.patch b/SOURCES/0002-webui-IdP-Remove-arrow-notation-due-to-uglify-js-lim.patch new file mode 100644 index 0000000..7928884 --- /dev/null +++ b/SOURCES/0002-webui-IdP-Remove-arrow-notation-due-to-uglify-js-lim.patch @@ -0,0 +1,60 @@ +From 7807bcc55b4927fc327830d2237200772d2e1106 Mon Sep 17 00:00:00 2001 +From: Rafael Guterres Jeffman +Date: Fri, 17 Jun 2022 15:40:04 -0300 +Subject: [PATCH] webui IdP: Remove arrow notation due to uglify-js limitation. + +uglify-js 2.x series do not support ECMAScript 6 arrow notation ('=>') +for callback definition. + +This patch changes the arrow definition callbacks for regular anonymous +function definitions. +--- + install/ui/src/freeipa/idp.js | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/install/ui/src/freeipa/idp.js b/install/ui/src/freeipa/idp.js +index ada09c075..be3c4f0e6 100644 +--- a/install/ui/src/freeipa/idp.js ++++ b/install/ui/src/freeipa/idp.js +@@ -227,7 +227,7 @@ IPA.add_idp_policy = function() { + // For custom template we show custom fields + // and mark all of them required and passed to the RPC + // If show_custom is false, the opposite happens +- custom_fields.forEach(fname => { ++ custom_fields.forEach(function(fname) { + widget_f = that.container.fields.get_field(fname); + widget_f.set_required(show_custom); + widget_f.set_enabled(show_custom); +@@ -235,7 +235,7 @@ IPA.add_idp_policy = function() { + }); + + // For template fields we show them if custom aren't shown +- template_fields.forEach(fname => { ++ template_fields.forEach(function(fname) { + widget_f = that.container.fields.get_field(fname); + widget_f.set_enabled(!show_custom); + widget_f.widget.set_visible(!show_custom); +@@ -252,7 +252,7 @@ IPA.add_idp_policy = function() { + var value = prov_f.get_value()[0]; + + // First, clear template fields from the previous provider choice +- template_fields.forEach(fname => { ++ template_fields.forEach(function(fname) { + widget_f = that.container.fields.get_field(fname); + widget_f.widget.set_visible(false); + widget_f.set_required(false); +@@ -260,9 +260,9 @@ IPA.add_idp_policy = function() { + }); + + // Second, enable and get required template-specific fields +- idp.templates.forEach(idp_v => { ++ idp.templates.forEach(function(idp_v) { + if (idp_v['value'] == value) { +- idp_v['fields'].forEach(fname => { ++ idp_v['fields'].forEach(function(fname) { + widget_f = that.container.fields.get_field(fname); + widget_f.set_required(true); + widget_f.set_enabled(true); +-- +2.36.1 + diff --git a/SOURCES/0003-Custodia-use-a-stronger-encryption-algo-when-exporting-keys_rhbz#2032806.patch b/SOURCES/0003-Custodia-use-a-stronger-encryption-algo-when-exporting-keys_rhbz#2032806.patch deleted file mode 100644 index f6cf756..0000000 --- a/SOURCES/0003-Custodia-use-a-stronger-encryption-algo-when-exporting-keys_rhbz#2032806.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 653a7fe02880c168755984133ee143567cc7bb4e Mon Sep 17 00:00:00 2001 -From: Francisco Trivino -Date: Wed, 26 Jan 2022 15:43:39 +0100 -Subject: [PATCH] Custodia: use a stronger encryption algo when exporting keys - -The Custodia key export handler is using the default's OpenSSL encryption -scheme for PKCS#12. - -This represents an issue when performing a migration from CentOS Stream 8 (C8S) -to CentOS Steam 9 (C9S) where the Custodia client running in the new C9S -replica talks to the Custodia server on C8S source server. The later creates an -encrypted PKCS#12 file that contains the cert and the key using the OpenSSL's -default encryption scheme, which is no longer supported on C9S. - -This commit enforces a stronger encryption algorigthm by adding following -arguments to the Custodia server handler: - --keypbe AES-256-CBC -certpbe AES-256-CBC -macalg sha384 - -The new arguments enforce stronger PBEv2 instead of the insecure PBEv1. - -Fixes: https://pagure.io/freeipa/issue/9101 - -Signed-off-by: Francisco Trivino -Reviewed-By: Christian Heimes -Reviewed-By: Florence Blanc-Renaud ---- - ipaserver/secrets/handlers/pemfile.py | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/ipaserver/secrets/handlers/pemfile.py b/ipaserver/secrets/handlers/pemfile.py -index 4e8eff0e3..ad36bd020 100644 ---- a/ipaserver/secrets/handlers/pemfile.py -+++ b/ipaserver/secrets/handlers/pemfile.py -@@ -31,6 +31,9 @@ def export_key(args, tmpdir): - '-out', pk12file, - '-inkey', args.keyfile, - '-password', 'file:{pk12pwfile}'.format(pk12pwfile=pk12pwfile), -+ '-keypbe', 'AES-256-CBC', -+ '-certpbe', 'AES-256-CBC', -+ '-macalg', 'sha384', - ]) - - with open(pk12file, 'rb') as f: --- -2.34.1 - diff --git a/SOURCES/0003-Preserve-user-fix-the-confusing-summary_rhbz#2022028.patch b/SOURCES/0003-Preserve-user-fix-the-confusing-summary_rhbz#2022028.patch new file mode 100644 index 0000000..a7b9808 --- /dev/null +++ b/SOURCES/0003-Preserve-user-fix-the-confusing-summary_rhbz#2022028.patch @@ -0,0 +1,131 @@ +From ff4152539b96d309dcceaf854a3e0a49f435acff Mon Sep 17 00:00:00 2001 +From: Florence Blanc-Renaud +Date: Mon, 20 Jun 2022 09:09:11 +0200 +Subject: [PATCH] Preserve user: fix the confusing summary + +When ipa user-del --preserve is called, the command output +prints a summary with: + Deleted user: user1 +although the user was preserved. +Replace the summary with + Preserved user: user1 +to reflect what was actually done. + +Fixes: https://pagure.io/freeipa/issue/9187 +Signed-off-by: Florence Blanc-Renaud +Reviewed-By: Michal Polovka +Reviewed-By: Rob Crittenden +--- + ipaserver/plugins/user.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/ipaserver/plugins/user.py b/ipaserver/plugins/user.py +index 25d2bb6aa..fa8a67d3d 100644 +--- a/ipaserver/plugins/user.py ++++ b/ipaserver/plugins/user.py +@@ -56,6 +56,7 @@ from .idviews import remove_ipaobject_overrides + from ipalib.plugable import Registry + from .baseldap import ( + LDAPObject, ++ pkey_to_unicode, + pkey_to_value, + LDAPCreate, + LDAPSearch, +@@ -701,6 +702,7 @@ class user_del(baseuser_del): + __doc__ = _('Delete a user.') + + msg_summary = _('Deleted user "%(value)s"') ++ msg_summary_preserved = _('Preserved user "%(value)s"') + + takes_options = baseuser_del.takes_options + ( + Bool('preserve?', +@@ -831,6 +833,8 @@ class user_del(baseuser_del): + failed.append(pkey_to_value(pkey, options)) + + val = dict(result=dict(failed=failed), value=preserved) ++ val['summary'] = self.msg_summary_preserved % dict( ++ value=pkey_to_unicode(preserved)) + return val + else: + return super(user_del, self).execute(*keys, **options) +-- +2.36.1 + +From 4984ff210a169129e4e56b10e54e9c795520855c Mon Sep 17 00:00:00 2001 +From: Florence Blanc-Renaud +Date: Mon, 20 Jun 2022 09:12:14 +0200 +Subject: [PATCH] xmlrpc tests: updated expected output for preserved user + +Update the expected summary for the command +ipa user-del --preserve + +The command now displays: Preserved user: user1 +instead of Deleted user: user1 + +Related: https://pagure.io/freeipa/issue/9187 + +Signed-off-by: Florence Blanc-Renaud +Reviewed-By: Michal Polovka +Reviewed-By: Rob Crittenden +--- + ipatests/test_xmlrpc/test_stageuser_plugin.py | 5 ++++- + ipatests/test_xmlrpc/tracker/user_plugin.py | 7 ++++++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/ipatests/test_xmlrpc/test_stageuser_plugin.py b/ipatests/test_xmlrpc/test_stageuser_plugin.py +index bc606b093..fd146876c 100644 +--- a/ipatests/test_xmlrpc/test_stageuser_plugin.py ++++ b/ipatests/test_xmlrpc/test_stageuser_plugin.py +@@ -479,11 +479,12 @@ class TestActive(XMLRPC_test): + + def test_delete_preserve(self, user): + user.ensure_exists() +- user.track_delete() ++ user.track_delete(preserve=True) + command = user.make_delete_command(no_preserve=False, preserve=True) + result = command() + user.check_delete(result) + ++ user.track_delete(preserve=False) + command = user.make_delete_command() + result = command() + user.check_delete(result) +@@ -622,6 +623,7 @@ class TestCustomAttr(XMLRPC_test): + assert 'BusinessCat' in result['result'][u'businesscategory'] + + # delete the user with --preserve ++ user_customattr.track_delete(preserve=True) + command = user_customattr.make_delete_command(no_preserve=False, + preserve=True) + result = command() +@@ -763,6 +765,7 @@ class TestGroups(XMLRPC_test): + result = command() + group.check_retrieve(result) + ++ user.track_delete(preserve=True) + command = user.make_delete_command(no_preserve=False, preserve=True) + result = command() + user.check_delete(result) +diff --git a/ipatests/test_xmlrpc/tracker/user_plugin.py b/ipatests/test_xmlrpc/tracker/user_plugin.py +index 03c106250..b04be4c19 100644 +--- a/ipatests/test_xmlrpc/tracker/user_plugin.py ++++ b/ipatests/test_xmlrpc/tracker/user_plugin.py +@@ -273,9 +273,14 @@ class UserTracker(CertmapdataMixin, KerberosAliasMixin, Tracker): + + def check_delete(self, result): + """ Check 'user-del' command result """ ++ if u'preserved' in self.attrs and self.attrs[u'preserved']: ++ summary = u'Preserved user "%s"' % self.uid ++ else: ++ summary = u'Deleted user "%s"' % self.uid ++ + assert_deepequal(dict( + value=[self.uid], +- summary=u'Deleted user "%s"' % self.uid, ++ summary=summary, + result=dict(failed=[]), + ), result) + +-- +2.36.1 + diff --git a/SOURCES/0004-Only-calculate-LDAP-password-grace-when-the-password_rhbz#782917.patch b/SOURCES/0004-Only-calculate-LDAP-password-grace-when-the-password_rhbz#782917.patch new file mode 100644 index 0000000..54da08a --- /dev/null +++ b/SOURCES/0004-Only-calculate-LDAP-password-grace-when-the-password_rhbz#782917.patch @@ -0,0 +1,56 @@ +From 3675bd1d7aca443832bb9bb2f521cc4d3a088aec Mon Sep 17 00:00:00 2001 +From: Rob Crittenden +Date: Wed, 29 Jun 2022 13:25:55 +0000 +Subject: [PATCH] Only calculate LDAP password grace when the password is + expired + +The user's pwd expiration was retrieved but inadvertently was never +compared to current time. So any LDAP bind, including from the +IPA API, counted against the grace period. There is no need to go +through the graceperiod code for non-expired passwords. + +https://pagure.io/freeipa/issue/1539 + +Signed-off-by: Rob Crittenden +Reviewed-By: Florence Blanc-Renaud +--- + .../ipa-graceperiod/ipa_graceperiod.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c b/daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c +index 0860b5c20..a3f57cb4b 100644 +--- a/daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c ++++ b/daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c +@@ -359,7 +359,8 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb) + Slapi_ValueSet *values = NULL; + long grace_limit = 0; + int grace_user_time; +- char *pwd_expiration = NULL; ++ char *tmpstr = NULL; ++ time_t pwd_expiration; + int pwresponse_requested = 0; + Slapi_PBlock *pbtm = NULL; + Slapi_Mods *smods = NULL; +@@ -414,12 +415,17 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb) + } + slapi_value_free(&objectclass); + +- pwd_expiration = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration"); +- if (pwd_expiration == NULL) { ++ tmpstr = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration"); ++ if (tmpstr == NULL) { + /* No expiration means nothing to do */ + LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn); + goto done; + } ++ pwd_expiration = ipapwd_gentime_to_time_t(tmpstr); ++ if (pwd_expiration > time(NULL)) { ++ /* Not expired, nothing to see here */ ++ goto done; ++ } + + ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry, + &values, &actual_type_name, +-- +2.36.1 + diff --git a/SOURCES/0004-ipa-kdb-do-not-remove-keys-for-hardened-auth-enabled-users_rhbz#2033342.patch b/SOURCES/0004-ipa-kdb-do-not-remove-keys-for-hardened-auth-enabled-users_rhbz#2033342.patch deleted file mode 100644 index 1e342e5..0000000 --- a/SOURCES/0004-ipa-kdb-do-not-remove-keys-for-hardened-auth-enabled-users_rhbz#2033342.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 6d70421f57d0eca066a922e09416ef7195ee96d4 Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Tue, 1 Feb 2022 16:43:09 +0100 -Subject: [PATCH] ipa-kdb: do not remove keys for hardened auth-enabled users - -Since 5d51ae5, principal keys were dropped in case user auth indicator -was not including password. Thereafter, the key removal behavior was -removed by 15ff9c8 in the context of the kdcpolicy plugin introduction. -Support for hardened pre-auth methods (FAST and SPAKE) was added in -d057040, and the removal of principal keys was restored afterwards by -f0d12b7, but not taking the new hardened auth indicator into account. - -Fixes: https://pagure.io/freeipa/issue/9065 -Related to: https://pagure.io/freeipa/issue/8001 - -Signed-off-by: Julien Rische -Reviewed-By: Alexander Bokovoy -Reviewed-By: Francisco Trivino ---- - daemons/ipa-kdb/ipa_kdb_principals.c | 23 ++++++++++++----------- - 1 file changed, 12 insertions(+), 11 deletions(-) - -diff --git a/daemons/ipa-kdb/ipa_kdb_principals.c b/daemons/ipa-kdb/ipa_kdb_principals.c -index 15f3df4fe..0d0d3748c 100644 ---- a/daemons/ipa-kdb/ipa_kdb_principals.c -+++ b/daemons/ipa-kdb/ipa_kdb_principals.c -@@ -788,17 +788,18 @@ static krb5_error_code ipadb_parse_ldap_entry(krb5_context kcontext, - &res_key_data, &result, &mkvno); - switch (ret) { - case 0: -- /* Only set a principal's key if password auth can be used. Otherwise -- * the KDC would add pre-authentication methods to the NEEDED_PREAUTH -- * reply for AS-REQs which indicate the password authentication is -- * available. This might confuse applications like e.g. SSSD which try -- * to determine suitable authentication methods and corresponding -- * prompts with the help of MIT Kerberos' responder interface which -- * acts on the returned pre-authentication methods. A typical example -- * is enforced OTP authentication where of course keys are available -- * for the first factor but password authentication should not be -- * advertised by the KDC. */ -- if (!(ua & IPADB_USER_AUTH_PASSWORD) && (ua != IPADB_USER_AUTH_NONE)) { -+ /* Only set a principal's key if password or hardened auth can be used. -+ * Otherwise the KDC would add pre-authentication methods to the -+ * NEEDED_PREAUTH reply for AS-REQs which indicate the password -+ * authentication is available. This might confuse applications like -+ * e.g. SSSD which try to determine suitable authentication methods and -+ * corresponding prompts with the help of MIT Kerberos' responder -+ * interface which acts on the returned pre-authentication methods. A -+ * typical example is enforced OTP authentication where of course keys -+ * are available for the first factor but password authentication -+ * should not be advertised by the KDC. */ -+ if (!(ua & (IPADB_USER_AUTH_PASSWORD | IPADB_USER_AUTH_HARDENED)) && -+ (ua != IPADB_USER_AUTH_NONE)) { - /* This is the same behavior as ENOENT below. */ - ipa_krb5_free_key_data(res_key_data, result); - break; --- -2.34.1 - -From 294ae35a61e6ca8816b261c57508e4be21221864 Mon Sep 17 00:00:00 2001 -From: Julien Rische -Date: Tue, 1 Feb 2022 19:38:29 +0100 -Subject: [PATCH] ipatests: add case for hardened-only ticket policy - -Signed-off-by: Julien Rische -Reviewed-By: Alexander Bokovoy -Reviewed-By: Francisco Trivino ---- - ipatests/test_integration/test_krbtpolicy.py | 30 ++++++++++++++++++-- - 1 file changed, 28 insertions(+), 2 deletions(-) - -diff --git a/ipatests/test_integration/test_krbtpolicy.py b/ipatests/test_integration/test_krbtpolicy.py -index 63e75ae67..9489fbc97 100644 ---- a/ipatests/test_integration/test_krbtpolicy.py -+++ b/ipatests/test_integration/test_krbtpolicy.py -@@ -103,8 +103,8 @@ class TestPWPolicy(IntegrationTest): - result = master.run_command('klist | grep krbtgt') - assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True - -- def test_krbtpolicy_hardended(self): -- """Test a hardened kerberos ticket policy with 10 min tickets""" -+ def test_krbtpolicy_password_and_hardended(self): -+ """Test a pwd and hardened kerberos ticket policy with 10min tickets""" - master = self.master - master.run_command(['ipa', 'user-mod', USER1, - '--user-auth-type', 'password', -@@ -131,6 +131,32 @@ class TestPWPolicy(IntegrationTest): - result = master.run_command('klist | grep krbtgt') - assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True - -+ def test_krbtpolicy_hardended(self): -+ """Test a hardened kerberos ticket policy with 30min tickets""" -+ master = self.master -+ master.run_command(['ipa', 'user-mod', USER1, -+ '--user-auth-type', 'hardened']) -+ master.run_command(['ipa', 'config-mod', -+ '--user-auth-type', 'hardened']) -+ master.run_command(['ipa', 'krbtpolicy-mod', USER1, -+ '--hardened-maxlife', '1800']) -+ -+ tasks.kdestroy_all(master) -+ -+ master.run_command(['kinit', USER1], -+ stdin_text=PASSWORD + '\n') -+ result = master.run_command('klist | grep krbtgt') -+ assert maxlife_within_policy(result.stdout_text, 1800, -+ slush=1800) is True -+ -+ tasks.kdestroy_all(master) -+ -+ # Verify that the short policy only applies to USER1 -+ master.run_command(['kinit', USER2], -+ stdin_text=PASSWORD + '\n') -+ result = master.run_command('klist | grep krbtgt') -+ assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True -+ - def test_krbtpolicy_password(self): - """Test the kerberos ticket policy which issues 20 min tickets""" - master = self.master --- -2.34.1 - diff --git a/SOURCES/0005-ipa-pki-proxy.conf-provide-access-to-kra-admin-kra-getStatus_rhbz#2049167.patch b/SOURCES/0005-ipa-pki-proxy.conf-provide-access-to-kra-admin-kra-getStatus_rhbz#2049167.patch deleted file mode 100644 index 3ac05fa..0000000 --- a/SOURCES/0005-ipa-pki-proxy.conf-provide-access-to-kra-admin-kra-getStatus_rhbz#2049167.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 9bae5492270d8b695999cd82831cbee62b04626b Mon Sep 17 00:00:00 2001 -From: Florence Blanc-Renaud -Date: Fri, 28 Jan 2022 16:58:42 +0100 -Subject: [PATCH] ipa-pki-proxy.conf: provide access to - /kra/admin/kra/getStatus - -The access to /kra/admin/kra/getStatus will be needed -in order to fix pki-healthcheck. -Note that this commit is a pre-requisite for the fix -to be done on PKI side. No test added since the full -integration test already exists in test_replica_promotion.py, -in TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica - -Fixes: https://pagure.io/freeipa/issue/9099 -Related: https://pagure.io/freeipa/issue/8582 - -Signed-off-by: Florence Blanc-Renaud -Reviewed-By: Rob Crittenden ---- - install/share/ipa-pki-proxy.conf.template | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/install/share/ipa-pki-proxy.conf.template b/install/share/ipa-pki-proxy.conf.template -index 96708482c..7a46f20b9 100644 ---- a/install/share/ipa-pki-proxy.conf.template -+++ b/install/share/ipa-pki-proxy.conf.template -@@ -1,4 +1,4 @@ --# VERSION 16 - DO NOT REMOVE THIS LINE -+# VERSION 17 - DO NOT REMOVE THIS LINE - - ProxyRequests Off - -@@ -11,7 +11,7 @@ ProxyRequests Off - - - # matches for admin port and installer -- -+ - SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate - SSLVerifyClient none - ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET --- -2.34.1 - diff --git a/SOURCES/0006-Backport-latest-test-fxes-in-python3-ipatests_rhbz#2048509.patch b/SOURCES/0006-Backport-latest-test-fxes-in-python3-ipatests_rhbz#2048509.patch deleted file mode 100644 index 14d1f0c..0000000 --- a/SOURCES/0006-Backport-latest-test-fxes-in-python3-ipatests_rhbz#2048509.patch +++ /dev/null @@ -1,755 +0,0 @@ -From 0edf915efbb39fac45c784171dd715ec6b28861a Mon Sep 17 00:00:00 2001 -From: Sumedh Sidhaye -Date: Fri, 14 Jan 2022 19:55:13 +0530 -Subject: [PATCH] Added test automation for SHA384withRSA CSR support - -Scenario 1: -Setup master with --ca-signing-algorithm=SHA384withRSA -Run certutil and check Signing Algorithm - -Scenario 2: -Setup a master -Stop services -Modify default.params.signingAlg in CS.cfg -Restart services -Resubmit cert (Resubmitted cert should have new Algorithm) - -Pagure Link: https://pagure.io/freeipa/issue/8906 - -Signed-off-by: Sumedh Sidhaye -Reviewed-By: Florence Blanc-Renaud -Reviewed-By: Rob Crittenden -Reviewed-By: Antonio Torres ---- - .../test_integration/test_installation.py | 63 +++++++++++++++++++ - 1 file changed, 63 insertions(+) - -diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py -index 0947241ae..f2d372c0c 100644 ---- a/ipatests/test_integration/test_installation.py -+++ b/ipatests/test_integration/test_installation.py -@@ -34,6 +34,7 @@ from ipatests.pytest_ipa.integration import tasks - from ipatests.pytest_ipa.integration.env_config import get_global_config - from ipatests.test_integration.base import IntegrationTest - from ipatests.test_integration.test_caless import CALessBase, ipa_certs_cleanup -+from ipatests.test_integration.test_cert import get_certmonger_fs_id - from ipaplatform import services - - -@@ -1916,3 +1917,65 @@ class TestInstallWithoutNamed(IntegrationTest): - tasks.install_replica( - self.master, self.replicas[0], setup_ca=False, setup_dns=False - ) -+ -+ -+class TestInstallwithSHA384withRSA(IntegrationTest): -+ num_replicas = 0 -+ -+ def test_install_master_withalgo_sha384withrsa(self, server_cleanup): -+ tasks.install_master( -+ self.master, -+ extra_args=['--ca-signing-algorithm=SHA384withRSA'], -+ ) -+ -+ # check Signing Algorithm post installation -+ dashed_domain = self.master.domain.realm.replace(".", '-') -+ cmd_args = ['certutil', '-L', '-d', -+ '/etc/dirsrv/slapd-{}/'.format(dashed_domain), -+ '-n', 'Server-Cert'] -+ result = self.master.run_command(cmd_args) -+ assert 'SHA-384 With RSA Encryption' in result.stdout_text -+ -+ def test_install_master_modify_existing(self, server_cleanup): -+ """ -+ Setup a master -+ Stop services -+ Modify default.params.signingAlg in CS.cfg -+ Restart services -+ Resubmit cert (Resubmitted cert should have new Algorithm) -+ """ -+ tasks.install_master(self.master) -+ self.master.run_command(['ipactl', 'stop']) -+ cs_cfg_content = self.master.get_file_contents(paths.CA_CS_CFG_PATH, -+ encoding='utf-8') -+ new_lines = [] -+ replace_str = "ca.signing.defaultSigningAlgorithm=SHA384withRSA" -+ ocsp_rep_str = "ca.ocsp_signing.defaultSigningAlgorithm=SHA384withRSA" -+ for line in cs_cfg_content.split('\n'): -+ if line.startswith('ca.signing.defaultSigningAlgorithm'): -+ new_lines.append(replace_str) -+ elif line.startswith('ca.ocsp_signing.defaultSigningAlgorithm'): -+ new_lines.append(ocsp_rep_str) -+ else: -+ new_lines.append(line) -+ self.master.put_file_contents(paths.CA_CS_CFG_PATH, -+ '\n'.join(new_lines)) -+ self.master.run_command(['ipactl', 'start']) -+ -+ cmd = ['getcert', 'list', '-f', paths.RA_AGENT_PEM] -+ result = self.master.run_command(cmd) -+ request_id = get_certmonger_fs_id(result.stdout_text) -+ -+ # resubmit RA Agent cert -+ cmd = ['getcert', 'resubmit', '-f', paths.RA_AGENT_PEM] -+ self.master.run_command(cmd) -+ -+ tasks.wait_for_certmonger_status(self.master, -+ ('CA_WORKING', 'MONITORING'), -+ request_id) -+ -+ cmd_args = ['openssl', 'x509', '-in', -+ paths.RA_AGENT_PEM, '-noout', '-text'] -+ result = self.master.run_command(cmd_args) -+ assert_str = 'Signature Algorithm: sha384WithRSAEncryption' -+ assert assert_str in result.stdout_text --- -2.34.1 - -From 8b22ee018c3bb7f58a1b6694a7fd611688f8e74f Mon Sep 17 00:00:00 2001 -From: Sumedh Sidhaye -Date: Thu, 25 Nov 2021 17:48:20 +0530 -Subject: [PATCH] Extend test to see if replica is not shown when running - `ipa-replica-manage list -v ` - -Related: https://pagure.io/freeipa/issue/8605 - -Signed-off-by: Sumedh Sidhaye -Reviewed-By: Florence Blanc-Renaud ---- - ipatests/test_integration/test_simple_replication.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/ipatests/test_integration/test_simple_replication.py b/ipatests/test_integration/test_simple_replication.py -index 8de385144..17092a499 100644 ---- a/ipatests/test_integration/test_simple_replication.py -+++ b/ipatests/test_integration/test_simple_replication.py -@@ -111,5 +111,6 @@ class TestSimpleReplication(IntegrationTest): - # has to be run with --force, there is no --unattended - self.master.run_command(['ipa-replica-manage', 'del', - self.replicas[0].hostname, '--force']) -- result = self.master.run_command(['ipa-replica-manage', 'list']) -+ result = self.master.run_command( -+ ['ipa-replica-manage', 'list', '-v', self.master.hostname]) - assert self.replicas[0].hostname not in result.stdout_text --- -2.34.1 - -From ba7ec71ba96280da3841ebe47df2a6dc1cd6341e Mon Sep 17 00:00:00 2001 -From: Mohammad Rizwan -Date: Fri, 26 Nov 2021 12:11:21 +0530 -Subject: [PATCH] ipatests: Fix test_ipa_cert_fix.py::TestCertFixReplica - teardown - -Fixture `expire_certs` moves date back after renewing the certs. -This is causing the ipa-replica to fail. This fix first uninstalls -the server then moves back the date. - -Fixes: https://pagure.io/freeipa/issue/9052 - -Signed-off-by: Mohammad Rizwan -Reviewed-By: Florence Blanc-Renaud ---- - ipatests/test_integration/test_ipa_cert_fix.py | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/ipatests/test_integration/test_ipa_cert_fix.py b/ipatests/test_integration/test_ipa_cert_fix.py -index 39904d5de..5b56054b4 100644 ---- a/ipatests/test_integration/test_ipa_cert_fix.py -+++ b/ipatests/test_integration/test_ipa_cert_fix.py -@@ -389,6 +389,12 @@ class TestCertFixReplica(IntegrationTest): - setup_dns=False, extra_args=['--no-ntp'] - ) - -+ @classmethod -+ def uninstall(cls, mh): -+ # Uninstall method is empty as the uninstallation is done in -+ # the fixture -+ pass -+ - @pytest.fixture - def expire_certs(self): - # move system date to expire certs -@@ -398,7 +404,8 @@ class TestCertFixReplica(IntegrationTest): - yield - - # move date back on replica and master -- for host in self.master, self.replicas[0]: -+ for host in self.replicas[0], self.master: -+ tasks.uninstall_master(host) - tasks.move_date(host, 'start', '-3years-1days') - - def test_renew_expired_cert_replica(self, expire_certs): --- -2.34.1 - -From 465f1669a6c5abc72da1ecaf9aefa8488f80806c Mon Sep 17 00:00:00 2001 -From: Anuja More -Date: Mon, 13 Dec 2021 17:37:05 +0530 -Subject: [PATCH] ipatests: Test default value of nsslapd-sizelimit. - -related : https://pagure.io/freeipa/issue/8962 - -Signed-off-by: Anuja More -Reviewed-By: Florence Blanc-Renaud ---- - ipatests/test_integration/test_installation.py | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py -index 95cfaad54..0947241ae 100644 ---- a/ipatests/test_integration/test_installation.py -+++ b/ipatests/test_integration/test_installation.py -@@ -1067,6 +1067,19 @@ class TestInstallMaster(IntegrationTest): - ) - assert "nsslapd-db-locks" not in result.stdout_text - -+ def test_nsslapd_sizelimit(self): -+ """ Test for default value of nsslapd-sizelimit. -+ -+ Related : https://pagure.io/freeipa/issue/8962 -+ """ -+ result = tasks.ldapsearch_dm( -+ self.master, -+ "cn=config", -+ ["nsslapd-sizelimit"], -+ scope="base" -+ ) -+ assert "nsslapd-sizelimit: 100000" in result.stdout_text -+ - def test_admin_root_alias_CVE_2020_10747(self): - # Test for CVE-2020-10747 fix - # https://bugzilla.redhat.com/show_bug.cgi?id=1810160 --- -2.34.1 - -From cbd9ac6ab07dfb60f67da762fdd70856ad35c230 Mon Sep 17 00:00:00 2001 -From: Mohammad Rizwan -Date: Thu, 25 Nov 2021 13:10:05 +0530 -Subject: [PATCH] ipatests: Test empty cert request doesn't force certmonger to - segfault - -When empty cert request is submitted to certmonger, it goes to -segfault. This fix test that if something like this happens, -certmonger should gracefuly handle it - -and some PEP8 fixes - -related: https://pagure.io/certmonger/issue/191 - -Signed-off-by: Mohammad Rizwan ---- - ipatests/test_integration/test_cert.py | 79 +++++++++++++++++++++++++- - 1 file changed, 78 insertions(+), 1 deletion(-) - -diff --git a/ipatests/test_integration/test_cert.py b/ipatests/test_integration/test_cert.py -index 5ffb8c608..0518d7954 100644 ---- a/ipatests/test_integration/test_cert.py -+++ b/ipatests/test_integration/test_cert.py -@@ -14,6 +14,7 @@ import random - import re - import string - import time -+import textwrap - - from ipaplatform.paths import paths - from ipapython.dn import DN -@@ -193,7 +194,7 @@ class TestInstallMasterClient(IntegrationTest): - tasks.kinit_admin(self.master) - tasks.user_add(self.master, user) - -- for id in (0,1): -+ for id in (0, 1): - csr_file = f'{id}.csr' - key_file = f'{id}.key' - cert_file = f'{id}.crt' -@@ -584,3 +585,79 @@ class TestCAShowErrorHandling(IntegrationTest): - error_msg = 'ipa: ERROR: The certificate for ' \ - '{} is not available on this server.'.format(lwca) - assert error_msg in result.stderr_text -+ -+ def test_certmonger_empty_cert_not_segfault(self): -+ """Test empty cert request doesn't force certmonger to segfault -+ -+ Test scenario: -+ create a cert request file in /var/lib/certmonger/requests which is -+ missing most of the required information, and ask request a new -+ certificate to certmonger. The wrong request file should not make -+ certmonger crash. -+ -+ related: https://pagure.io/certmonger/issue/191 -+ """ -+ empty_cert_req_content = textwrap.dedent(""" -+ id=dogtag-ipa-renew-agent -+ key_type=UNSPECIFIED -+ key_gen_type=UNSPECIFIED -+ key_size=0 -+ key_gen_size=0 -+ key_next_type=UNSPECIFIED -+ key_next_gen_type=UNSPECIFIED -+ key_next_size=0 -+ key_next_gen_size=0 -+ key_preserve=0 -+ key_storage_type=NONE -+ key_perms=0 -+ key_requested_count=0 -+ key_issued_count=0 -+ cert_storage_type=FILE -+ cert_perms=0 -+ cert_is_ca=0 -+ cert_ca_path_length=0 -+ cert_no_ocsp_check=0 -+ last_need_notify_check=19700101000000 -+ last_need_enroll_check=19700101000000 -+ template_is_ca=0 -+ template_ca_path_length=-1 -+ template_no_ocsp_check=0 -+ state=NEED_KEY_PAIR -+ autorenew=0 -+ monitor=0 -+ submitted=19700101000000 -+ """) -+ # stop certmonger service -+ self.master.run_command(['systemctl', 'stop', 'certmonger']) -+ -+ # place an empty cert request file to certmonger request dir -+ self.master.put_file_contents( -+ os.path.join(paths.CERTMONGER_REQUESTS_DIR, '20211125062617'), -+ empty_cert_req_content -+ ) -+ -+ # start certmonger, it should not fail -+ self.master.run_command(['systemctl', 'start', 'certmonger']) -+ -+ # request a new cert, should succeed and certmonger doesn't goes -+ # to segfault -+ result = self.master.run_command([ -+ "ipa-getcert", "request", -+ "-f", os.path.join(paths.OPENSSL_CERTS_DIR, "test.pem"), -+ "-k", os.path.join(paths.OPENSSL_PRIVATE_DIR, "test.key"), -+ ]) -+ request_id = re.findall(r'\d+', result.stdout_text) -+ -+ # check if certificate is in MONITORING state -+ status = tasks.wait_for_request(self.master, request_id[0], 50) -+ assert status == "MONITORING" -+ -+ self.master.run_command( -+ ['ipa-getcert', 'stop-tracking', '-i', request_id[0]] -+ ) -+ self.master.run_command([ -+ 'rm', '-rf', -+ os.path.join(paths.CERTMONGER_REQUESTS_DIR, '20211125062617'), -+ os.path.join(paths.OPENSSL_CERTS_DIR, 'test.pem'), -+ os.path.join(paths.OPENSSL_PRIVATE_DIR, 'test.key') -+ ]) --- -2.34.1 - -From edbd8f692a28fc999b92e9032614d366511db323 Mon Sep 17 00:00:00 2001 -From: Anuja More -Date: Mon, 6 Dec 2021 20:50:01 +0530 -Subject: [PATCH] ipatests: webui: Tests for subordinate ids. - -Added web-ui tests to verify where operations -using subordinate ids are working as expected. - -Related : https://pagure.io/freeipa/issue/8361 - -Signed-off-by: Anuja More -Reviewed-By: Michal Polovka -Reviewed-By: Florence Blanc-Renaud -Reviewed-By: Florence Blanc-Renaud ---- - ipatests/test_webui/test_subid.py | 141 ++++++++++++++++++++++++++++++ - ipatests/test_webui/ui_driver.py | 28 ++++++ - 2 files changed, 169 insertions(+) - create mode 100644 ipatests/test_webui/test_subid.py - -diff --git a/ipatests/test_webui/test_subid.py b/ipatests/test_webui/test_subid.py -new file mode 100644 -index 000000000..26decdba0 ---- /dev/null -+++ b/ipatests/test_webui/test_subid.py -@@ -0,0 +1,141 @@ -+ -+""" -+Tests for subordinateid. -+""" -+ -+from ipatests.test_webui.ui_driver import UI_driver -+import ipatests.test_webui.data_config as config_data -+import ipatests.test_webui.data_user as user_data -+from ipatests.test_webui.ui_driver import screenshot -+import re -+ -+ -+class test_subid(UI_driver): -+ -+ def add_user(self, pkey, name, surname): -+ self.add_record('user', { -+ 'pkey': pkey, -+ 'add': [ -+ ('textbox', 'uid', pkey), -+ ('textbox', 'givenname', name), -+ ('textbox', 'sn', surname), -+ ] -+ }) -+ -+ def set_default_subid(self): -+ self.navigate_to_entity(config_data.ENTITY) -+ self.check_option('ipauserdefaultsubordinateid', 'checked') -+ self.facet_button_click('save') -+ -+ def get_user_count(self, user_pkey): -+ self.navigate_to_entity('subid', facet='search') -+ self.apply_search_filter(user_pkey) -+ self.wait_for_request() -+ return self.get_rows() -+ -+ @screenshot -+ def test_set_defaultsubid(self): -+ """ -+ Test to verify that enable/disable is working for -+ adding subids to new users. -+ """ -+ self.init_app() -+ self.add_record(user_data.ENTITY, user_data.DATA2) -+ self.navigate_to_entity(config_data.ENTITY) -+ # test subid can be enabled/disabled. -+ self.set_default_subid() -+ assert self.get_field_checked('ipauserdefaultsubordinateid') -+ self.set_default_subid() -+ assert not self.get_field_checked('ipauserdefaultsubordinateid') -+ -+ @screenshot -+ def test_user_defaultsubid(self): -+ """ -+ Test to verify that subid is generated for new user. -+ """ -+ self.init_app() -+ user_pkey = "some-user" -+ -+ self.set_default_subid() -+ assert self.get_field_checked('ipauserdefaultsubordinateid') -+ -+ before_count = self.get_user_count(user_pkey) -+ assert len(before_count) == 0 -+ -+ self.add_user(user_pkey, 'Some', 'User') -+ after_count = self.get_user_count(user_pkey) -+ assert len(after_count) == 1 -+ -+ @screenshot -+ def test_user_subid_mod_desc(self): -+ """ -+ Test to verify that auto-assigned subid description is modified. -+ """ -+ self.init_app() -+ self.navigate_to_record("some-user") -+ self.switch_to_facet('memberof_subid') -+ rows = self.get_rows() -+ self.navigate_to_row_record(rows[-1]) -+ self.fill_textbox("description", "some-user-subid-desc") -+ self.facet_button_click('save') -+ -+ @screenshot -+ def test_admin_subid(self): -+ """ -+ Test to verify that subid range is created with owner admin. -+ """ -+ self.init_app() -+ self.navigate_to_entity('subid', facet='search') -+ self.facet_button_click('add') -+ self.select_combobox('ipaowner', 'admin') -+ self.dialog_button_click('add') -+ self.wait(0.3) -+ self.assert_no_error_dialog() -+ -+ @screenshot -+ def test_admin_subid_negative(self): -+ """ -+ Test to verify that readding the subid fails with error. -+ """ -+ self.init_app() -+ self.navigate_to_entity('subid', facet='search') -+ self.facet_button_click('add') -+ self.select_combobox('ipaowner', 'admin') -+ self.dialog_button_click('add') -+ self.wait(0.3) -+ err_dialog = self.get_last_error_dialog(dialog_name='error_dialog') -+ text = self.get_text('.modal-body div p', err_dialog) -+ text = text.strip() -+ pattern = r'Subordinate id with with name .* already exists.' -+ assert re.search(pattern, text) is not None -+ self.close_all_dialogs() -+ -+ @screenshot -+ def test_user_subid_add(self): -+ """ -+ Test to verify that subid range is created for given user. -+ """ -+ self.init_app() -+ self.navigate_to_entity('subid', facet='search') -+ before_count = self.get_rows() -+ self.facet_button_click('add') -+ self.select_combobox('ipaowner', user_data.PKEY2) -+ self.dialog_button_click('add') -+ self.wait(0.3) -+ self.assert_no_error_dialog() -+ after_count = self.get_rows() -+ assert len(before_count) < len(after_count) -+ -+ @screenshot -+ def test_subid_del(self): -+ """ -+ Test to remove subordinate id for given user. -+ """ -+ self.init_app() -+ self.navigate_to_entity('subid', facet='search') -+ user_uid = self.get_record_pkey("some-user", "ipaowner", -+ table_name="ipauniqueid") -+ before_count = self.get_rows() -+ self.delete_record(user_uid, table_name="ipauniqueid") -+ after_count = self.get_rows() -+ assert len(before_count) > len(after_count) -diff --git a/ipatests/test_webui/ui_driver.py b/ipatests/test_webui/ui_driver.py -index 46fd512ae..77fd74e49 100644 ---- a/ipatests/test_webui/ui_driver.py -+++ b/ipatests/test_webui/ui_driver.py -@@ -1151,6 +1151,34 @@ class UI_driver: - return row - return None - -+ def get_row_by_column_value(self, key, column_name, parent=None, -+ table_name=None): -+ """ -+ Get the first matched row element of a search table with given key -+ matched against selected column. None if not found -+ """ -+ rows = self.get_rows(parent, table_name) -+ s = "td div[name='%s']" % column_name -+ for row in rows: -+ has = self.find(s, By.CSS_SELECTOR, row) -+ if has.text == key: -+ return row -+ return None -+ -+ def get_record_pkey(self, key, column, parent=None, table_name=None): -+ """ -+ Get record pkey if value of column is known -+ """ -+ row = self.get_row_by_column_value(key, -+ column_name=column, -+ parent=parent, -+ table_name=table_name) -+ val = None -+ if row: -+ el = self.find("td input", By.CSS_SELECTOR, row) -+ val = el.get_attribute("value") -+ return val -+ - def navigate_to_row_record(self, row, pkey_column=None): - """ - Navigate to record by clicking on a link. --- -2.34.1 - -From 419d7fd6e5a9ed2d356ad05eef1043309f5646ef Mon Sep 17 00:00:00 2001 -From: Michal Polovka -Date: Fri, 7 Jan 2022 12:12:26 +0100 -Subject: [PATCH] ipatests: webui: Use safe-loader for loading YAML - configuration file - -FullLoader class for YAML loader was introduced in version 5.1 which -also deprecated default loader. SafeLoader, however, stays consistent -across the versions and brings added security. - -This fix is necessary as PyYAML > 5.1 is not available in downstream. - -Related: https://pagure.io/freeipa/issue/9009 - -Signed-off-by: Michal Polovka -Reviewed-By: Rob Crittenden ---- - ipatests/test_webui/ui_driver.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ipatests/test_webui/ui_driver.py b/ipatests/test_webui/ui_driver.py -index 77fd74e49..519efee9b 100644 ---- a/ipatests/test_webui/ui_driver.py -+++ b/ipatests/test_webui/ui_driver.py -@@ -192,7 +192,7 @@ class UI_driver: - if not NO_YAML and os.path.isfile(path): - try: - with open(path, 'r') as conf: -- cls.config = yaml.load(stream=conf, Loader=yaml.FullLoader) -+ cls.config = yaml.safe_load(stream=conf) - except yaml.YAMLError as e: - pytest.skip("Invalid Web UI config.\n%s" % e) - except IOError as e: --- -2.34.1 - -From 5444da016edc416c0c9481c660c013053dbb93b5 Mon Sep 17 00:00:00 2001 -From: Mohammad Rizwan -Date: Thu, 18 Nov 2021 18:43:22 +0530 -Subject: [PATCH] PEP8 Fixes - -Signed-off-by: Mohammad Rizwan ---- - .../test_integration/test_replica_promotion.py | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/ipatests/test_integration/test_replica_promotion.py b/ipatests/test_integration/test_replica_promotion.py -index 1a4e9bc12..c328b1a08 100644 ---- a/ipatests/test_integration/test_replica_promotion.py -+++ b/ipatests/test_integration/test_replica_promotion.py -@@ -138,7 +138,6 @@ class TestReplicaPromotionLevel1(ReplicaPromotionBase): - assert res.returncode == 1 - assert expected_err in res.stderr_text - -- - @replicas_cleanup - def test_one_command_installation(self): - """ -@@ -150,11 +149,11 @@ class TestReplicaPromotionLevel1(ReplicaPromotionBase): - Firewall(self.replicas[0]).enable_services(["freeipa-ldap", - "freeipa-ldaps"]) - self.replicas[0].run_command(['ipa-replica-install', '-w', -- self.master.config.admin_password, -- '-n', self.master.domain.name, -- '-r', self.master.domain.realm, -- '--server', self.master.hostname, -- '-U']) -+ self.master.config.admin_password, -+ '-n', self.master.domain.name, -+ '-r', self.master.domain.realm, -+ '--server', self.master.hostname, -+ '-U']) - # Ensure that pkinit is properly configured, test for 7566 - result = self.replicas[0].run_command(['ipa-pkinit-manage', 'status']) - assert "PKINIT is enabled" in result.stdout_text -@@ -321,7 +320,7 @@ class TestWrongClientDomain(IntegrationTest): - result1 = client.run_command(['ipa-replica-install', '-U', '-w', - self.master.config.dirman_password], - raiseonerr=False) -- assert(result1.returncode == 0), ( -+ assert (result1.returncode == 0), ( - 'Failed to promote the client installed with the upcase domain name') - - def test_client_rollback(self): -@@ -355,6 +354,7 @@ class TestWrongClientDomain(IntegrationTest): - assert("An error occurred while removing SSSD" not in - result.stdout_text) - -+ - class TestRenewalMaster(IntegrationTest): - - topology = 'star' --- -2.34.1 - -From 1d19b860d4cd3bd65a4b143b588425d9a64237fd Mon Sep 17 00:00:00 2001 -From: Mohammad Rizwan -Date: Thu, 18 Nov 2021 18:36:58 +0530 -Subject: [PATCH] Test cases for ipa-replica-conncheck command - -Following test cases would be checked: -- when called with --principal (it should then prompt for a password) -- when called with --principal / --password -- when called without principal and password but with a kerberos TGT, - kinit admin done before calling ipa-replica-conncheck -- when called without principal and password, and without any kerberos - TGT (it should default to principal=admin and prompt for a password) - -related: https://pagure.io/freeipa/issue/9047 - -Signed-off-by: Mohammad Rizwan ---- - .../test_replica_promotion.py | 70 +++++++++++++++++++ - 1 file changed, 70 insertions(+) - -diff --git a/ipatests/test_integration/test_replica_promotion.py b/ipatests/test_integration/test_replica_promotion.py -index b9c56f775..1a4e9bc12 100644 ---- a/ipatests/test_integration/test_replica_promotion.py -+++ b/ipatests/test_integration/test_replica_promotion.py -@@ -437,6 +437,76 @@ class TestRenewalMaster(IntegrationTest): - self.assertCARenewalMaster(master, replica.hostname) - self.assertCARenewalMaster(replica, replica.hostname) - -+ def test_replica_concheck(self): -+ """Test cases for ipa-replica-conncheck command -+ -+ Following test cases would be checked: -+ - when called with --principal (it should then prompt for a password) -+ - when called with --principal / --password -+ - when called without principal and password but with a kerberos TGT, -+ kinit admin done before calling ipa-replica-conncheck -+ - when called without principal and password, and without any kerberos -+ TGT (it should default to principal=admin and prompt for a password) -+ -+ related: https://pagure.io/freeipa/issue/9047 -+ """ -+ exp_str1 = "Connection from replica to master is OK." -+ exp_str2 = "Connection from master to replica is OK" -+ tasks.kdestroy_all(self.replicas[0]) -+ # when called with --principal (it should then prompt for a password) -+ result = self.replicas[0].run_command( -+ ['ipa-replica-conncheck', '--auto-master-check', -+ '--master', self.master.hostname, -+ '-r', self.replicas[0].domain.realm, -+ '-p', self.replicas[0].config.admin_name], -+ stdin_text=self.master.config.admin_password -+ ) -+ assert result.returncode == 0 -+ assert ( -+ exp_str1 in result.stderr_text and exp_str2 in result.stderr_text -+ ) -+ -+ # when called with --principal / --password -+ result = self.replicas[0].run_command([ -+ 'ipa-replica-conncheck', '--auto-master-check', -+ '--master', self.master.hostname, -+ '-r', self.replicas[0].domain.realm, -+ '-p', self.replicas[0].config.admin_name, -+ '-w', self.master.config.admin_password -+ ]) -+ assert result.returncode == 0 -+ assert ( -+ exp_str1 in result.stderr_text and exp_str2 in result.stderr_text -+ ) -+ -+ # when called without principal and password, and without -+ # any kerberos TGT, it should default to principal=admin -+ # and prompt for a password -+ result = self.replicas[0].run_command( -+ ['ipa-replica-conncheck', '--auto-master-check', -+ '--master', self.master.hostname, -+ '-r', self.replicas[0].domain.realm], -+ stdin_text=self.master.config.admin_password -+ ) -+ assert result.returncode == 0 -+ assert ( -+ exp_str1 in result.stderr_text and exp_str2 in result.stderr_text -+ ) -+ -+ # when called without principal and password but with a kerberos TGT, -+ # kinit admin done before calling ipa-replica-conncheck -+ tasks.kinit_admin(self.replicas[0]) -+ result = self.replicas[0].run_command( -+ ['ipa-replica-conncheck', '--auto-master-check', -+ '--master', self.master.hostname, -+ '-r', self.replicas[0].domain.realm] -+ ) -+ assert result.returncode == 0 -+ assert ( -+ exp_str1 in result.stderr_text and exp_str2 in result.stderr_text -+ ) -+ tasks.kdestroy_all(self.replicas[0]) -+ - def test_automatic_renewal_master_transfer_ondelete(self): - # Test that after replica uninstallation, master overtakes the cert - # renewal master role from replica (which was previously set there) --- -2.34.1 - diff --git a/SOURCES/0007-Don-t-always-override-the-port-in-import_included_profiles_rhbz#2022483.patch b/SOURCES/0007-Don-t-always-override-the-port-in-import_included_profiles_rhbz#2022483.patch deleted file mode 100644 index f8b3b9f..0000000 --- a/SOURCES/0007-Don-t-always-override-the-port-in-import_included_profiles_rhbz#2022483.patch +++ /dev/null @@ -1,104 +0,0 @@ -From edb216849e4f47d6cae95981edf0c3fe2653fd7a Mon Sep 17 00:00:00 2001 -From: Rob Crittenden -Date: Fri, 28 Jan 2022 16:46:35 -0500 -Subject: [PATCH] Don't always override the port in import_included_profiles - -I can only guess to the original purpose of this override. I -believe it was because this is called in the installer prior -to Apache being set up. The expectation was that this would -only be called locally. It predates the RestClient class. - -RestClient will attempt to find an available service. In this -case, during a CA installation, the local server is not -considered available because it lacks an entry in -cn=masters. So it will never be returned as an option. - -So by overriding the port to 8443 the remote connection will -likely fail because we don't require that the port be open. - -So instead, instantiate a RestClient and see what happens. - -There are several use-cases: - -1. Installing an initial server. The RestClient connection - should fail, so we will fall back to the override port and - use the local server. If Apache happens to be running with - a globally-issued certificate then the RestClient will - succeed. In this case if the connected host and the local - hostname are the same, override in that case as well. - -2. Installing as a replica. In this case the local server should - be ignored in all cases and a remote CA will be picked with - no override done. - -3. Switching from CA-less to CA-ful. The web server will be - trusted but the RestClient login will fail with a 404. Fall - back to the override port in this case. - -The motivation for this is trying to install an EL 8.x replica -against an EL 7.9 server. 8.5+ includes the ACME service and -a new profile is needed which doesn't exist in 7. This was -failing because the RestClient determined that the local server -wasn't running a CA so tried the remote one (7.9) on the override -port 8443. Since this port isn't open: failure. - -Chances are that adding the profile is still going to fail -because again, 7.9 lacks ACME capabilities, but it will fail in -a way that allows the installation to continue. - -I suspect that all of the overrides can similarly handled, or -handled directly within the RestClient class, but for the sake -of "do no harm" I'm only changing this instance for now. - -https://pagure.io/freeipa/issue/9100 - -Signed-off-by: Rob Crittenden -Reviewed-By: Florence Blanc-Renaud ---- - ipaserver/install/cainstance.py | 30 +++++++++++++++++++++++++++++- - 1 file changed, 29 insertions(+), 1 deletion(-) - -diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py -index 8c8bf1b3a..ad206aad4 100644 ---- a/ipaserver/install/cainstance.py -+++ b/ipaserver/install/cainstance.py -@@ -1953,7 +1953,35 @@ def import_included_profiles(): - cn=['certprofiles'], - ) - -- api.Backend.ra_certprofile.override_port = 8443 -+ # At this point Apache may or may not be running with a valid -+ # certificate. The local server is not yet recognized as a full -+ # CA yet so it isn't discoverable. So try to do some detection -+ # on what port to use, 443 (remote) or 8443 (local) for importing -+ # the profiles. -+ # -+ # api.Backend.ra_certprofile invokes the RestClient class -+ # which will discover and login to the CA REST API. We can -+ # use this information to detect where to import the profiles. -+ # -+ # If the login is successful (e.g. doesn't raise an exception) -+ # and it returns our hostname (it prefers the local host) then -+ # we override and talk locally. -+ # -+ # Otherwise a NetworkError means we can't connect on 443 (perhaps -+ # a firewall) or we get an HTTP error (valid TLS certificate on -+ # Apache but no CA, login fails with 404) so we override to the -+ # local server. -+ # -+ # When override port was always set to 8443 the RestClient could -+ # pick a remote server and since 8443 isn't in our firewall profile -+ # setting up a new server would fail. -+ try: -+ with api.Backend.ra_certprofile as profile_api: -+ if profile_api.ca_host == api.env.host: -+ api.Backend.ra_certprofile.override_port = 8443 -+ except (errors.NetworkError, errors.RemoteRetrieveError) as e: -+ logger.debug('Overriding CA port: %s', e) -+ api.Backend.ra_certprofile.override_port = 8443 - - for (profile_id, desc, store_issued) in dogtag.INCLUDED_PROFILES: - dn = DN(('cn', profile_id), --- -2.34.1 - diff --git a/SOURCES/0008-Remove-ipa-join-errors-from-behind-the-debug-option_rhbz#2048558.patch b/SOURCES/0008-Remove-ipa-join-errors-from-behind-the-debug-option_rhbz#2048558.patch deleted file mode 100644 index e083b06..0000000 --- a/SOURCES/0008-Remove-ipa-join-errors-from-behind-the-debug-option_rhbz#2048558.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 7c5540bb47799b4db95673d22f61995ad5c56440 Mon Sep 17 00:00:00 2001 -From: Rob Crittenden -Date: Mon, 31 Jan 2022 17:31:50 -0500 -Subject: [PATCH] Remove ipa-join errors from behind the debug option - -This brings it inline with the previous XML-RPC output which -only hid the request and response from the output and not -any errors returned. - -https://pagure.io/freeipa/issue/9103 - -Signed-off-by: Rob Crittenden -Reviewed-By: Florence Blanc-Renaud -Reviewed-By: Peter Keresztes Schmidt ---- - client/ipa-join.c | 27 +++++++++------------------ - 1 file changed, 9 insertions(+), 18 deletions(-) - -diff --git a/client/ipa-join.c b/client/ipa-join.c -index d98739a9a..5888a33bf 100644 ---- a/client/ipa-join.c -+++ b/client/ipa-join.c -@@ -743,8 +743,7 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response - - json_str = json_dumps(json, 0); - if (!json_str) { -- if (debug) -- fprintf(stderr, _("json_dumps() failed\n")); -+ fprintf(stderr, _("json_dumps() failed\n")); - - rval = 17; - goto cleanup; -@@ -758,8 +757,7 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response - CURLcode res = curl_easy_perform(curl); - if (res != CURLE_OK) - { -- if (debug) -- fprintf(stderr, _("JSON-RPC call failed: %s\n"), curl_easy_strerror(res)); -+ fprintf(stderr, _("JSON-RPC call failed: %s\n"), curl_easy_strerror(res)); - - rval = 17; - goto cleanup; -@@ -769,8 +767,7 @@ jsonrpc_request(const char *ipaserver, const json_t *json, curl_buffer *response - curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &resp_code); - - if (resp_code != 200) { -- if (debug) -- fprintf(stderr, _("JSON-RPC call failed with status code: %li\n"), resp_code); -+ fprintf(stderr, _("JSON-RPC call failed with status code: %li\n"), resp_code); - - if (!quiet && resp_code == 401) - fprintf(stderr, _("JSON-RPC call was unauthorized. Check your credentials.\n")); -@@ -848,8 +845,7 @@ jsonrpc_parse_response(const char *payload, json_t** j_result_obj, bool quiet) { - - j_root = json_loads(payload, 0, &j_error); - if (!j_root) { -- if (debug) -- fprintf(stderr, _("Parsing JSON-RPC response failed: %s\n"), j_error.text); -+ fprintf(stderr, _("Parsing JSON-RPC response failed: %s\n"), j_error.text); - - rval = 17; - goto cleanup; -@@ -864,8 +860,7 @@ jsonrpc_parse_response(const char *payload, json_t** j_result_obj, bool quiet) { - - *j_result_obj = json_object_get(j_root, "result"); - if (!*j_result_obj) { -- if (debug) -- fprintf(stderr, _("Parsing JSON-RPC response failed: no 'result' value found.\n")); -+ fprintf(stderr, _("Parsing JSON-RPC response failed: no 'result' value found.\n")); - - rval = 17; - goto cleanup; -@@ -897,8 +892,7 @@ jsonrpc_parse_join_response(const char *payload, join_info *join_i, bool quiet) - &tmp_hostdn, - "krbprincipalname", &tmp_princ, - "krblastpwdchange", &tmp_pwdch) != 0) { -- if (debug) -- fprintf(stderr, _("Extracting the data from the JSON-RPC response failed: %s\n"), j_error.text); -+ fprintf(stderr, _("Extracting the data from the JSON-RPC response failed: %s\n"), j_error.text); - - rval = 17; - goto cleanup; -@@ -941,8 +935,7 @@ join_krb5_jsonrpc(const char *ipaserver, const char *hostname, char **hostdn, co - "nshardwareplatform", uinfo.machine); - - if (!json_req) { -- if (debug) -- fprintf(stderr, _("json_pack_ex() failed: %s\n"), j_error.text); -+ fprintf(stderr, _("json_pack_ex() failed: %s\n"), j_error.text); - - rval = 17; - goto cleanup; -@@ -990,8 +983,7 @@ jsonrpc_parse_unenroll_response(const char *payload, bool* result, bool quiet) { - - if (json_unpack_ex(j_result_obj, &j_error, 0, "{s:b}", - "result", result) != 0) { -- if (debug) -- fprintf(stderr, _("Extracting the data from the JSON-RPC response failed: %s\n"), j_error.text); -+ fprintf(stderr, _("Extracting the data from the JSON-RPC response failed: %s\n"), j_error.text); - - rval = 20; - goto cleanup; -@@ -1021,8 +1013,7 @@ jsonrpc_unenroll_host(const char *ipaserver, const char *host, bool quiet) { - host); - - if (!json_req) { -- if (debug) -- fprintf(stderr, _("json_pack_ex() failed: %s\n"), j_error.text); -+ fprintf(stderr, _("json_pack_ex() failed: %s\n"), j_error.text); - - rval = 17; - goto cleanup; --- -2.34.1 - diff --git a/SOURCES/0009-Enable-the-ccache-sweep-timer-during-installation_rhbz#2051575.patch b/SOURCES/0009-Enable-the-ccache-sweep-timer-during-installation_rhbz#2051575.patch deleted file mode 100644 index ef581d8..0000000 --- a/SOURCES/0009-Enable-the-ccache-sweep-timer-during-installation_rhbz#2051575.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 9b6d0bb1245c4891ccc270f360d0f72a4b1444c1 Mon Sep 17 00:00:00 2001 -From: Rob Crittenden -Date: Mon, 7 Feb 2022 10:39:55 -0500 -Subject: [PATCH] Enable the ccache sweep timer during installation - -The timer was only being enabled during package installation -if IPA was configured. So effectively only on upgrade. - -Add as a separate installation step after the ccache directory -is configured. - -Fixes: https://pagure.io/freeipa/issue/9107 - -Signed-off-by: Rob Crittenden -Reviewed-By: Alexander Bokovoy ---- - ipaserver/install/httpinstance.py | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py -index 732bb58d4..50ccf5e50 100644 ---- a/ipaserver/install/httpinstance.py -+++ b/ipaserver/install/httpinstance.py -@@ -140,6 +140,8 @@ class HTTPInstance(service.Service): - self.step("publish CA cert", self.__publish_ca_cert) - self.step("clean up any existing httpd ccaches", - self.remove_httpd_ccaches) -+ self.step("enable ccache sweep", -+ self.enable_ccache_sweep) - self.step("configuring SELinux for httpd", self.configure_selinux_for_httpd) - if not self.is_kdcproxy_configured(): - self.step("create KDC proxy config", self.create_kdcproxy_conf) -@@ -177,6 +179,11 @@ class HTTPInstance(service.Service): - [paths.SYSTEMD_TMPFILES, '--create', '--prefix', paths.IPA_CCACHES] - ) - -+ def enable_ccache_sweep(self): -+ ipautil.run( -+ [paths.SYSTEMCTL, 'enable', 'ipa-ccache-sweep.timer'] -+ ) -+ - def __configure_http(self): - self.update_httpd_service_ipa_conf() - self.update_httpd_wsgi_conf() --- -2.34.1 - -From 0d9eb3d515385412abefe9c33e0099ea14f33cbc Mon Sep 17 00:00:00 2001 -From: Mohammad Rizwan -Date: Wed, 9 Feb 2022 18:56:21 +0530 -Subject: [PATCH] Test ipa-ccache-sweep.timer enabled by default during - installation - -This test checks that ipa-ccache-sweep.timer is enabled by default -during the ipa installation. - -related: https://pagure.io/freeipa/issue/9107 - -Signed-off-by: Mohammad Rizwan -Reviewed-By: Alexander Bokovoy ---- - .../test_integration/test_installation.py | 19 +++++++++++++++++-- - 1 file changed, 17 insertions(+), 2 deletions(-) - -diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py -index f2d372c0c..63edbaa2b 100644 ---- a/ipatests/test_integration/test_installation.py -+++ b/ipatests/test_integration/test_installation.py -@@ -475,7 +475,7 @@ class TestInstallCA(IntegrationTest): - - # Tweak sysrestore.state to drop installation section - self.master.run_command( -- ['sed','-i', r's/\[installation\]/\[badinstallation\]/', -+ ['sed', '-i', r's/\[installation\]/\[badinstallation\]/', - os.path.join(paths.SYSRESTORE, SYSRESTORE_STATEFILE)]) - - # Re-run installation check and it should fall back to old method -@@ -485,7 +485,7 @@ class TestInstallCA(IntegrationTest): - - # Restore installation section. - self.master.run_command( -- ['sed','-i', r's/\[badinstallation\]/\[installation\]/', -+ ['sed', '-i', r's/\[badinstallation\]/\[installation\]/', - os.path.join(paths.SYSRESTORE, SYSRESTORE_STATEFILE)]) - - # Uninstall and confirm that the old method reports correctly -@@ -690,6 +690,7 @@ def get_pki_tomcatd_pid(host): - break - return(pid) - -+ - def get_ipa_services_pids(host): - ipa_services_name = [ - "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia", -@@ -1309,6 +1310,20 @@ class TestInstallMasterKRA(IntegrationTest): - def test_install_master(self): - tasks.install_master(self.master, setup_dns=False, setup_kra=True) - -+ def test_ipa_ccache_sweep_timer_enabled(self): -+ """Test ipa-ccache-sweep.timer enabled by default during installation -+ -+ This test checks that ipa-ccache-sweep.timer is enabled by default -+ during the ipa installation. -+ -+ related: https://pagure.io/freeipa/issue/9107 -+ """ -+ result = self.master.run_command( -+ ['systemctl', 'is-enabled', 'ipa-ccache-sweep.timer'], -+ raiseonerr=False -+ ) -+ assert 'enabled' in result.stdout_text -+ - def test_install_dns(self): - tasks.install_dns(self.master) - --- -2.34.1 - diff --git a/SOURCES/0010-ipatests-remove-additional-check-for-failed-units_rhbz#2053024.patch b/SOURCES/0010-ipatests-remove-additional-check-for-failed-units_rhbz#2053024.patch deleted file mode 100644 index c384f15..0000000 --- a/SOURCES/0010-ipatests-remove-additional-check-for-failed-units_rhbz#2053024.patch +++ /dev/null @@ -1,31 +0,0 @@ -From b36bcf4ea5ed93baa4dc63f8e2be542d678211fb Mon Sep 17 00:00:00 2001 -From: Anuja More -Date: Thu, 10 Feb 2022 18:49:06 +0530 -Subject: [PATCH] ipatests: remove additional check for failed units. - -On RHEL tests are randomly failing because of this check -and the test doesn't need to check this. - -Related : https://pagure.io/freeipa/issue/9108 - -Signed-off-by: Anuja More -Reviewed-By: Florence Blanc-Renaud ---- - ipatests/test_integration/test_otp.py | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/ipatests/test_integration/test_otp.py b/ipatests/test_integration/test_otp.py -index d8ce527ca..6e70ddcb3 100644 ---- a/ipatests/test_integration/test_otp.py -+++ b/ipatests/test_integration/test_otp.py -@@ -316,7 +316,6 @@ class TestOTPToken(IntegrationTest): - check_services = self.master.run_command( - ['systemctl', 'list-units', '--state=failed'] - ) -- assert "0 loaded units listed" in check_services.stdout_text - assert "ipa-otpd" not in check_services.stdout_text - # Be sure no services are running and failed units - self.master.run_command(['killall', 'ipa-otpd'], raiseonerr=False) --- -2.34.1 - diff --git a/SOURCES/0011-ipa_cldap-fix-memory-leak_rhbz#2032738.patch b/SOURCES/0011-ipa_cldap-fix-memory-leak_rhbz#2032738.patch deleted file mode 100644 index 3c8109e..0000000 --- a/SOURCES/0011-ipa_cldap-fix-memory-leak_rhbz#2032738.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 186ebe311bc9545d7a9860cd5e8c748131bbe41e Mon Sep 17 00:00:00 2001 -From: Francisco Trivino -Date: Thu, 10 Feb 2022 14:23:12 +0100 -Subject: [PATCH] ipa_cldap: fix memory leak - -ipa_cldap_encode_netlogon() allocates memory to store binary data as part of -berval (bv_val) when processing a CLDAP packet request from a worker. The -data is used by ipa_cldap_respond() but bv_val is not freed later on. - -This commit is adding the corresponding free() after ipa_cldap_respond() -is completed. - -Discovered by LeakSanitizer - -Fixes: https://pagure.io/freeipa/issue/9110 -Signed-off-by: Francisco Trivino -Reviewed-By: Alexander Bokovoy -Reviewed-By: Rob Crittenden -Reviewed-By: Thierry Bordaz ---- - daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c -index db4a3d061..252bcf647 100644 ---- a/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c -+++ b/daemons/ipa-slapi-plugins/ipa-cldap/ipa_cldap_worker.c -@@ -287,6 +287,7 @@ done: - ipa_cldap_respond(ctx, req, &reply); - - ipa_cldap_free_kvps(&req->kvps); -+ free(reply.bv_val); - free(req); - return; - } --- -2.34.1 - diff --git a/SOURCES/0012-ipatests-fix-TestOTPToken-test_check_otpd_after_idle_timeout_rhbz#2053024.patch b/SOURCES/0012-ipatests-fix-TestOTPToken-test_check_otpd_after_idle_timeout_rhbz#2053024.patch deleted file mode 100644 index e7081cd..0000000 --- a/SOURCES/0012-ipatests-fix-TestOTPToken-test_check_otpd_after_idle_timeout_rhbz#2053024.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 4c54e9d6ddb72eab6f654bf3dc2d29f27498ac96 Mon Sep 17 00:00:00 2001 -From: Florence Blanc-Renaud -Date: Sun, 5 Dec 2021 17:38:58 +0100 -Subject: [PATCH] ipatests: fix - TestOTPToken::test_check_otpd_after_idle_timeout - -The test sets 389-ds nsslapd-idletimeout to 60s, then does a -kinit with an otp token (which makes ipa-otpd create a LDAP -connection), then sleeps for 60s. The expectation is that -ns-slapd will detect that the LDAP conn from ipa-otpd is idle -and close the connection. -According to 389ds doc, the idle timeout is enforced when the -connection table is walked. By doing a ldapsearch, the test -"wakes up" ns-slapd and forces the detection of ipa-otpd -idle connection. - -Fixes: https://pagure.io/freeipa/issue/9044 -Signed-off-by: Florence Blanc-Renaud -Reviewed-By: Anuja More ---- - ipatests/test_integration/test_otp.py | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/ipatests/test_integration/test_otp.py b/ipatests/test_integration/test_otp.py -index 353470897..d8ce527ca 100644 ---- a/ipatests/test_integration/test_otp.py -+++ b/ipatests/test_integration/test_otp.py -@@ -354,6 +354,9 @@ class TestOTPToken(IntegrationTest): - otpvalue = totp.generate(int(time.time())).decode("ascii") - kinit_otp(self.master, USER, password=PASSWORD, otp=otpvalue) - time.sleep(60) -+ # ldapsearch will wake up slapd and force walking through -+ # the connection list, in order to spot the idle connections -+ tasks.ldapsearch_dm(self.master, "", ldap_args=[], scope="base") - - def test_cb(cmd_jornalctl): - # check if LDAP connection is timed out --- -2.34.1 - diff --git a/SOURCES/1002-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch b/SOURCES/1002-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch new file mode 100644 index 0000000..e1a74ff --- /dev/null +++ b/SOURCES/1002-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch @@ -0,0 +1,69 @@ +From 0d44e959e5bbe822b51137a8e7cf48fa25533805 Mon Sep 17 00:00:00 2001 +From: Rafael Guterres Jeffman +Date: Fri, 10 Dec 2021 12:15:36 -0300 +Subject: [PATCH] Revert "freeipa.spec: depend on bind-dnssec-utils" + +This reverts commit f89d59b6e18b54967682f6a37ce92ae67ab3fcda. +--- + freeipa.spec.in | 4 +--- + ipaplatform/base/paths.py | 2 +- + ipaplatform/fedora/paths.py | 1 + + ipaserver/dnssec/bindmgr.py | 1 - + 4 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/freeipa.spec.in b/freeipa.spec.in +index 8f5c370e5..e20edb7bc 100755 +--- a/freeipa.spec.in ++++ b/freeipa.spec.in +@@ -576,11 +576,9 @@ Requires: %{name}-server = %{version}-%{release} + Requires: bind-dyndb-ldap >= 11.2-2 + Requires: bind >= %{bind_version} + Requires: bind-utils >= %{bind_version} +-# bind-dnssec-utils is required by the OpenDNSSec integration +-# https://pagure.io/freeipa/issue/9026 +-Requires: bind-dnssec-utils >= %{bind_version} + %if %{with bind_pkcs11} + Requires: bind-pkcs11 >= %{bind_version} ++Requires: bind-pkcs11-utils >= %{bind_version} + %else + Requires: softhsm >= %{softhsm_version} + Requires: openssl-pkcs11 >= %{openssl_pkcs11_version} +diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py +index 7d21367ec..42a47f1df 100644 +--- a/ipaplatform/base/paths.py ++++ b/ipaplatform/base/paths.py +@@ -259,7 +259,6 @@ class BasePathNamespace: + IPA_PKI_RETRIEVE_KEY = "/usr/libexec/ipa/ipa-pki-retrieve-key" + IPA_HTTPD_PASSWD_READER = "/usr/libexec/ipa/ipa-httpd-pwdreader" + IPA_PKI_WAIT_RUNNING = "/usr/libexec/ipa/ipa-pki-wait-running" +- DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel" ++ DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel-pkcs11" +- DNSSEC_KEYFROMLABEL_9_17 = "/usr/bin/dnssec-keyfromlabel" + GETSEBOOL = "/usr/sbin/getsebool" + GROUPADD = "/usr/sbin/groupadd" +diff --git a/ipaplatform/fedora/paths.py b/ipaplatform/fedora/paths.py +index 4e993c063..92a948966 100644 +--- a/ipaplatform/fedora/paths.py ++++ b/ipaplatform/fedora/paths.py +@@ -36,6 +36,7 @@ class FedoraPathNamespace(RedHatPathNamespace): + NAMED_CRYPTO_POLICY_FILE = "/etc/crypto-policies/back-ends/bind.config" + if HAS_NFS_CONF: + SYSCONFIG_NFS = '/etc/nfs.conf' ++ DNSSEC_KEYFROMLABEL = "/usr/sbin/dnssec-keyfromlabel" + + + paths = FedoraPathNamespace() +diff --git a/ipaserver/dnssec/bindmgr.py b/ipaserver/dnssec/bindmgr.py +index 0c79cc03d..a15c0e601 100644 +--- a/ipaserver/dnssec/bindmgr.py ++++ b/ipaserver/dnssec/bindmgr.py +@@ -127,7 +127,6 @@ class BINDMgr: + ) + cmd = [ + paths.DNSSEC_KEYFROMLABEL, +- '-E', 'pkcs11', + '-K', workdir, + '-a', attrs['idnsSecAlgorithm'][0], + '-l', uri +-- +2.31.1 diff --git a/SOURCES/1101-Harden-FreeIPA-KDC-processing-of-PAC-buffers-20211130.patch b/SOURCES/1101-Harden-FreeIPA-KDC-processing-of-PAC-buffers-20211130.patch deleted file mode 100644 index 48bb8e0..0000000 --- a/SOURCES/1101-Harden-FreeIPA-KDC-processing-of-PAC-buffers-20211130.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 7d93bda31ce0b4e0e22c6e464c9138800dcf8b1c Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 26 Nov 2021 11:13:51 +0200 -Subject: [PATCH] ipa-kdb: fix requester SID check according to MS-KILE and - MS-SFU updates - -New versions of MS-KILE and MS-SFU after Windows Server November 2021 -security updates add PAC_REQUESTER_SID buffer check behavior: - - - PAC_REQUESTER_SID should only be added for TGT requests - - - if PAC_REQUESTER_SID is present, KDC must verify that the cname on - the ticket resolves to the account with the same SID as the - PAC_REQUESTER_SID. If it doesn't KDC must respond with - KDC_ERR_TKT_REVOKED - -Change requester SID check to skip exact check for non-local -PAC_REQUESTER_SID but harden to ensure it comes from the trusted domains -we know about. - -If requester SID is the same as in PAC, we already do cname vs PAC SID -verification. - -With these changes FreeIPA works against Windows Server 2019 with -November 2021 security fixes in cross-realm S4U2Self operations. - -Fixes: https://pagure.io/freeipa/issue/9031 - -Signed-off-by: Alexander Bokovoy -Reviewed-By: Rob Crittenden ---- - daemons/ipa-kdb/ipa_kdb_mspac.c | 47 ++++++++++++++++++++++++--------- - 1 file changed, 34 insertions(+), 13 deletions(-) - -diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c -index 538cfbba9..1b972c167 100644 ---- a/daemons/ipa-kdb/ipa_kdb_mspac.c -+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c -@@ -1697,7 +1697,7 @@ static krb5_error_code check_logon_info_consistent(krb5_context context, - "local [%s], PAC [%s]", - dom ? dom : "", - sid ? sid : ""); -- return KRB5KDC_ERR_POLICY; -+ return KRB5KDC_ERR_TGT_REVOKED; - } - } - -@@ -1709,7 +1709,7 @@ static krb5_error_code check_logon_info_consistent(krb5_context context, - kerr = ipadb_get_principal(context, client_princ, flags, &client_actual); - if (kerr != 0) { - krb5_klog_syslog(LOG_ERR, "PAC issue: ipadb_get_principal failed."); -- return KRB5KDC_ERR_POLICY; -+ return KRB5KDC_ERR_TGT_REVOKED; - } - - ied = (struct ipadb_e_data *)client_actual->e_data; -@@ -1743,7 +1743,7 @@ static krb5_error_code check_logon_info_consistent(krb5_context context, - "local [%s] vs PAC [%s]", - local_sid ? local_sid : "", - pac_sid ? pac_sid : ""); -- kerr = KRB5KDC_ERR_POLICY; -+ kerr = KRB5KDC_ERR_TGT_REVOKED; - goto done; - } - -@@ -2005,22 +2005,43 @@ static krb5_error_code ipadb_check_logon_info(krb5_context context, - /* Check that requester SID is the same as in the PAC entry */ - if (requester_sid != NULL) { - struct dom_sid client_sid; -+ bool is_from_trusted_domain = false; - kerr = ipadb_get_sid_from_pac(tmpctx, info.info, &client_sid); - if (kerr) { - goto done; - } - result = dom_sid_check(&client_sid, requester_sid, true); - if (!result) { -- /* memctx is freed by the caller */ -- char *pac_sid = dom_sid_string(tmpctx, &client_sid); -- char *req_sid = dom_sid_string(tmpctx, requester_sid); -- krb5_klog_syslog(LOG_ERR, "PAC issue: PAC has a SID " -- "different from what PAC requester claims. " -- "PAC [%s] vs PAC requester [%s]", -- pac_sid ? pac_sid : "", -- req_sid ? req_sid : ""); -- kerr = KRB5KDC_ERR_POLICY; -- goto done; -+ struct ipadb_context *ipactx = ipadb_get_context(context); -+ if (!ipactx || !ipactx->mspac) { -+ return KRB5_KDB_DBNOTINITED; -+ } -+ /* In S4U case we might be dealing with the PAC issued by the trusted domain */ -+ if (is_s4u && (ipactx->mspac->trusts != NULL)) { -+ /* Iterate through list of trusts and check if this SID belongs to -+ * one of the domains we trust */ -+ for(int i = 0 ; i < ipactx->mspac->num_trusts ; i++) { -+ result = dom_sid_check(&ipactx->mspac->trusts[i].domsid, -+ requester_sid, false); -+ if (result) { -+ is_from_trusted_domain = true; -+ break; -+ } -+ } -+ } -+ -+ if (!is_from_trusted_domain) { -+ /* memctx is freed by the caller */ -+ char *pac_sid = dom_sid_string(tmpctx, &client_sid); -+ char *req_sid = dom_sid_string(tmpctx, requester_sid); -+ krb5_klog_syslog(LOG_ERR, "PAC issue: PAC has a SID " -+ "different from what PAC requester claims. " -+ "PAC [%s] vs PAC requester [%s]", -+ pac_sid ? pac_sid : "", -+ req_sid ? req_sid : ""); -+ kerr = KRB5KDC_ERR_TGT_REVOKED; -+ goto done; -+ } - } - } - --- -2.31.1 - diff --git a/SOURCES/freeipa-4.9.10.tar.gz.asc b/SOURCES/freeipa-4.9.10.tar.gz.asc new file mode 100644 index 0000000..2804c24 --- /dev/null +++ b/SOURCES/freeipa-4.9.10.tar.gz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCAAdFiEE11Z2TU1+KXxtrRFyaYdvcqbi008FAmKp71wACgkQaYdvcqbi +008rbg/9G5w7KXgJcrhwBx5qqd4fqzSnwJdyN5oaBIEKNsAigMD7LIYawqgnO3g/ +/3FmJTbeCrOj9EoakvE1YNRT+75oxAO+rMFcRvFHlJyfMCa3r3lrS4LrlQiiyNwZ +IHovcXr0Q3fizhp/V3acyZqx2pbnSh24CK4q5a1CNUs8SPkEFcOfpAJIMQCHeH6t +ScfxuWOp8R1FnaNQc/9x3vy3ySQbHMxIWLSfJy7pk7FhLGAvgVNQBAz70Bg7BfR1 +R1V6syGeaPmqLOQw0jV05YMxyKwkbnSK/h2DlCg/iNQ/S71rXhOpuk01dDf73CI4 +Fu1H9TX50Indq31+4qbOlKZqDshhNzRRpn2m2qVvzeTfObHlZMbYNyVamovP9fEZ +pfJcppI8aNDURjqpf/sVy4G8mhI5FQS+Q7bKvv9C04iE3XpTutg8q5mLMXGwWekY +yeklBAmdygOKsY1uWb7BCH9eoWCVWKIwi4m5uYteZNxBt4aqsa/VFsxCE1P2T7/S ++yc1Jo7hXWW8v3wm+dIGJj+Lz9YlJxC9SAiC72a6kTwIe2gnKlxoYbqe/18hEWm6 +0jESl2LiXfBhXz0YQlv2HjcPWZMMrNuhSCGTMgzP8KfZB258mtxpbBTk5/e9Wgsk +29GCfaMWFUqZsrteG10HT/P6cotre6EVffQl9lNlPNQpX+DUKy4= +=azus +-----END PGP SIGNATURE----- diff --git a/SOURCES/freeipa-4.9.8.tar.gz.asc b/SOURCES/freeipa-4.9.8.tar.gz.asc deleted file mode 100644 index c14420c..0000000 --- a/SOURCES/freeipa-4.9.8.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABCAAdFiEE11Z2TU1+KXxtrRFyaYdvcqbi008FAmGf1XcACgkQaYdvcqbi -00/kMQ//Vano94V0/L3YsLaqKiFcGo/py5pTq1Os3wB9zzCYSuU0P/eajuHLBYNe -MfxecZihFFlmUdNooNWbewT4CE0ey1qFLwPfGXuLrse6fXVLLaYnAv2mkPUmDSpM -XfXO0PFU0BtdkMAUsdUATngPCpQzYjVUKsAMwPovi3UcLzFZ8tWJKMA55urhwC4q -E042wPLqzcX6Ee5JBSBkfNe35vG2LY7o3Ynh8SVCee2lBJvdWiuFT5XRhybXUsOp -q3eTsVPz68p7CvOrjlLSsWPP0nbGF1O1UQsN+oaDZAav1Nx8lTOlxUCUQXWbs2X6 -BTUAOmZ6VjYu61sNgNSj+BSHlHIT3uRJ55JO5nLH/hLm0Oxn6SGRTVMueqV376QA -CsIk7UrdcX9QUtu70eRxuu1aAWJ5eaF4GDWnFP+62wzd/d6LjWEE+9kXgvrcTF0C -UzjWrmbI8x23bB4kqcROHz8lryMsBpZ94QKPHVppMiPgapDKRkculYkSeRLboADi -q4mh2prkDSq9diWV4HvZTGwPU77oiLrQsvbGuvwD62PAlyQ4rZpfW3FllTL2Lcxy -urA8a9UnQWQtDOsZIyxmMJ7R04gjI5fZfDhq6S09L9MfjFEKjsqO4FzXamj+SbAo -w25sIp1qT0sV1vOt+/R/HYSIyggQyTZpQJu5UB34QLqpfDdUwFg= -=t9up ------END PGP SIGNATURE----- diff --git a/SPECS/ipa.spec b/SPECS/ipa.spec index c2fd678..d53f198 100644 --- a/SPECS/ipa.spec +++ b/SPECS/ipa.spec @@ -146,8 +146,8 @@ # RHEL 8.2+, F32+ has 3.58 %global nss_version 3.44.0-4 -# RHEL 8.3+, F32+ -%global sssd_version 2.4.0 +# RHEL 8.7+, F35+, adds IdP integration +%global sssd_version 2.7.0 %define krb5_base_version %(LC_ALL=C /usr/bin/pkgconf --modversion krb5 | grep -Eo '^[^.]+\.[^.]+' || echo %krb5_version) %global kdcproxy_version 0.4-3 @@ -178,7 +178,7 @@ # Work-around fact that RPM SPEC parser does not accept # "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement -%define IPA_VERSION 4.9.8 +%define IPA_VERSION 4.9.10 # Release candidate version -- uncomment with one percent for RC versions #%%global rc_version %%nil %define AT_SIGN @ @@ -191,7 +191,7 @@ Name: %{package_name} Version: %{IPA_VERSION} -Release: 6%{?rc_version:.%rc_version}%{?dist} +Release: 3%{?rc_version:.%rc_version}%{?dist} Summary: The Identity, Policy and Audit system License: GPLv3+ @@ -211,23 +211,15 @@ Source1: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_vers # RHEL spec file only: START %if %{NON_DEVELOPER_BUILD} %if 0%{?rhel} >= 8 -Patch0001: 0001-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch -Patch0002: 0002-Config-plugin-return-EmptyModlist-when-no-change-is-applied_rhbz#2031825.patch -Patch0003: 0003-Custodia-use-a-stronger-encryption-algo-when-exporting-keys_rhbz#2032806.patch -Patch0004: 0004-ipa-kdb-do-not-remove-keys-for-hardened-auth-enabled-users_rhbz#2033342.patch -Patch0005: 0005-ipa-pki-proxy.conf-provide-access-to-kra-admin-kra-getStatus_rhbz#2049167.patch -Patch0006: 0006-Backport-latest-test-fxes-in-python3-ipatests_rhbz#2048509.patch -Patch0007: 0007-Don-t-always-override-the-port-in-import_included_profiles_rhbz#2022483.patch -Patch0008: 0008-Remove-ipa-join-errors-from-behind-the-debug-option_rhbz#2048558.patch -Patch0009: 0009-Enable-the-ccache-sweep-timer-during-installation_rhbz#2051575.patch -Patch0010: 0010-ipatests-remove-additional-check-for-failed-units_rhbz#2053024.patch -Patch0011: 0011-ipa_cldap-fix-memory-leak_rhbz#2032738.patch -Patch0012: 0012-ipatests-fix-TestOTPToken-test_check_otpd_after_idle_timeout_rhbz#2053024.patch +Patch0001: 0001-ipa-otpd-Fix-build-on-older-versions-of-gcc.patch +Patch0002: 0002-webui-IdP-Remove-arrow-notation-due-to-uglify-js-lim.patch +Patch0003: 0003-Preserve-user-fix-the-confusing-summary_rhbz#2022028.patch +Patch0004: 0004-Only-calculate-LDAP-password-grace-when-the-password_rhbz#782917.patch Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch +Patch1002: 1002-Revert-freeipa.spec-depend-on-bind-dnssec-utils.patch %endif %endif # RHEL spec file only: END -Patch1101: 1101-Harden-FreeIPA-KDC-processing-of-PAC-buffers-20211130.patch # For the timestamp trick in patch application BuildRequires: diffstat @@ -324,7 +316,9 @@ BuildRequires: python3-wheel %if %{with doc} BuildRequires: python3-sphinx -BuildRequires: python3-m2r +BuildRequires: plantum1 +BuildRequires: fontconfig +BuildRequires: google-noto-sans-vf-fonts %endif # @@ -473,6 +467,8 @@ Requires: libpwquality Requires: cracklib-dicts # NDR libraries are internal in Samba and change with version without changing SONAME Requires: samba-client-libs >= %{samba_version} +# Due to RHBZ#2100916, libvert-libev is required by ipa-otp. +Requires: libverto-libev >= 0.3.2-1 Provides: %{alt_name}-server = %{version} Conflicts: %{alt_name}-server @@ -647,7 +643,12 @@ Requires: python3-sssdconfig >= %{sssd_version} Requires: cyrus-sasl-gssapi%{?_isa} Requires: chrony Requires: krb5-workstation >= %{krb5_version} -Requires: authselect >= 0.4-2 +# authselect: sssd profile with-subid +%if 0%{?fedora} >= 36 +Requires: authselect >= 1.4.0 +%else +Requires: authselect >= 1.2.5 +%endif Requires: curl # NIS domain name config: /usr/lib/systemd/system/*-domainname.service # All Fedora 28+ and RHEL8+ contain the service in hostname package @@ -659,6 +660,7 @@ Requires: xmlrpc-c >= 1.27.4 Requires: jansson %endif Requires: sssd-ipa >= %{sssd_version} +Requires: sssd-idp >= %{sssd_version} Requires: certmonger >= %{certmonger_version} Requires: nss-tools >= %{nss_version} Requires: bind-utils @@ -1050,6 +1052,7 @@ rm %{buildroot}/%{plugin_dir}/libipa_extdom_extop.la rm %{buildroot}/%{plugin_dir}/libipa_range_check.la rm %{buildroot}/%{plugin_dir}/libipa_otp_counter.la rm %{buildroot}/%{plugin_dir}/libipa_otp_lasttoken.la +rm %{buildroot}/%{plugin_dir}/libipa_graceperiod.la rm %{buildroot}/%{plugin_dir}/libtopology.la rm %{buildroot}/%{_libdir}/krb5/plugins/kdb/ipadb.la rm %{buildroot}/%{_libdir}/samba/pdb/ipasam.la @@ -1233,6 +1236,7 @@ if [ $1 -gt 1 ] ; then %{__python3} -c 'from ipaclient.install.client import configure_krb5_snippet; configure_krb5_snippet()' >>/var/log/ipaupgrade.log 2>&1 %{__python3} -c 'from ipaclient.install.client import update_ipa_nssdb; update_ipa_nssdb()' >>/var/log/ipaupgrade.log 2>&1 + chmod 0600 /var/log/ipaupgrade.lo SSH_CLIENT_SYSTEM_CONF="/etc/ssh/ssh_config" if [ -f "$SSH_CLIENT_SYSTEM_CONF" ]; then sed -E --in-place=.orig 's/^(HostKeyAlgorithms ssh-rsa,ssh-dss)$/# disabled by ipa-client update\n# \1/' "$SSH_CLIENT_SYSTEM_CONF" @@ -1408,6 +1412,7 @@ fi %attr(755,root,root) %{plugin_dir}/libipa_sidgen.so %attr(755,root,root) %{plugin_dir}/libipa_sidgen_task.so %attr(755,root,root) %{plugin_dir}/libipa_extdom_extop.so +%attr(755,root,root) %{plugin_dir}/libipa_graceperiod.so %attr(755,root,root) %{_libdir}/krb5/plugins/kdb/ipadb.so %{_mandir}/man1/ipa-replica-conncheck.1* %{_mandir}/man1/ipa-replica-install.1* @@ -1711,8 +1716,46 @@ fi # with selinux %endif - %changelog +* Thu Jul 07 2022 Rafael Jeffman - 4.9.10-3 +- Add explicit dependency for libvert-libev + Resolves: RHBZ#2104929 + +* Fri Jul 01 2022 Rafael Jeffman - 4.9.10-2 +- Preserve user: fix the confusing summary + Resolves: RHBZ#2022028 +- Only calculate LDAP password grace when the password is expired + Related: RHBZ#782917 + +* Wed Jun 15 2022 Rafael Jeffman - 4.9.10-1 +- Rebase to upstream release 4.9.10 + Remove upstream patches 0002 to 0016 that are part of version 4.9.10 + Remove patches 1101 that is part of version 4.9.10 + Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases + Add patches 0001 and 0002 to fix build on RHEL 8.7 + Resolves: RHBZ#2079466 + Resolves: RHBZ#2063155 + Resolves: RHBZ#1958777 + Resolves: RHBZ#2068088 + Resolves: RHBZ#2004646 + Resolves: RHBZ#782917 + Resolves: RHBZ#2059396 + Resolves: RHBZ#2092015 + +* Tue Apr 5 2022 Rafael Jeffman - 4.9.8-8 +- Backport latest test fixes in python3-ipatests + Resolves: RHBZ#2060841 +- extdom: user getorigby{user|group}name if available + Resolves: RHBZ#2062379 +- Set the mode on ipaupgrade.log during RPM post snipppet + Resolves: RHBZ#2061957 +- test_krbtpolicy: skip SPAKE-related tests in FIPS mode + Resolves: RHBZ#1909630 + +* Thu Feb 24 2022 Rafael Jeffman - 4.9.8-7 +- ipatests: Backport test fixes in python3-ipatests. + Resolves: RHBZ#2057505 + * Mon Feb 14 2022 Rafael Jeffman - 4.9.8-6 - ipatests: fix TestOTPToken::test_check_otpd_after_idle_timeout Related: RHBZ#2053024