diff --git a/.gitignore b/.gitignore
index eb27ffd..b6c4220 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/freeipa-4.8.7.tar.gz
+SOURCES/freeipa-4.9.0rc3.tar.gz
diff --git a/.ipa.metadata b/.ipa.metadata
index f2e66c8..359554f 100644
--- a/.ipa.metadata
+++ b/.ipa.metadata
@@ -1 +1 @@
-0099d799a77a757eeb4a95a69a38bdec24e45026 SOURCES/freeipa-4.8.7.tar.gz
+71c0691597296f321e093d9acb36677c26593a1f SOURCES/freeipa-4.9.0rc3.tar.gz
diff --git a/SOURCES/0001-WebUI-Fix-IPA-Error-3007-RequirmentError-while-addin_rhbz#1757045.patch b/SOURCES/0001-WebUI-Fix-IPA-Error-3007-RequirmentError-while-addin_rhbz#1757045.patch
deleted file mode 100644
index 34580fe..0000000
--- a/SOURCES/0001-WebUI-Fix-IPA-Error-3007-RequirmentError-while-addin_rhbz#1757045.patch
+++ /dev/null
@@ -1,409 +0,0 @@
-From c2ba333b9681d008d9c528a79dbdd76ce11a3ecd Mon Sep 17 00:00:00 2001
-From: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Date: Thu, 28 May 2020 08:47:49 +0200
-Subject: [PATCH 01/22] WebUI: Fix "IPA Error 3007: RequirmentError" while
- adding idoverrideuser association
-
-Add builder for association adder dialog which allows to override behavior of the component.
-Replace default implementation with a custom one for idoverrideuser.
-Replace text filter with 'ID view' select box in the idoverrideuser dialog.
-
-Ticket: https://pagure.io/freeipa/issue/8335
-
-Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- install/ui/src/freeipa/association.js | 13 ++++-
- install/ui/src/freeipa/dialog.js | 73 ++++++++++++++++-----------
- install/ui/src/freeipa/group.js | 14 +++++
- install/ui/src/freeipa/idviews.js | 58 +++++++++++++++++++++
- ipaserver/plugins/internal.py | 6 +++
- 5 files changed, 133 insertions(+), 31 deletions(-)
-
-diff --git a/install/ui/src/freeipa/association.js b/install/ui/src/freeipa/association.js
-index f10ccb2a5..b083a79f9 100644
---- a/install/ui/src/freeipa/association.js
-+++ b/install/ui/src/freeipa/association.js
-@@ -25,6 +25,7 @@
- define([
- 'dojo/_base/lang',
- 'dojo/Deferred',
-+ './builder',
- './metadata',
- './ipa',
- './jquery',
-@@ -38,7 +39,7 @@ define([
- './facet',
- './search',
- './dialog'],
-- function(lang, Deferred, metadata_provider, IPA, $, metadata,
-+ function(lang, Deferred, builder, metadata_provider, IPA, $, metadata,
- navigation, phases, reg, rpc, su, text) {
-
- /**
-@@ -1209,7 +1210,8 @@ exp.association_facet = IPA.association_facet = function (spec, no_init) {
-
- var pkeys = that.data.result.result[that.get_attribute_name()];
-
-- var dialog = IPA.association_adder_dialog({
-+ var dialog = builder.build('association_adder_dialog', {
-+ $type: that.other_entity.name,
- title: title,
- entity: that.entity,
- pkey: pkey,
-@@ -1675,6 +1677,13 @@ IPA.attr_read_only_evaluator = function(spec) {
- return that;
- };
-
-+// Create a registry for adder dialogs where key is name of 'other entity'.
-+// It allows to override dialogs for some specific cases of association
-+// creation.
-+var dialog_builder = builder.get('association_adder_dialog');
-+dialog_builder.factory = IPA.association_adder_dialog;
-+reg.set('association_adder_dialog', dialog_builder.registry);
-+
- phases.on('registration', function() {
- var w = reg.widget;
- var f = reg.field;
-diff --git a/install/ui/src/freeipa/dialog.js b/install/ui/src/freeipa/dialog.js
-index c153120df..d67d63b6d 100644
---- a/install/ui/src/freeipa/dialog.js
-+++ b/install/ui/src/freeipa/dialog.js
-@@ -919,35 +919,7 @@ IPA.adder_dialog = function(spec) {
- 'class': 'input-group col-md-12 adder-dialog-top'
- }).appendTo(container);
-
-- var filter_placeholder = text.get('@i18n:association.filter_placeholder');
-- filter_placeholder = filter_placeholder.replace('${other_entity}',
-- that.other_entity.metadata.label);
--
-- that.filter_field = $('<input/>', {
-- type: 'text',
-- name: 'filter',
-- 'class': 'form-control',
-- 'placeholder': filter_placeholder,
-- keyup: function(event) {
-- if (event.keyCode === keys.ENTER) {
-- that.search();
-- return false;
-- }
-- }
-- }).appendTo(input_group);
--
-- var input_group_btn = $('<div/>', {
-- 'class': 'input-group-btn'
-- }).appendTo(input_group);
--
-- that.find_button = IPA.button({
-- name: 'find',
-- label: '@i18n:buttons.filter',
-- click: function() {
-- that.search();
-- return false;
-- }
-- }).appendTo(input_group_btn);
-+ that.filter_field = that.get_filter_field(input_group);
-
- var row = $('<div/>', { 'class': 'row adder-dialog-main'}).appendTo(container);
- //
-@@ -1132,6 +1104,49 @@ IPA.adder_dialog = function(spec) {
- return that.filter_field.val();
- };
-
-+ /**
-+ * Return field for filtering available items
-+ *
-+ * Default implementation returns text input + "Filter" button.
-+ * It can be overridden.
-+ *
-+ * @param {HTMLElement} input_group - container for a filter field
-+ * @return {HTMLElement}
-+ */
-+ that.get_filter_field = function(input_group) {
-+ var filter_placeholder = text.get(
-+ '@i18n:association.filter_placeholder'
-+ ).replace('${other_entity}', that.other_entity.metadata.label);
-+
-+ var filter_field = $('<input/>', {
-+ type: 'text',
-+ name: 'filter',
-+ 'class': 'form-control',
-+ 'placeholder': filter_placeholder,
-+ keyup: function(event) {
-+ if (event.keyCode === keys.ENTER) {
-+ that.search();
-+ return false;
-+ }
-+ }
-+ }).appendTo(input_group);
-+
-+ var input_group_btn = $('<div/>', {
-+ 'class': 'input-group-btn'
-+ }).appendTo(input_group);
-+
-+ that.find_button = IPA.button({
-+ name: 'find',
-+ label: '@i18n:buttons.filter',
-+ click: function() {
-+ that.search();
-+ return false;
-+ }
-+ }).appendTo(input_group_btn);
-+
-+ return filter_field;
-+ };
-+
- /**
- * Clear rows in available table
- */
-diff --git a/install/ui/src/freeipa/group.js b/install/ui/src/freeipa/group.js
-index e46d8c7e3..2984bd4b2 100644
---- a/install/ui/src/freeipa/group.js
-+++ b/install/ui/src/freeipa/group.js
-@@ -205,6 +205,20 @@ return {
- add_title: '@i18n:objects.group.add_into_sudo',
- remove_method: 'remove_user',
- remove_title: '@i18n:objects.group.remove_from_sudo'
-+ },
-+ {
-+ $type: 'association',
-+ name: 'member_idoverrideuser',
-+ associator: IPA.serial_associator,
-+ add_title: '@i18n:objects.group.add_idoverride_user',
-+ remove_title: '@i18n:objects.group.remove_idoverride_users',
-+ columns: [
-+ {
-+ name: 'ipaanchoruuid',
-+ label: '@i18n:objects.idoverrideuser.anchor_label',
-+ link: false
-+ }
-+ ]
- }
- ],
- standard_association_facets: true,
-diff --git a/install/ui/src/freeipa/idviews.js b/install/ui/src/freeipa/idviews.js
-index 35dc998c8..a4fca6205 100644
---- a/install/ui/src/freeipa/idviews.js
-+++ b/install/ui/src/freeipa/idviews.js
-@@ -966,6 +966,58 @@ idviews.unapply_action = function(spec) {
- return that;
- };
-
-+idviews.idoverrideuser_adder_dialog = function(spec) {
-+
-+ spec = spec || {};
-+
-+ var that = IPA.association_adder_dialog(spec);
-+
-+ that.base_search = that.search;
-+
-+ that.search = function() {
-+ // Search for users only in case a ID view is selected
-+ if (that.get_filter()) {
-+ that.base_search();
-+ }
-+ };
-+
-+ /**
-+ * Replace default text filter with a select box for filtering by ID view
-+ */
-+ that.get_filter_field = function(input_group) {
-+
-+ var filter_field = $('<select/>', {
-+ name: 'filter',
-+ 'class': 'form-control',
-+ change: function(event) {
-+ that.search();
-+ }
-+ }).appendTo(input_group);
-+
-+ rpc.command({
-+ entity: 'idview',
-+ method: 'find',
-+ on_success: function(data) {
-+ var results = data.result;
-+
-+ for (var i=0; i<results.count; i++) {
-+ var result = results.result[i];
-+ $('<option/>', {
-+ text: result.cn[0],
-+ value: result.cn[0]
-+ }).appendTo(filter_field);
-+ }
-+
-+ that.search();
-+ }
-+ }).execute();
-+
-+ return filter_field;
-+ };
-+
-+ return that;
-+};
-+
- /**
- * ID View entity specification object
- * @member idviews
-@@ -993,6 +1045,7 @@ idviews.register = function() {
- var f = reg.facet;
- var a = reg.action;
- var w = reg.widget;
-+ var ad = reg.association_adder_dialog;
-
- e.register({type: 'idview', spec: idviews.spec});
- e.register({
-@@ -1012,6 +1065,11 @@ idviews.register = function() {
-
- w.register('idviews_certs', idviews.idviews_certs_widget);
- w.register('cert_textarea', idviews.cert_textarea_widget);
-+
-+ ad.register({
-+ type: 'idoverrideuser',
-+ factory: idviews.idoverrideuser_adder_dialog
-+ });
- };
-
- phases.on('registration', idviews.register);
-diff --git a/ipaserver/plugins/internal.py b/ipaserver/plugins/internal.py
-index 5f2b1fdc2..7622e65dc 100644
---- a/ipaserver/plugins/internal.py
-+++ b/ipaserver/plugins/internal.py
-@@ -835,6 +835,9 @@ class i18n_messages(Command):
- "Remove users from member managers for user group "
- "'${primary_key}'"
- ),
-+ "add_idoverride_user": _(
-+ "Add user ID override into user group '${primary_key}'"
-+ ),
- "details": _("Group Settings"),
- "external": _("External"),
- "groups": _("Groups"),
-@@ -868,6 +871,9 @@ class i18n_messages(Command):
- "remove_users": _(
- "Remove users from user group '${primary_key}'"
- ),
-+ "remove_idoverride_users": _(
-+ "Remove user ID overrides from user group '${primary_key}'"
-+ ),
- "type": _("Group Type"),
- "user_groups": _("User Groups"),
- },
---
-2.26.2
-
-From f6c460aee8542d4d81cd9970d71051c240156973 Mon Sep 17 00:00:00 2001
-From: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Date: Thu, 16 Jul 2020 18:52:24 +0200
-Subject: [PATCH] WebUI: Fix error "unknown command
- 'idoverrideuser_add_member'"
-
-There was wrong IPA.associator class used for 'Groups' -> 'User ID overrides' association,
-as a result a wrong command was sent to the server.
-
-Ticket: https://pagure.io/freeipa/issue/8416
-
-Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- install/ui/src/freeipa/group.js | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/install/ui/src/freeipa/group.js b/install/ui/src/freeipa/group.js
-index 2984bd4b2..61c19a82f 100644
---- a/install/ui/src/freeipa/group.js
-+++ b/install/ui/src/freeipa/group.js
-@@ -209,7 +209,6 @@ return {
- {
- $type: 'association',
- name: 'member_idoverrideuser',
-- associator: IPA.serial_associator,
- add_title: '@i18n:objects.group.add_idoverride_user',
- remove_title: '@i18n:objects.group.remove_idoverride_users',
- columns: [
---
-2.26.2
-
-From e35739b7e9f6bb016b37abbd92bdaee71a59a288 Mon Sep 17 00:00:00 2001
-From: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Date: Wed, 29 Jul 2020 09:41:36 +0200
-Subject: [PATCH] WebUI tests: Add test case to cover user ID override feature
-
-The test case includes adding an user ID override to Default Trust View
-and adding the ID override to some IPA group.
-
-Ticket: https://pagure.io/freeipa/issue/8416
-
-Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- ipatests/test_webui/test_trust.py | 41 +++++++++++++++++++++++++++++++
- 1 file changed, 41 insertions(+)
-
-diff --git a/ipatests/test_webui/test_trust.py b/ipatests/test_webui/test_trust.py
-index c04c2fcd8..605f8a2a7 100644
---- a/ipatests/test_webui/test_trust.py
-+++ b/ipatests/test_webui/test_trust.py
-@@ -21,6 +21,8 @@
- Trust tests
- """
-
-+import ipatests.test_webui.data_group as group
-+import ipatests.test_webui.data_idviews as idview
- from ipatests.test_webui.ui_driver import UI_driver
- from ipatests.test_webui.ui_driver import screenshot
- from ipatests.test_webui.task_range import range_tasks
-@@ -29,6 +31,8 @@ import pytest
- ENTITY = 'trust'
- CONFIG_ENTITY = 'trustconfig'
-
-+DEFAULT_TRUST_VIEW = 'Default Trust View'
-+
- CONFIG_DATA = {
- 'mod': [
- ['combobox', 'ipantfallbackprimarygroup', 'admins'],
-@@ -164,3 +168,40 @@ class test_trust(trust_tasks):
-
- self.mod_record(CONFIG_ENTITY, CONFIG_DATA)
- self.mod_record(CONFIG_ENTITY, CONFIG_DATA2)
-+
-+ @screenshot
-+ def test_group_member_idoverrideuser(self):
-+
-+ self.init_app()
-+
-+ # Create new trust
-+ data = self.get_data()
-+ self.add_record(ENTITY, data)
-+
-+ # Create an user ID override
-+ ad_domain = self.config.get('ad_domain')
-+ ad_admin = self.config.get('ad_admin')
-+ idoverrideuser_pkey = '{}@{}'.format(ad_admin, ad_domain).lower()
-+
-+ self.navigate_to_record(DEFAULT_TRUST_VIEW, entity=idview.ENTITY)
-+ self.add_record(idview.ENTITY, {
-+ 'pkey': idoverrideuser_pkey,
-+ 'add': [
-+ ('textbox', 'ipaanchoruuid_default', idoverrideuser_pkey),
-+ ],
-+ }, facet='idoverrideuser')
-+
-+ # Create new group and add the user ID override there
-+ self.navigate_to_entity(group.ENTITY)
-+ self.add_record(group.ENTITY, group.DATA)
-+ self.navigate_to_record(group.PKEY)
-+ self.add_associations([idoverrideuser_pkey],
-+ facet='member_idoverrideuser', delete=True)
-+
-+ # Clean up data
-+ self.navigate_to_entity(group.ENTITY)
-+ self.delete_record(group.PKEY)
-+ self.navigate_to_record(DEFAULT_TRUST_VIEW, entity=idview.ENTITY)
-+ self.delete_record(idoverrideuser_pkey)
-+ self.navigate_to_entity(ENTITY)
-+ self.delete_record(ad_domain)
---
-2.26.2
-
diff --git a/SOURCES/0002-EPN-does-not-ship-its-default-configuration_rhbz#1847999.patch b/SOURCES/0002-EPN-does-not-ship-its-default-configuration_rhbz#1847999.patch
deleted file mode 100644
index eec611f..0000000
--- a/SOURCES/0002-EPN-does-not-ship-its-default-configuration_rhbz#1847999.patch
+++ /dev/null
@@ -1,601 +0,0 @@
-From 77fae8c48bbe0f4499f4d8ed91b268568c64cd7c Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes@redhat.com>
-Date: Thu, 11 Jun 2020 11:17:25 +0200
-Subject: [PATCH] Move ipa-epn systemd files and run RPM hooks
-
-The init/systemd directory is for server only and not part of
-CLIENT_ONLY builds.
-
-It's necesary to run pre/post installation hooks to make systemd aware
-of new files.
-
-Fixes: https://pagure.io/freeipa/issue/8367
-Signed-off-by: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Francois Cami <fcami@redhat.com>
----
- .gitignore | 4 +--
- client/Makefile.am | 1 +
- client/share/Makefile.am | 5 ++++
- {install => client}/share/expire_msg.template | 0
- client/systemd/Makefile.am | 27 +++++++++++++++++++
- {init => client}/systemd/ipa-epn.service.in | 0
- {init => client}/systemd/ipa-epn.timer.in | 0
- configure.ac | 24 +++++++++++++++--
- freeipa.spec.in | 15 +++++++++++
- init/systemd/Makefile.am | 8 +++---
- install/share/Makefile.am | 5 ----
- server.m4 | 19 -------------
- 12 files changed, 76 insertions(+), 32 deletions(-)
- rename {install => client}/share/expire_msg.template (100%)
- create mode 100644 client/systemd/Makefile.am
- rename {init => client}/systemd/ipa-epn.service.in (100%)
- rename {init => client}/systemd/ipa-epn.timer.in (100%)
-
-#diff --git a/.gitignore b/.gitignore
-#index 6584c3b4f..4cedb1ff2 100644
-#--- a/.gitignore
-#+++ b/.gitignore
-#@@ -94,8 +94,6 @@ freeipa2-dev-doc
-# /init/ipa_memcached
-# /init/systemd/ipa-custodia.service
-# /init/systemd/ipa.service
-#-/init/systemd/ipa-epn.service
-#-/init/systemd/ipa-epn.timer
-# /init/tmpfilesd/ipa.conf
-#
-# !/install/ui/doc/Makefile.in
-#@@ -116,6 +114,8 @@ freeipa2-dev-doc
-# /client/ipa-getkeytab
-# /client/ipa-join
-# /client/ipa-rmkeytab
-#+/client/systemd/ipa-epn.service
-#+/client/systemd/ipa-epn.timer
-#
-# /ipaplatform/override.py
-# /ipapython/version.py
-diff --git a/client/Makefile.am b/client/Makefile.am
-index 858a9369e..87da87fcd 100644
---- a/client/Makefile.am
-+++ b/client/Makefile.am
-@@ -95,6 +95,7 @@ SUBDIRS = \
- share \
- man \
- sysconfig \
-+ systemd \
- $(NULL)
- # init
-
-diff --git a/client/share/Makefile.am b/client/share/Makefile.am
-index 6d4a62d5e..1402a3a9d 100644
---- a/client/share/Makefile.am
-+++ b/client/share/Makefile.am
-@@ -4,3 +4,8 @@ appdir = $(IPA_DATA_DIR)/client
- dist_app_DATA = \
- freeipa.template \
- $(NULL)
-+
-+epnconfdir = $(IPA_SYSCONF_DIR)/epn
-+dist_epnconf_DATA = \
-+ expire_msg.template \
-+ $(NULL)
-diff --git a/install/share/expire_msg.template b/client/share/expire_msg.template
-similarity index 100%
-rename from install/share/expire_msg.template
-rename to client/share/expire_msg.template
-diff --git a/client/systemd/Makefile.am b/client/systemd/Makefile.am
-new file mode 100644
-index 000000000..1f591be83
---- /dev/null
-+++ b/client/systemd/Makefile.am
-@@ -0,0 +1,27 @@
-+# This file will be processed with automake-1.7 to create Makefile.in
-+#
-+AUTOMAKE_OPTIONS = 1.7
-+
-+NULL =
-+
-+dist_noinst_DATA = \
-+ ipa-epn.service.in \
-+ ipa-epn.timer.in \
-+ $(NULL)
-+
-+systemdsystemunit_DATA = \
-+ ipa-epn.service \
-+ ipa-epn.timer \
-+ $(NULL)
-+
-+CLEANFILES = $(systemdsystemunit_DATA)
-+
-+%: %.in Makefile
-+ sed \
-+ -e 's|@bindir[@]|$(bindir)|g' \
-+ -e 's|@IPA_SYSCONF_DIR[@]|$(IPA_SYSCONF_DIR)|g' \
-+ -e 's|@localstatedir[@]|$(localstatedir)|g' \
-+ -e 's|@sbindir[@]|$(sbindir)|g' \
-+ -e 's|@libexecdir[@]|$(libexecdir)|g' \
-+ -e 's|@sysconfenvdir[@]|$(sysconfenvdir)|g' \
-+ '$(srcdir)/$@.in' >$@
-diff --git a/init/systemd/ipa-epn.service.in b/client/systemd/ipa-epn.service.in
-similarity index 100%
-rename from init/systemd/ipa-epn.service.in
-rename to client/systemd/ipa-epn.service.in
-diff --git a/init/systemd/ipa-epn.timer.in b/client/systemd/ipa-epn.timer.in
-similarity index 100%
-rename from init/systemd/ipa-epn.timer.in
-rename to client/systemd/ipa-epn.timer.in
-diff --git a/configure.ac b/configure.ac
-index 5ec529088..586b2532a 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -220,6 +220,25 @@ AC_ARG_WITH([runstatedir],
- [runstatedir="/run"])
- AC_SUBST([runstatedir])
-
-+dnl ---------------------------------------------------------------------------
-+dnl - Check for systemd directories
-+dnl ---------------------------------------------------------------------------
-+
-+PKG_CHECK_EXISTS([systemd], [], [AC_MSG_ERROR([systemd not found])])
-+AC_ARG_WITH([systemdsystemunitdir],
-+ AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
-+ [Directory for systemd service files]),
-+ [systemdsystemunitdir=$with_systemdsystemunitdir],
-+ [systemdsystemunitdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=systemdsystemunitdir systemd)])
-+AC_SUBST([systemdsystemunitdir])
-+
-+AC_ARG_WITH([systemdtmpfilesdir],
-+ AS_HELP_STRING([--with-systemdtmpfilesdir=DIR],
-+ [Directory for systemd-tmpfiles configuration files]),
-+ [systemdtmpfilesdir=$with_systemdtmpfilesdir],
-+ [systemdtmpfilesdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=tmpfilesdir systemd)])
-+AC_SUBST([systemdtmpfilesdir])
-+
- dnl ---------------------------------------------------------------------------
- dnl - Server-only configuration
- dnl ---------------------------------------------------------------------------
-@@ -544,6 +563,7 @@ AC_CONFIG_FILES([
- client/share/Makefile
- client/man/Makefile
- client/sysconfig/Makefile
-+ client/systemd/Makefile
- contrib/completion/Makefile
- contrib/Makefile
- daemons/dnssec/Makefile
-@@ -637,13 +657,13 @@ echo "
- jslint: ${JSLINT}
- LDAP libs: ${LDAP_LIBS}
- OpenSSL crypto libs: ${CRYPTO_LIBS}
-- KRB5 libs: ${KRB5_LIBS}"
-+ KRB5 libs: ${KRB5_LIBS}
-+ systemdsystemunitdir: ${systemdsystemunitdir}"
-
- AM_COND_IF([ENABLE_SERVER], [
- echo "\
- KRAD libs: ${KRAD_LIBS}
- krb5rundir: ${krb5rundir}
-- systemdsystemunitdir: ${systemdsystemunitdir}
- systemdtmpfilesdir: ${systemdtmpfilesdir}
- build mode: server & client"
- ], [
-diff --git a/freeipa.spec.in b/freeipa.spec.in
-index cec57e64e..1d8f4e6aa 100755
---- a/freeipa.spec.in
-+++ b/freeipa.spec.in
-@@ -586,6 +586,10 @@ on the machine enrolled into a FreeIPA environment
- %package client-epn
- Summary: Tools to configure Expiring Password Notification in IPA
- Group: System Environment/Base
-+Requires: systemd-units
-+Requires(post): systemd-units
-+Requires(preun): systemd-units
-+Requires(postun): systemd-units
- Requires: %{name}-client = %{version}-%{release}
-
- %description client-epn
-@@ -1003,6 +1007,17 @@ fi
- # ONLY_CLIENT
- %endif
-
-+%preun client-epn
-+%systemd_preun ipa-epn.service
-+%systemd_preun ipa-epn.timer
-+
-+%postun client-epn
-+%systemd_postun ipa-epn.service
-+%systemd_postun ipa-epn.timer
-+
-+%post client-epn
-+%systemd_post ipa-epn.service
-+%systemd_post ipa-epn.timer
-
- %post client
- if [ $1 -gt 1 ] ; then
-diff --git a/init/systemd/Makefile.am b/init/systemd/Makefile.am
-index 5053dbff6..175178787 100644
---- a/init/systemd/Makefile.am
-+++ b/init/systemd/Makefile.am
-@@ -2,17 +2,17 @@
- #
- AUTOMAKE_OPTIONS = 1.7
-
-+NULL =
-+
- dist_noinst_DATA = \
- ipa-custodia.service.in \
- ipa.service.in \
-- ipa-epn.service.in \
-- ipa-epn.timer.in
-+ $(NULL)
-
- systemdsystemunit_DATA = \
- ipa-custodia.service \
- ipa.service \
-- ipa-epn.service \
-- ipa-epn.timer
-+ $(NULL)
-
- CLEANFILES = $(systemdsystemunit_DATA)
-
-diff --git a/install/share/Makefile.am b/install/share/Makefile.am
-index 496e81288..e95796dfb 100644
---- a/install/share/Makefile.am
-+++ b/install/share/Makefile.am
-@@ -106,8 +106,3 @@ dist_app_DATA = \
- kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy
- dist_kdcproxyconf_DATA = \
- kdcproxy.conf
--
--epnconfdir = $(IPA_SYSCONF_DIR)/epn
--dist_epnconf_DATA = \
-- expire_msg.template \
-- $(NULL)
-diff --git a/server.m4 b/server.m4
-index d35823e80..842d599d2 100644
---- a/server.m4
-+++ b/server.m4
-@@ -153,22 +153,3 @@ dnl Check for libverto
- dnl ---------------------------------------------------------------------------
-
- PKG_CHECK_MODULES([LIBVERTO], [libverto])
--
--dnl ---------------------------------------------------------------------------
--dnl - Check for systemd directories
--dnl ---------------------------------------------------------------------------
--
--PKG_CHECK_EXISTS([systemd], [], [AC_MSG_ERROR([systemd not found])])
--AC_ARG_WITH([systemdsystemunitdir],
-- AS_HELP_STRING([--with-systemdsystemunitdir=DIR],
-- [Directory for systemd service files]),
-- [systemdsystemunitdir=$with_systemdsystemunitdir],
-- [systemdsystemunitdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=systemdsystemunitdir systemd)])
--AC_SUBST([systemdsystemunitdir])
--
--AC_ARG_WITH([systemdtmpfilesdir],
-- AS_HELP_STRING([--with-systemdtmpfilesdir=DIR],
-- [Directory for systemd-tmpfiles configuration files]),
-- [systemdtmpfilesdir=$with_systemdtmpfilesdir],
-- [systemdtmpfilesdir=$($PKG_CONFIG --define-variable=prefix='${prefix}' --variable=tmpfilesdir systemd)])
--AC_SUBST([systemdtmpfilesdir])
---
-2.26.2
-
-From 23e2935e5c5cb402dd4f6f44eaa4b013e6a8188a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Mon, 22 Jun 2020 16:39:02 +0200
-Subject: [PATCH] EPN: ship the configuration file.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Ship and install /etc/ipa/epn.conf.
-Minor fixes to the associated man page.
-
-Fixes: https://pagure.io/freeipa/issue/8374
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- client/man/epn.conf.5 | 5 ++--
- client/share/Makefile.am | 7 +++++-
- client/share/epn.conf | 54 ++++++++++++++++++++++++++++++++++++++++
- freeipa.spec.in | 4 ++-
- 4 files changed, 65 insertions(+), 5 deletions(-)
- create mode 100644 client/share/epn.conf
-
-diff --git a/client/man/epn.conf.5 b/client/man/epn.conf.5
-index 38e99e25d..14f5dbb75 100644
---- a/client/man/epn.conf.5
-+++ b/client/man/epn.conf.5
-@@ -71,11 +71,10 @@ Specifies the From e-mail address value in the e-mails sent. The default is
- root@localhost. Bounces will be sent here.
- .TP
- .B smtp_delay <milliseconds>
--Time to wait, in milliseconds, between each e-mail sent to try to avoid overloading the mail queue.
-+Time to wait, in milliseconds, between each e-mail sent to try to avoid overloading the mail queue. The default is 0.
- .TP
- .B mail_from <address>
--Specifies the From: e-mal address value in the e-mails sent. The default is
--noreply@ipadefaultemaildomain. This value can be found by running
-+Specifies the From: e-mail address value in the e-mails sent. The default is noreply@ipadefaultemaildomain. This value can be found by running
- .I ipa config-show
- .TP
- .B notify_ttls <list of days>
-diff --git a/client/share/Makefile.am b/client/share/Makefile.am
-index 1402a3a9d..472242e62 100644
---- a/client/share/Makefile.am
-+++ b/client/share/Makefile.am
-@@ -5,7 +5,12 @@ dist_app_DATA = \
- freeipa.template \
- $(NULL)
-
--epnconfdir = $(IPA_SYSCONF_DIR)/epn
-+epnconfdir = $(IPA_SYSCONF_DIR)
- dist_epnconf_DATA = \
-+ epn.conf \
-+ $(NULL)
-+
-+epntemplatedir = $(IPA_SYSCONF_DIR)/epn
-+dist_epntemplate_DATA = \
- expire_msg.template \
- $(NULL)
-diff --git a/client/share/epn.conf b/client/share/epn.conf
-new file mode 100644
-index 000000000..0e590dfc3
---- /dev/null
-+++ b/client/share/epn.conf
-@@ -0,0 +1,54 @@
-+# Global IPA-EPN [0] configuration file.
-+# For a complete explanation of each parameter, see the epn.conf(5)
-+# manual page.
-+# For best results, change no more than a single parameter at a time,
-+# and test if ipa-epn(1) still works as intended, using --dry-run when
-+# it makes sense.
-+#
-+# [0] https://github.com/freeipa/freeipa/blob/master/doc/designs/expiring-password-notification.md
-+
-+[global]
-+
-+# Specifies the SMTP server to use.
-+smtp_server = localhost
-+
-+# Specifies the SMTP port.
-+smtp_port = 25
-+
-+# Specifies the id of the user to authenticate with the SMTP server.
-+# Default None (empty value).
-+# smtp_user =
-+
-+# Specifies the password for the authorized user.
-+# Default None (empty value).
-+# smtp_password =
-+
-+# pecifies the number of seconds to wait for SMTP to respond.
-+smtp_timeout = 60
-+
-+# Specifies the type of secure connection to make. Options are: none,
-+# starttls and ssl.
-+smtp_security = none
-+
-+# Specifies the From e-mail address value in the e-mails sent. Bounces will
-+# be sent here.
-+smtp_admin = root@localhost
-+
-+# Time to wait, in milliseconds, between each e-mail sent to try to avoid
-+# overloading the mail queue.
-+smtp_delay = 0
-+
-+# Specifies the From: e-mail address value in the e-mails sent.
-+# The default when unset is noreply@ipadefaultemaildomain.
-+# This value can be found by running ipa config-show.
-+# mail_from =
-+
-+# The list of days before a password expiration when ipa-epn should notify
-+# a user that their password will soon require a reset.
-+notify_ttls = 28, 14, 7, 3, 1
-+
-+# Set the character set of the message.
-+msg_charset = utf8
-+
-+# Set the message's MIME sub-content type.
-+msg_subtype = plain
-diff --git a/freeipa.spec.in b/freeipa.spec.in
-index 5bce6f118..8cca99697 100755
---- a/freeipa.spec.in
-+++ b/freeipa.spec.in
-@@ -1387,13 +1387,15 @@ fi
-
- %files client-epn
- %doc README.md Contributors.txt
-+%dir %{_sysconfdir}/ipa/epn
- %license COPYING
- %{_sbindir}/ipa-epn
- %{_mandir}/man1/ipa-epn.1*
- %{_mandir}/man5/epn.conf.5*
- %attr(644,root,root) %{_unitdir}/ipa-epn.service
- %attr(644,root,root) %{_unitdir}/ipa-epn.timer
--%attr(644,root,root) %{_sysconfdir}/ipa/epn/expire_msg.template
-+%attr(600,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn.conf
-+%attr(644,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn/expire_msg.template
-
- %files -n python3-ipaclient
- %doc README.md Contributors.txt
---
-2.26.2
-
-From 3b43950d35f78b28d4edde4fda475b5aa84f4587 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 23 Jun 2020 09:39:02 +0200
-Subject: [PATCH] man pages: fix epn.conf.5 and ipa-epn.1 formatting
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fix formatting issues found with mandoc.
-
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- client/man/epn.conf.5 | 2 +-
- client/man/ipa-epn.1 | 8 ++++----
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/client/man/epn.conf.5 b/client/man/epn.conf.5
-index 14f5dbb75..df1f0156c 100644
---- a/client/man/epn.conf.5
-+++ b/client/man/epn.conf.5
-@@ -16,7 +16,7 @@
- .\"
- .\" Author: Rob Crittenden <rcritten@@redhat.com>
- .\"
--.TH "epn.conf" "5" "Apr 28 2020" "FreeIPA" "FreeIPA Manual Pages"
-+.TH "EPN.CONF" "5" "April 28, 2020" "FreeIPA" "FreeIPA Manual Pages"
- .SH "NAME"
- epn.conf \- Expiring Password Notification configuration file
- .SH "SYNOPSIS"
-diff --git a/client/man/ipa-epn.1 b/client/man/ipa-epn.1
-index 9999ea8ca..124fd4536 100644
---- a/client/man/ipa-epn.1
-+++ b/client/man/ipa-epn.1
-@@ -15,14 +15,14 @@
- .\" along with this program. If not, see <http://www.gnu.org/licenses/>.
- .\"
- .\"
--.TH "ipa-epn" "1" "Apr 24 2020" "FreeIPA" "FreeIPA Manual Pages"
-+.TH "IPA-EPN" "1" "April 24, 2020" "FreeIPA" "FreeIPA Manual Pages"
- .SH "NAME"
- ipa\-epn \- Send expiring password nofications
- .SH "SYNOPSIS"
--ipa\-epn \[options\]
-+ipa\-epn \fR[options\fR]
-
- .SH "DESCRIPTION"
--ipa\-epn provides a method to warn users via email that their IPA account password is about to expire.
-+ipa\-epn provides a method to warn users via email that their IPA account password is about to expire.
-
- It can be used in dry\-run mode which is recommmended during setup. The output is always JSON in this case.
-
-@@ -38,7 +38,7 @@ The \-\-to\-nbdays CLI option can be used to determine the number of notificatio
-
- If \fB\-\-from\-nbdays\fR is not specified, ipa\-epn will look within a 24\-hour long time range in <number of days> days.
-
--if \fB\-\-from\-nbdays\fR is specified, the date range starts at \fB\-\-from\-nbdays\fR days in the future and ends at \fB\-\-to\-nbdays\fR in the future.
-+if \fB\-\-from\-nbdays\fR is specified, the date range starts at \fB\-\-from\-nbdays\fR days in the future and ends at \fB\-\-to\-nbdays\fR in the future.
-
- Together, these two CLI options can be used to determine how many emails would be sent in a specific time in the future.
-
---
-2.26.2
-
-From 2648c218467792e907435eaa5267a0f3457f634f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 23 Jun 2020 13:50:02 +0200
-Subject: [PATCH] ipatests: check that EPN's configuration file is installed.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes: https://pagure.io/freeipa/issue/8374
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipatests/test_integration/test_epn.py | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index 7f56d4bc0..409d588d5 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -209,6 +209,20 @@ class TestEPN(IntegrationTest):
- cls.master.run_command(r'rm -f /etc/pki/tls/private/postfix.key')
- cls.master.run_command(r'rm -f /etc/pki/tls/certs/postfix.pem')
-
-+ @pytest.mark.xfail(reason='pr-ci issue 378', strict=True)
-+ def test_EPN_config_file(self):
-+ """Check that the EPN configuration file is installed.
-+ https://pagure.io/freeipa/issue/8374
-+ """
-+ epn_conf = "/etc/ipa/epn.conf"
-+ epn_template = "/etc/ipa/epn/expire_msg.template"
-+ cmd1 = self.master.run_command(["rpm", "-qc", "freeipa-client-epn"])
-+ assert epn_conf in cmd1.stdout_text
-+ assert epn_template in cmd1.stdout_text
-+ cmd2 = self.master.run_command(["sha256sum", epn_conf])
-+ ck = "4c207b5c9c760c36db0d3b2b93da50ea49edcc4002d6d1e7383601f0ec30b957"
-+ assert cmd2.stdout_text.find(ck) == 0
-+
- def test_EPN_smoketest_1(self):
- """No users except admin. Check --dry-run output.
- With the default configuration, the result should be an empty list.
---
-2.26.2
-
-From 06accac8906f66ebbb31849d6528b39ae006b124 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Wed, 24 Jun 2020 23:24:36 +0200
-Subject: [PATCH] ipatests: ipa_epn: uninstall/reinstall ipa-client-epn
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Due to https://github.com/freeipa/freeipa-pr-ci/issues/378
-the installed version of freeipa-client-epn is not the built
-one. Temporarily force uninstall/reinstall of this package
-before running the test.
-
-Fixes: https://pagure.io/freeipa/issue/8374
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipatests/test_integration/test_epn.py | 20 +++++++++++++++++++-
- 1 file changed, 19 insertions(+), 1 deletion(-)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index 409d588d5..9a9fb17b9 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -209,11 +209,29 @@ class TestEPN(IntegrationTest):
- cls.master.run_command(r'rm -f /etc/pki/tls/private/postfix.key')
- cls.master.run_command(r'rm -f /etc/pki/tls/certs/postfix.pem')
-
-- @pytest.mark.xfail(reason='pr-ci issue 378', strict=True)
-+ @pytest.mark.skip_if_platform(
-+ "debian", reason="Cannot check installed packages using RPM"
-+ )
- def test_EPN_config_file(self):
- """Check that the EPN configuration file is installed.
- https://pagure.io/freeipa/issue/8374
- """
-+ # workaround for https://github.com/freeipa/freeipa-pr-ci/issues/378
-+ rpm_q_cmds = [
-+ ["rpm", "-qi", "freeipa-client"],
-+ ["rpm", "-qi", "freeipa-client-epn"],
-+ ["rpm", "-qc", "freeipa-client-epn"],
-+ ["rpm", "-V", "freeipa-client-epn"],
-+ ["rpm", "-qvc", "freeipa-client-epn"],
-+ ["ls", "-l", "/etc/ipa", "/etc/ipa/epn"],
-+ ]
-+ for cmd in rpm_q_cmds:
-+ self.master.run_command(cmd, raiseonerr=False)
-+ tasks.uninstall_packages(self.master, ["*ipa-client-epn"])
-+ tasks.install_packages(self.master, ["*ipa-client-epn"])
-+ for cmd in rpm_q_cmds:
-+ self.master.run_command(cmd, raiseonerr=False)
-+ # end workaround
- epn_conf = "/etc/ipa/epn.conf"
- epn_template = "/etc/ipa/epn/expire_msg.template"
- cmd1 = self.master.run_command(["rpm", "-qc", "freeipa-client-epn"])
---
-2.26.2
-
diff --git a/SOURCES/0003-Use-256-bit-AJP-secret_rhbz#1849914.patch b/SOURCES/0003-Use-256-bit-AJP-secret_rhbz#1849914.patch
deleted file mode 100644
index f011db3..0000000
--- a/SOURCES/0003-Use-256-bit-AJP-secret_rhbz#1849914.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-From be48983558a560dadad410a70a4a1684565ed481 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Mon, 15 Jun 2020 18:38:35 -0400
-Subject: [PATCH] Clarify AJP connector creation process
-
-We do two things:
-
- 1. Fix the xpath for AJP connector verification. An AJP connector is
- one which has protocol="AJP/1.3", NOT one that has port="8009". An
- AJP connector can exist on any port and port 8009 can have any
- protocol. Secrets only make sense on AJP connectors, so make the
- xpath match the existing comment.
-
- 2. Add some background in-line documentation about AJP secret
- provisioning. This should help future developers understand why this
- was added to IPA and what limitations there are in what PKI or IPA
- can do. Most notably, explain why Dogtag can't upgrade the AJP
- connector to have a secret in the general case.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- ipaserver/install/dogtaginstance.py | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py
-index 42c9db3fb..aa3baeb7c 100644
---- a/ipaserver/install/dogtaginstance.py
-+++ b/ipaserver/install/dogtaginstance.py
-@@ -308,11 +308,12 @@ class DogtagInstance(service.Service):
- doc = server_xml.getroot()
-
- # no AJP connector means no need to update anything
-- connectors = doc.xpath('//Connector[@port="8009"]')
-+ connectors = doc.xpath('//Connector[@protocol="AJP/1.3"]')
- if len(connectors) == 0:
- return
-
-- # AJP connector is set on port 8009. Use non-greedy search to find it
-+ # AJP protocol is at version 1.3. Assume there is only one as
-+ # Dogtag only provisions one.
- connector = connectors[0]
-
- # Detect tomcat version and choose the right option name
-@@ -331,11 +332,24 @@ class DogtagInstance(service.Service):
- rewrite = False
- else:
- if oldattr in connector.attrib:
-+ # Sufficiently new Dogtag versions (10.9.0-a2) handle the
-+ # upgrade for us; we need only to ensure that we're not both
-+ # attempting to upgrade server.xml at the same time.
-+ # Hopefully this is guaranteed for us.
- self.ajp_secret = connector.attrib[oldattr]
- connector.attrib[secretattr] = self.ajp_secret
- del connector.attrib[oldattr]
- else:
-- # Generate password, don't use special chars to not break XML
-+ # Generate password, don't use special chars to not break XML.
-+ #
-+ # If we hit this case, pkispawn was run on an older Dogtag
-+ # version and we're stuck migrating, choosing a password
-+ # ourselves. Dogtag can't generate one randomly because a
-+ # Dogtag administrator might've configured AJP and might
-+ # not be using IPA.
-+ #
-+ # Newer Dogtag versions will generate a random password
-+ # during pkispawn.
- self.ajp_secret = ipautil.ipa_generate_password(special=None)
- connector.attrib[secretattr] = self.ajp_secret
-
---
-2.26.2
-
-From 1e804bf19da4ee274e735fd49452d4df5d73a002 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 17 Jun 2020 16:00:25 -0400
-Subject: [PATCH] Configure PKI AJP Secret with 256-bit secret
-
-By default, PKI's AJP secret is generated as a 75-bit password. By
-generating it in IPA, we can guarantee the strength of the AJP secret.
-It makes sense to use a stronger AJP secret because it typically
-isn't rotated; access to AJP allows an attacker to impersonate an admin
-while talking to PKI.
-
-Fixes: https://pagure.io/freeipa/issue/8372
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1849146
-Related: https://bugzilla.redhat.com/show_bug.cgi?id=1845447
-Related: https://github.com/dogtagpki/pki/pull/437
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- install/share/ipaca_customize.ini | 1 +
- install/share/ipaca_default.ini | 2 ++
- ipaserver/install/dogtaginstance.py | 4 +++-
- 3 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/install/share/ipaca_customize.ini b/install/share/ipaca_customize.ini
-index 6d58579af..948734241 100644
---- a/install/share/ipaca_customize.ini
-+++ b/install/share/ipaca_customize.ini
-@@ -12,6 +12,7 @@
- #
- # Predefined variables
- # - ipa_ca_subject
-+# - ipa_ajp_secret
- # - ipa_fqdn
- # - ipa_subject_base
- # - pki_admin_password
-diff --git a/install/share/ipaca_default.ini b/install/share/ipaca_default.ini
-index 2b9900286..a51256116 100644
---- a/install/share/ipaca_default.ini
-+++ b/install/share/ipaca_default.ini
-@@ -12,6 +12,7 @@ ipa_ca_pem_file=/etc/ipa/ca.crt
-
- ## dynamic values
- # ipa_ca_subject=
-+# ipa_ajp_secret=
- # ipa_subject_base=
- # ipa_fqdn=
- # ipa_ocsp_uri=
-@@ -66,6 +67,7 @@ pki_issuing_ca=%(pki_issuing_ca_uri)s
- pki_replication_password=
-
- pki_enable_proxy=True
-+pki_ajp_secret=%(ipa_ajp_secret)s
- pki_restart_configured_instance=False
- pki_security_domain_hostname=%(ipa_fqdn)s
- pki_security_domain_https_port=443
-diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py
-index aa3baeb7c..361d80a8c 100644
---- a/ipaserver/install/dogtaginstance.py
-+++ b/ipaserver/install/dogtaginstance.py
-@@ -840,7 +840,9 @@ class PKIIniLoader:
- pki_subsystem_type=subsystem.lower(),
- home_dir=os.path.expanduser("~"),
- # for softhsm2 testing
-- softhsm2_so=paths.LIBSOFTHSM2_SO
-+ softhsm2_so=paths.LIBSOFTHSM2_SO,
-+ # Configure a more secure AJP password by default
-+ ipa_ajp_secret=ipautil.ipa_generate_password(special=None)
- )
-
- @classmethod
---
-2.26.2
-
diff --git a/SOURCES/0004-baseuser-fix-ipanthomedirectorydrive-option-name_rhbz#1851411.patch b/SOURCES/0004-baseuser-fix-ipanthomedirectorydrive-option-name_rhbz#1851411.patch
deleted file mode 100644
index f87b301..0000000
--- a/SOURCES/0004-baseuser-fix-ipanthomedirectorydrive-option-name_rhbz#1851411.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From a090b429fda35c5a9c3cfb672ab42a5985d00ff9 Mon Sep 17 00:00:00 2001
-From: Petr Vobornik <pvoborni@redhat.com>
-Date: Mon, 8 Jun 2020 19:27:30 +0200
-Subject: [PATCH] baseuser: fix ipanthomedirectorydrive option name
-
-It should be ipanthomedirectorydrive and not ipanthomedirectoryrive.
-
-This fixes showing the field in Web UI and also should fix CLI as it
-probably never worked.
-
-Signed-off-by: Petr Vobornik <pvoborni@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- API.txt | 8 ++++----
- ipaserver/plugins/baseuser.py | 2 +-
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/API.txt b/API.txt
-index 5354a33a0..300b3d9b1 100644
---- a/API.txt
-+++ b/API.txt
-@@ -5085,7 +5085,7 @@ option: Str('in_role*', cli_name='in_roles')
- option: Str('in_sudorule*', cli_name='in_sudorules')
- option: Str('initials?', autofill=False)
- option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')
--option: StrEnum('ipanthomedirectoryrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
-+option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
- option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
- option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
- option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
-@@ -5147,7 +5147,7 @@ option: Str('givenname?', autofill=False, cli_name='first')
- option: Str('homedirectory?', autofill=False, cli_name='homedir')
- option: Str('initials?', autofill=False)
- option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')
--option: StrEnum('ipanthomedirectoryrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
-+option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
- option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
- option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
- option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')
-@@ -6185,7 +6185,7 @@ option: Str('in_role*', cli_name='in_roles')
- option: Str('in_sudorule*', cli_name='in_sudorules')
- option: Str('initials?', autofill=False)
- option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')
--option: StrEnum('ipanthomedirectoryrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
-+option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
- option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
- option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
- option: Str('ipatokenradiusconfiglink?', autofill=False, cli_name='radius')
-@@ -6250,7 +6250,7 @@ option: Str('givenname?', autofill=False, cli_name='first')
- option: Str('homedirectory?', autofill=False, cli_name='homedir')
- option: Str('initials?', autofill=False)
- option: Str('ipanthomedirectory?', autofill=False, cli_name='smb_home_dir')
--option: StrEnum('ipanthomedirectoryrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
-+option: StrEnum('ipanthomedirectorydrive?', autofill=False, cli_name='smb_home_drive', values=[u'A:', u'B:', u'C:', u'D:', u'E:', u'F:', u'G:', u'H:', u'I:', u'J:', u'K:', u'L:', u'M:', u'N:', u'O:', u'P:', u'Q:', u'R:', u'S:', u'T:', u'U:', u'V:', u'W:', u'X:', u'Y:', u'Z:'])
- option: Str('ipantlogonscript?', autofill=False, cli_name='smb_logon_script')
- option: Str('ipantprofilepath?', autofill=False, cli_name='smb_profile_path')
- option: Str('ipasshpubkey*', autofill=False, cli_name='sshpubkey')
-diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
-index a0ed65874..e1b7763f0 100644
---- a/ipaserver/plugins/baseuser.py
-+++ b/ipaserver/plugins/baseuser.py
-@@ -420,7 +420,7 @@ class baseuser(LDAPObject):
- label=_('SMB Home Directory'),
- flags=['no_create'],
- ),
-- StrEnum('ipanthomedirectoryrive?',
-+ StrEnum('ipanthomedirectorydrive?',
- cli_name='smb_home_drive',
- label=_('SMB Home Directory Drive'),
- flags=['no_create'],
---
-2.26.2
-
-From 691b3cddb275821630f443f22706fa75e7c7a5c8 Mon Sep 17 00:00:00 2001
-From: Petr Vobornik <pvoborni@redhat.com>
-Date: Mon, 8 Jun 2020 19:11:33 +0200
-Subject: [PATCH] webui: hide user attributes for SMB services section if empty
-
-This section should be hidded if user object hasn't ipantuserattrs
-object class. I.e. when trusts are not enabled.
-
-Web UI framework already supports hidding of sections if the
-section contains no visible field. So to achieve it we simply needs
-to hide the fields. Given that attributelevelrights
-contains rights only for attributes of current object classes, all
-of these are regarded as not writable.
-
-We can leverage feature of input_widget that it gets hidden
-when the attribute is not writable and has no value and widget's
-"hidden_if_empty" is set to true. Thus doing it here.
-
-For this to work, it is also required to fix an issue with
-"ipanthomedirectorydrive" which is optional (in API) but Web UI
-doesn't offer "empty" ("") value. Adding it here.
-
-fixes: https://pagure.io/freeipa/issue/8336
-
-Signed-off-by: Petr Vobornik <pvoborni@redhat.com>
-Reviewed-By: Serhii Tsymbaliuk <stsymbal@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- install/ui/src/freeipa/user.js | 20 +++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/install/ui/src/freeipa/user.js b/install/ui/src/freeipa/user.js
-index fb626f2a1..8f1f5cd85 100644
---- a/install/ui/src/freeipa/user.js
-+++ b/install/ui/src/freeipa/user.js
-@@ -367,36 +367,39 @@ return {
- {
- name: 'smb_attributes',
- label: '@i18n:objects.smb_attributes.title',
-- show_cond: ['oc_ipantuserattrs'],
- fields: [{
- name: 'ipantlogonscript',
- tooltip: {
- title: '@i18n:objects.smb_attributes.ipantlogonscript_tooltip'
-- }
-+ },
-+ hidden_if_empty: true
- },
- {
- name: 'ipantprofilepath',
- tooltip: {
- title: '@i18n:objects.smb_attributes.ipantprofilepath_tooltip'
-- }
-+ },
-+ hidden_if_empty: true
- },
- {
- name: 'ipanthomedirectory',
- tooltip: {
- title: '@i18n:objects.smb_attributes.ipanthomedirectory_tooltip'
-- }
-+ },
-+ hidden_if_empty: true
- },
- {
- name: 'ipanthomedirectorydrive',
- $type: 'select',
- options: IPA.create_options([
-- 'A:', 'B:', 'C:', 'D:', 'E:', 'F:', 'G:', 'H:', 'I:',
-- 'J:', 'K:', 'L:', 'M:', 'N:', 'O:', 'P:', 'Q:', 'R:',
-- 'S:', 'T:', 'U:', 'V:', 'W:', 'X:', 'Y:', 'Z:'
-+ '', 'A:', 'B:', 'C:', 'D:', 'E:', 'F:', 'G:', 'H:',
-+ 'I:', 'J:', 'K:', 'L:', 'M:', 'N:', 'O:', 'P:', 'Q:',
-+ 'R:', 'S:', 'T:', 'U:', 'V:', 'W:', 'X:', 'Y:', 'Z:'
- ]),
- tooltip: {
- title: '@i18n:objects.smb_attributes.ipanthomedirectorydrive_tooltip'
-- }
-+ },
-+ hidden_if_empty: true
- }
- ]
- }
-@@ -482,7 +485,6 @@ return {
- IPA.user.self_service_other_user_evaluator,
- IPA.user.preserved_user_evaluator,
- IPA.user.is_locked_evaluator,
-- IPA.object_class_evaluator,
- IPA.cert.certificate_evaluator
- ],
- summary_conditions: [
---
-2.26.2
-
diff --git a/SOURCES/0005-selinux-don-t-audit-rules-deny-fetching-trust-topology_rhbz#1845596.patch b/SOURCES/0005-selinux-don-t-audit-rules-deny-fetching-trust-topology_rhbz#1845596.patch
deleted file mode 100644
index b67d1ef..0000000
--- a/SOURCES/0005-selinux-don-t-audit-rules-deny-fetching-trust-topology_rhbz#1845596.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 42dd1628a1211363c860917e474ecc5b9c1fdb84 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Thu, 2 Jul 2020 15:50:00 +0300
-Subject: [PATCH] selinux: allow oddjobd to set up ipa_helper_t context for
- execution
-
-On Fedora 32+ and RHEL 8.3.0+ execution of ipa_helper_t context requires
-SELinux policy permission to use 'noatsecure'. This comes most likely
-from execve() setup by glibc.
-
-Add SELinux interface ipa_helper_noatsecure() that can be called by
-oddjob's SELinux policy definition.
-
-In addition, if ipa_helper_t runs ipa-getkeytab, libkrb5 will attempt to
-access SELinux configuration and produce AVC for that. Allow reading
-general userspace SELinux configuration.
-
-Fixes: https://pagure.io/freeipa/issue/8395
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- selinux/ipa.if | 18 ++++++++++++++++++
- selinux/ipa.te | 1 +
- 2 files changed, 19 insertions(+)
-
-diff --git a/selinux/ipa.if b/selinux/ipa.if
-index ea971b8fa..783db8b78 100644
---- a/selinux/ipa.if
-+++ b/selinux/ipa.if
-@@ -419,3 +419,21 @@ ifndef(`dirsrv_systemctl',`
- ps_process_pattern($1, dirsrv_t)
- ')
- ')
-+
-+
-+########################################
-+## <summary>
-+## Allow ipa_helper noatsecure
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`ipa_helper_noatsecure',`
-+ gen_require(`
-+ type ipa_helper_t;
-+ ')
-+ allow $1 ipa_helper_t:process { noatsecure };
-+')
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 587e5e585..383979094 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -115,6 +115,7 @@ optional_policy(`
-
-
- allow ipa_helper_t self:capability { net_admin dac_read_search dac_override chown };
-+seutil_read_config(ipa_helper_t);
-
- #kernel bug
- dontaudit ipa_helper_t self:capability2 block_suspend;
---
-2.26.2
-
-From 0d70addbbf2a99e7398a518bc98d5fe109469bb5 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Fri, 3 Jul 2020 17:20:49 +0300
-Subject: [PATCH] selinux: support running ipa-custodia with PrivateTmp=yes
-
-Related: https://pagure.io/freeipa/issue/8395
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- selinux/ipa.te | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 383979094..a3381217a 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -390,3 +390,7 @@ optional_policy(`
- sssd_search_lib(ipa_custodia_t)
- sssd_stream_connect(ipa_custodia_t)
- ')
-+
-+optional_policy(`
-+ systemd_private_tmp(ipa_custodia_tmp_t)
-+')
---
-2.26.2
-
diff --git a/SOURCES/0006-fix-iPAddress-cert-issuance-for-1-host-service_rhbz#1846352.patch b/SOURCES/0006-fix-iPAddress-cert-issuance-for-1-host-service_rhbz#1846352.patch
deleted file mode 100644
index c1c7764..0000000
--- a/SOURCES/0006-fix-iPAddress-cert-issuance-for-1-host-service_rhbz#1846352.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 128500198d3782a76616cf1d971d5aeb17e8c1da Mon Sep 17 00:00:00 2001
-From: Fraser Tweedale <ftweedal@redhat.com>
-Date: Thu, 11 Jun 2020 22:42:38 +1000
-Subject: [PATCH] fix iPAddress cert issuance for >1 host/service
-
-The 'cert_request' command accumulates DNS names from the CSR,
-before checking that all IP addresses in the CSR are reachable from
-those DNS names. Before adding a DNS name to the set, we check that
-that it corresponds to the FQDN of a known host/service principal
-(including principal aliases). When a DNS name maps to a
-"alternative" principal (i.e. not the one given via the 'principal'
-argument), this check was not being performed correctly.
-Specifically, we were looking for the 'krbprincipalname' field on
-the RPC response object directly, instead of its 'result' field.
-
-To resolve the issue, dereference the RPC response to its 'result'
-field before invoking the '_dns_name_matches_principal' subroutine.
-
-Fixes: https://pagure.io/freeipa/issue/8368
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipaserver/plugins/cert.py | 6 +-
- .../test_cert_request_ip_address.py | 62 +++++++++++++++++--
- 2 files changed, 61 insertions(+), 7 deletions(-)
-
-diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
-index d353bc3ea..fe7ea34f5 100644
---- a/ipaserver/plugins/cert.py
-+++ b/ipaserver/plugins/cert.py
-@@ -827,13 +827,13 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
- try:
- if principal_type == HOST:
- alt_principal_obj = api.Command['host_show'](
-- name, all=True)
-+ name, all=True)['result']
- elif principal_type == KRBTGT:
- alt_principal = kerberos.Principal(
- (u'host', name), principal.realm)
- elif principal_type == SERVICE:
- alt_principal_obj = api.Command['service_show'](
-- alt_principal, all=True)
-+ alt_principal, all=True)['result']
- except errors.NotFound:
- # We don't want to issue any certificates referencing
- # machines we don't know about. Nothing is stored in this
-@@ -866,7 +866,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
- pass
-
- # Now check write access and caacl
-- altdn = alt_principal_obj['result']['dn']
-+ altdn = alt_principal_obj['dn']
- if not ldap.can_write(altdn, "usercertificate"):
- raise errors.ACIError(info=_(
- "Insufficient privilege to create a certificate "
-diff --git a/ipatests/test_xmlrpc/test_cert_request_ip_address.py b/ipatests/test_xmlrpc/test_cert_request_ip_address.py
-index bf4de05bf..c0475d30d 100644
---- a/ipatests/test_xmlrpc/test_cert_request_ip_address.py
-+++ b/ipatests/test_xmlrpc/test_cert_request_ip_address.py
-@@ -28,10 +28,16 @@ from ipatests.test_xmlrpc.tracker.host_plugin import HostTracker
- from ipatests.test_xmlrpc.tracker.user_plugin import UserTracker
- from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test
-
--host_fqdn = f'iptest.{api.env.domain}'
-+host_shortname = 'iptest'
-+host_fqdn = f'{host_shortname}.{api.env.domain}'
- host_princ = f'host/{host_fqdn}'
- host_ptr = f'{host_fqdn}.'
-
-+host2_shortname = 'iptest2'
-+host2_fqdn = f'{host2_shortname}.{api.env.domain}'
-+host2_princ = f'host/{host2_fqdn}'
-+host2_ptr = f'{host2_fqdn}.'
-+
- other_fqdn = f'other.{api.env.domain}'
- other_ptr = f'{other_fqdn}.'
-
-@@ -39,6 +45,10 @@ ipv4_address = '169.254.0.42'
- ipv4_revzone_s = '0.254.169.in-addr.arpa.'
- ipv4_revrec_s = '42'
-
-+host2_ipv4_address = '169.254.0.43'
-+host2_ipv4_revzone_s = '0.254.169.in-addr.arpa.'
-+host2_ipv4_revrec_s = '43'
-+
- ipv6_address = 'fe80::8f18:bdab:4299:95fa'
- ipv6_revzone_s = '0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.'
- ipv6_revrec_s = 'a.f.5.9.9.9.2.4.b.a.d.b.8.1.f.8'
-@@ -46,7 +56,13 @@ ipv6_revrec_s = 'a.f.5.9.9.9.2.4.b.a.d.b.8.1.f.8'
-
- @pytest.fixture(scope='class')
- def host(request, xmlrpc_setup):
-- tr = HostTracker('iptest')
-+ tr = HostTracker(host_shortname)
-+ return tr.make_fixture(request)
-+
-+
-+@pytest.fixture(scope='class')
-+def host2(request, xmlrpc_setup):
-+ tr = HostTracker(host2_shortname)
- return tr.make_fixture(request)
-
-
-@@ -88,6 +104,12 @@ def ipv6_revzone(host):
- yield from _zone_setup(host, ipv6_revzone_s)
-
-
-+@pytest.fixture(scope='class')
-+def host2_ipv4_ptr(host2, ipv4_revzone):
-+ yield from _record_setup(
-+ host2, ipv4_revzone, host2_ipv4_revrec_s, ptrrecord=host2_ptr)
-+
-+
- @pytest.fixture(scope='class')
- def ipv4_ptr(host, ipv4_revzone):
- yield from _record_setup(
-@@ -100,16 +122,22 @@ def ipv6_ptr(host, ipv6_revzone):
- host, ipv6_revzone, ipv6_revrec_s, ptrrecord=host_ptr)
-
-
-+@pytest.fixture(scope='class')
-+def host2_ipv4_a(host2):
-+ yield from _record_setup(
-+ host2, api.env.domain, host2_shortname, arecord=host2_ipv4_address)
-+
-+
- @pytest.fixture(scope='class')
- def ipv4_a(host):
- yield from _record_setup(
-- host, api.env.domain, 'iptest', arecord=ipv4_address)
-+ host, api.env.domain, host_shortname, arecord=ipv4_address)
-
-
- @pytest.fixture(scope='class')
- def ipv6_aaaa(host):
- yield from _record_setup(
-- host, api.env.domain, 'iptest', aaaarecord=ipv6_address)
-+ host, api.env.domain, host_shortname, aaaarecord=ipv6_address)
-
-
- @pytest.fixture(scope='class')
-@@ -210,6 +238,12 @@ csr_cname2 = csr([
- x509.DNSName(f'cname2.{api.env.domain}'),
- x509.IPAddress(ipaddress.ip_address(ipv4_address)),
- ])
-+csr_two_dnsname_two_ip = csr([
-+ x509.DNSName(host_fqdn),
-+ x509.IPAddress(ipaddress.ip_address(ipv4_address)),
-+ x509.DNSName(host2_fqdn),
-+ x509.IPAddress(ipaddress.ip_address(host2_ipv4_address)),
-+])
-
-
- @pytest.fixture
-@@ -449,3 +483,23 @@ class TestIPAddressCNAME(XMLRPC_test):
- def test_two_levels(self, host, csr_cname2):
- with pytest.raises(errors.ValidationError, match=PAT_FWD):
- host.run_command('cert_request', csr_cname2, principal=host_princ)
-+
-+
-+@pytest.mark.tier1
-+class TestTwoHostsTwoIPAddresses(XMLRPC_test):
-+ """
-+ Test certificate issuance with CSR containing two hosts
-+ and two IP addresses (one for each host).
-+
-+ """
-+ def test_host_exists(
-+ self, host, host2, ipv4_a, ipv4_ptr, host2_ipv4_a, host2_ipv4_ptr,
-+ ):
-+ # for convenience, this test also establishes the DNS
-+ # record fixtures, which have class scope
-+ host.ensure_exists()
-+ host2.ensure_exists()
-+
-+ def test_issuance(self, host, csr_two_dnsname_two_ip):
-+ host.run_command(
-+ 'cert_request', csr_two_dnsname_two_ip, principal=host_princ)
---
-2.26.2
-
diff --git a/SOURCES/0007-Specify-cert_paths-when-calling-PKIConnection_rhbz#1849155.patch b/SOURCES/0007-Specify-cert_paths-when-calling-PKIConnection_rhbz#1849155.patch
deleted file mode 100644
index 72a73cb..0000000
--- a/SOURCES/0007-Specify-cert_paths-when-calling-PKIConnection_rhbz#1849155.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 9ded9e2573a00c388533f2a09365c499a4e2961e Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Fri, 19 Jun 2020 08:48:56 -0400
-Subject: [PATCH] Specify cert_paths when calling PKIConnection
-
-PKIConnection now defaults to specifying verify=True. We've introduced
-a new parameter, cert_paths, to specify additional paths (directories or
-files) to load as certificates. Specify the IPA CA certificate file so
-we can guarantee connections succeed and validate the peer's certificate.
-
-Point to IPA CA certificate during pkispawn
-
-Bump pki_version to 10.9.0-0.4 (aka -b2)
-
-Fixes: https://pagure.io/freeipa/issue/8379
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1849155
-Related: https://github.com/dogtagpki/pki/pull/443
-Related: https://bugzilla.redhat.com/show_bug.cgi?id=1426572
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
-Signed-off-by: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- freeipa.spec.in | 6 +++---
- install/tools/ipa-pki-wait-running.in | 3 ++-
- ipaserver/install/cainstance.py | 7 +++++++
- ipaserver/install/dogtaginstance.py | 3 ++-
- ipaserver/plugins/dogtag.py | 11 +++++------
- 5 files changed, 19 insertions(+), 11 deletions(-)
-
-diff --git a/freeipa.spec.in b/freeipa.spec.in
-index 74e752ea5..d00b9d640 100755
---- a/freeipa.spec.in
-+++ b/freeipa.spec.in
-@@ -112,9 +112,9 @@
- # Fedora
- %endif
-
--# 10.7.3 supports LWCA key replication using AES
--# https://pagure.io/freeipa/issue/8020
--%global pki_version 10.7.3-1
-+# PKIConnection has been modified to always validate certs.
-+# https://pagure.io/freeipa/issue/8379
-+%global pki_version 10.9.0-0.4
-
- # https://pagure.io/certmonger/issue/90
- %global certmonger_version 0.79.7-1
-diff --git a/install/tools/ipa-pki-wait-running.in b/install/tools/ipa-pki-wait-running.in
-index 69f5ec296..4f0f2f34a 100644
---- a/install/tools/ipa-pki-wait-running.in
-+++ b/install/tools/ipa-pki-wait-running.in
-@@ -59,7 +59,8 @@ def get_conn(hostname, subsystem):
- """
- conn = PKIConnection(
- hostname=hostname,
-- subsystem=subsystem
-+ subsystem=subsystem,
-+ cert_paths=paths.IPA_CA_CRT
- )
- logger.info(
- "Created connection %s://%s:%s/%s",
-diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
-index 706bc28cc..9294f1dba 100644
---- a/ipaserver/install/cainstance.py
-+++ b/ipaserver/install/cainstance.py
-@@ -509,6 +509,13 @@ class CAInstance(DogtagInstance):
- else:
- pki_pin = None
-
-+ # When spawning a CA instance, always point to IPA_CA_CRT if it
-+ # exists. Later, when we're performing step 2 of an external CA
-+ # installation, we'll overwrite this key to point to the real
-+ # external CA.
-+ if os.path.exists(paths.IPA_CA_CRT):
-+ cfg['pki_cert_chain_path'] = paths.IPA_CA_CRT
-+
- if self.clone:
- if self.no_db_setup:
- cfg.update(
-diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py
-index 361d80a8c..7e295665c 100644
---- a/ipaserver/install/dogtaginstance.py
-+++ b/ipaserver/install/dogtaginstance.py
-@@ -70,7 +70,8 @@ def get_security_domain():
- connection = PKIConnection(
- protocol='https',
- hostname=api.env.ca_host,
-- port='8443'
-+ port='8443',
-+ cert_paths=paths.IPA_CA_CRT
- )
- domain_client = pki.system.SecurityDomainClient(connection)
- info = domain_client.get_security_domain_info()
-diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py
-index 4de26d76f..b300f6b18 100644
---- a/ipaserver/plugins/dogtag.py
-+++ b/ipaserver/plugins/dogtag.py
-@@ -2082,13 +2082,12 @@ class kra(Backend):
- 'https',
- self.kra_host,
- str(self.kra_port),
-- 'kra')
-+ 'kra',
-+ cert_paths=paths.IPA_CA_CRT
-+ )
-
-- connection.session.cert = (paths.RA_AGENT_PEM, paths.RA_AGENT_KEY)
-- # uncomment the following when this commit makes it to release
-- # https://git.fedorahosted.org/cgit/pki.git/commit/?id=71ae20c
-- # connection.set_authentication_cert(paths.RA_AGENT_PEM,
-- # paths.RA_AGENT_KEY)
-+ connection.set_authentication_cert(paths.RA_AGENT_PEM,
-+ paths.RA_AGENT_KEY)
-
- try:
- yield KRAClient(connection, crypto)
---
-2.26.2
-
diff --git a/SOURCES/0008-Add-missing-SELinux-rule-for-ipa-custodia.sock_rhbz#1857157.patch b/SOURCES/0008-Add-missing-SELinux-rule-for-ipa-custodia.sock_rhbz#1857157.patch
deleted file mode 100644
index c94ebee..0000000
--- a/SOURCES/0008-Add-missing-SELinux-rule-for-ipa-custodia.sock_rhbz#1857157.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From d83b760d1f76a3ba8e527dd27551e51a600b22c0 Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes@redhat.com>
-Date: Wed, 15 Jul 2020 10:23:35 +0200
-Subject: [PATCH] Add missing SELinux rule for ipa-custodia.sock
-
-A SELinux rule for ipa_custodia_stream_connect(httpd_t) was not copied
-from upstream rules. It breaks installations on systems that don't have
-ipa_custodia_stream_connect in SELinux domain for apache, e.g. RHEL 8.3.
-
-Fixes: https://pagure.io/freeipa/issue/8412
-Signed-off-by: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index a3381217a4..c4c3fa805e 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -378,6 +378,13 @@ optional_policy(`
- ipa_search_lib(ipa_custodia_t)
- ')
-
-+optional_policy(`
-+ gen_require(`
-+ type httpd_t;
-+ ')
-+ ipa_custodia_stream_connect(httpd_t)
-+')
-+
- optional_policy(`
- pki_manage_tomcat_etc_rw(ipa_custodia_t)
- pki_read_tomcat_cert(ipa_custodia_t)
diff --git a/SOURCES/0009-ipa-client-install-use-the-authselect-backup-during_rhbz#1810179.patch b/SOURCES/0009-ipa-client-install-use-the-authselect-backup-during_rhbz#1810179.patch
deleted file mode 100644
index 5a96294..0000000
--- a/SOURCES/0009-ipa-client-install-use-the-authselect-backup-during_rhbz#1810179.patch
+++ /dev/null
@@ -1,189 +0,0 @@
-From ca880cfb117fc870a6e2710b9e31b2f67d5651e1 Mon Sep 17 00:00:00 2001
-From: Florence Blanc-Renaud <flo@redhat.com>
-Date: Wed, 29 Jul 2020 13:35:49 +0200
-Subject: [PATCH] ipa-client-install: use the authselect backup during
- uninstall
-
-When ipa-client-install is run on a system with no existing
-authselect configuration (for instance a fedora 31 new install),
-uninstallation is picking sssd profile but this may lead to
-a configuration with differences compared to the pre-ipa-client
-state.
-
-Now that authselect provides an option to backup the existing
-configuration prior to setting a profile, the client install
-can save the backup name and uninstall is able to apply the
-backup in order to go back to the pre-ipa-client state.
-
-Fixes: https://pagure.io/freeipa/issue/8189
-Reviewed-By: Francois Cami <fcami@redhat.com>
-Reviewed-By: Michal Polovka <mpolovka@redhat.com>
----
- ipaplatform/redhat/authconfig.py | 37 ++++++++++++++------------------
- 1 file changed, 16 insertions(+), 21 deletions(-)
-
-diff --git a/ipaplatform/redhat/authconfig.py b/ipaplatform/redhat/authconfig.py
-index 758376f2b..89f452d66 100644
---- a/ipaplatform/redhat/authconfig.py
-+++ b/ipaplatform/redhat/authconfig.py
-@@ -27,6 +27,7 @@ from ipaplatform.paths import paths
- from ipapython import ipautil
- from ipapython.admintool import ScriptError
- import os
-+import time
-
- FILES_TO_NOT_BACKUP = ['passwd', 'group', 'shadow', 'gshadow']
-
-@@ -103,28 +104,16 @@ class RedHatAuthSelect(RedHatAuthToolBase):
- def configure(self, sssd, mkhomedir, statestore, sudo=True):
- # In the statestore, the following keys are used for the
- # 'authselect' module:
-+ # Old method:
- # profile: name of the profile configured pre-installation
- # features_list: list of features configured pre-installation
- # mkhomedir: True if installation was called with --mkhomedir
- # profile and features_list are used when reverting to the
- # pre-install state
-- cfg = self._parse_authselect_output()
-- if cfg:
-- statestore.backup_state('authselect', 'profile', cfg[0])
-- statestore.backup_state(
-- 'authselect', 'features_list', " ".join(cfg[1]))
-- else:
-- # cfg = None means that the current conf is not managed by
-- # authselect but by authconfig.
-- # As we are using authselect to configure the host,
-- # it will not be possible to revert to a custom authconfig
-- # configuration later (during uninstall)
-- # Best thing to do will be to use sssd profile at this time
-- logger.warning(
-- "WARNING: The configuration pre-client installation is not "
-- "managed by authselect and cannot be backed up. "
-- "Uninstallation may not be able to revert to the original "
-- "state.")
-+ # New method:
-+ # backup: name of the authselect backup
-+ backup_name = "pre_ipaclient_{}".format(time.strftime("%Y%m%d%H%M%S"))
-+ statestore.backup_state('authselect', 'backup', backup_name)
-
- cmd = [paths.AUTHSELECT, "select", "sssd"]
- if mkhomedir:
-@@ -133,6 +122,7 @@ class RedHatAuthSelect(RedHatAuthToolBase):
- if sudo:
- cmd.append("with-sudo")
- cmd.append("--force")
-+ cmd.append("--backup={}".format(backup_name))
-
- ipautil.run(cmd)
-
-@@ -179,10 +169,15 @@ class RedHatAuthSelect(RedHatAuthToolBase):
- else:
- features = []
-
-- cmd = [paths.AUTHSELECT, "select", profile]
-- cmd.extend(features)
-- cmd.append("--force")
-- ipautil.run(cmd)
-+ backup = statestore.restore_state('authselect', 'backup')
-+ if backup:
-+ cmd = [paths.AUTHSELECT, "backup-restore", backup]
-+ ipautil.run(cmd)
-+ else:
-+ cmd = [paths.AUTHSELECT, "select", profile]
-+ cmd.extend(features)
-+ cmd.append("--force")
-+ ipautil.run(cmd)
-
- def backup(self, path):
- current = self._get_authselect_current_output()
---
-2.26.2
-
-# Not needed for 4.7.8 release
-#
-#From 3eaab97e317584bc47d4a27a607267ed90df7ff7 Mon Sep 17 00:00:00 2001
-#From: Florence Blanc-Renaud <flo@redhat.com>
-#Date: Wed, 29 Jul 2020 13:40:26 +0200
-#Subject: [PATCH] ipatests: remove the xfail for test_nfs.py
-#
-#Related: https://pagure.io/freeipa/issue/8189
-#Reviewed-By: Francois Cami <fcami@redhat.com>
-#Reviewed-By: Michal Polovka <mpolovka@redhat.com>
-#---
-# ipatests/test_integration/test_nfs.py | 4 ----
-# 1 file changed, 4 deletions(-)
-#
-#diff --git a/ipatests/test_integration/test_nfs.py b/ipatests/test_integration/test_nfs.py
-#index 7272b0d44..832c56cca 100644
-#--- a/ipatests/test_integration/test_nfs.py
-#+++ b/ipatests/test_integration/test_nfs.py
-#@@ -363,10 +363,6 @@ class TestIpaClientAutomountFileRestore(IntegrationTest):
-# cmd = self.clients[0].run_command(sha256nsswitch_cmd)
-# assert cmd.stdout_text == orig_sha256
-#
-#- @pytest.mark.xfail(
-#- reason="https://pagure.io/freeipa/issue/8189",
-#- strict=True
-#- )
-# def test_nsswitch_backup_restore_sssd(self):
-# self.nsswitch_backup_restore()
-#
-#--
-#2.26.2
-
-From 4baf6b292f28481ece483bb8ecbd6a0807d9d45a Mon Sep 17 00:00:00 2001
-From: Florence Blanc-Renaud <flo@redhat.com>
-Date: Wed, 29 Jul 2020 17:57:53 +0200
-Subject: [PATCH] ipatests: fix test_authselect
-
-Before the code fix, install/uninstall on a config without
-any authselect profile was not able to restore the exact
-state but configured sssd profile instead.
-
-Now that the code is doing a pre-install backup, uninstall
-restores the exact state and the test needs to be updated
-accordingly.
-
-Related: https://pagure.io/freeipa/issue/8189
-Reviewed-By: Francois Cami <fcami@redhat.com>
-Reviewed-By: Michal Polovka <mpolovka@redhat.com>
----
- ipatests/test_integration/test_authselect.py | 13 ++++++++-----
- 1 file changed, 8 insertions(+), 5 deletions(-)
-
-diff --git a/ipatests/test_integration/test_authselect.py b/ipatests/test_integration/test_authselect.py
-index bdf7d9f77..cba23e707 100644
---- a/ipatests/test_integration/test_authselect.py
-+++ b/ipatests/test_integration/test_authselect.py
-@@ -100,7 +100,9 @@ class TestClientInstallation(IntegrationTest):
- ['rm', '-f', '/etc/authselect/authselect.conf'])
- result = self._install_client()
- assert result.returncode == 0
-- assert self.msg_warn_install in result.stderr_text
-+ # With the fix for 8189, there is no warning any more
-+ # because install is performing a pre-install backup
-+ assert self.msg_warn_install not in result.stderr_text
- # Client installation must configure the 'sssd' profile
- # with sudo
- check_authselect_profile(self.client, default_profile, ('with-sudo',))
-@@ -109,12 +111,13 @@ class TestClientInstallation(IntegrationTest):
- """
- Test client un-installation when there was no authselect profile
- """
-- # As the client did not have any authselect profile before install,
-- # uninstall must print a warning about restoring 'sssd' profile
-- # by default
-+ # The client did not have any authselect profile before install,
-+ # but uninstall must be able to restore the backup
-+ # Check that no profile is configured after uninstall
- result = self._uninstall_client()
- assert result.returncode == 0
-- check_authselect_profile(self.client, default_profile)
-+ assert not self.client.transport.file_exists(
-+ '/etc/authselect/authselect.conf')
-
- def test_install_client_preconfigured_profile(self):
- """
---
-2.26.2
-
diff --git a/SOURCES/0010-Replace-SSLCertVerificationError-with-CertificateErr_rhbz#1858318.patch b/SOURCES/0010-Replace-SSLCertVerificationError-with-CertificateErr_rhbz#1858318.patch
deleted file mode 100644
index 4144d57..0000000
--- a/SOURCES/0010-Replace-SSLCertVerificationError-with-CertificateErr_rhbz#1858318.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 66a5a0efd538e31a190ca6ecb775bc1dfc4ee232 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Wed, 29 Jul 2020 13:42:43 -0400
-Subject: [PATCH] Replace SSLCertVerificationError with CertificateError for
- py36
-
-This exception was added in python 3.7. Use CertificateError
-instead which is an alias and will work with older python releases.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1858318
-
-Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
----
- ipaserver/install/server/upgrade.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
-index 2c36bc0e2..2c1517865 100644
---- a/ipaserver/install/server/upgrade.py
-+++ b/ipaserver/install/server/upgrade.py
-@@ -667,7 +667,7 @@ def http_certificate_ensure_ipa_ca_dnsname(http):
-
- try:
- cert.match_hostname(expect)
-- except ssl.SSLCertVerificationError:
-+ except ssl.CertificateError:
- if certs.is_ipa_issued_cert(api, cert):
- request_id = certmonger.get_request_id(
- {'cert-file': paths.HTTPD_CERT_FILE})
---
-2.26.2
-
diff --git a/SOURCES/0011-Fix-AVC-denial-during-ipa-adtrust-install---add-agents_rhbz#1859213.patch b/SOURCES/0011-Fix-AVC-denial-during-ipa-adtrust-install---add-agents_rhbz#1859213.patch
deleted file mode 100644
index 1298351..0000000
--- a/SOURCES/0011-Fix-AVC-denial-during-ipa-adtrust-install---add-agents_rhbz#1859213.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From c72ef1ed965aca79da4576d9579dec5459e14b99 Mon Sep 17 00:00:00 2001
-From: Christian Heimes <cheimes@redhat.com>
-Date: Fri, 8 May 2020 15:27:01 +0200
-Subject: [PATCH] SELinux: Backport dirsrv_systemctl interface
-
-Signed-off-by: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- selinux/ipa.if | 27 +++++++++++++++++++++++++++
- 1 file changed, 27 insertions(+)
-
-diff --git a/selinux/ipa.if b/selinux/ipa.if
-index cefae5d90..ea971b8fa 100644
---- a/selinux/ipa.if
-+++ b/selinux/ipa.if
-@@ -392,3 +392,30 @@ ifndef(`apache_manage_pid_files',`
- manage_sock_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
- ')
- ')
-+
-+########################################
-+## <summary>
-+## Execute dirsrv server in the dirsrv domain.
-+## Backport from https://github.com/fedora-selinux/selinux-policy-contrib/pull/241
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+ifndef(`dirsrv_systemctl',`
-+ interface(`dirsrv_systemctl',`
-+ gen_require(`
-+ type dirsrv_unit_file_t;
-+ type dirsrv_t;
-+ ')
-+
-+ systemd_exec_systemctl($1)
-+ init_reload_services($1)
-+ allow $1 dirsrv_unit_file_t:file read_file_perms;
-+ allow $1 dirsrv_unit_file_t:service manage_service_perms;
-+
-+ ps_process_pattern($1, dirsrv_t)
-+ ')
-+')
---
-2.26.2
-
-From f76c56c6072418c78f138678b1c4dd917fea6ee1 Mon Sep 17 00:00:00 2001
-From: Zdenek Pytela <zpytela@redhat.com>
-Date: Thu, 7 May 2020 16:17:12 +0200
-Subject: [PATCH] Allow ipa-adtrust-install restart sssd and dirsrv services
-
-Allow ipa_helper_t connect to init using /run/systemd/private socket.
-Allow ipa_helper_t read init process state.
-Allow ipa_helper_t manage sssd and dirsrv units.
-
-See: https://bugzilla.redhat.com/show_bug.cgi?id=1820298
-See: https://github.com/fedora-selinux/selinux-policy-contrib/pull/241
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- selinux/ipa.te | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index b1e29c8e2..587e5e585 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -147,6 +147,9 @@ auth_use_nsswitch(ipa_helper_t)
-
- files_list_tmp(ipa_helper_t)
-
-+init_read_state(ipa_helper_t)
-+init_stream_connect(ipa_helper_t)
-+
- ipa_manage_pid_files(ipa_helper_t)
- ipa_read_lib(ipa_helper_t)
-
-@@ -156,6 +159,10 @@ optional_policy(`
- dirsrv_stream_connect(ipa_helper_t)
- ')
-
-+optional_policy(`
-+ dirsrv_systemctl(ipa_helper_t)
-+')
-+
- optional_policy(`
- ldap_stream_connect(ipa_helper_t)
- ')
-@@ -182,6 +189,7 @@ optional_policy(`
-
- optional_policy(`
- sssd_manage_lib_files(ipa_helper_t)
-+ sssd_systemctl(ipa_helper_t)
- ')
-
- ########################################
---
-2.26.2
-
diff --git a/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file_rhbz#1863616.patch b/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file_rhbz#1863616.patch
deleted file mode 100644
index ac9ddfe..0000000
--- a/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file_rhbz#1863616.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 81c955e561dd42ab70a39bf636c90e82a9d7d899 Mon Sep 17 00:00:00 2001
-From: Florence Blanc-Renaud <flo@redhat.com>
-Date: Mon, 3 Aug 2020 18:52:07 +0200
-Subject: [PATCH] CAless installation: set the perms on KDC cert file
-
-In CA less installation, the KDC certificate file does not have
-the expected 644 permissions. As a consequence, WebUI login
-fails.
-
-The fix makes sure that the KDC cert file is saved with 644 perms.
-
-Fixes: https://pagure.io/freeipa/issue/8440
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipaserver/install/krbinstance.py | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
-index 09d14693c..1910ff374 100644
---- a/ipaserver/install/krbinstance.py
-+++ b/ipaserver/install/krbinstance.py
-@@ -536,6 +536,8 @@ class KrbInstance(service.Service):
- certs.install_pem_from_p12(self.pkcs12_info[0],
- self.pkcs12_info[1],
- paths.KDC_CERT)
-+ # The KDC cert needs to be readable by everyone
-+ os.chmod(paths.KDC_CERT, 0o644)
- certs.install_key_from_p12(self.pkcs12_info[0],
- self.pkcs12_info[1],
- paths.KDC_KEY)
---
-2.26.2
-
-From 295dd4235f693b7b4b4270b46a28cb6e7b3d00b4 Mon Sep 17 00:00:00 2001
-From: Florence Blanc-Renaud <flo@redhat.com>
-Date: Mon, 3 Aug 2020 18:53:47 +0200
-Subject: [PATCH] ipatests: check KDC cert permissions in CA less install
-
-The KDC certificate file must be stored with 644 permissions.
-Add a test checking the file permissions on server + replica.
-
-Related: https://pagure.io/freeipa/issue/8440
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipatests/test_integration/test_caless.py | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py
-index a7b2cbbbc..1ea7d9896 100644
---- a/ipatests/test_integration/test_caless.py
-+++ b/ipatests/test_integration/test_caless.py
-@@ -1527,6 +1527,13 @@ class TestCertInstall(CALessBase):
- assert result.returncode == 0
-
-
-+def verify_kdc_cert_perms(host):
-+ """Verify that the KDC cert pem file has 0644 perms"""
-+ cmd = host.run_command(['stat', '-c',
-+ '"%a %G:%U"', paths.KDC_CERT])
-+ assert "644 root:root" in cmd.stdout_text
-+
-+
- class TestPKINIT(CALessBase):
- """Install master and replica with PKINIT"""
- num_replicas = 1
-@@ -1540,6 +1547,7 @@ class TestPKINIT(CALessBase):
- result = cls.install_server(pkinit_pkcs12_exists=True,
- pkinit_pin=_DEFAULT)
- assert result.returncode == 0
-+ verify_kdc_cert_perms(cls.master)
-
- @replica_install_teardown
- def test_server_replica_install_pkinit(self):
-@@ -1549,6 +1557,7 @@ class TestPKINIT(CALessBase):
- pkinit_pin=_DEFAULT)
- assert result.returncode == 0
- self.verify_installation()
-+ verify_kdc_cert_perms(self.replicas[0])
-
-
- class TestServerReplicaCALessToCAFull(CALessBase):
---
-2.26.2
-
diff --git a/SOURCES/0013-IPA-EPN-Use-a-helper-to-retrieve-LDAP-attributes-fro_rhbz#1866938.patch b/SOURCES/0013-IPA-EPN-Use-a-helper-to-retrieve-LDAP-attributes-fro_rhbz#1866938.patch
deleted file mode 100644
index b2655a8..0000000
--- a/SOURCES/0013-IPA-EPN-Use-a-helper-to-retrieve-LDAP-attributes-fro_rhbz#1866938.patch
+++ /dev/null
@@ -1,145 +0,0 @@
-From b95817e35716bbab000633043817202e17d7c53e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Thu, 6 Aug 2020 17:07:36 +0200
-Subject: [PATCH] IPA-EPN: Use a helper to retrieve LDAP attributes from an
- entry
-
-Allow for empty attributes.
-
-Reviewed-By: Francois Cami <fcami@redhat.com>
----
- ipaclient/install/ipa_epn.py | 22 +++++++++++++++-------
- 1 file changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/ipaclient/install/ipa_epn.py b/ipaclient/install/ipa_epn.py
-index 65f9f3d47..0d1ae2add 100644
---- a/ipaclient/install/ipa_epn.py
-+++ b/ipaclient/install/ipa_epn.py
-@@ -122,22 +122,30 @@ class EPNUserList:
- """Return len(self)."""
- return len(self._expiring_password_user_dq)
-
-+ def get_ldap_attr(self, entry, attr):
-+ """Get a single value from a multi-valued attr in a safe way"""
-+ return str(entry.get(attr, [""]).pop(0))
-+
- def add(self, entry):
- """Parses and appends an LDAP user entry with the uid, cn,
- givenname, sn, krbpasswordexpiration and mail attributes.
- """
- try:
- self._sorted = False
-+ if entry.get("mail") is None:
-+ logger.error("IPA-EPN: No mail address defined for: %s",
-+ entry.dn)
-+ return
- self._expiring_password_user_dq.append(
- dict(
-- uid=str(entry["uid"].pop(0)),
-- cn=str(entry["cn"].pop(0)),
-- givenname=str(entry["givenname"].pop(0)),
-- sn=str(entry["sn"].pop(0)),
-- krbpasswordexpiration=str(
-- entry["krbpasswordexpiration"].pop(0)
-+ uid=self.get_ldap_attr(entry, "uid"),
-+ cn=self.get_ldap_attr(entry, "cn"),
-+ givenname=self.get_ldap_attr(entry, "givenname"),
-+ sn=self.get_ldap_attr(entry, "sn"),
-+ krbpasswordexpiration=(
-+ self.get_ldap_attr(entry,"krbpasswordexpiration")
- ),
-- mail=str(entry["mail"]),
-+ mail=str(entry.get("mail")),
- )
- )
- except IndexError as e:
---
-2.26.2
-
-From 8e810d8cf38ec60d76178bd673e218fb05d56c8e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Thu, 6 Aug 2020 17:13:19 +0200
-Subject: [PATCH] IPA-EPN: fix configuration file typo
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Francois Cami <fcami@redhat.com>
----
- client/share/epn.conf | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/client/share/epn.conf b/client/share/epn.conf
-index 0e590dfc3..e3645801c 100644
---- a/client/share/epn.conf
-+++ b/client/share/epn.conf
-@@ -23,7 +23,7 @@ smtp_port = 25
- # Default None (empty value).
- # smtp_password =
-
--# pecifies the number of seconds to wait for SMTP to respond.
-+# Specifies the number of seconds to wait for SMTP to respond.
- smtp_timeout = 60
-
- # Specifies the type of secure connection to make. Options are: none,
---
-2.26.2
-
-From 1b1dbcbe9d83ba35f3cfdd01399f123816ec6e5b Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Thu, 6 Aug 2020 18:57:10 -0400
-Subject: [PATCH] IPA-EPN: Test that users without givenname and/or mail are
- handled
-
-The admin user does not have a givenname by default, allow for that.
-
-Report errors for users without a default e-mail address.
-
-Update the SHA256 hash with the typo fix.
-
-Reviewed-By: Francois Cami <fcami@redhat.com>
----
- ipatests/test_integration/test_epn.py | 22 +++++++++++++++++++++-
- 1 file changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index 18f73c722..c5c73835a 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -240,7 +240,7 @@ class TestEPN(IntegrationTest):
- assert epn_conf in cmd1.stdout_text
- assert epn_template in cmd1.stdout_text
- cmd2 = self.master.run_command(["sha256sum", epn_conf])
-- ck = "4c207b5c9c760c36db0d3b2b93da50ea49edcc4002d6d1e7383601f0ec30b957"
-+ ck = "192481b52fb591112afd7b55b12a44c6618fdbc7e05a3b1866fd67ec579c51df"
- assert cmd2.stdout_text.find(ck) == 0
-
- def test_EPN_smoketest_1(self):
-@@ -591,3 +591,23 @@ class TestEPN(IntegrationTest):
- self.master.put_file_contents('/etc/ipa/epn.conf', epn_conf)
- result = tasks.ipa_epn(self.master, raiseonerr=False)
- assert "smtp_delay cannot be less than zero" in result.stderr_text
-+
-+ def test_EPN_admin(self):
-+ """The admin user is special and has no givenName by default
-+ It also doesn't by default have an e-mail address
-+ Check --dry-run output.
-+ """
-+ epn_conf = textwrap.dedent('''
-+ [global]
-+ ''')
-+ self.master.put_file_contents('/etc/ipa/epn.conf', epn_conf)
-+ self.master.run_command(
-+ ['ipa', 'user-mod', 'admin', '--password-expiration',
-+ datetime_to_generalized_time(
-+ datetime.datetime.utcnow() + datetime.timedelta(days=7)
-+ )]
-+ )
-+ (unused, stderr_text, _unused) = self._check_epn_output(
-+ self.master, dry_run=True
-+ )
-+ assert "uid=admin" in stderr_text
---
-2.26.2
-
diff --git a/SOURCES/0014-IPA-EPN-enhance-input-validation_rhbz#1866291.patch b/SOURCES/0014-IPA-EPN-enhance-input-validation_rhbz#1866291.patch
deleted file mode 100644
index b905262..0000000
--- a/SOURCES/0014-IPA-EPN-enhance-input-validation_rhbz#1866291.patch
+++ /dev/null
@@ -1,404 +0,0 @@
-From 9479a393a71fe1de7d62ca2b50a7d3d8698d4ba1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 4 Aug 2020 11:05:31 +0200
-Subject: [PATCH] ipatests: tasks.py: fix ipa-epn invocation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-tasks.py::ipa_epn would previously fail to invoke ipa-epn with
-from_nbdays=0.
-
-Related: https://pagure.io/freeipa/issue/8449
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
----
- ipatests/pytest_ipa/integration/tasks.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py
-index a3f7cc838..c0a592750 100755
---- a/ipatests/pytest_ipa/integration/tasks.py
-+++ b/ipatests/pytest_ipa/integration/tasks.py
-@@ -1470,9 +1470,9 @@ def ipa_epn(
- cmd.append("--dry-run")
- if mailtest:
- cmd.append("--mail-test")
-- if from_nbdays:
-+ if from_nbdays is not None:
- cmd.extend(("--from-nbdays", str(from_nbdays)))
-- if to_nbdays:
-+ if to_nbdays is not None:
- cmd.extend(("--to-nbdays", str(to_nbdays)))
- return host.run_command(cmd, raiseonerr=raiseonerr)
-
---
-2.26.2
-
-From 3b8fdd87760cfb8ec739c67298f012cf0bd3ac39 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Wed, 5 Aug 2020 10:02:31 +0200
-Subject: [PATCH] ipatests: test_epn: test_EPN_nbdays enhancements
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Enhance test_EPN_nbdays so that it checks:
-* that no emails get sent when using --dry-run
-* that --from-nbdays implies --dry-run
-* that --to-nbdays requires --from-nbdays
-* illegal inputs for nbdays:
-** from-nbdays > to-nbdays
-** non-numerical input
-** decimal input
-
-Fixes: https://pagure.io/freeipa/issue/8449
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
----
- ipatests/test_integration/test_epn.py | 130 +++++++++++++++++++++++---
- 1 file changed, 117 insertions(+), 13 deletions(-)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index f4c123c6d..18f73c722 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -15,6 +15,13 @@
- # You should have received a copy of the GNU General Public License
- # along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-+######
-+# This test suite will _expectedly_ fail if run at the end of the UTC day
-+# because users would be created during day N and then EPN output checked
-+# during day N+1. This is expected and should be ignored as it does not
-+# reflect a product bug. -- fcami
-+######
-+
- from __future__ import print_function, absolute_import
-
- import base64
-@@ -178,12 +185,14 @@ class TestEPN(IntegrationTest):
- from_nbdays=None,
- to_nbdays=None,
- raiseonerr=True,
-+ validatejson=True
- ):
- result = tasks.ipa_epn(host, raiseonerr=raiseonerr, dry_run=dry_run,
- from_nbdays=from_nbdays,
- to_nbdays=to_nbdays)
-- json.dumps(json.loads(result.stdout_text), ensure_ascii=False)
-- return (result.stdout_text, result.stderr_text)
-+ if validatejson:
-+ json.dumps(json.loads(result.stdout_text), ensure_ascii=False)
-+ return (result.stdout_text, result.stderr_text, result.returncode)
-
- @classmethod
- def install(cls, mh):
-@@ -244,12 +253,12 @@ class TestEPN(IntegrationTest):
- ''')
- self.master.put_file_contents('/etc/ipa/epn.conf', epn_conf)
- # check EPN on client (LDAP+GSSAPI)
-- (stdout_text, unused) = self._check_epn_output(
-+ (stdout_text, unused, _unused) = self._check_epn_output(
- self.clients[0], dry_run=True
- )
- assert len(json.loads(stdout_text)) == 0
- # check EPN on master (LDAPI)
-- (stdout_text, unused) = self._check_epn_output(
-+ (stdout_text, unused, _unused) = self._check_epn_output(
- self.master, dry_run=True
- )
- assert len(json.loads(stdout_text)) == 0
-@@ -292,10 +301,10 @@ class TestEPN(IntegrationTest):
- ),
- ],
- )
-- (stdout_text_client, unused) = self._check_epn_output(
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
- self.clients[0], dry_run=True
- )
-- (stdout_text_master, unused) = self._check_epn_output(
-+ (stdout_text_master, unused, _unused) = self._check_epn_output(
- self.master, dry_run=True
- )
- assert stdout_text_master == stdout_text_client
-@@ -331,10 +340,10 @@ class TestEPN(IntegrationTest):
- password=None,
- )
-
-- (stdout_text_client, unused) = self._check_epn_output(
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
- self.clients[0], dry_run=True
- )
-- (stdout_text_master, unused) = self._check_epn_output(
-+ (stdout_text_master, unused, _unused) = self._check_epn_output(
- self.master, dry_run=True
- )
- assert stdout_text_master == stdout_text_client
-@@ -344,22 +353,117 @@ class TestEPN(IntegrationTest):
- expected_users = ["user1", "user3", "user7", "user14", "user28"]
- assert sorted(user_lst) == sorted(expected_users)
-
-- def test_EPN_nbdays(self):
-+ def test_EPN_nbdays_0(self, cleanupmail):
- """Test the to/from nbdays options (implies --dry-run)
-
- We have a set of users installed with varying expiration
- dates. Confirm that to/from nbdays finds them.
-+
-+ Make sure --dry-run does not accidentally send emails.
- """
-
-- # Compare the notify_ttls values
-+ # Use the notify_ttls values with a 1-day sliding window
- for i in self.notify_ttls:
- user_list = []
-- (stdout_text_client, unused) = self._check_epn_output(
-- self.clients[0], from_nbdays=i, to_nbdays=i + 1, dry_run=True)
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
-+ self.clients[0], from_nbdays=i, to_nbdays=i + 1, dry_run=True
-+ )
- for user in json.loads(stdout_text_client):
- user_list.append(user["uid"])
- assert len(user_list) == 1
-- assert user_list[0] == "user%d" % i
-+ userid = "user{id}".format(id=i)
-+ assert user_list[0] == userid
-+
-+ # Check that the user list is expected for any given notify_ttls.
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
-+ self.clients[0], to_nbdays=i
-+ )
-+ user_list = [user["uid"] for user in json.loads(stdout_text_client)]
-+ assert len(user_list) == 1
-+ assert user_list[0] == "user{id}".format(id=i - 1)
-+
-+ # make sure no emails were sent
-+ result = self.clients[0].run_command(['ls', '-lha', '/var/mail/'])
-+ assert userid not in result.stdout_text
-+
-+ def test_EPN_nbdays_1(self, cleanupmail):
-+ """Test that for a given range, we find the users in that range"""
-+
-+ # Use hardcoded date ranges for now
-+ for date_range in [(0, 5), (7, 15), (1, 20)]:
-+ expected_user_list = ["user{i}".format(i=i)
-+ for i in range(date_range[0], date_range[1])]
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
-+ self.clients[0],
-+ from_nbdays=date_range[0],
-+ to_nbdays=date_range[1]
-+ )
-+ user_list = [user["uid"] for user in json.loads(stdout_text_client)]
-+ for user in expected_user_list:
-+ assert user in user_list
-+ for user in user_list:
-+ assert user in expected_user_list
-+
-+ # Test the to/from nbdays options behavior with illegal input
-+
-+ def test_EPN_nbdays_input_0(self):
-+ """Make sure that --to-nbdays implies --dry-run ;
-+ therefore check that the output is valid JSON and contains the
-+ expected user.
-+ """
-+
-+ (stdout_text_client, unused, _unused) = self._check_epn_output(
-+ self.clients[0], to_nbdays=5, dry_run=False
-+ )
-+ assert len(json.loads(stdout_text_client)) == 1
-+ assert json.loads(stdout_text_client)[0]["uid"] == "user4"
-+
-+ def test_EPN_nbdays_input_1(self):
-+ """Make sure that --from-nbdays cannot be used without --to-nbdays"""
-+
-+ (unused, stderr_text_client, rc) = \
-+ self._check_epn_output(
-+ self.clients[0], from_nbdays=3,
-+ raiseonerr=False, validatejson=False
-+ )
-+ assert "You cannot specify --from-nbdays without --to-nbdays" \
-+ in stderr_text_client
-+ assert rc > 0
-+
-+ @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
-+ def test_EPN_nbdays_input_2(self):
-+ """alpha input"""
-+
-+ (unused, stderr, rc) = self._check_epn_output(
-+ self.clients[0], to_nbdays="abc",
-+ raiseonerr=False, validatejson=False
-+ )
-+ assert "error: --to-nbdays must be an integer." in stderr
-+ assert rc > 0
-+
-+ @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
-+ def test_EPN_nbdays_input_3(self):
-+ """from_nbdays > to_nbdays"""
-+
-+ (unused, stderr, rc) = self._check_epn_output(
-+ self.clients[0], from_nbdays=9, to_nbdays=7,
-+ raiseonerr=False, validatejson=False
-+ )
-+ assert "error: --from-nbdays must be smaller than --to-nbdays." in \
-+ stderr
-+ assert rc > 0
-+
-+ @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
-+ def test_EPN_nbdays_input_4(self):
-+ """decimal input"""
-+
-+ (unused, stderr, rc) = self._check_epn_output(
-+ self.clients[0], to_nbdays=7.3,
-+ raiseonerr=False, validatejson=False
-+ )
-+ logger.info(stderr)
-+ assert rc > 0
-+ assert "error: --to-nbdays must be an integer." in stderr
-
- # From here the tests build on one another:
- # 1) add auth
---
-2.26.2
-
-From b4266023e04729db12de2f7e0de4da9e1d00db38 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Fri, 7 Aug 2020 19:08:39 +0200
-Subject: [PATCH] ipatests: test_epn: update error messages
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Update error messages in the test.
-
-Fixes: https://pagure.io/freeipa/issue/8449
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
----
- ipatests/test_integration/test_epn.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index e03521193..af662140a 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -458,7 +458,7 @@ class TestEPN(IntegrationTest):
- self.clients[0], to_nbdays="abc",
- raiseonerr=False, validatejson=False
- )
-- assert "error: --to-nbdays must be an integer." in stderr
-+ assert "error: --to-nbdays must be a positive integer." in stderr
- assert rc > 0
-
- @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
-@@ -483,7 +483,7 @@ class TestEPN(IntegrationTest):
- )
- logger.info(stderr)
- assert rc > 0
-- assert "error: --to-nbdays must be an integer." in stderr
-+ assert "error: --to-nbdays must be a positive integer." in stderr
-
- # From here the tests build on one another:
- # 1) add auth
---
-2.26.2
-
-From 2809084a44e3b174fa48a611e79f04358e1d6dca Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Wed, 5 Aug 2020 09:05:31 +0200
-Subject: [PATCH] IPA-EPN: enhance input validation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Enhance input validation:
-* make sure --from-nbdays and --to-nbdays are integer
-* make sure --from-nbdays < --to-nbdays
-
-Fixes: https://pagure.io/freeipa/issue/8444
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
----
- ipaclient/install/ipa_epn.py | 28 +++++++++++++++++++++++++--
- ipatests/test_integration/test_epn.py | 3 ---
- 2 files changed, 26 insertions(+), 5 deletions(-)
-
-diff --git a/ipaclient/install/ipa_epn.py b/ipaclient/install/ipa_epn.py
-index 82d7b3f57..88c926e88 100644
---- a/ipaclient/install/ipa_epn.py
-+++ b/ipaclient/install/ipa_epn.py
-@@ -246,9 +246,33 @@ class EPN(admintool.AdminTool):
-
- def validate_options(self):
- super(EPN, self).validate_options(needs_root=True)
-- if self.options.to_nbdays:
-+ if self.options.to_nbdays is not None:
-+ try:
-+ if int(self.options.to_nbdays) < 0:
-+ raise RuntimeError('Input is negative.')
-+ except Exception as e:
-+ self.option_parser.error(
-+ "--to-nbdays must be a positive integer. "
-+ "{error}".format(error=e)
-+ )
- self.options.dry_run = True
-- if self.options.from_nbdays and not self.options.to_nbdays:
-+ if self.options.from_nbdays is not None:
-+ try:
-+ if int(self.options.from_nbdays) < 0:
-+ raise RuntimeError('Input is negative.')
-+ except Exception as e:
-+ self.option_parser.error(
-+ "--from-nbdays must be a positive integer. "
-+ "{error}".format(error=e)
-+ )
-+ if self.options.from_nbdays is not None and \
-+ self.options.to_nbdays is not None:
-+ if int(self.options.from_nbdays) >= int(self.options.to_nbdays):
-+ self.option_parser.error(
-+ "--from-nbdays must be smaller than --to-nbdays."
-+ )
-+ if self.options.from_nbdays is not None and \
-+ self.options.to_nbdays is None:
- self.option_parser.error(
- "You cannot specify --from-nbdays without --to-nbdays"
- )
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index af662140a..fc26888cb 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -450,7 +450,6 @@ class TestEPN(IntegrationTest):
- in stderr_text_client
- assert rc > 0
-
-- @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
- def test_EPN_nbdays_input_2(self):
- """alpha input"""
-
-@@ -461,7 +460,6 @@ class TestEPN(IntegrationTest):
- assert "error: --to-nbdays must be a positive integer." in stderr
- assert rc > 0
-
-- @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
- def test_EPN_nbdays_input_3(self):
- """from_nbdays > to_nbdays"""
-
-@@ -473,7 +471,6 @@ class TestEPN(IntegrationTest):
- stderr
- assert rc > 0
-
-- @pytest.mark.xfail(reason='freeipa ticket 8444', strict=True)
- def test_EPN_nbdays_input_4(self):
- """decimal input"""
-
---
-2.26.2
-
diff --git a/SOURCES/0015-IPA-EPN-Fix-SMTP-connection-error-handling_rhbz#1863079.patch b/SOURCES/0015-IPA-EPN-Fix-SMTP-connection-error-handling_rhbz#1863079.patch
deleted file mode 100644
index 3871c56..0000000
--- a/SOURCES/0015-IPA-EPN-Fix-SMTP-connection-error-handling_rhbz#1863079.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From 3cf7fb1014ae40fd5a5278f27577a8196a4af051 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Fri, 7 Aug 2020 07:51:53 +0200
-Subject: [PATCH] ipatests: test_epn: add test_EPN_connection_refused
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Add a test for EPN behavior when the configured SMTP does not
-accept connections.
-
-Fixes: https://pagure.io/freeipa/issue/8445
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipatests/test_integration/test_epn.py | 27 ++++++++++++++++++++++++---
- 1 file changed, 24 insertions(+), 3 deletions(-)
-
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index c5c73835a..1a25d3710 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -182,14 +182,20 @@ class TestEPN(IntegrationTest):
- self,
- host,
- dry_run=False,
-+ mailtest=False,
- from_nbdays=None,
- to_nbdays=None,
- raiseonerr=True,
- validatejson=True
- ):
-- result = tasks.ipa_epn(host, raiseonerr=raiseonerr, dry_run=dry_run,
-- from_nbdays=from_nbdays,
-- to_nbdays=to_nbdays)
-+ result = tasks.ipa_epn(
-+ host,
-+ from_nbdays=from_nbdays,
-+ to_nbdays=to_nbdays,
-+ mailtest=mailtest,
-+ dry_run=dry_run,
-+ raiseonerr=raiseonerr
-+ )
- if validatejson:
- json.dumps(json.loads(result.stdout_text), ensure_ascii=False)
- return (result.stdout_text, result.stderr_text, result.returncode)
-@@ -243,6 +249,21 @@ class TestEPN(IntegrationTest):
- ck = "192481b52fb591112afd7b55b12a44c6618fdbc7e05a3b1866fd67ec579c51df"
- assert cmd2.stdout_text.find(ck) == 0
-
-+ @pytest.mark.xfail(reason='freeipa ticket 8445', strict=True)
-+ def test_EPN_connection_refused(self):
-+ """Test EPN behavior when the configured SMTP is down
-+ """
-+
-+ self.master.run_command(["systemctl", "stop", "postfix"])
-+ (unused, stderr_text, rc) = self._check_epn_output(
-+ self.master, mailtest=True,
-+ raiseonerr=False, validatejson=False
-+ )
-+ self.master.run_command(["systemctl", "start", "postfix"])
-+ assert "IPA-EPN: Could not connect to the configured SMTP server" in \
-+ stderr_text
-+ assert rc > 0
-+
- def test_EPN_smoketest_1(self):
- """No users except admin. Check --dry-run output.
- With the default configuration, the result should be an empty list.
---
-2.26.2
-
-From 53f330b053740b169d211aa16b3b36fb61157bbd Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Fri, 7 Aug 2020 06:19:31 +0200
-Subject: [PATCH] IPA-EPN: Fix SMTP connection error handling
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Enhance error message when SMTP is down.
-
-Fixes: https://pagure.io/freeipa/issue/8445
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipaclient/install/ipa_epn.py | 17 ++++++++++-------
- ipatests/test_integration/test_epn.py | 1 -
- 2 files changed, 10 insertions(+), 8 deletions(-)
-
-diff --git a/ipaclient/install/ipa_epn.py b/ipaclient/install/ipa_epn.py
-index 0d1ae2add..82d7b3f57 100644
---- a/ipaclient/install/ipa_epn.py
-+++ b/ipaclient/install/ipa_epn.py
-@@ -38,6 +38,7 @@ from email.mime.multipart import MIMEMultipart
- from email.mime.text import MIMEText
- from email.header import Header
- from email.utils import make_msgid
-+from socket import error as socketerror
-
- from ipaplatform.paths import paths
- from ipalib import api, errors
-@@ -640,13 +641,15 @@ class MTAClient:
- port=self._smtp_port,
- timeout=self._smtp_timeout,
- )
-- except smtplib.SMTPException as e:
-- logger.error(
-- "IPA-EPN: Unable to connect to %s:%s: %s",
-- self._smtp_hostname,
-- self._smtp_port,
-- e,
-- )
-+ except (socketerror, smtplib.SMTPException) as e:
-+ msg = \
-+ "IPA-EPN: Could not connect to the configured SMTP server: " \
-+ "{host}:{port}: {error}".format(
-+ host=self._smtp_hostname,
-+ port=self._smtp_port,
-+ error=e
-+ )
-+ raise admintool.ScriptError(msg)
-
- try:
- self._conn.ehlo()
-diff --git a/ipatests/test_integration/test_epn.py b/ipatests/test_integration/test_epn.py
-index 1a25d3710..e03521193 100644
---- a/ipatests/test_integration/test_epn.py
-+++ b/ipatests/test_integration/test_epn.py
-@@ -249,7 +249,6 @@ class TestEPN(IntegrationTest):
- ck = "192481b52fb591112afd7b55b12a44c6618fdbc7e05a3b1866fd67ec579c51df"
- assert cmd2.stdout_text.find(ck) == 0
-
-- @pytest.mark.xfail(reason='freeipa ticket 8445', strict=True)
- def test_EPN_connection_refused(self):
- """Test EPN behavior when the configured SMTP is down
- """
---
-2.26.2
-
diff --git a/SOURCES/0016-Set-mode-of-etc-ipa-ca.crt-to-0644-in-CA-less-instal_rhbz#1870202.patch b/SOURCES/0016-Set-mode-of-etc-ipa-ca.crt-to-0644-in-CA-less-instal_rhbz#1870202.patch
deleted file mode 100644
index 8f8c1df..0000000
--- a/SOURCES/0016-Set-mode-of-etc-ipa-ca.crt-to-0644-in-CA-less-instal_rhbz#1870202.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 4a97145c3a76a4d9ebf52b3905410a0bd7bec856 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Tue, 4 Aug 2020 15:09:56 -0400
-Subject: [PATCH] Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
-
-It was previously being set to 0444 which triggered a warning
-in freeipa-healthcheck.
-
-Even root needs DAC_OVERRIDE capability to write to a 0o444 file
-which may not be available in some environments.
-
-https://pagure.io/freeipa/issue/8441
-
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- ipaserver/install/certs.py | 2 +-
- ipaserver/install/server/install.py | 5 ++---
- 2 files changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
-index 22ee79bd1..51d9f9221 100644
---- a/ipaserver/install/certs.py
-+++ b/ipaserver/install/certs.py
-@@ -329,7 +329,7 @@ class CertDB:
- ipautil.backup_file(cacert_fname)
- root_nicknames = self.find_root_cert(nickname)[:-1]
- with open(cacert_fname, "w") as f:
-- os.fchmod(f.fileno(), stat.S_IRUSR | stat.S_IRGRP | stat.S_IROTH)
-+ os.fchmod(f.fileno(), 0o644)
- for root in root_nicknames:
- result = self.run_certutil(["-L", "-n", root, "-a"],
- capture_output=True)
-diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
-index b53c58e2a..6a593602f 100644
---- a/ipaserver/install/server/install.py
-+++ b/ipaserver/install/server/install.py
-@@ -891,9 +891,8 @@ def install(installer):
-
- ca.install_step_0(False, None, options, custodia=custodia)
- else:
-- # Put the CA cert where other instances expect it
-- x509.write_certificate(http_ca_cert, paths.IPA_CA_CRT)
-- os.chmod(paths.IPA_CA_CRT, 0o444)
-+ # /etc/ipa/ca.crt is created as a side-effect of
-+ # dsinstance::enable_ssl() via export_ca_cert()
-
- if not options.no_pkinit:
- x509.write_certificate(http_ca_cert, paths.KDC_CA_BUNDLE_PEM)
---
-2.26.2
-
-From da2079ce2cc841aec56da872131112eb24326f81 Mon Sep 17 00:00:00 2001
-From: Rob Crittenden <rcritten@redhat.com>
-Date: Tue, 4 Aug 2020 15:12:20 -0400
-Subject: [PATCH] ipatests: Check permissions of /etc/ipa/ca.crt new
- installations
-
-It should be 0644 root:root for both CA-ful and CA-less installs.
-
-https://pagure.io/freeipa/issue/8441
-
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
----
- ipatests/test_integration/test_caless.py | 8 ++++++++
- ipatests/test_integration/test_installation.py | 10 ++++++++++
- 2 files changed, 18 insertions(+)
-
-diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py
-index 1ea7d9896..16dfbb320 100644
---- a/ipatests/test_integration/test_caless.py
-+++ b/ipatests/test_integration/test_caless.py
-@@ -394,6 +394,14 @@ class CALessBase(IntegrationTest):
- host, cert_from_ldap.public_bytes(x509.Encoding.PEM))
- assert cert_from_ldap == expected_cacrt
-
-+ result = host.run_command(
-+ ["/usr/bin/stat", "-c", "%U:%G:%a", paths.IPA_CA_CRT]
-+ )
-+ (owner, group, mode) = result.stdout_text.strip().split(':')
-+ assert owner == "root"
-+ assert group == "root"
-+ assert mode == "644"
-+
- # Verify certmonger was not started
- result = host.run_command(['getcert', 'list'], raiseonerr=False)
- assert result.returncode == 0
-diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py
-index 100a5a766..fb1990083 100644
---- a/ipatests/test_integration/test_installation.py
-+++ b/ipatests/test_integration/test_installation.py
-@@ -346,6 +346,16 @@ class TestInstallCA(IntegrationTest):
- status = tasks.wait_for_request(self.master, request_id[0], 300)
- assert status == "MONITORING"
-
-+ def test_ipa_ca_crt_permissions(self):
-+ """Verify that /etc/ipa/ca.cert is mode 0644 root:root"""
-+ result = self.master.run_command(
-+ ["/usr/bin/stat", "-c", "%U:%G:%a", paths.IPA_CA_CRT]
-+ )
-+ out = str(result.stdout_text.strip())
-+ (owner, group, mode) = out.split(':')
-+ assert mode == "644"
-+ assert owner == "root"
-+ assert group == "root"
-
- class TestInstallWithCA_KRA1(InstallTestBase1):
-
---
-2.26.2
-
diff --git a/SOURCES/0017-SELinux-Policy-let-custodia-replicate-keys_rhbz#1868432.patch b/SOURCES/0017-SELinux-Policy-let-custodia-replicate-keys_rhbz#1868432.patch
deleted file mode 100644
index 2e1c708..0000000
--- a/SOURCES/0017-SELinux-Policy-let-custodia-replicate-keys_rhbz#1868432.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 438285470610dee4aa6a56523df22307840ede87 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Mon, 7 Sep 2020 11:07:21 +0200
-Subject: [PATCH] SELinux Policy: let custodia replicate keys
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Enhance the SELinux policy so that custodia can replicate sub-CA keys
-and certificates:
-allow ipa_custodia_t self:tcp_socket { bind create };
-allow ipa_custodia_t node_t:tcp_socket node_bind;
-allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
-allow ipa_custodia_t pki_tomcat_cert_t:file create;
-allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
-allow ipa_custodia_t self:process execmem;
-
-Found by: test_replica_promotion::TestSubCAkeyReplication
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- selinux/ipa.te | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index c4c3fa805..3fa4ba980 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -72,6 +72,9 @@ logging_log_file(ipa_custodia_log_t)
- type ipa_custodia_tmp_t;
- files_tmp_file(ipa_custodia_tmp_t)
-
-+type pki_tomcat_cert_t;
-+type node_t;
-+
- ########################################
- #
- # ipa_otpd local policy
-@@ -323,10 +326,18 @@ optional_policy(`
- allow ipa_custodia_t self:capability { setgid setuid };
- allow ipa_custodia_t self:fifo_file rw_fifo_file_perms;
- allow ipa_custodia_t self:netlink_route_socket { create_socket_perms nlmsg_read };
-+allow ipa_custodia_t self:process execmem;
- allow ipa_custodia_t self:unix_stream_socket create_stream_socket_perms;
- allow ipa_custodia_t self:unix_dgram_socket create_socket_perms;
-+allow ipa_custodia_t self:tcp_socket { bind create };
- allow ipa_custodia_t self:udp_socket create_socket_perms;
-
-+allow ipa_custodia_t node_t:tcp_socket node_bind;
-+
-+allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
-+allow ipa_custodia_t pki_tomcat_cert_t:file create;
-+allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
-+
- manage_dirs_pattern(ipa_custodia_t,ipa_custodia_log_t,ipa_custodia_log_t)
- manage_files_pattern(ipa_custodia_t, ipa_custodia_log_t, ipa_custodia_log_t)
- logging_log_filetrans(ipa_custodia_t, ipa_custodia_log_t, { dir file })
---
-2.26.2
-
diff --git a/SOURCES/0018-dogtaginstance.py-add-debug-to-pkispawn_rhbz#1879604.patch b/SOURCES/0018-dogtaginstance.py-add-debug-to-pkispawn_rhbz#1879604.patch
deleted file mode 100644
index a95c32b..0000000
--- a/SOURCES/0018-dogtaginstance.py-add-debug-to-pkispawn_rhbz#1879604.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-Adapted version of d1c860e59b52. to make it apply without commits
-
-34b4d9bce5 - ipatests: Test ipa user login with wrong password
-ab36d79adc - ipatests: Test for ipa-nis-manage CLI tool.
-
-From d1c860e59b5237178066ed963cc2fa50d99cd690 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Wed, 16 Sep 2020 17:07:21 +0200
-Subject: [PATCH] ipatests: check that pkispawn log is not empty
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Since commits:
-https://github.com/dogtagpki/pki/commit/0102d836f4eac0fcea0adddb4c98d5ea05e4e8f6
-https://github.com/dogtagpki/pki/commit/de217557a642d799b1c4c390efa55493707c738e
-pkispawn will not honor the pki_log_level configuration item.
-All 10.9 Dogtag versions have these commits.
-This affects FreeIPA in that it makes debugging Dogtag installation issues next
-to impossible.
-Adding --debug to the pkispawn CLI is required to revert to the previous
-behavior.
-Therefore check that the log is not empty and contains DEBUG+INFO lines.
-
-Fixes: https://pagure.io/freeipa/issue/8503
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipatests/test_integration/test_commands.py | 23 ++++++++++++++++++++++
- 1 file changed, 23 insertions(+)
-
-diff --git a/ipatests/test_integration/test_commands.py b/ipatests/test_integration/test_commands.py
-index fa6abd81e..3a12bcde2 100644
---- a/ipatests/test_integration/test_commands.py
-+++ b/ipatests/test_integration/test_commands.py
-@@ -1295,3 +1295,26 @@ class TestIPACommand(IntegrationTest):
- assert msg2 not in result.stderr_text
- finally:
- bashrc_backup.restore()
-+
-+ def test_pkispawn_log_is_present(self):
-+ """
-+ This testcase checks if pkispawn logged properly.
-+ It is a candidate from being moved out of test_commands.
-+ """
-+ result = self.master.run_command(
-+ ["ls", "/var/log/pki/"]
-+ )
-+ pkispawnlogfile = None
-+ for file in result.stdout_text.splitlines():
-+ if file.startswith("pki-ca-spawn"):
-+ pkispawnlogfile = file
-+ break
-+ assert pkispawnlogfile is not None
-+ pkispawnlogfile = os.path.sep.join(("/var/log/pki", pkispawnlogfile))
-+ pkispawnlog = self.master.get_file_contents(
-+ pkispawnlogfile, encoding='utf-8'
-+ )
-+ # Totally arbitrary. pkispawn debug logs tend to be > 10KiB.
-+ assert len(pkispawnlog) > 1024
-+ assert "DEBUG" in pkispawnlog
-+ assert "INFO" in pkispawnlog
---
-2.26.2
-
-From 97c6d2d2c2359b8ff5585afa0d2e5f5599cd5048 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Thu, 17 Sep 2020 07:31:59 +0200
-Subject: [PATCH] dogtaginstance.py: add --debug to pkispawn
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Since commits:
-https://github.com/dogtagpki/pki/commit/0102d836f4eac0fcea0adddb4c98d5ea05e4e8f6
-https://github.com/dogtagpki/pki/commit/de217557a642d799b1c4c390efa55493707c738e
-pkispawn will not honor the pki_log_level configuration item.
-All 10.9 Dogtag versions have these commits.
-This affects FreeIPA in that it makes debugging Dogtag installation issues next
-to impossible.
-Adding --debug to the pkispawn CLI is required to revert to the previous
-behavior.
-
-Fixes: https://pagure.io/freeipa/issue/8503
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
----
- ipaserver/install/dogtaginstance.py | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py
-index 524262ad7..03fdd7c0b 100644
---- a/ipaserver/install/dogtaginstance.py
-+++ b/ipaserver/install/dogtaginstance.py
-@@ -183,7 +183,8 @@ class DogtagInstance(service.Service):
- subsystem = self.subsystem
- args = [paths.PKISPAWN,
- "-s", subsystem,
-- "-f", cfg_file]
-+ "-f", cfg_file,
-+ "--debug"]
-
- with open(cfg_file) as f:
- logger.debug(
---
-2.26.2
-
diff --git a/SOURCES/0019-SELinux-add-dedicated-policy-for-ipa-pki-retrieve-key-ipatests-enhance-TestSubCAkeyReplication_rhbz#1870202.patch b/SOURCES/0019-SELinux-add-dedicated-policy-for-ipa-pki-retrieve-key-ipatests-enhance-TestSubCAkeyReplication_rhbz#1870202.patch
deleted file mode 100644
index d271d98..0000000
--- a/SOURCES/0019-SELinux-add-dedicated-policy-for-ipa-pki-retrieve-key-ipatests-enhance-TestSubCAkeyReplication_rhbz#1870202.patch
+++ /dev/null
@@ -1,549 +0,0 @@
-From 52929cbadf0252fcac1019b74663a2808061ea1b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Thu, 17 Sep 2020 11:30:45 +0200
-Subject: [PATCH] ipatests: enhance TestSubCAkeyReplication
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-enhance the test suite so that it covers:
-- deleting subCAs (disabling them first)
-- checking what happens when creating a dozen+ subCAs at a time
-- adding a subCA that already exists and expect failure
-
-Related: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- .../test_replica_promotion.py | 52 +++++++++++++++++--
- 1 file changed, 47 insertions(+), 5 deletions(-)
-
-diff --git a/ipatests/test_integration/test_replica_promotion.py b/ipatests/test_integration/test_replica_promotion.py
-index 82117054f..f0b72e1f8 100644
---- a/ipatests/test_integration/test_replica_promotion.py
-+++ b/ipatests/test_integration/test_replica_promotion.py
-@@ -474,17 +474,35 @@ class TestSubCAkeyReplication(IntegrationTest):
- SERVER_CERT_NICK: 'u,u,u',
- }
-
-- def add_subca(self, host, name, subject):
-+ def add_subca(self, host, name, subject, raiseonerr=True):
- result = host.run_command([
- 'ipa', 'ca-add', name,
- '--subject', subject,
-- '--desc', self.SUBCA_DESC,
-+ '--desc', self.SUBCA_DESC],
-+ raiseonerr=raiseonerr
-+ )
-+ if raiseonerr:
-+ assert "ipa: ERROR:" not in result.stderr_text
-+ auth_id = "".join(re.findall(AUTH_ID_RE, result.stdout_text))
-+ return '{} {}'.format(IPA_CA_NICKNAME, auth_id)
-+ else:
-+ assert "ipa: ERROR:" in result.stderr_text
-+ assert result.returncode != 0
-+ return result
-+
-+ def del_subca(self, host, name):
-+ host.run_command([
-+ 'ipa', 'ca-disable', name
- ])
-- auth_id = "".join(re.findall(AUTH_ID_RE, result.stdout_text))
-- return '{} {}'.format(IPA_CA_NICKNAME, auth_id)
-+ result = host.run_command([
-+ 'ipa', 'ca-del', name
-+ ])
-+ assert "Deleted CA \"{}\"".format(name) in result.stdout_text
-
- def check_subca(self, host, name, cert_nick):
-- host.run_command(['ipa', 'ca-show', name])
-+ result = host.run_command(['ipa', 'ca-show', name])
-+ # ipa ca-show returns 0 even if the cert cannot be found locally.
-+ assert "ipa: ERROR:" not in result.stderr_text
- tasks.run_certutil(
- host, ['-L', '-n', cert_nick], paths.PKI_TOMCAT_ALIAS_DIR
- )
-@@ -627,6 +645,30 @@ class TestSubCAkeyReplication(IntegrationTest):
- ssl = replica.run_command(ssl_cmd)
- assert 'Issuer: CN = {}'.format(self.SUBCA_MASTER) in ssl.stdout_text
-
-+ def test_del_subca_master_on_replica(self):
-+ self.del_subca(self.replicas[0], self.SUBCA_MASTER)
-+
-+ def test_del_subca_replica(self):
-+ self.del_subca(self.replicas[0], self.SUBCA_REPLICA)
-+
-+ def test_scale_add_subca(self):
-+ master = self.master
-+ replica = self.replicas[0]
-+
-+ subcas = {}
-+ for i in range(0, 16):
-+ name = "_".join((self.SUBCA_MASTER, str(i)))
-+ cn = "_".join((self.SUBCA_MASTER_CN, str(i)))
-+ subcas[name] = self.add_subca(master, name, cn)
-+ self.add_subca(master, name, cn, raiseonerr=False)
-+
-+ # give replication some time
-+ time.sleep(15)
-+
-+ for name in subcas:
-+ self.check_subca(replica, name, subcas[name])
-+ self.del_subca(replica, name)
-+
-
- class TestReplicaInstallCustodia(IntegrationTest):
- """
---
-2.26.2
-
-From 5a5962426d8174212f0b7efef1a9e53aaecb5901 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Fri, 18 Sep 2020 11:55:37 +0200
-Subject: [PATCH] SELinux: Add dedicated policy for ipa-pki-retrieve-key
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Add proper labeling, transition and policy for ipa-pki-retrieve-key.
-Make sure tomcat_t can execute ipa-pki-retrieve-key.
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: Christian Heimes <cheimes@redhat.com>
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.fc | 1 +
- selinux/ipa.te | 28 ++++++++++++++++++++++++++++
- 2 files changed, 29 insertions(+)
-
-diff --git a/selinux/ipa.fc b/selinux/ipa.fc
-index a98cc4665..1176f383c 100644
---- a/selinux/ipa.fc
-+++ b/selinux/ipa.fc
-@@ -30,5 +30,6 @@
- /usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
- /usr/libexec/ipa/custodia/ipa-custodia-pki-tomcat-wrapped -- gen_context(system_u:object_r:ipa_custodia_pki_tomcat_exec_t,s0)
- /usr/libexec/ipa/custodia/ipa-custodia-ra-agent -- gen_context(system_u:object_r:ipa_custodia_ra_agent_exec_t,s0)
-+/usr/libexec/ipa/ipa-pki-retrieve-key -- gen_context(system_u:object_r:ipa_pki_retrieve_key_exec_t,s0)
-
- /var/log/ipa-custodia.audit.log(/.*)? -- gen_context(system_u:object_r:ipa_custodia_log_t,s0)
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 3fa4ba980..26daed293 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -75,6 +75,9 @@ files_tmp_file(ipa_custodia_tmp_t)
- type pki_tomcat_cert_t;
- type node_t;
-
-+type ipa_pki_retrieve_key_exec_t;
-+init_script_file(ipa_pki_retrieve_key_exec_t)
-+
- ########################################
- #
- # ipa_otpd local policy
-@@ -412,3 +415,28 @@ optional_policy(`
- optional_policy(`
- systemd_private_tmp(ipa_custodia_tmp_t)
- ')
-+
-+optional_policy(`
-+ gen_require(`
-+ type tomcat_t;
-+ ')
-+ can_exec(tomcat_t, ipa_pki_retrieve_key_exec_t)
-+ pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_exec_t)
-+')
-+
-+optional_policy(`
-+ gen_require(`
-+ type devlog_t;
-+ ')
-+
-+ dontaudit ipa_custodia_t devlog_t:lnk_file read_lnk_file_perms;
-+')
-+
-+optional_policy(`
-+ java_exec(ipa_custodia_pki_tomcat_exec_t)
-+ # allow Java to read system status and RNG
-+ dev_read_urand(ipa_custodia_t)
-+ dev_read_rand(ipa_custodia_t)
-+ kernel_read_network_state(ipa_custodia_t)
-+ dev_read_sysfs(ipa_custodia_t)
-+')
---
-2.26.2
-
-From c126610ea6605a1ff36cecf2e2f5b2cb97130831 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Fri, 18 Sep 2020 17:45:39 +0200
-Subject: [PATCH] SELinux Policy: let custodia_t map custodia_tmp_t
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is used by the JVM perf counters.
-
-Related: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 26daed293..0a9ccaf83 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -347,6 +347,7 @@ logging_log_filetrans(ipa_custodia_t, ipa_custodia_log_t, { dir file })
-
- manage_dirs_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
- manage_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
-+mmap_exec_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
- files_tmp_filetrans(ipa_custodia_t, ipa_custodia_tmp_t, { dir file })
-
- kernel_dgram_send(ipa_custodia_t)
---
-2.26.2
-
-From 310dbd6eec337f0747d73fa87363083a742fc5dc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Mon, 21 Sep 2020 11:32:52 +0200
-Subject: [PATCH] SELinux Policy: ipa_pki_retrieve_key_exec_t =>
- ipa_pki_retrieve_key_t
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Grant pki_manage_tomcat_etc_rw to ipa_pki_retrieve_key_t instead of
-ipa_pki_retrieve_key_exec_t.
-As suggested by Ondrej Mosnáček.
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 0a9ccaf83..92a3b2359 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -78,6 +78,8 @@ type node_t;
- type ipa_pki_retrieve_key_exec_t;
- init_script_file(ipa_pki_retrieve_key_exec_t)
-
-+type ipa_pki_retrieve_key_t;
-+
- ########################################
- #
- # ipa_otpd local policy
-@@ -422,7 +424,7 @@ optional_policy(`
- type tomcat_t;
- ')
- can_exec(tomcat_t, ipa_pki_retrieve_key_exec_t)
-- pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_exec_t)
-+ pki_manage_tomcat_etc_rw(ipa_pki_retrieve_key_t)
- ')
-
- optional_policy(`
---
-2.26.2
-
-From 0518c63768b50973f3d3129547f5b4b95335f4a8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Mon, 21 Sep 2020 11:37:12 +0200
-Subject: [PATCH] SELinux Policy: ipa_custodia_pki_tomcat_exec_t =>
- ipa_custodia_pki_tomcat_t
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-ipa_custodia_pki_tomcat_exec_t was granted java_exec by mistake ; replace by
-ipa_custodia_pki_tomcat_t.
-As suggested by Ondrej Mosnáček.
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 92a3b2359..b2c618a53 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -63,6 +63,8 @@ init_script_file(ipa_custodia_dmldap_exec_t)
- type ipa_custodia_pki_tomcat_exec_t;
- init_script_file(ipa_custodia_pki_tomcat_exec_t)
-
-+type ipa_custodia_pki_tomcat_t;
-+
- type ipa_custodia_ra_agent_exec_t;
- init_script_file(ipa_custodia_ra_agent_exec_t)
-
-@@ -436,7 +438,7 @@ optional_policy(`
- ')
-
- optional_policy(`
-- java_exec(ipa_custodia_pki_tomcat_exec_t)
-+ java_exec(ipa_custodia_pki_tomcat_t)
- # allow Java to read system status and RNG
- dev_read_urand(ipa_custodia_t)
- dev_read_rand(ipa_custodia_t)
---
-2.26.2
-
-From 25cf7af0d41bbd34621f37c95802675b42baeae9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 22 Sep 2020 11:36:13 +0200
-Subject: [PATCH] SELinux Policy: flag ipa_pki_retrieve_key_exec_t as
- domain_type
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index b2c618a53..42b010133 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -78,6 +78,7 @@ type pki_tomcat_cert_t;
- type node_t;
-
- type ipa_pki_retrieve_key_exec_t;
-+domain_type(ipa_pki_retrieve_key_exec_t)
- init_script_file(ipa_pki_retrieve_key_exec_t)
-
- type ipa_pki_retrieve_key_t;
---
-2.26.2
-
-From 7ad04841245668e3126cb1718ef7ec1b744526e8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 22 Sep 2020 13:12:05 +0200
-Subject: [PATCH] SELinux Policy: make interfaces for kernel modules
- non-optional
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Interfaces for kernel modules do not need to be in an optional module.
-Also make sure ipa_custodia_t can log.
-Suggested by Lukas Vrabec.
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 16 +++++++++-------
- 1 file changed, 9 insertions(+), 7 deletions(-)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index 42b010133..f984a0f94 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -78,10 +78,9 @@ type pki_tomcat_cert_t;
- type node_t;
-
- type ipa_pki_retrieve_key_exec_t;
--domain_type(ipa_pki_retrieve_key_exec_t)
--init_script_file(ipa_pki_retrieve_key_exec_t)
--
- type ipa_pki_retrieve_key_t;
-+domain_type(ipa_pki_retrieve_key_t)
-+init_script_file(ipa_pki_retrieve_key_exec_t)
-
- ########################################
- #
-@@ -356,6 +355,7 @@ mmap_exec_files_pattern(ipa_custodia_t, ipa_custodia_tmp_t, ipa_custodia_tmp_t)
- files_tmp_filetrans(ipa_custodia_t, ipa_custodia_tmp_t, { dir file })
-
- kernel_dgram_send(ipa_custodia_t)
-+kernel_read_network_state(ipa_custodia_t)
-
- auth_read_passwd(ipa_custodia_t)
-
-@@ -366,6 +366,10 @@ can_exec(ipa_custodia_t, ipa_custodia_ra_agent_exec_t)
- corecmd_exec_bin(ipa_custodia_t)
- corecmd_mmap_bin_files(ipa_custodia_t)
-
-+dev_read_urand(ipa_custodia_t)
-+dev_read_rand(ipa_custodia_t)
-+dev_read_sysfs(ipa_custodia_t)
-+
- domain_use_interactive_fds(ipa_custodia_t)
-
- files_mmap_usr_files(ipa_custodia_t)
-@@ -377,6 +381,8 @@ files_read_etc_files(ipa_custodia_t)
- libs_exec_ldconfig(ipa_custodia_t)
- libs_ldconfig_exec_entry_type(ipa_custodia_t)
-
-+logging_send_syslog_msg(ipa_custodia_t)
-+
- miscfiles_read_generic_certs(ipa_custodia_t)
- miscfiles_read_localization(ipa_custodia_t)
-
-@@ -441,8 +447,4 @@ optional_policy(`
- optional_policy(`
- java_exec(ipa_custodia_pki_tomcat_t)
- # allow Java to read system status and RNG
-- dev_read_urand(ipa_custodia_t)
-- dev_read_rand(ipa_custodia_t)
-- kernel_read_network_state(ipa_custodia_t)
-- dev_read_sysfs(ipa_custodia_t)
- ')
---
-2.26.2
-
-From 6a31605c1d249416ed7627755bca23a1cc45a581 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Tue, 22 Sep 2020 13:34:40 +0200
-Subject: [PATCH] SELinux Policy: Allow tomcat_t to read kerberos keytabs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is required to fix:
-avc: denied { search } for pid=1930 comm="ipa-pki-retriev" name="krb5" dev="dm-0" ino=8620822 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:krb5_keytab_t:s0 tclass=dir permissive=0
-
-Macros suggested by: Ondrej Mosnacek
-
-Fixes: https://pagure.io/freeipa/issue/8488
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
-Reviewed-By: Rob Crittenden <rcritten@redhat.com>
-Reviewed-By: Ondrej Mosnacek <omosnace@redhat.com>
-Reviewed-By: Lukas Vrabec <lvrabec@redhat.com>
-Reviewed-By: Zdenek Pytela <zpytela@redhat.com>
-Reviewed-By: Thomas Woerner <twoerner@redhat.com>
----
- selinux/ipa.te | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index f984a0f94..fa577191c 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -448,3 +448,11 @@ optional_policy(`
- java_exec(ipa_custodia_pki_tomcat_t)
- # allow Java to read system status and RNG
- ')
-+
-+optional_policy(`
-+ gen_require(`
-+ type tomcat_t;
-+ ')
-+ kerberos_read_config(tomcat_t)
-+ kerberos_read_keytab(tomcat_t)
-+')
---
-2.26.2
-
diff --git a/SOURCES/0020-SELinux-do-not-double-define-node_t-and-pki_tomcat_c_rhbz#1870202.patch b/SOURCES/0020-SELinux-do-not-double-define-node_t-and-pki_tomcat_c_rhbz#1870202.patch
deleted file mode 100644
index 6ec25a7..0000000
--- a/SOURCES/0020-SELinux-do-not-double-define-node_t-and-pki_tomcat_c_rhbz#1870202.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 58c3343a67a3922dcc84d3d4b1deca515c48a6f8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
-Date: Wed, 23 Sep 2020 09:17:53 +0200
-Subject: [PATCH] SELinux: do not double-define node_t and pki_tomcat_cert_t
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-node_t and pki_tomcat_cert_t are defined in other modules.
-Do not double-define them.
-
-Fixes: https://pagure.io/freeipa/issue/8513
-Signed-off-by: François Cami <fcami@redhat.com>
-Reviewed-By: Christian Heimes <cheimes@redhat.com>
----
- selinux/ipa.te | 25 ++++++++++++++++---------
- 1 file changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/selinux/ipa.te b/selinux/ipa.te
-index fa577191c..d80e64a0b 100644
---- a/selinux/ipa.te
-+++ b/selinux/ipa.te
-@@ -74,9 +74,6 @@ logging_log_file(ipa_custodia_log_t)
- type ipa_custodia_tmp_t;
- files_tmp_file(ipa_custodia_tmp_t)
-
--type pki_tomcat_cert_t;
--type node_t;
--
- type ipa_pki_retrieve_key_exec_t;
- type ipa_pki_retrieve_key_t;
- domain_type(ipa_pki_retrieve_key_t)
-@@ -339,12 +336,6 @@ allow ipa_custodia_t self:unix_dgram_socket create_socket_perms;
- allow ipa_custodia_t self:tcp_socket { bind create };
- allow ipa_custodia_t self:udp_socket create_socket_perms;
-
--allow ipa_custodia_t node_t:tcp_socket node_bind;
--
--allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
--allow ipa_custodia_t pki_tomcat_cert_t:file create;
--allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
--
- manage_dirs_pattern(ipa_custodia_t,ipa_custodia_log_t,ipa_custodia_log_t)
- manage_files_pattern(ipa_custodia_t, ipa_custodia_log_t, ipa_custodia_log_t)
- logging_log_filetrans(ipa_custodia_t, ipa_custodia_log_t, { dir file })
-@@ -456,3 +447,19 @@ optional_policy(`
- kerberos_read_config(tomcat_t)
- kerberos_read_keytab(tomcat_t)
- ')
-+
-+optional_policy(`
-+ gen_require(`
-+ type node_t;
-+ ')
-+ allow ipa_custodia_t node_t:tcp_socket node_bind;
-+')
-+
-+optional_policy(`
-+ gen_require(`
-+ type pki_tomcat_cert_t;
-+ ')
-+ allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
-+ allow ipa_custodia_t pki_tomcat_cert_t:file create;
-+ allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
-+')
---
-2.26.2
-
diff --git a/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch b/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
index b252f00..2ff282b 100644
--- a/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
+++ b/SOURCES/1001-Change-branding-to-IPA-and-Identity-Management.patch
@@ -1,7 +1,7 @@
-From f40f42dd9b8c5da54a872ef6a7de46e5ae3ba341 Mon Sep 17 00:00:00 2001
+From 801b072f7fdc3e8b961136d52704f3e09314511e Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 01/78] client/man/default.conf.5: Change branding to IPA and
+Subject: [PATCH 01/93] client/man/default.conf.5: Change branding to IPA and
Identity Management
---
@@ -9,7 +9,7 @@ Subject: [PATCH 01/78] client/man/default.conf.5: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/default.conf.5 b/client/man/default.conf.5
-index 728fc0871..6ec8616bc 100644
+index 8336ed8..f85fd67 100644
--- a/client/man/default.conf.5
+++ b/client/man/default.conf.5
@@ -16,7 +16,7 @@
@@ -22,12 +22,13 @@ index 728fc0871..6ec8616bc 100644
default.conf \- IPA configuration file
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From ddf6ddd9a6b0482d01fce2df102f25d719adfa79 Mon Sep 17 00:00:00 2001
+
+From 0304c1f2a71889d069ef56928b6c200cfe8536b1 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 02/78] client/man/ipa-certupdate.1: Change branding to IPA and
+Subject: [PATCH 02/93] client/man/ipa-certupdate.1: Change branding to IPA and
Identity Management
---
@@ -35,7 +36,7 @@ Subject: [PATCH 02/78] client/man/ipa-certupdate.1: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa-certupdate.1 b/client/man/ipa-certupdate.1
-index d95790a36..431b395a9 100644
+index d95790a..431b395 100644
--- a/client/man/ipa-certupdate.1
+++ b/client/man/ipa-certupdate.1
@@ -16,7 +16,7 @@
@@ -48,12 +49,13 @@ index d95790a36..431b395a9 100644
ipa\-certupdate \- Update local IPA certificate databases with certificates from the server
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 100af01bbb2838c4c43159f4eaa925c57113baec Mon Sep 17 00:00:00 2001
+From 6ea76e04904faed0bb4622a25e79050cb40de03b Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 03/78] client/man/ipa-client-automount.1: Change branding to
+Subject: [PATCH 03/93] client/man/ipa-client-automount.1: Change branding to
IPA and Identity Management
---
@@ -61,7 +63,7 @@ Subject: [PATCH 03/78] client/man/ipa-client-automount.1: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa-client-automount.1 b/client/man/ipa-client-automount.1
-index 4c3caee93..3f6edabd0 100644
+index 4c3caee..3f6edab 100644
--- a/client/man/ipa-client-automount.1
+++ b/client/man/ipa-client-automount.1
@@ -16,7 +16,7 @@
@@ -74,12 +76,13 @@ index 4c3caee93..3f6edabd0 100644
ipa\-client\-automount \- Configure automount and NFS for IPA
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 497a46243f09fa8d8a295f61710065c675a91800 Mon Sep 17 00:00:00 2001
+
+From 9ce4bccbcc4270742012e548a94de7a29f809071 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 04/78] client/man/ipa-client-install.1: Change branding to IPA
+Subject: [PATCH 04/93] client/man/ipa-client-install.1: Change branding to IPA
and Identity Management
---
@@ -87,7 +90,7 @@ Subject: [PATCH 04/78] client/man/ipa-client-install.1: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa-client-install.1 b/client/man/ipa-client-install.1
-index 2d031fb2c..64ab1bff0 100644
+index 2d031fb..64ab1bf 100644
--- a/client/man/ipa-client-install.1
+++ b/client/man/ipa-client-install.1
@@ -1,7 +1,7 @@
@@ -100,12 +103,13 @@ index 2d031fb2c..64ab1bff0 100644
ipa\-client\-install \- Configure an IPA client
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 5d13b4528df055dee11ddd07c10a073b8ddd0065 Mon Sep 17 00:00:00 2001
+From b82626b957bec1d023b204d77d8c0f28b495756a Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 05/78] client/man/ipa-getkeytab.1: Change branding to IPA and
+Subject: [PATCH 05/93] client/man/ipa-getkeytab.1: Change branding to IPA and
Identity Management
---
@@ -113,7 +117,7 @@ Subject: [PATCH 05/78] client/man/ipa-getkeytab.1: Change branding to IPA and
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/client/man/ipa-getkeytab.1 b/client/man/ipa-getkeytab.1
-index f06fcd910..01a2618ef 100644
+index a4bcd88..b57c548 100644
--- a/client/man/ipa-getkeytab.1
+++ b/client/man/ipa-getkeytab.1
@@ -17,7 +17,7 @@
@@ -135,12 +139,13 @@ index f06fcd910..01a2618ef 100644
.SH "EXAMPLES"
Add and retrieve a keytab for the NFS service principal on
--
-2.21.1
+2.28.0
-From c89ccf3e9cf8868c19e12716dcff110b0cc040fc Mon Sep 17 00:00:00 2001
+
+From 4f371317112e7f02d53a00b63ae4c0836923f947 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 06/78] client/man/ipa-join.1: Change branding to IPA and
+Subject: [PATCH 06/93] client/man/ipa-join.1: Change branding to IPA and
Identity Management
---
@@ -148,7 +153,7 @@ Subject: [PATCH 06/78] client/man/ipa-join.1: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa-join.1 b/client/man/ipa-join.1
-index d88160784..30b667558 100644
+index 6e512b8..5eaf68f 100644
--- a/client/man/ipa-join.1
+++ b/client/man/ipa-join.1
@@ -16,7 +16,7 @@
@@ -161,12 +166,13 @@ index d88160784..30b667558 100644
ipa\-join \- Join a machine to an IPA realm and get a keytab for the host service principal
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From e691f8e132a0d7f12049015cf728e6ed1f3ca18b Mon Sep 17 00:00:00 2001
+From 32d30177deb6cd2753eb2871957b83d3421c002f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 07/78] client/man/ipa-rmkeytab.1: Change branding to IPA and
+Subject: [PATCH 07/93] client/man/ipa-rmkeytab.1: Change branding to IPA and
Identity Management
---
@@ -174,7 +180,7 @@ Subject: [PATCH 07/78] client/man/ipa-rmkeytab.1: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa-rmkeytab.1 b/client/man/ipa-rmkeytab.1
-index 53f775439..2c8218c94 100644
+index 53f7754..2c8218c 100644
--- a/client/man/ipa-rmkeytab.1
+++ b/client/man/ipa-rmkeytab.1
@@ -17,7 +17,7 @@
@@ -187,12 +193,13 @@ index 53f775439..2c8218c94 100644
ipa\-rmkeytab \- Remove a kerberos principal from a keytab
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 5bfab52a3246268a063d16700bf7063da56f3fa4 Mon Sep 17 00:00:00 2001
+
+From 57c3e0cee6397e4aa6fb2c5fe792759e6fda7d99 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 08/78] client/man/ipa.1: Change branding to IPA and Identity
+Subject: [PATCH 08/93] client/man/ipa.1: Change branding to IPA and Identity
Management
---
@@ -200,7 +207,7 @@ Subject: [PATCH 08/78] client/man/ipa.1: Change branding to IPA and Identity
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/client/man/ipa.1 b/client/man/ipa.1
-index f9fae7c0d..2fb21b52d 100644
+index f9fae7c..2fb21b5 100644
--- a/client/man/ipa.1
+++ b/client/man/ipa.1
@@ -16,7 +16,7 @@
@@ -213,12 +220,13 @@ index f9fae7c0d..2fb21b52d 100644
ipa \- IPA command\-line interface
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From e2387735f5a4b37cec1c850ac2725ed8ddf59322 Mon Sep 17 00:00:00 2001
+From 92d2f9691d307cd8572db9c2742cb78c7179896b Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 09/78] install/html/ssbrowser.html: Change branding to IPA and
+Subject: [PATCH 09/93] install/html/ssbrowser.html: Change branding to IPA and
Identity Management
---
@@ -226,7 +234,7 @@ Subject: [PATCH 09/78] install/html/ssbrowser.html: Change branding to IPA and
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/html/ssbrowser.html b/install/html/ssbrowser.html
-index a48a24511..f934dbb40 100644
+index a48a245..f934dbb 100644
--- a/install/html/ssbrowser.html
+++ b/install/html/ssbrowser.html
@@ -2,7 +2,7 @@
@@ -248,12 +256,13 @@ index a48a24511..f934dbb40 100644
</nav>
--
-2.21.1
+2.28.0
-From 10b4195ec2820ddbb67bcdb6a74a8f4aa20c12fe Mon Sep 17 00:00:00 2001
+
+From 540ff1c5860d37c2042112fcaf5b8de237d8c109 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 10/78] install/html/unauthorized.html: Change branding to IPA
+Subject: [PATCH 10/93] install/html/unauthorized.html: Change branding to IPA
and Identity Management
---
@@ -261,7 +270,7 @@ Subject: [PATCH 10/78] install/html/unauthorized.html: Change branding to IPA
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/html/unauthorized.html b/install/html/unauthorized.html
-index 630982da8..b8c64d69d 100644
+index 630982d..b8c64d6 100644
--- a/install/html/unauthorized.html
+++ b/install/html/unauthorized.html
@@ -2,7 +2,7 @@
@@ -283,12 +292,13 @@ index 630982da8..b8c64d69d 100644
</nav>
--
-2.21.1
+2.28.0
+
-From 8293605a01b9b45d4ab87d7fd9342b9e832ba3ce Mon Sep 17 00:00:00 2001
+From b4b7601be41d0c814d55d64f38cfc3a3c08c1628 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 11/78] install/migration/index.html: Change branding to IPA
+Subject: [PATCH 11/93] install/migration/index.html: Change branding to IPA
and Identity Management
---
@@ -296,7 +306,7 @@ Subject: [PATCH 11/78] install/migration/index.html: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/migration/index.html b/install/migration/index.html
-index fca517cdc..b5ac1f6df 100644
+index fca517c..b5ac1f6 100644
--- a/install/migration/index.html
+++ b/install/migration/index.html
@@ -2,7 +2,7 @@
@@ -309,12 +319,13 @@ index fca517cdc..b5ac1f6df 100644
<!--[if IE]>
<meta id="ie-detector">
--
-2.21.1
+2.28.0
-From 6a479bab8581f2960a628d309a705d42ef9dfdbf Mon Sep 17 00:00:00 2001
+
+From 69b03b7ca83ecb54cd6a8542a92c9c7cb102b3f6 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 12/78] install/share/schema.d/README: Change branding to IPA
+Subject: [PATCH 12/93] install/share/schema.d/README: Change branding to IPA
and Identity Management
---
@@ -322,7 +333,7 @@ Subject: [PATCH 12/78] install/share/schema.d/README: Change branding to IPA
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/share/schema.d/README b/install/share/schema.d/README
-index 19e3e6832..2a92ec6ae 100644
+index 19e3e68..2a92ec6 100644
--- a/install/share/schema.d/README
+++ b/install/share/schema.d/README
@@ -7,8 +7,8 @@ schema files during the run of ipa-server-upgrade utility. Therefore, they are
@@ -337,12 +348,13 @@ index 19e3e6832..2a92ec6ae 100644
You may place your schema files in a subdirectory too, the code that loads
schema files processes recursively all subdirectories of schema.d.
--
-2.21.1
+2.28.0
+
-From c52b451a88bc8d18d1e08f237e5bcf648861c650 Mon Sep 17 00:00:00 2001
+From e8db20893eadd919dd295d65b31e509fca87930c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 13/78] install/tools/ipa-adtrust-install.in: Change branding
+Subject: [PATCH 13/93] install/tools/ipa-adtrust-install.in: Change branding
to IPA and Identity Management
---
@@ -350,7 +362,7 @@ Subject: [PATCH 13/78] install/tools/ipa-adtrust-install.in: Change branding
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/tools/ipa-adtrust-install.in b/install/tools/ipa-adtrust-install.in
-index 7d94b718e..80f5d27a7 100644
+index 93365cc..707b887 100644
--- a/install/tools/ipa-adtrust-install.in
+++ b/install/tools/ipa-adtrust-install.in
@@ -141,11 +141,11 @@ def main():
@@ -368,12 +380,13 @@ index 7d94b718e..80f5d27a7 100644
# print " * Add a SID to all users and Posix groups"
print("")
--
-2.21.1
+2.28.0
-From 7213f732557deb560aede21286abd2404a0e6f9e Mon Sep 17 00:00:00 2001
+
+From dc37f813fce1df41e3bbf5adf3791b32bca3d87c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 14/78] install/tools/ipa-replica-conncheck.in: Change branding
+Subject: [PATCH 14/93] install/tools/ipa-replica-conncheck.in: Change branding
to IPA and Identity Management
---
@@ -381,10 +394,10 @@ Subject: [PATCH 14/78] install/tools/ipa-replica-conncheck.in: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/ipa-replica-conncheck.in b/install/tools/ipa-replica-conncheck.in
-index b22db1139..b86ce4569 100644
+index fdc3224..a749778 100644
--- a/install/tools/ipa-replica-conncheck.in
+++ b/install/tools/ipa-replica-conncheck.in
-@@ -290,7 +290,7 @@ class PortResponder(threading.Thread):
+@@ -291,7 +291,7 @@ class PortResponder(threading.Thread):
self._sockets = []
self._close = False
self._close_lock = threading.Lock()
@@ -394,12 +407,13 @@ index b22db1139..b86ce4569 100644
self.ports_open_cond = threading.Condition()
--
-2.21.1
+2.28.0
+
-From 1f2a34a5fcb88b3ca94949a513523eb3862e99c1 Mon Sep 17 00:00:00 2001
+From 223ff47bcb51ba58dd8123b764dfadfdc28fbaec Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 15/78] install/tools/man/ipa-adtrust-install.1: Change
+Subject: [PATCH 15/93] install/tools/man/ipa-adtrust-install.1: Change
branding to IPA and Identity Management
---
@@ -407,7 +421,7 @@ Subject: [PATCH 15/78] install/tools/man/ipa-adtrust-install.1: Change
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/tools/man/ipa-adtrust-install.1 b/install/tools/man/ipa-adtrust-install.1
-index b11065806..f70f316f6 100644
+index b110658..f70f316 100644
--- a/install/tools/man/ipa-adtrust-install.1
+++ b/install/tools/man/ipa-adtrust-install.1
@@ -16,7 +16,7 @@
@@ -429,12 +443,13 @@ index b11065806..f70f316f6 100644
to the list automatically as restart of the LDAP service on each of them
is required. The host where ipa\-adtrust\-install is being run is added
--
-2.21.1
+2.28.0
-From 5742d0b0fa19dc744f81aeed6727c472d2e5505f Mon Sep 17 00:00:00 2001
+
+From 33cde0005c9cb310d07071a6ca6d27fb320af952 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:39 +0300
-Subject: [PATCH 16/78] install/tools/man/ipa-advise.1: Change branding to IPA
+Subject: [PATCH 16/93] install/tools/man/ipa-advise.1: Change branding to IPA
and Identity Management
---
@@ -442,7 +457,7 @@ Subject: [PATCH 16/78] install/tools/man/ipa-advise.1: Change branding to IPA
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/tools/man/ipa-advise.1 b/install/tools/man/ipa-advise.1
-index 4c494aab9..515bbddbe 100644
+index 4c494aa..515bbdd 100644
--- a/install/tools/man/ipa-advise.1
+++ b/install/tools/man/ipa-advise.1
@@ -16,7 +16,7 @@
@@ -462,12 +477,13 @@ index 4c494aab9..515bbddbe 100644
\ No newline at end of file
+1 if an error occurred
--
-2.21.1
+2.28.0
+
-From 650e5f89bb097c559b52a961866296380f3f94d5 Mon Sep 17 00:00:00 2001
+From 41eb935c96c0a6495f233fd0934be3e92a19407f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 17/78] install/tools/man/ipa-backup.1: Change branding to IPA
+Subject: [PATCH 17/93] install/tools/man/ipa-backup.1: Change branding to IPA
and Identity Management
---
@@ -475,7 +491,7 @@ Subject: [PATCH 17/78] install/tools/man/ipa-backup.1: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-backup.1 b/install/tools/man/ipa-backup.1
-index 2f0bc9e6a..77d5d7caa 100644
+index 2f0bc9e..77d5d7c 100644
--- a/install/tools/man/ipa-backup.1
+++ b/install/tools/man/ipa-backup.1
@@ -16,7 +16,7 @@
@@ -488,12 +504,13 @@ index 2f0bc9e6a..77d5d7caa 100644
ipa\-backup \- Back up an IPA master
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From f8849ddf92e83d23b0c317b1c5f59ad9af1e3e1c Mon Sep 17 00:00:00 2001
+
+From 1af2634f0f24d36bf9225a1b84e40294b914725f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 18/78] install/tools/man/ipa-ca-install.1: Change branding to
+Subject: [PATCH 18/93] install/tools/man/ipa-ca-install.1: Change branding to
IPA and Identity Management
---
@@ -501,7 +518,7 @@ Subject: [PATCH 18/78] install/tools/man/ipa-ca-install.1: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-ca-install.1 b/install/tools/man/ipa-ca-install.1
-index 3ebe32c0a..8e57c0092 100644
+index 3ebe32c..8e57c00 100644
--- a/install/tools/man/ipa-ca-install.1
+++ b/install/tools/man/ipa-ca-install.1
@@ -16,7 +16,7 @@
@@ -514,12 +531,13 @@ index 3ebe32c0a..8e57c0092 100644
ipa\-ca\-install \- Install a CA on a server
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 625ae452bc457003c9f4559884abb9afa2bb41ca Mon Sep 17 00:00:00 2001
+From 8ff8e7e56ce9efd49c597157b70189a76a588a42 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 19/78] install/tools/man/ipa-cacert-manage.1: Change branding
+Subject: [PATCH 19/93] install/tools/man/ipa-cacert-manage.1: Change branding
to IPA and Identity Management
---
@@ -527,7 +545,7 @@ Subject: [PATCH 19/78] install/tools/man/ipa-cacert-manage.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-cacert-manage.1 b/install/tools/man/ipa-cacert-manage.1
-index b76ee1816..4359b12e3 100644
+index 3f8c346..c992384 100644
--- a/install/tools/man/ipa-cacert-manage.1
+++ b/install/tools/man/ipa-cacert-manage.1
@@ -16,7 +16,7 @@
@@ -540,12 +558,13 @@ index b76ee1816..4359b12e3 100644
ipa\-cacert\-manage \- Manage CA certificates in IPA
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 13ebf098b64a5aefd39aac7a1eef1367170bc284 Mon Sep 17 00:00:00 2001
+
+From 3dfaf75f7260a9dceb15089e98dc0d564078432c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 20/78] install/tools/man/ipa-compat-manage.1: Change branding
+Subject: [PATCH 20/93] install/tools/man/ipa-compat-manage.1: Change branding
to IPA and Identity Management
---
@@ -553,7 +572,7 @@ Subject: [PATCH 20/78] install/tools/man/ipa-compat-manage.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-compat-manage.1 b/install/tools/man/ipa-compat-manage.1
-index f22b1743e..26470331a 100644
+index f22b174..2647033 100644
--- a/install/tools/man/ipa-compat-manage.1
+++ b/install/tools/man/ipa-compat-manage.1
@@ -16,7 +16,7 @@
@@ -566,12 +585,13 @@ index f22b1743e..26470331a 100644
ipa\-compat\-manage \- Enables or disables the schema compatibility plugin
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 2dfc9079680b04f286eeed4f65ce4f02914c55b7 Mon Sep 17 00:00:00 2001
+From 9af2e4cdb0ad3ab9147d0a357153cc55d0bcc481 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 21/78] install/tools/man/ipa-csreplica-manage.1: Change
+Subject: [PATCH 21/93] install/tools/man/ipa-csreplica-manage.1: Change
branding to IPA and Identity Management
---
@@ -579,7 +599,7 @@ Subject: [PATCH 21/78] install/tools/man/ipa-csreplica-manage.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-csreplica-manage.1 b/install/tools/man/ipa-csreplica-manage.1
-index ab5bfddd8..6d039751e 100644
+index ab5bfdd..6d03975 100644
--- a/install/tools/man/ipa-csreplica-manage.1
+++ b/install/tools/man/ipa-csreplica-manage.1
@@ -16,7 +16,7 @@
@@ -592,12 +612,13 @@ index ab5bfddd8..6d039751e 100644
ipa\-csreplica\-manage \- Manage an IPA CS replica
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 4858e90ba2b7aca2af1e2375b2442b3fa5c30f9c Mon Sep 17 00:00:00 2001
+
+From b5b6885eb4503f63ced3fe1e9f1741c1ab4c84af Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 22/78] install/tools/man/ipa-dns-install.1: Change branding to
+Subject: [PATCH 22/93] install/tools/man/ipa-dns-install.1: Change branding to
IPA and Identity Management
---
@@ -605,7 +626,7 @@ Subject: [PATCH 22/78] install/tools/man/ipa-dns-install.1: Change branding to
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/tools/man/ipa-dns-install.1 b/install/tools/man/ipa-dns-install.1
-index 14e4cd51f..029001eca 100644
+index 14e4cd5..029001e 100644
--- a/install/tools/man/ipa-dns-install.1
+++ b/install/tools/man/ipa-dns-install.1
@@ -1,7 +1,7 @@
@@ -627,12 +648,13 @@ index 14e4cd51f..029001eca 100644
This command requires that an IPA server is already installed and configured.
--
-2.21.1
+2.28.0
+
-From aeb6e9ae2e4ebf5d627e80f0a495a45589c0455f Mon Sep 17 00:00:00 2001
+From 1a4935f79690a6d4fb0158f854fde1af754edd95 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 23/78] install/tools/man/ipa-kra-install.1: Change branding to
+Subject: [PATCH 23/93] install/tools/man/ipa-kra-install.1: Change branding to
IPA and Identity Management
---
@@ -640,7 +662,7 @@ Subject: [PATCH 23/78] install/tools/man/ipa-kra-install.1: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-kra-install.1 b/install/tools/man/ipa-kra-install.1
-index 6c8523aa0..5476a4e71 100644
+index 6c8523a..5476a4e 100644
--- a/install/tools/man/ipa-kra-install.1
+++ b/install/tools/man/ipa-kra-install.1
@@ -16,7 +16,7 @@
@@ -653,12 +675,13 @@ index 6c8523aa0..5476a4e71 100644
ipa\-kra\-install \- Install a KRA on a server
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From d71a89b2b1ebe588672e76f04c7edd6d7a287837 Mon Sep 17 00:00:00 2001
+
+From 294662f5ac3ba2c96f0f37b9107f40b7f991590c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 24/78] install/tools/man/ipa-ldap-updater.1: Change branding
+Subject: [PATCH 24/93] install/tools/man/ipa-ldap-updater.1: Change branding
to IPA and Identity Management
---
@@ -666,7 +689,7 @@ Subject: [PATCH 24/78] install/tools/man/ipa-ldap-updater.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-ldap-updater.1 b/install/tools/man/ipa-ldap-updater.1
-index 4893802c2..7ead55bd9 100644
+index 4893802..7ead55b 100644
--- a/install/tools/man/ipa-ldap-updater.1
+++ b/install/tools/man/ipa-ldap-updater.1
@@ -16,7 +16,7 @@
@@ -679,12 +702,13 @@ index 4893802c2..7ead55bd9 100644
ipa\-ldap\-updater \- Update the IPA LDAP configuration
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From acdf99fd7afbfd614b2db75bddf647ad12d2767f Mon Sep 17 00:00:00 2001
+From 356e3e24c2df2f8da159be229cd73416b5808097 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 25/78] install/tools/man/ipa-managed-entries.1: Change
+Subject: [PATCH 25/93] install/tools/man/ipa-managed-entries.1: Change
branding to IPA and Identity Management
---
@@ -692,7 +716,7 @@ Subject: [PATCH 25/78] install/tools/man/ipa-managed-entries.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-managed-entries.1 b/install/tools/man/ipa-managed-entries.1
-index 3d5ca22b8..edaa0a90d 100644
+index 3d5ca22..edaa0a9 100644
--- a/install/tools/man/ipa-managed-entries.1
+++ b/install/tools/man/ipa-managed-entries.1
@@ -16,7 +16,7 @@
@@ -705,12 +729,13 @@ index 3d5ca22b8..edaa0a90d 100644
ipa\-managed\-entries \- Enables or disables the schema Managed Entry plugins
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 2cbdc087d8f18733d36e60788faddef5a914821a Mon Sep 17 00:00:00 2001
+
+From 03ab99f72d60f2e8240aa6222939384f227d4ba8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 26/78] install/tools/man/ipa-nis-manage.1: Change branding to
+Subject: [PATCH 26/93] install/tools/man/ipa-nis-manage.1: Change branding to
IPA and Identity Management
---
@@ -718,7 +743,7 @@ Subject: [PATCH 26/78] install/tools/man/ipa-nis-manage.1: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-nis-manage.1 b/install/tools/man/ipa-nis-manage.1
-index 93278487c..1107b7790 100644
+index 9327848..1107b77 100644
--- a/install/tools/man/ipa-nis-manage.1
+++ b/install/tools/man/ipa-nis-manage.1
@@ -16,7 +16,7 @@
@@ -731,12 +756,13 @@ index 93278487c..1107b7790 100644
ipa\-nis\-manage \- Enables or disables the NIS listener plugin
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 3af61d4b26532726492bc7d121ec8b39bb68dce6 Mon Sep 17 00:00:00 2001
+From d840ef02568c90384dcb597cdc3fa06148401e4b Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 27/78] install/tools/man/ipa-otptoken-import.1: Change
+Subject: [PATCH 27/93] install/tools/man/ipa-otptoken-import.1: Change
branding to IPA and Identity Management
---
@@ -744,7 +770,7 @@ Subject: [PATCH 27/78] install/tools/man/ipa-otptoken-import.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-otptoken-import.1 b/install/tools/man/ipa-otptoken-import.1
-index 920a08ca2..fe91040fa 100644
+index 920a08c..fe91040 100644
--- a/install/tools/man/ipa-otptoken-import.1
+++ b/install/tools/man/ipa-otptoken-import.1
@@ -16,7 +16,7 @@
@@ -757,12 +783,13 @@ index 920a08ca2..fe91040fa 100644
ipa\-otptoken\-import \- Imports OTP tokens from RFC 6030 XML file
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 426c1370d990dcd44612427abc75f8b21178f279 Mon Sep 17 00:00:00 2001
+
+From e8488e7d4657538a407fcb6af8b65db03acc01f4 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 28/78] install/tools/man/ipa-pkinit-manage.1: Change branding
+Subject: [PATCH 28/93] install/tools/man/ipa-pkinit-manage.1: Change branding
to IPA and Identity Management
---
@@ -770,7 +797,7 @@ Subject: [PATCH 28/78] install/tools/man/ipa-pkinit-manage.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-pkinit-manage.1 b/install/tools/man/ipa-pkinit-manage.1
-index 5018ce8aa..50d63e921 100644
+index 5018ce8..50d63e9 100644
--- a/install/tools/man/ipa-pkinit-manage.1
+++ b/install/tools/man/ipa-pkinit-manage.1
@@ -1,7 +1,7 @@
@@ -783,12 +810,13 @@ index 5018ce8aa..50d63e921 100644
ipa\-pkinit\-manage \- Enables or disables PKINIT
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 7553161cbb48d42e76babe540ae878d328cb462b Mon Sep 17 00:00:00 2001
+From 0d46f57eb6b80d9c807f30ca357b5a6e740f1aad Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 29/78] install/tools/man/ipa-replica-conncheck.1: Change
+Subject: [PATCH 29/93] install/tools/man/ipa-replica-conncheck.1: Change
branding to IPA and Identity Management
---
@@ -796,7 +824,7 @@ Subject: [PATCH 29/78] install/tools/man/ipa-replica-conncheck.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-replica-conncheck.1 b/install/tools/man/ipa-replica-conncheck.1
-index 6451f3545..ed441e3be 100644
+index 6451f35..ed441e3 100644
--- a/install/tools/man/ipa-replica-conncheck.1
+++ b/install/tools/man/ipa-replica-conncheck.1
@@ -16,7 +16,7 @@
@@ -809,12 +837,13 @@ index 6451f3545..ed441e3be 100644
ipa\-replica\-conncheck \- Check a replica\-master network connection before installation
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 3676e1a1040aa6ae858134828cfcd7b35e74d4f5 Mon Sep 17 00:00:00 2001
+
+From 3eff0ac28e58ce96c2ba9e439501654cefe7458f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 30/78] install/tools/man/ipa-replica-install.1: Change
+Subject: [PATCH 30/93] install/tools/man/ipa-replica-install.1: Change
branding to IPA and Identity Management
---
@@ -822,7 +851,7 @@ Subject: [PATCH 30/78] install/tools/man/ipa-replica-install.1: Change
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/install/tools/man/ipa-replica-install.1 b/install/tools/man/ipa-replica-install.1
-index 19d1d9110..44fce10ba 100644
+index 19d1d91..44fce10 100644
--- a/install/tools/man/ipa-replica-install.1
+++ b/install/tools/man/ipa-replica-install.1
@@ -1,7 +1,7 @@
@@ -853,12 +882,13 @@ index 19d1d9110..44fce10ba 100644
to the list automatically as restart of the LDAP service on each of them
is required. The host where ipa\-adtrust\-install is being run is added
--
-2.21.1
+2.28.0
+
-From 139ddf89255aa4423499208d5b4191dbc7b829dd Mon Sep 17 00:00:00 2001
+From 2b097ebacacba27dd7af501ab4bdf521e9affac8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 31/78] install/tools/man/ipa-replica-manage.1: Change branding
+Subject: [PATCH 31/93] install/tools/man/ipa-replica-manage.1: Change branding
to IPA and Identity Management
---
@@ -866,7 +896,7 @@ Subject: [PATCH 31/78] install/tools/man/ipa-replica-manage.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-replica-manage.1 b/install/tools/man/ipa-replica-manage.1
-index 239f1591c..2c94278ca 100644
+index 239f159..2c94278 100644
--- a/install/tools/man/ipa-replica-manage.1
+++ b/install/tools/man/ipa-replica-manage.1
@@ -16,7 +16,7 @@
@@ -879,12 +909,13 @@ index 239f1591c..2c94278ca 100644
ipa\-replica\-manage \- Manage an IPA replica
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 773bf31555e662f24f807e4b69b8dcf1f88e3f83 Mon Sep 17 00:00:00 2001
+
+From 78a43b16ab8b2914e243465642fef5de519adbe9 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 32/78] install/tools/man/ipa-restore.1: Change branding to IPA
+Subject: [PATCH 32/93] install/tools/man/ipa-restore.1: Change branding to IPA
and Identity Management
---
@@ -892,7 +923,7 @@ Subject: [PATCH 32/78] install/tools/man/ipa-restore.1: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-restore.1 b/install/tools/man/ipa-restore.1
-index 5843d5546..bc0755baa 100644
+index 5843d55..bc0755b 100644
--- a/install/tools/man/ipa-restore.1
+++ b/install/tools/man/ipa-restore.1
@@ -16,7 +16,7 @@
@@ -905,12 +936,13 @@ index 5843d5546..bc0755baa 100644
ipa\-restore \- Restore an IPA master
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From c00d47be96e91102bf3eeecf0a2363cf21f260eb Mon Sep 17 00:00:00 2001
+From 4c99b9799d6ba16191cb6a8c0bec5c89f2c1ed41 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 33/78] install/tools/man/ipa-server-certinstall.1: Change
+Subject: [PATCH 33/93] install/tools/man/ipa-server-certinstall.1: Change
branding to IPA and Identity Management
---
@@ -918,7 +950,7 @@ Subject: [PATCH 33/78] install/tools/man/ipa-server-certinstall.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-server-certinstall.1 b/install/tools/man/ipa-server-certinstall.1
-index 79bd7c885..3f12a5af2 100644
+index 8798819..0aa5315 100644
--- a/install/tools/man/ipa-server-certinstall.1
+++ b/install/tools/man/ipa-server-certinstall.1
@@ -16,7 +16,7 @@
@@ -931,12 +963,13 @@ index 79bd7c885..3f12a5af2 100644
ipa\-server\-certinstall \- Install new SSL server certificates
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From b95e2315685e4142b7f0d5ea1fdaa7b4a1b2a9d7 Mon Sep 17 00:00:00 2001
+
+From 6a1ad17abeff8606049746caa7bd79bb7d1e8a5d Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 34/78] install/tools/man/ipa-server-install.1: Change branding
+Subject: [PATCH 34/93] install/tools/man/ipa-server-install.1: Change branding
to IPA and Identity Management
---
@@ -944,7 +977,7 @@ Subject: [PATCH 34/78] install/tools/man/ipa-server-install.1: Change branding
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/tools/man/ipa-server-install.1 b/install/tools/man/ipa-server-install.1
-index 1a4d2f658..fdb0f4cb3 100644
+index 1a4d2f6..fdb0f4c 100644
--- a/install/tools/man/ipa-server-install.1
+++ b/install/tools/man/ipa-server-install.1
@@ -1,7 +1,7 @@
@@ -966,12 +999,13 @@ index 1a4d2f658..fdb0f4cb3 100644
.TP
\fB\-\-setup\-dns\fR
--
-2.21.1
+2.28.0
+
-From e63c333515020e37c3be9a9e2a3f67304badad2e Mon Sep 17 00:00:00 2001
+From 4db5773eb5b53b6f5cf94875241ca3110f0b08f8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 35/78] install/tools/man/ipa-server-upgrade.1: Change branding
+Subject: [PATCH 35/93] install/tools/man/ipa-server-upgrade.1: Change branding
to IPA and Identity Management
---
@@ -979,7 +1013,7 @@ Subject: [PATCH 35/78] install/tools/man/ipa-server-upgrade.1: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-server-upgrade.1 b/install/tools/man/ipa-server-upgrade.1
-index cbbdc5901..3db19b0f1 100644
+index cbbdc59..3db19b0 100644
--- a/install/tools/man/ipa-server-upgrade.1
+++ b/install/tools/man/ipa-server-upgrade.1
@@ -2,7 +2,7 @@
@@ -992,12 +1026,13 @@ index cbbdc5901..3db19b0f1 100644
ipa\-server\-upgrade \- upgrade IPA server
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From 7dfbdf73de322616cc6235db57bd8f3fd0805ac5 Mon Sep 17 00:00:00 2001
+
+From cccdfc43e3350f07b09c3ebfc8b42b2fe34fcb11 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 36/78] install/tools/man/ipa-winsync-migrate.1: Change
+Subject: [PATCH 36/93] install/tools/man/ipa-winsync-migrate.1: Change
branding to IPA and Identity Management
---
@@ -1005,7 +1040,7 @@ Subject: [PATCH 36/78] install/tools/man/ipa-winsync-migrate.1: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipa-winsync-migrate.1 b/install/tools/man/ipa-winsync-migrate.1
-index 88702bad6..1812f6348 100644
+index 88702ba..1812f63 100644
--- a/install/tools/man/ipa-winsync-migrate.1
+++ b/install/tools/man/ipa-winsync-migrate.1
@@ -16,7 +16,7 @@
@@ -1018,12 +1053,13 @@ index 88702bad6..1812f6348 100644
ipa\-winsync\-migrate \- Seamless migration of AD users created by winsync to native AD users.
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
+
-From 79d8cc19a6a65a00006ded393bc7b1716522bca1 Mon Sep 17 00:00:00 2001
+From 88d658bc5fc1d48974eb81d5b06d8368cc51425e Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 37/78] install/tools/man/ipactl.8: Change branding to IPA and
+Subject: [PATCH 37/93] install/tools/man/ipactl.8: Change branding to IPA and
Identity Management
---
@@ -1031,7 +1067,7 @@ Subject: [PATCH 37/78] install/tools/man/ipactl.8: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/tools/man/ipactl.8 b/install/tools/man/ipactl.8
-index fb533aae2..d7aaaf8ed 100644
+index fb533aa..d7aaaf8 100644
--- a/install/tools/man/ipactl.8
+++ b/install/tools/man/ipactl.8
@@ -16,7 +16,7 @@
@@ -1044,12 +1080,13 @@ index fb533aae2..d7aaaf8ed 100644
ipactl \- IPA Server Control Interface
.SH "SYNOPSIS"
--
-2.21.1
+2.28.0
-From a4ee86f8c53ebb9dbec7ffd75a40f06c8104ad9a Mon Sep 17 00:00:00 2001
+
+From 32f17868c89b47f0ee775279a63e670b44c766d8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 38/78] install/ui/css/patternfly.css: Change branding to IPA
+Subject: [PATCH 38/93] install/ui/css/patternfly.css: Change branding to IPA
and Identity Management
---
@@ -1057,7 +1094,7 @@ Subject: [PATCH 38/78] install/ui/css/patternfly.css: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/css/patternfly.css b/install/ui/css/patternfly.css
-index ee920530b..de574a84c 100644
+index ee92053..de574a8 100644
--- a/install/ui/css/patternfly.css
+++ b/install/ui/css/patternfly.css
@@ -4,4 +4,4 @@
@@ -1069,12 +1106,13 @@ index ee920530b..de574a84c 100644
+ */.bootstrap-select.btn-group,.bootstrap-select.btn-group[class*=span]{float:none;display:inline-block;margin-bottom:10px;margin-left:0}.form-horizontal .bootstrap-select.btn-group,.form-inline .bootstrap-select.btn-group,.form-search .bootstrap-select.btn-group{margin-bottom:0}.bootstrap-select.form-control{margin-bottom:0;padding:0;border:none}.bootstrap-select.btn-group.pull-right,.bootstrap-select.btn-group[class*=span].pull-right,.row-fluid .bootstrap-select.btn-group[class*=span].pull-right{float:right}.input-append .bootstrap-select.btn-group{margin-left:-1px}.input-prepend .bootstrap-select.btn-group{margin-right:-1px}.bootstrap-select:not([class*=span]):not([class*=col-]):not([class*=form-control]){width:220px}.bootstrap-select{width:220px\9}.bootstrap-select.form-control:not([class*=span]){width:100%}.bootstrap-select>.btn{width:100%}.error .bootstrap-select .btn{border:1px solid #b94a48}.dropdown-menu{z-index:2000}.bootstrap-select.show-menu-arrow.open>.btn{z-index:2051}.bootstrap-select .btn:focus{outline:thin dotted #333!important;outline:5px auto -webkit-focus-ring-color!important;outline-offset:-2px}.bootstrap-select.btn-group .btn .filter-option{overflow:hidden;position:absolute;left:12px;right:25px;text-align:left}.bootstrap-select.btn-group .btn .caret{position:absolute;top:50%;right:12px;margin-top:-2px;vertical-align:middle}.bootstrap-select.btn-group .dropdown-menu li.disabled>a,.bootstrap-select.btn-group>.disabled{cursor:not-allowed}.bootstrap-select.btn-group>.disabled:focus{outline:0!important}.bootstrap-select.btn-group[class*=span] .btn{width:100%}.bootstrap-select.btn-group .dropdown-menu{min-width:100%;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}.bootstrap-select.btn-group .dropdown-menu.inner{position:static;border:0;padding:0;margin:0;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none}.bootstrap-select.btn-group .dropdown-menu dt{display:block;padding:3px 20px;cursor:default}.bootstrap-select.btn-group .div-contain{overflow:hidden}.bootstrap-select.btn-group .dropdown-menu li{position:relative}.bootstrap-select.btn-group .dropdown-menu li>a.opt{position:relative;padding-left:35px}.bootstrap-select.btn-group .dropdown-menu li>a{cursor:pointer}.bootstrap-select.btn-group .dropdown-menu li>dt small{font-weight:400}.bootstrap-select.btn-group.show-tick .dropdown-menu li.selected a i.check-mark{display:inline-block;position:absolute;right:15px;margin-top:2.5px}.bootstrap-select.btn-group .dropdown-menu li a i.check-mark{display:none}.bootstrap-select.btn-group.show-tick .dropdown-menu li a span.text{margin-right:34px}.bootstrap-select.btn-group .dropdown-menu li small{padding-left:.5em}.bootstrap-select.btn-group .dropdown-menu li.active:not(.disabled)>a small,.bootstrap-select.btn-group .dropdown-menu li:not(.disabled)>a:focus small,.bootstrap-select.btn-group .dropdown-menu li:not(.disabled)>a:hover small{color:#64b1d8;color:rgba(255,255,255,.4)}.bootstrap-select.btn-group .dropdown-menu li>dt small{font-weight:400}.bootstrap-select.show-menu-arrow .dropdown-toggle:before{content:'';display:inline-block;border-left:7px solid transparent;border-right:7px solid transparent;border-bottom:7px solid #CCC;border-bottom-color:rgba(0,0,0,.2);position:absolute;bottom:-4px;left:9px;display:none}.bootstrap-select.show-menu-arrow .dropdown-toggle:after{content:'';display:inline-block;border-left:6px solid transparent;border-right:6px solid transparent;border-bottom:6px solid #fff;position:absolute;bottom:-4px;left:10px;display:none}.bootstrap-select.show-menu-arrow.dropup .dropdown-toggle:before{bottom:auto;top:-3px;border-top:7px solid #ccc;border-bottom:0;border-top-color:rgba(0,0,0,.2)}.bootstrap-select.show-menu-arrow.dropup .dropdown-toggle:after{bottom:auto;top:-3px;border-top:6px solid #fff;border-bottom:0}.bootstrap-select.show-menu-arrow.pull-right .dropdown-toggle:before{right:12px;left:auto}.bootstrap-select.show-menu-arrow.pull-right .dropdown-toggle:after{right:13px;left:auto}.bootstrap-select.show-menu-arrow.open>.dropdown-toggle:after,.bootstrap-select.show-menu-arrow.open>.dropdown-toggle:before{display:block}.bootstrap-select.btn-group .no-results{padding:3px;background:#f5f5f5;margin:0 5px}.mobile-device{position:absolute;top:0;left:0;display:block!important;width:100%;height:100%!important;opacity:0}.bootstrap-select.fit-width{width:auto!important}.bootstrap-select.btn-group.fit-width .btn .filter-option{position:static}.bootstrap-select.btn-group.fit-width .btn .caret{position:static;top:auto;margin-top:-1px}.control-group.error .bootstrap-select .dropdown-toggle{border-color:#b94a48}.bootstrap-select-searchbox{padding:4px 8px}.bootstrap-select-searchbox input{margin-bottom:0}.alert{border-width:1px;padding-left:47px;padding-right:14px;position:relative}.alert .alert-link{color:#0088ce}.alert .alert-link:hover{color:#00659c}.alert>.btn.pull-right{margin-top:-3px}.alert>.pficon{font-size:22px;position:absolute;left:13px;top:10px}.alert .close{opacity:.85;filter:alpha(opacity=85)}.alert .close:focus,.alert .close:hover{opacity:1;filter:alpha(opacity=100)}.alert .pficon-info{color:#4d5258}.alert-dismissable{padding-right:28px}.alert-dismissable .close{right:-13px;top:1px}.badge{margin-left:6px}.nav-pills>li>a>.badge{margin-left:6px}.bootstrap-select.btn-group.form-control{margin-bottom:0}.bootstrap-select.btn-group .btn{-webkit-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;-o-transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s;transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s}.bootstrap-select.btn-group .btn:hover{border-color:#7dc3e8}.bootstrap-select.btn-group .btn .caret{margin-top:-4px}.bootstrap-select.btn-group .btn:focus{border-color:#0088ce;outline:0!important;-webkit-box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 8px rgba(0,136,206,.6);box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 8px rgba(0,136,206,.6)}.has-error .bootstrap-select.btn-group .btn{border-color:#c00}.has-error .bootstrap-select.btn-group .btn:focus{border-color:#900;-webkit-box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #f33;box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #f33}.has-success .bootstrap-select.btn-group .btn{border-color:#3c763d}.has-success .bootstrap-select.btn-group .btn:focus{border-color:#2b542c;-webkit-box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #67b168;box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #67b168}.has-warning .bootstrap-select.btn-group .btn{border-color:#ec7a08}.has-warning .bootstrap-select.btn-group .btn:focus{border-color:#bb6106;-webkit-box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #faad60;box-shadow:inset 0 1px 1px rgba(3,3,3,.075),0 0 6px #faad60}.bootstrap-select.btn-group .dropdown-menu>.active>a,.bootstrap-select.btn-group .dropdown-menu>.active>a:active{background-color:#def3ff!important;border-color:#bee1f4!important;color:#363636!important}.bootstrap-select.btn-group .dropdown-menu>.active>a small,.bootstrap-select.btn-group .dropdown-menu>.active>a:active small{color:#9c9c9c!important}.bootstrap-select.btn-group .dropdown-menu>.disabled>a{color:#9c9c9c!important}.bootstrap-select.btn-group .dropdown-menu>.selected>a{background-color:#0088ce!important;border-color:#0088ce!important;color:#fff!important}.bootstrap-select.btn-group .dropdown-menu>.selected>a small{color:rgba(255,255,255,.5)!important}.bootstrap-select.btn-group .dropdown-menu .divider{background:#ededed!important;margin:4px 1px!important}.bootstrap-select.btn-group .dropdown-menu dt{color:#8b8d8f;font-weight:400;padding:1px 10px}.bootstrap-select.btn-group .dropdown-menu li>a.opt{padding:1px 10px}.bootstrap-select.btn-group .dropdown-menu li a:active small{color:rgba(255,255,255,.5)!important}.bootstrap-select.btn-group .dropdown-menu li a:focus small,.bootstrap-select.btn-group .dropdown-menu li a:hover small{color:#9c9c9c}.bootstrap-select.btn-group .dropdown-menu li:not(.disabled) a:focus small,.bootstrap-select.btn-group .dropdown-menu li:not(.disabled) a:hover small{color:#9c9c9c}.combobox-container.combobox-selected .glyphicon-remove{display:inline-block}.combobox-container .caret{margin-left:0}.combobox-container .combobox::-ms-clear{display:none}.combobox-container .dropdown-menu{margin-top:-1px;width:100%}.combobox-container .glyphicon-remove{display:none;top:auto;width:12px}.combobox-container .glyphicon-remove:before{content:"\e60b";font-family:PatternFlyIcons-webfont}.combobox-container .input-group-addon{background-color:#f1f1f1;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0);border-color:#bbb;color:#4d5258;position:relative}.combobox-container .input-group-addon.active,.combobox-container .input-group-addon:active,.combobox-container .input-group-addon:focus,.combobox-container .input-group-addon:hover,.open .dropdown-toggle.combobox-container .input-group-addon{background-color:#f1f1f1;background-image:none;border-color:#bbb;color:#4d5258}.combobox-container .input-group-addon.active,.combobox-container .input-group-addon:active,.open .dropdown-toggle.combobox-container .input-group-addon{background-image:none}.combobox-container .input-group-addon.active.focus,.combobox-container .input-group-addon.active:focus,.combobox-container .input-group-addon.active:hover,.combobox-container .input-group-addon:active.focus,.combobox-container .input-group-addon:active:focus,.combobox-container .input-group-addon:active:hover,.open .dropdown-toggle.combobox-container .input-group-addon.focus,.open .dropdown-toggle.combobox-container .input-group-addon:focus,.open .dropdown-toggle.combobox-container .input-group-addon:hover{background-color:#e5e5e5;border-color:#a9a9a9}.combobox-container .input-group-addon.disabled,.combobox-container .input-group-addon.disabled.active,.combobox-container .input-group-addon.disabled:active,.combobox-container .input-group-addon.disabled:focus,.combobox-container .input-group-addon.disabled:hover,.combobox-container .input-group-addon[disabled],.combobox-container .input-group-addon[disabled].active,.combobox-container .input-group-addon[disabled]:active,.combobox-container .input-group-addon[disabled]:focus,.combobox-container .input-group-addon[disabled]:hover,fieldset[disabled] .combobox-container .input-group-addon,fieldset[disabled] .combobox-container .input-group-addon.active,fieldset[disabled] .combobox-container .input-group-addon:active,fieldset[disabled] .combobox-container .input-group-addon:focus,fieldset[disabled] .combobox-container .input-group-addon:hover{background-color:#f1f1f1;border-color:#bbb}.combobox-container .input-group-addon:active{-webkit-box-shadow:inset 0 2px 8px rgba(3,3,3,.2);box-shadow:inset 0 2px 8px rgba(3,3,3,.2)}.treeview .list-group{border-top:0}.treeview .list-group-item{background:0 0;border-bottom:1px solid transparent!important;border-top:1px solid transparent!important;margin-bottom:0;padding:0 10px}.treeview .list-group-item:hover{background:#def3ff!important;border-color:#bee1f4!important}.treeview .list-group-item.node-selected{background:#0088ce!important;border-color:#0088ce!important;color:#fff!important}.treeview span.icon{display:inline-block;font-size:13px;min-width:10px;text-align:center}.treeview span.icon>[class*=fa-angle]{font-size:15px}.treeview span.indent{margin-right:5px}.breadcrumb{padding-left:0}.breadcrumb>.active strong{font-weight:600}.breadcrumb>li{display:inline}.breadcrumb>li+li:before{color:#9c9c9c;content:"\f101";font-family:FontAwesome;font-size:11px;padding:0 9px 0 7px}.btn{-webkit-box-shadow:0 2px 3px rgba(3,3,3,.1);box-shadow:0 2px 3px rgba(3,3,3,.1)}.btn:active{-webkit-box-shadow:inset 0 2px 8px rgba(3,3,3,.2);box-shadow:inset 0 2px 8px rgba(3,3,3,.2)}.btn.disabled,.btn[disabled],fieldset[disabled] .btn{background-color:#fafafa!important;background-image:none!important;border-color:#d1d1d1!important;color:#8b8d8f!important;opacity:1}.btn.disabled:active,.btn[disabled]:active,fieldset[disabled] .btn:active{-webkit-box-shadow:none;box-shadow:none}.btn.disabled.btn-link,.btn[disabled].btn-link,fieldset[disabled] .btn.btn-link{background-color:transparent!important;border:0}.btn-danger{background-color:#a30000;background-image:-webkit-linear-gradient(top,#c00 0,#a30000 100%);background-image:-o-linear-gradient(top,#c00 0,#a30000 100%);background-image:linear-gradient(to bottom,#c00 0,#a30000 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffcc0000', endColorstr='#ffa30000', GradientType=0);border-color:#8b0000;color:#fff}.btn-danger.active,.btn-danger:active,.btn-danger:focus,.btn-danger:hover,.open .dropdown-toggle.btn-danger{background-color:#a30000;background-image:none;border-color:#8b0000;color:#fff}.btn-danger.active,.btn-danger:active,.open .dropdown-toggle.btn-danger{background-image:none}.btn-danger.active.focus,.btn-danger.active:focus,.btn-danger.active:hover,.btn-danger:active.focus,.btn-danger:active:focus,.btn-danger:active:hover,.open .dropdown-toggle.btn-danger.focus,.open .dropdown-toggle.btn-danger:focus,.open .dropdown-toggle.btn-danger:hover{background-color:#8a0000;border-color:#670000}.btn-danger.disabled,.btn-danger.disabled.active,.btn-danger.disabled:active,.btn-danger.disabled:focus,.btn-danger.disabled:hover,.btn-danger[disabled],.btn-danger[disabled].active,.btn-danger[disabled]:active,.btn-danger[disabled]:focus,.btn-danger[disabled]:hover,fieldset[disabled] .btn-danger,fieldset[disabled] .btn-danger.active,fieldset[disabled] .btn-danger:active,fieldset[disabled] .btn-danger:focus,fieldset[disabled] .btn-danger:hover{background-color:#a30000;border-color:#8b0000}.btn-default{background-color:#f1f1f1;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0);border-color:#bbb;color:#4d5258}.btn-default.active,.btn-default:active,.btn-default:focus,.btn-default:hover,.open .dropdown-toggle.btn-default{background-color:#f1f1f1;background-image:none;border-color:#bbb;color:#4d5258}.btn-default.active,.btn-default:active,.open .dropdown-toggle.btn-default{background-image:none}.btn-default.active.focus,.btn-default.active:focus,.btn-default.active:hover,.btn-default:active.focus,.btn-default:active:focus,.btn-default:active:hover,.open .dropdown-toggle.btn-default.focus,.open .dropdown-toggle.btn-default:focus,.open .dropdown-toggle.btn-default:hover{background-color:#e5e5e5;border-color:#a9a9a9}.btn-default.disabled,.btn-default.disabled.active,.btn-default.disabled:active,.btn-default.disabled:focus,.btn-default.disabled:hover,.btn-default[disabled],.btn-default[disabled].active,.btn-default[disabled]:active,.btn-default[disabled]:focus,.btn-default[disabled]:hover,fieldset[disabled] .btn-default,fieldset[disabled] .btn-default.active,fieldset[disabled] .btn-default:active,fieldset[disabled] .btn-default:focus,fieldset[disabled] .btn-default:hover{background-color:#f1f1f1;border-color:#bbb}.btn-link,.btn-link:active{-webkit-box-shadow:none;box-shadow:none}.btn-primary{background-color:#0088ce;background-image:-webkit-linear-gradient(top,#39a5dc 0,#0088ce 100%);background-image:-o-linear-gradient(top,#39a5dc 0,#0088ce 100%);background-image:linear-gradient(to bottom,#39a5dc 0,#0088ce 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff39a5dc', endColorstr='#ff0088ce', GradientType=0);border-color:#00659c;color:#fff}.btn-primary.active,.btn-primary:active,.btn-primary:focus,.btn-primary:hover,.open .dropdown-toggle.btn-primary{background-color:#0088ce;background-image:none;border-color:#00659c;color:#fff}.btn-primary.active,.btn-primary:active,.open .dropdown-toggle.btn-primary{background-image:none}.btn-primary.active.focus,.btn-primary.active:focus,.btn-primary.active:hover,.btn-primary:active.focus,.btn-primary:active:focus,.btn-primary:active:hover,.open .dropdown-toggle.btn-primary.focus,.open .dropdown-toggle.btn-primary:focus,.open .dropdown-toggle.btn-primary:hover{background-color:#0077b5;border-color:#004e78}.btn-primary.disabled,.btn-primary.disabled.active,.btn-primary.disabled:active,.btn-primary.disabled:focus,.btn-primary.disabled:hover,.btn-primary[disabled],.btn-primary[disabled].active,.btn-primary[disabled]:active,.btn-primary[disabled]:focus,.btn-primary[disabled]:hover,fieldset[disabled] .btn-primary,fieldset[disabled] .btn-primary.active,fieldset[disabled] .btn-primary:active,fieldset[disabled] .btn-primary:focus,fieldset[disabled] .btn-primary:hover{background-color:#0088ce;border-color:#00659c}.btn-group-xs .btn,.btn-group-xs>.btn,.btn-xs{font-weight:400}.close{text-shadow:none;opacity:.6;filter:alpha(opacity=60)}.close:focus,.close:hover{opacity:.9;filter:alpha(opacity=90)}.ColVis_Button:active:focus{outline:0}.ColVis_catcher{position:absolute;z-index:999}.ColVis_collection{background-color:#fff;border:1px solid #bbb;border-radius:1px;-webkit-box-shadow:0 6px 12px rgba(3,3,3,.175);box-shadow:0 6px 12px rgba(3,3,3,.175);background-clip:padding-box;list-style:none;margin:-1px 0 0 0;padding:5px 10px;width:150px;z-index:1000}.ColVis_collection label{font-weight:400;margin-bottom:5px;margin-top:5px;padding-left:20px}.ColVis_collectionBackground{background-color:#fff;height:100%;left:0;position:fixed;top:0;width:100%;z-index:998}.dataTables_header{background-color:#f5f5f5;border:1px solid #d1d1d1;border-bottom:none;padding:5px;position:relative;text-align:center}.dataTables_header .btn{-webkit-box-shadow:none;box-shadow:none}.dataTables_header .ColVis{position:absolute;right:5px;text-align:left;top:5px}.dataTables_header .ColVis+.dataTables_info{padding-right:30px}.dataTables_header .dataTables_filter{position:absolute}.dataTables_header .dataTables_filter input{border:1px solid #bbb;height:24px}@media (max-width:767px){.dataTables_header .dataTables_filter input{width:100px}}.dataTables_header .dataTables_info{padding:2px 0}@media (max-width:480px){.dataTables_header .dataTables_info{text-align:right}}.dataTables_header .dataTables_info b{font-weight:700}.dataTables_footer{background-color:#fff;border:1px solid #d1d1d1;border-top:none;overflow:hidden}.dataTables_paginate{background:#fafafa;float:right;margin:0}.dataTables_paginate .pagination{float:left;margin:0}.dataTables_paginate .pagination>li>span{border-color:#fff #d1d1d1 #f5f5f5;border-width:0 1px;font-size:16px;font-weight:400;padding:0;text-align:center;width:31px}.dataTables_paginate .pagination>li>span:focus,.dataTables_paginate .pagination>li>span:hover{filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.dataTables_paginate .pagination>li.last>span{border-right:none}.dataTables_paginate .pagination>li.disabled>span{background:#f5f5f5;border-left-color:#ededed;border-right-color:#ededed;filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.dataTables_paginate .pagination-input{float:left;font-size:12px;line-height:1em;padding:4px 15px 0;text-align:right}.dataTables_paginate .pagination-input .paginate_input{border:1px solid #d1d1d1;-webkit-box-shadow:inset 0 1px 1px rgba(3,3,3,.075);box-shadow:inset 0 1px 1px rgba(3,3,3,.075);font-size:12px;font-weight:600;height:19px;margin-right:8px;padding-right:3px;text-align:right;width:30px}.dataTables_paginate .pagination-input .paginate_of{position:relative}.dataTables_paginate .pagination-input .paginate_of b{margin-left:3px}.dataTables_wrapper{margin:20px 0}@media (max-width:767px){.dataTables_wrapper .table-responsive{margin-bottom:0}}.DTCR_clonedTable{background-color:rgba(255,255,255,.7);z-index:202}.DTCR_pointer{background-color:#0088ce;width:1px;z-index:201}table.datatable{margin-bottom:0;max-width:none!important}table.datatable thead .sorting,table.datatable thead .sorting_asc,table.datatable thead .sorting_asc_disabled,table.datatable thead .sorting_desc,table.datatable thead .sorting_desc_disabled{cursor:pointer}table.datatable thead .sorting_asc,table.datatable thead .sorting_desc{color:#0088ce!important;position:relative}table.datatable thead .sorting_asc:after,table.datatable thead .sorting_desc:after{content:"\f107";font-family:FontAwesome;font-size:10px;font-weight:400;height:9px;left:7px;line-height:12px;position:relative;top:2px;vertical-align:baseline;width:12px}table.datatable thead .sorting_asc:before,table.datatable thead .sorting_desc:before{background:#0088ce;content:'';height:2px;position:absolute;left:0;top:0;width:100%}table.datatable thead .sorting_asc:after{content:"\f106";top:-3px}table.datatable th:active{outline:0}.caret{font-family:FontAwesome;font-weight:400;height:9px;position:relative;vertical-align:baseline;width:12px}.caret:before{bottom:0;content:"\f107";left:0;line-height:12px;position:absolute;text-align:center;top:-1px;right:0}.dropup .caret:before{content:"\f106"}.dropdown-menu .divider{background-color:#ededed;height:1px;margin:4px 1px;overflow:hidden}.dropdown-menu>li>a{border-color:transparent;border-style:solid;border-width:1px 0;padding:1px 10px}.dropdown-menu>li>a:focus,.dropdown-menu>li>a:hover{border-color:#bee1f4;filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.dropdown-menu>li>a:active{background-color:#0088ce;border-color:#0088ce;color:#fff!important;filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.dropdown-menu>.active>a,.dropdown-menu>.active>a:focus,.dropdown-menu>.active>a:hover{background-color:#0088ce!important;border-color:#0088ce!important;filter:progid:DXImageTransform.Microsoft.gradient(enabled=false)}.dropdown-menu>.disabled>a,.dropdown-menu>.disabled>a:focus,.dropdown-menu>.disabled>a:hover{border-color:transparent}.dropdown-menu>.disabled>a:focus,.dropdown-menu>.disabled>a:hover{border-color:transparent}.dropdown-header{padding-left:10px;padding-right:10px;text-transform:uppercase}.btn-group>.dropdown-menu,.dropdown>.dropdown-menu,.input-group-btn>.dropdown-menu{margin-top:-1px}.dropup .dropdown-menu{margin-bottom:-1px}.dropdown-submenu{position:relative}.dropdown-submenu:hover>a{background-color:#def3ff;border-color:#bee1f4}.dropdown-submenu:hover>.dropdown-menu{display:block}.dropdown-submenu.pull-left{float:none!important}.dropdown-submenu.pull-left>.dropdown-menu{left:auto;margin-left:10px;right:100%}.dropdown-submenu>a{padding-right:20px!important}.dropdown-submenu>a:after{content:"\f105";font-family:FontAwesome;display:block;position:absolute;right:10px;top:2px}.dropdown-submenu>.dropdown-menu{left:100%;margin-top:0;top:-6px}.dropup .dropdown-submenu>.dropdown-menu{bottom:-5px;top:auto}.open .dropdown-submenu.active>.dropdown-menu{display:block}.dropdown-kebab-pf .btn-link{color:#252525;font-size:16px;line-height:1;padding:4px 0}.dropdown-kebab-pf .btn-link:active,.dropdown-kebab-pf .btn-link:focus,.dropdown-kebab-pf .btn-link:hover{color:#0088ce}.dropdown-kebab-pf .dropdown-menu{left:-15px;margin-top:11px}.dropdown-kebab-pf .dropdown-menu.dropdown-menu-right{left:auto;right:-15px}.dropdown-kebab-pf .dropdown-menu.dropdown-menu-right:after,.dropdown-kebab-pf .dropdown-menu.dropdown-menu-right:before{left:auto;right:6px}.dropdown-kebab-pf .dropdown-menu:after,.dropdown-kebab-pf .dropdown-menu:before{border-bottom-color:#bbb;border-bottom-style:solid;border-bottom-width:10px;border-left:10px solid transparent;border-right:10px solid transparent;content:"";display:inline-block;left:6px;position:absolute;top:-11px}.dropdown-kebab-pf .dropdown-menu:after{border-bottom-color:#fff;top:-10px}.dropdown-kebab-pf.dropup .dropdown-menu{margin-bottom:11px;margin-top:0}.dropdown-kebab-pf.dropup .dropdown-menu:after,.dropdown-kebab-pf.dropup .dropdown-menu:before{border-bottom:none;border-top-color:#bbb;border-top-style:solid;border-top-width:10px;bottom:-11px;top:auto}.dropdown-kebab-pf.dropup .dropdown-menu:after{border-top-color:#fff;bottom:-10px}@font-face{font-family:'Open Sans';font-style:normal;font-weight:400;src:local('Open Sans'),local('OpenSans'),url(../fonts/open-sans/OpenSans-Regular.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:normal;font-weight:300;src:local('OpenSans-Light'),local('Open Sans Light'),url(../fonts/open-sans/OpenSans-Light.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:normal;font-weight:600;src:local('Open Sans Semibold'),local('OpenSans-Semibold'),url(../fonts/open-sans/OpenSans-Semibold.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:normal;font-weight:700;src:local('Open Sans Bold'),local('OpenSans-Bold'),url(../fonts/open-sans/OpenSans-Bold.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:normal;font-weight:800;src:local('Open Sans Extrabold'),local('OpenSans-Extrabold'),url(../fonts/open-sans/OpenSans-ExtraBold.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:italic;font-weight:300;src:local('Open Sans Light Italic'),local('OpenSansLight-Italic'),url(../fonts/open-sans/OpenSans-LightItalic.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:italic;font-weight:400;src:local('Open Sans Italic'),local('OpenSans-Italic'),url(../fonts/open-sans/OpenSans-Italic.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:italic;font-weight:600;src:local('Open Sans Semibold Italic'),local('OpenSans-SemiboldItalic'),url(../fonts/open-sans/OpenSans-SemiboldItalic.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:italic;font-weight:700;src:local('Open Sans Bold Italic'),local('OpenSans-BoldItalic'),url(../fonts/open-sans/OpenSans-BoldItalic.ttf) format('truetype')}@font-face{font-family:'Open Sans';font-style:italic;font-weight:800;src:local('Open Sans Extrabold Italic'),local('OpenSans-ExtraboldItalic'),url(../fonts/open-sans/OpenSans-ExtraBoldItalic.ttf) format('truetype')}.chars-remaining-pf span{font-weight:600;padding-right:5px}.chars-warn-remaining-pf{color:#c00}.form-control[disabled],.form-control[readonly],fieldset[disabled] .form-control{-webkit-box-shadow:none;box-shadow:none;color:#8b8d8f}.form-control[disabled]:hover,.form-control[readonly]:hover,fieldset[disabled] .form-control:hover{border-color:#bbb}.form-control:hover{border-color:#7dc3e8}.has-error .form-control:hover{border-color:#900}.has-success .form-control:hover{border-color:#2b542c}.has-warning .form-control:hover{border-color:#bb6106}.has-error .checkbox,.has-error .checkbox-inline,.has-error .control-label,.has-error .radio,.has-error .radio-inline,.has-error.checkbox label,.has-error.checkbox-inline label,.has-error.radio label,.has-error.radio-inline label,.has-success .checkbox,.has-success .checkbox-inline,.has-success .control-label,.has-success .radio,.has-success .radio-inline,.has-success.checkbox label,.has-success.checkbox-inline label,.has-success.radio label,.has-success.radio-inline label,.has-warning .checkbox,.has-warning .checkbox-inline,.has-warning .control-label,.has-warning .radio,.has-warning .radio-inline,.has-warning.checkbox label,.has-warning.checkbox-inline label,.has-warning.radio label,.has-warning.radio-inline label{color:#363636}.help-block{margin-bottom:0}.input-group .input-group-btn .btn{-webkit-box-shadow:none;box-shadow:none}label{font-weight:600}.navbar-nav>li>.dropdown-menu.infotip{border-top-width:1px!important;margin-top:10px}@media (max-width:767px){.navbar-pf .navbar-nav .open .dropdown-menu.infotip{background-color:#fff!important;margin-top:0}}.infotip{min-width:235px;padding:0}.infotip .list-group{border-top:0;margin:0;padding:8px 0}.infotip .list-group .list-group-item{border:none;margin:0 15px 0 34px;padding:5px 0}.infotip .list-group .list-group-item>.i{color:#4d5258;font-size:13px;left:-20px;position:absolute;top:8px}.infotip .list-group .list-group-item>a{color:#4d5258;line-height:13px}.infotip .list-group .list-group-item>.close{float:right}.infotip .footer{background-color:#f5f5f5;padding:6px 15px}.infotip .footer a:hover{color:#0088ce}.infotip .arrow,.infotip .arrow:after{border-color:transparent;border-style:solid;display:block;height:0;position:absolute;width:0}.infotip .arrow{border-width:11px}.infotip .arrow:after{border-width:10px;content:""}.infotip.bottom .arrow,.infotip.bottom-left .arrow,.infotip.bottom-right .arrow{border-bottom-color:#999;border-bottom-color:#bbb;border-top-width:0;left:50%;margin-left:-11px;top:-11px}.infotip.bottom .arrow:after,.infotip.bottom-left .arrow:after,.infotip.bottom-right .arrow:after{border-top-width:0;border-bottom-color:#fff;content:" ";margin-left:-10px;top:1px}.infotip.bottom-left .arrow{left:20%}.infotip.bottom-right .arrow{left:80%}.infotip.top .arrow{border-bottom-width:0;border-top-color:#999;border-top-color:#bbb;bottom:-11px;left:50%;margin-left:-11px}.infotip.top .arrow:after{border-bottom-width:0;border-top-color:#f5f5f5;bottom:1px;content:" ";margin-left:-10px}.infotip.right .arrow{border-left-width:0;border-right-color:#999;border-right-color:#bbb;left:-11px;margin-top:-11px;top:50%}.infotip.right .arrow:after{bottom:-10px;border-left-width:0;border-right-color:#fff;content:" ";left:1px}.infotip.left .arrow{border-left-color:#999;border-left-color:#bbb;border-right-width:0;margin-top:-11px;right:-11px;top:50%}.infotip.left .arrow:after{border-left-color:#fff;border-right-width:0;bottom:-10px;content:" ";right:1px}.label{border-radius:0;font-size:100%;font-weight:600}h1 .label,h2 .label,h3 .label,h4 .label,h5 .label,h6 .label{font-size:75%}.list-group{border-top:1px solid #ededed}.list-group .list-group-item:first-child{border-top:0}.list-group-item{border-top:0;border-left:0;border-right:0;margin-bottom:0}.list-group-item-heading{font-weight:600}.list-group-item.active,.list-group-item.active:focus,.list-group-item.active:hover{border-top:solid 1px #39a5dc;margin-top:-1px;z-index:auto}.list-group-item.active:first-child{border-top:1px solid #39a5dc!important;margin-top:-1px}.login-pf{height:100%}.login-pf #brand{position:relative;top:-70px}.login-pf #brand img{display:block;height:18px;margin:0 auto;max-width:100%}@media (min-width:768px){.login-pf #brand img{margin:0;text-align:left}}.login-pf #badge{display:block;margin:20px auto 70px;position:relative;text-align:center}@media (min-width:768px){.login-pf #badge{float:right;margin-right:64px;margin-top:50px}}.login-pf body{background:#1a1a1a url(../img/bg-login.jpg) repeat-x 50% 0;background-size:auto}@media (min-width:768px){.login-pf body{background-size:100% auto}}.login-pf .container{background-color:transparent;clear:right;color:#fff;padding-bottom:40px;padding-top:20px;width:auto}@media (min-width:768px){.login-pf .container{bottom:13%;padding-left:80px;position:absolute;width:100%}}.login-pf .container [class^=alert]{background:0 0;color:#fff}.login-pf .container .details p:first-child{border-top:1px solid rgba(255,255,255,.3);padding-top:25px;margin-top:25px}@media (min-width:768px){.login-pf .container .details{border-left:1px solid rgba(255,255,255,.3);padding-left:40px}.login-pf .container .details p:first-child{border-top:0;padding-top:0;margin-top:0}}.login-pf .container .details p{margin-bottom:2px}.login-pf .container .form-horizontal .control-label{font-size:13px;font-weight:400;text-align:left}.login-pf .container .form-horizontal .form-group:last-child,.login-pf .container .form-horizontal .form-group:last-child .help-block:last-child{margin-bottom:0}.login-pf .container .help-block{color:#fff}@media (min-width:768px){.login-pf .container .login{padding-right:40px}}.login-pf .container .submit{text-align:right}.modal-header{background-color:#f5f5f5;border-bottom:none;padding:10px 18px}.modal-header .close{margin-top:2px}.modal-title{font-size:13px;font-weight:700}.modal-footer{border-top:none;margin-top:15px;padding:14px 15px 15px}.modal-footer>.btn{padding-left:10px;padding-right:10px}.modal-footer>.btn>.fa-angle-left{margin-right:5px}.modal-footer>.btn>.fa-angle-right{margin-left:5px}.navbar-pf{background:#393F45;border:0;border-radius:0;border-top:3px solid #c00;margin-bottom:0;min-height:0}.navbar-pf .navbar-brand{color:#fff;height:auto;padding:12px 0;margin:0 0 0 20px}.navbar-pf .navbar-brand img{display:block}.navbar-pf .navbar-collapse{border-top:0;-webkit-box-shadow:none;box-shadow:none;padding:0}.navbar-pf .navbar-header{border-bottom:1px solid #53565b;float:none}.navbar-pf .navbar-nav{margin:0}.navbar-pf .navbar-nav>.active>a,.navbar-pf .navbar-nav>.active>a:focus,.navbar-pf .navbar-nav>.active>a:hover{background-color:#454C53;color:#fff}.navbar-pf .navbar-nav>li>a{color:#dbdada;line-height:1;padding:10px 20px;text-shadow:none}.navbar-pf .navbar-nav>li>a:focus,.navbar-pf .navbar-nav>li>a:hover{color:#fff}.navbar-pf .navbar-nav>.open>a,.navbar-pf .navbar-nav>.open>a:focus,.navbar-pf .navbar-nav>.open>a:hover{background-color:#454C53;color:#fff}@media (max-width:767px){.navbar-pf .navbar-nav .active .dropdown-menu,.navbar-pf .navbar-nav .active .navbar-persistent,.navbar-pf .navbar-nav .open .dropdown-menu{background-color:#3c434a!important;margin-left:0;padding-bottom:0;padding-top:0}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu.open>a,.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu.open>a:focus,.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu.open>a:hover,.navbar-pf .navbar-nav .active .dropdown-menu>.active>a,.navbar-pf .navbar-nav .active .dropdown-menu>.active>a:focus,.navbar-pf .navbar-nav .active .dropdown-menu>.active>a:hover,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.open>a,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.open>a:focus,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.open>a:hover,.navbar-pf .navbar-nav .active .navbar-persistent>.active>a,.navbar-pf .navbar-nav .active .navbar-persistent>.active>a:focus,.navbar-pf .navbar-nav .active .navbar-persistent>.active>a:hover,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu.open>a,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu.open>a:focus,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu.open>a:hover,.navbar-pf .navbar-nav .open .dropdown-menu>.active>a,.navbar-pf .navbar-nav .open .dropdown-menu>.active>a:focus,.navbar-pf .navbar-nav .open .dropdown-menu>.active>a:hover{background-color:#424950!important;color:#fff}.navbar-pf .navbar-nav .active .dropdown-menu>li>a,.navbar-pf .navbar-nav .active .navbar-persistent>li>a,.navbar-pf .navbar-nav .open .dropdown-menu>li>a{background-color:transparent;border:0;color:#dbdada;outline:0;padding-left:30px}.navbar-pf .navbar-nav .active .dropdown-menu>li>a:hover,.navbar-pf .navbar-nav .active .navbar-persistent>li>a:hover,.navbar-pf .navbar-nav .open .dropdown-menu>li>a:hover{color:#fff}.navbar-pf .navbar-nav .active .dropdown-menu .divider,.navbar-pf .navbar-nav .active .navbar-persistent .divider,.navbar-pf .navbar-nav .open .dropdown-menu .divider{background-color:#53565b;margin:0 1px}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-header,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-header,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-header{padding-bottom:0;padding-left:30px}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu.open .dropdown-toggle,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.open .dropdown-toggle,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu.open .dropdown-toggle{color:#fff}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu.pull-left,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.pull-left,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu.pull-left{float:none!important}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu>a:after,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu>a:after,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu>a:after{display:none}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu .dropdown-header,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-header,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu .dropdown-header{padding-left:45px}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu .dropdown-menu,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-menu,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu .dropdown-menu{border:0;bottom:auto;-webkit-box-shadow:none;box-shadow:none;display:block;float:none;margin:0;min-width:0;padding:0;position:relative;left:auto;right:auto;top:auto}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu .dropdown-menu>li>a,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-menu>li>a,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu .dropdown-menu>li>a{padding:5px 15px 5px 45px;line-height:20px}.navbar-pf .navbar-nav .active .dropdown-menu .dropdown-submenu .dropdown-menu .dropdown-menu>li>a,.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-menu .dropdown-menu>li>a,.navbar-pf .navbar-nav .open .dropdown-menu .dropdown-submenu .dropdown-menu .dropdown-menu>li>a{padding-left:60px}.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu.open .dropdown-menu{display:block}.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu>a:after{display:inline-block!important;position:relative;right:auto;top:1px}.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-menu{display:none}.navbar-pf .navbar-nav .active .navbar-persistent .dropdown-submenu .dropdown-submenu>a:after{display:none!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu{background-color:#fff!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.active>a,.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.active>a:active{background-color:#def3ff!important;border-color:#bee1f4!important;color:#363636!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.active>a small,.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.active>a:active small{color:#9c9c9c!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.disabled>a{color:#9c9c9c!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.selected>a,.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.selected>a:active{background-color:#0088ce!important;border-color:#0088ce!important;color:#fff!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.selected>a small,.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu>.selected>a:active small{color:rgba(255,255,255,.5)!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu li>a.opt{border-bottom:1px solid transparent;border-top:1px solid transparent;color:#363636;padding-left:10px;padding-right:10px}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu li a:active small{color:rgba(255,255,255,.5)!important}.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu li a:focus small,.navbar-pf .navbar-nav .context-bootstrap-select .open>.dropdown-menu li a:hover small{color:#9c9c9c}.navbar-pf .navbar-nav .context-bootstrap-select>.open>.dropdown-menu{padding-bottom:5px;padding-top:5px}}.navbar-pf .navbar-persistent{display:none}.navbar-pf .active>.navbar-persistent{display:block}.navbar-pf .navbar-primary{float:none}.navbar-pf .navbar-primary .context{border-bottom:1px solid #53565b}.navbar-pf .navbar-primary .context.context-bootstrap-select .bootstrap-select.btn-group,.navbar-pf .navbar-primary .context.context-bootstrap-select .bootstrap-select.btn-group[class*=span]{margin:8px 20px 9px;width:auto}.navbar-pf .navbar-primary>li>.navbar-persistent>.dropdown-submenu>a{position:relative}.navbar-pf .navbar-primary>li>.navbar-persistent>.dropdown-submenu>a:after{content:"\f107";display:inline-block;font-family:FontAwesome;font-weight:400}@media (max-width:767px){.navbar-pf .navbar-primary>li>.navbar-persistent>.dropdown-submenu>a:after{height:10px;margin-left:4px;vertical-align:baseline}}.navbar-pf .navbar-toggle{border:0;margin:0;padding:10px 20px}.navbar-pf .navbar-toggle:focus,.navbar-pf .navbar-toggle:hover{background-color:transparent;outline:0}.navbar-pf .navbar-toggle:focus .icon-bar,.navbar-pf .navbar-toggle:hover .icon-bar{-webkit-box-shadow:0 0 3px #fff;box-shadow:0 0 3px #fff}.navbar-pf .navbar-toggle .icon-bar{background-color:#fff}.navbar-pf .navbar-utility{border-bottom:1px solid #53565b}.navbar-pf .navbar-utility li.dropdown>.dropdown-toggle{padding-left:36px;position:relative}.navbar-pf .navbar-utility li.dropdown>.dropdown-toggle .pficon-user{left:20px;position:absolute;top:10px}@media (max-width:767px){.navbar-pf .navbar-utility>li+li{border-top:1px solid #53565b}}@media (min-width:768px){.navbar-pf .navbar-brand{padding:7px 0 8px}.navbar-pf .navbar-nav>li>a{padding-bottom:14px;padding-top:14px}.navbar-pf .navbar-persistent{font-size:14px}.navbar-pf .navbar-primary{font-size:14px;background-image:-webkit-linear-gradient(top,#474c50 0,#383f43 100%);background-image:-o-linear-gradient(top,#474c50 0,#383f43 100%);background-image:linear-gradient(to bottom,#474c50 0,#383f43 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff474c50', endColorstr='#ff383f43', GradientType=0)}.navbar-pf .navbar-primary.persistent-secondary .context .dropdown-menu{top:auto}.navbar-pf .navbar-primary.persistent-secondary .dropup .dropdown-menu{bottom:-5px;top:auto}.navbar-pf .navbar-primary.persistent-secondary>li{position:static}.navbar-pf .navbar-primary.persistent-secondary>li.active{margin-bottom:32px}.navbar-pf .navbar-primary.persistent-secondary>li.active>.navbar-persistent{display:block;left:0;position:absolute}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent{background:#f6f6f6;border-bottom:1px solid #cecdcd;padding:0;width:100%}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent a{text-decoration:none!important}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active:before,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active:hover:before{background:#0088ce;bottom:-1px;content:'';display:block;height:2px;left:20px;position:absolute;right:20px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active:hover>a,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active>a,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active>a:hover{color:#0088ce!important}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.active .active>a{color:#fff}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu:hover>.dropdown-menu{display:none}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu.open>.dropdown-menu{display:block;left:20px;margin-top:1px;top:100%}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu.open>.dropdown-toggle{color:#252525}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu.open>.dropdown-toggle:after{border-top-color:#252525}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu>.dropdown-toggle{padding-right:35px!important}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.dropdown-submenu>.dropdown-toggle:after{position:absolute;right:20px;top:10px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.open:before,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li:hover:before{background:#bbb;bottom:-1px;content:'';display:block;height:2px;left:20px;position:absolute;right:20px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.open>a,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li:hover>a{color:#252525}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li.open>a:after,.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li:hover>a:after{border-top-color:#252525}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li>a{background-color:transparent;display:block;line-height:1;padding:9px 20px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li>a.dropdown-toggle{padding-right:35px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li>a.dropdown-toggle:after{font-size:15px;position:absolute;right:20px;top:9px}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li>a:hover{color:#252525}.navbar-pf .navbar-primary.persistent-secondary>li>.navbar-persistent>li a{color:#4d5258}.navbar-pf .navbar-primary>li>a{border-bottom:1px solid transparent;border-top:1px solid transparent;position:relative;margin:-1px 0 0}.navbar-pf .navbar-primary>li>a:hover{background-color:#4b5053;border-top-color:#949699;color:#dbdada;background-image:-webkit-linear-gradient(top,#5c6165 0,#4b5053 100%);background-image:-o-linear-gradient(top,#5c6165 0,#4b5053 100%);background-image:linear-gradient(to bottom,#5c6165 0,#4b5053 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff5c6165', endColorstr='#ff4b5053', GradientType=0)}.navbar-pf .navbar-primary>.active>a,.navbar-pf .navbar-primary>.active>a:focus,.navbar-pf .navbar-primary>.active>a:hover,.navbar-pf .navbar-primary>.open>a,.navbar-pf .navbar-primary>.open>a:focus,.navbar-pf .navbar-primary>.open>a:hover{background-color:#64686c;border-bottom-color:#64686c;border-top-color:#949699;-webkit-box-shadow:none;box-shadow:none;color:#fff;background-image:-webkit-linear-gradient(top,#72757a 0,#64686c 100%);background-image:-o-linear-gradient(top,#72757a 0,#64686c 100%);background-image:linear-gradient(to bottom,#72757a 0,#64686c 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff72757a', endColorstr='#ff64686c', GradientType=0)}.navbar-pf .navbar-primary li.context.context-bootstrap-select .filter-option{max-width:160px;text-overflow:ellipsis}.navbar-pf .navbar-primary li.context.dropdown{border-bottom:0}.navbar-pf .navbar-primary li.context.context-bootstrap-select,.navbar-pf .navbar-primary li.context>a{background-color:#505458;border-bottom-color:#65696d;border-right:1px solid #65696d;border-top-color:#64696d;font-weight:600;background-image:-webkit-linear-gradient(top,#585d61 0,#505458 100%);background-image:-o-linear-gradient(top,#585d61 0,#505458 100%);background-image:linear-gradient(to bottom,#585d61 0,#505458 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff585d61', endColorstr='#ff505458', GradientType=0)}.navbar-pf .navbar-primary li.context.context-bootstrap-select:hover,.navbar-pf .navbar-primary li.context>a:hover{background-color:#5a5e62;border-bottom-color:#6e7276;border-right-color:#6e7276;border-top-color:#6c7276;background-image:-webkit-linear-gradient(top,#62676b 0,#5a5e62 100%);background-image:-o-linear-gradient(top,#62676b 0,#5a5e62 100%);background-image:linear-gradient(to bottom,#62676b 0,#5a5e62 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff62676b', endColorstr='#ff5a5e62', GradientType=0)}.navbar-pf .navbar-primary li.context.open>a{background-color:#65696d;border-bottom-color:#6e7276;border-right-color:#777a7e;border-top-color:#767a7e;background-image:-webkit-linear-gradient(top,#6b7175 0,#65696d 100%);background-image:-o-linear-gradient(top,#6b7175 0,#65696d 100%);background-image:linear-gradient(to bottom,#6b7175 0,#65696d 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#ff6b7175', endColorstr='#ff65696d', GradientType=0)}.navbar-pf .navbar-utility{border-bottom:0;font-size:11px;position:absolute;right:0;top:0}.navbar-pf .navbar-utility>.active>a,.navbar-pf .navbar-utility>.active>a:focus,.navbar-pf .navbar-utility>.active>a:hover,.navbar-pf .navbar-utility>.open>a,.navbar-pf .navbar-utility>.open>a:focus,.navbar-pf .navbar-utility>.open>a:hover{background:#5b6165;color:#fff}.navbar-pf .navbar-utility>li>a{border-left:1px solid #53565b;color:#fff!important;padding:7px 10px}.navbar-pf .navbar-utility>li>a:hover{background:#4a5053;border-left-color:#636466}.navbar-pf .navbar-utility>li.open>a{border-left-color:#6c6e70;color:#fff!important}.navbar-pf .navbar-utility li.dropdown>.dropdown-toggle{padding-left:26px}.navbar-pf .navbar-utility li.dropdown>.dropdown-toggle .pficon-user{left:10px;top:7px}.navbar-pf .navbar-utility .open .dropdown-menu{left:auto;right:0}.navbar-pf .navbar-utility .open .dropdown-menu .dropdown-menu{left:auto;right:100%}.navbar-pf .navbar-utility .open .dropdown-menu{border-top-width:0}.navbar-pf .open .dropdown-submenu>.dropdown-menu,.navbar-pf .open.bootstrap-select .dropdown-menu{border-top-width:1px!important}}@media (max-width:360px){.navbar-pf .navbar-brand{margin-left:10px;width:75%}.navbar-pf .navbar-brand img{height:auto;max-width:100%}.navbar-pf .navbar-toggle{padding-left:0}}.drawer-pf{background-color:#fafafa;border:1px solid #d1d1d1;-webkit-box-shadow:0 6px 12px rgba(3,3,3,.175);box-shadow:0 6px 12px rgba(3,3,3,.175);overflow-y:auto;position:absolute;right:0;width:320px;z-index:2}.drawer-pf .panel{border-bottom:none;border-left:none;border-right:none}.drawer-pf .panel-group .panel-heading+.panel-collapse .panel-body{border-top:none;border-bottom:1px solid #d1d1d1;padding:0}.drawer-pf .panel-counter{display:block;font-style:italic;line-height:1.2;padding-left:18px;padding-top:5px}.drawer-pf .panel-heading{border-bottom:1px solid #d1d1d1}.drawer-pf .panel-group{bottom:0;margin-bottom:0;position:absolute;top:25px;width:100%}.drawer-pf .panel-title a{cursor:pointer;display:block}.drawer-pf.drawer-pf-expanded{left:270px;width:inherit}.drawer-pf.drawer-pf-expanded .drawer-pf-toggle-expand:before{content:"\f101"}.drawer-pf-toggle-expand{color:inherit;cursor:pointer;left:0;padding:2px 5px;position:absolute}.drawer-pf-toggle-expand:before{content:"\f100";font-family:FontAwesome}.drawer-pf-toggle-expand:focus,.drawer-pf-toggle-expand:hover{color:inherit;text-decoration:none}.drawer-pf-action .btn-link{color:#0088ce;padding:10px 0}.drawer-pf-action .btn-link:hover{color:#00659c}.drawer-pf-loading{color:#4d5258;font-size:14px;padding:20px 15px}.drawer-pf-notification{border-bottom:1px solid #d1d1d1;padding:15px}.drawer-pf-notification .date{border-right:1px solid #aaa;display:inline-block;line-height:1;margin-right:5px;padding-right:9px}.drawer-pf-notification .pficon{font-size:14px;margin-top:3px}.drawer-pf-notification:last-of-type{border-bottom:none}.drawer-pf-notification:hover{background-color:#def3ff}.drawer-pf-notification.unread .drawer-pf-notification-message{font-weight:700}.drawer-pf-notification.expanded-notification .date{border-right:none;padding-right:0}.drawer-pf-notification-info,.drawer-pf-notification-message{display:block;padding-left:27px;padding-right:19px}.expanded-notification .drawer-pf-notification-info,.expanded-notification .drawer-pf-notification-message{display:inline-block}.drawer-pf-notifications-non-clickable .drawer-pf-notification:hover{background-color:#fff}.drawer-pf-title{background-color:#fafafa;border-bottom:1px solid #d1d1d1;position:absolute;width:318px}.drawer-pf-title h3{font-size:12px;margin:0;padding:6px 15px}.navbar-pf-vertical .drawer-pf{height:calc(100vh - 80px);top:58px}.navbar-pf-vertical .nav .drawer-pf-trigger .drawer-pf-trigger-icon{border-left:1px solid #53565b;border-right:1px solid #53565b;padding-left:15px;padding-right:15px}.navbar-pf-vertical .nav .drawer-pf-trigger.open .drawer-pf-trigger-icon{background-color:#4a5053}.navbar-pf .drawer-pf{height:calc(100vh - 46px);top:26px}.navbar-pf .drawer-pf-trigger-icon{cursor:pointer}.pager li>a,.pager li>span{background-color:#f1f1f1;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0);border-color:#bbb;color:#4d5258;font-weight:600;line-height:22px;padding:2px 14px}.open .dropdown-toggle.pager li>a,.open .dropdown-toggle.pager li>span,.pager li>a.active,.pager li>a:active,.pager li>a:focus,.pager li>a:hover,.pager li>span.active,.pager li>span:active,.pager li>span:focus,.pager li>span:hover{background-color:#f1f1f1;background-image:none;border-color:#bbb;color:#4d5258}.open .dropdown-toggle.pager li>a,.open .dropdown-toggle.pager li>span,.pager li>a.active,.pager li>a:active,.pager li>span.active,.pager li>span:active{background-image:none}.open .dropdown-toggle.pager li>a.focus,.open .dropdown-toggle.pager li>a:focus,.open .dropdown-toggle.pager li>a:hover,.open .dropdown-toggle.pager li>span.focus,.open .dropdown-toggle.pager li>span:focus,.open .dropdown-toggle.pager li>span:hover,.pager li>a.active.focus,.pager li>a.active:focus,.pager li>a.active:hover,.pager li>a:active.focus,.pager li>a:active:focus,.pager li>a:active:hover,.pager li>span.active.focus,.pager li>span.active:focus,.pager li>span.active:hover,.pager li>span:active.focus,.pager li>span:active:focus,.pager li>span:active:hover{background-color:#e5e5e5;border-color:#a9a9a9}.pager li>a.disabled,.pager li>a.disabled.active,.pager li>a.disabled:active,.pager li>a.disabled:focus,.pager li>a.disabled:hover,.pager li>a[disabled],.pager li>a[disabled].active,.pager li>a[disabled]:active,.pager li>a[disabled]:focus,.pager li>a[disabled]:hover,.pager li>span.disabled,.pager li>span.disabled.active,.pager li>span.disabled:active,.pager li>span.disabled:focus,.pager li>span.disabled:hover,.pager li>span[disabled],.pager li>span[disabled].active,.pager li>span[disabled]:active,.pager li>span[disabled]:focus,.pager li>span[disabled]:hover,fieldset[disabled] .pager li>a,fieldset[disabled] .pager li>a.active,fieldset[disabled] .pager li>a:active,fieldset[disabled] .pager li>a:focus,fieldset[disabled] .pager li>a:hover,fieldset[disabled] .pager li>span,fieldset[disabled] .pager li>span.active,fieldset[disabled] .pager li>span:active,fieldset[disabled] .pager li>span:focus,fieldset[disabled] .pager li>span:hover{background-color:#f1f1f1;border-color:#bbb}.pager li>a>.i,.pager li>span>.i{font-size:18px;vertical-align:top;margin:2px 0}.pager li>a:hover>a:focus{color:#4d5258}.pager li a:active{background-image:none;-webkit-box-shadow:inset 0 3px 5px rgba(3,3,3,.125);box-shadow:inset 0 3px 5px rgba(3,3,3,.125);outline:0}.pager .disabled>a,.pager .disabled>a:active,.pager .disabled>a:focus,.pager .disabled>a:hover,.pager .disabled>span{background:#f5f5f5;-webkit-box-shadow:none;box-shadow:none;color:#8b8d8f;cursor:default}.pager .next>a>.i,.pager .next>span>.i{margin-left:5px}.pager .previous>a>.i,.pager .previous>span>.i{margin-right:5px}.pager-sm li>a,.pager-sm li>span{font-weight:400;line-height:16px;padding:1px 10px}.pager-sm li>a>.i,.pager-sm li>span>.i{font-size:12px}.pagination>li>a,.pagination>li>span{background-color:#f1f1f1;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0);border-color:#bbb;color:#4d5258;cursor:default;font-weight:600;padding:2px 10px}.open .dropdown-toggle.pagination>li>a,.open .dropdown-toggle.pagination>li>span,.pagination>li>a.active,.pagination>li>a:active,.pagination>li>a:focus,.pagination>li>a:hover,.pagination>li>span.active,.pagination>li>span:active,.pagination>li>span:focus,.pagination>li>span:hover{background-color:#f1f1f1;background-image:none;border-color:#bbb;color:#4d5258}.open .dropdown-toggle.pagination>li>a,.open .dropdown-toggle.pagination>li>span,.pagination>li>a.active,.pagination>li>a:active,.pagination>li>span.active,.pagination>li>span:active{background-image:none}.open .dropdown-toggle.pagination>li>a.focus,.open .dropdown-toggle.pagination>li>a:focus,.open .dropdown-toggle.pagination>li>a:hover,.open .dropdown-toggle.pagination>li>span.focus,.open .dropdown-toggle.pagination>li>span:focus,.open .dropdown-toggle.pagination>li>span:hover,.pagination>li>a.active.focus,.pagination>li>a.active:focus,.pagination>li>a.active:hover,.pagination>li>a:active.focus,.pagination>li>a:active:focus,.pagination>li>a:active:hover,.pagination>li>span.active.focus,.pagination>li>span.active:focus,.pagination>li>span.active:hover,.pagination>li>span:active.focus,.pagination>li>span:active:focus,.pagination>li>span:active:hover{background-color:#e5e5e5;border-color:#a9a9a9}.pagination>li>a.disabled,.pagination>li>a.disabled.active,.pagination>li>a.disabled:active,.pagination>li>a.disabled:focus,.pagination>li>a.disabled:hover,.pagination>li>a[disabled],.pagination>li>a[disabled].active,.pagination>li>a[disabled]:active,.pagination>li>a[disabled]:focus,.pagination>li>a[disabled]:hover,.pagination>li>span.disabled,.pagination>li>span.disabled.active,.pagination>li>span.disabled:active,.pagination>li>span.disabled:focus,.pagination>li>span.disabled:hover,.pagination>li>span[disabled],.pagination>li>span[disabled].active,.pagination>li>span[disabled]:active,.pagination>li>span[disabled]:focus,.pagination>li>span[disabled]:hover,fieldset[disabled] .pagination>li>a,fieldset[disabled] .pagination>li>a.active,fieldset[disabled] .pagination>li>a:active,fieldset[disabled] .pagination>li>a:focus,fieldset[disabled] .pagination>li>a:hover,fieldset[disabled] .pagination>li>span,fieldset[disabled] .pagination>li>span.active,fieldset[disabled] .pagination>li>span:active,fieldset[disabled] .pagination>li>span:focus,fieldset[disabled] .pagination>li>span:hover{background-color:#f1f1f1;border-color:#bbb}.pagination>li>a>.i,.pagination>li>span>.i{font-size:15px;vertical-align:top;margin:2px 0}.pagination>li>a:active,.pagination>li>span:active{-webkit-box-shadow:inset 0 2px 8px rgba(3,3,3,.2);box-shadow:inset 0 2px 8px rgba(3,3,3,.2)}.pagination>.active>a,.pagination>.active>a:focus,.pagination>.active>a:hover,.pagination>.active>span,.pagination>.active>span:focus,.pagination>.active>span:hover{background-color:#f1f1f1;border-color:#bbb;-webkit-box-shadow:inset 0 2px 8px rgba(3,3,3,.2);box-shadow:inset 0 2px 8px rgba(3,3,3,.2);color:#4d5258;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0)}.pagination>.disabled>a,.pagination>.disabled>a:focus,.pagination>.disabled>a:hover,.pagination>.disabled>span,.pagination>.disabled>span:focus,.pagination>.disabled>span:hover{-webkit-box-shadow:none;box-shadow:none;cursor:default;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0)}.pagination-sm>li>a,.pagination-sm>li>span{padding:2px 6px;font-size:11px;line-height:1.5}.pagination-sm>li:first-child>a,.pagination-sm>li:first-child>span{border-bottom-left-radius:1px;border-top-left-radius:1px}.pagination-sm>li:last-child>a,.pagination-sm>li:last-child>span{border-bottom-right-radius:1px;border-top-right-radius:1px}.pagination-sm>li>a,.pagination-sm>li>span{font-weight:400}.pagination-sm>li>a>.i,.pagination-sm>li>span>.i{font-size:12px;margin-top:2px}.panel-title{font-weight:700}.panel-group .panel{color:#4d5258}.panel-group .panel+.panel{margin-top:-1px}.panel-group .panel-default{border-color:#bbb;border-top-color:#bbb}.panel-group .panel-heading{background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0)}.panel-group .panel-heading+.panel-collapse .panel-body{border-top:1px solid #d1d1d1}.panel-group .panel-title{font-weight:500;line-height:1}.panel-group .panel-title>a{color:#4d5258;font-weight:600}.panel-group .panel-title>a:before{content:"\f107";display:inline-block;font-family:FontAwesome;font-size:13px;margin-right:5px;text-align:center;vertical-align:0;width:8px}.panel-group .panel-title>a:focus{outline:0;text-decoration:none}.panel-group .panel-title>a:hover{text-decoration:none}.panel-group .panel-title>a.collapsed:before{content:"\f105"}.popover{-webkit-box-shadow:0 2px 2px rgba(3,3,3,.08);box-shadow:0 2px 2px rgba(3,3,3,.08);padding:0}.popover-content{color:#4d5258;line-height:18px;padding:10px 14px}.popover-title{border-bottom:none;border-radius:0;color:#4d5258;font-size:13px;font-weight:700;min-height:34px}.popover-title .close{height:22px;position:absolute;right:8px;top:6px}.popover-title.closable{padding-right:30px}@-webkit-keyframes progress-bar-stripes{from{background-position:0 0}to{background-position:40px 0}}@keyframes progress-bar-stripes{from{background-position:0 0}to{background-position:40px 0}}.progress{-webkit-box-shadow:inset 0 0 1px rgba(3,3,3,.25);box-shadow:inset 0 0 1px rgba(3,3,3,.25)}.progress.progress-label-left,.progress.progress-label-top-right{overflow:visible;position:relative}.progress.progress-label-left{margin-left:40px}.progress.progress-sm{height:14px;margin-bottom:14px}.progress.progress-xs{height:6px;margin-bottom:6px}td>.progress:first-child:last-child{margin-bottom:0;margin-top:3px}.progress-bar{box-shadow:none}.progress-label-left .progress-bar span,.progress-label-right .progress-bar span,.progress-label-top-right .progress-bar span{color:#363636;position:absolute;text-align:right}.progress-label-left .progress-bar span{font-size:14px;left:-40px;top:0;width:35px}.progress-label-right .progress-bar span,.progress-label-top-right .progress-bar span{font-size:11px;overflow:hidden;right:0;text-overflow:ellipsis;white-space:nowrap}.progress-label-right .progress-bar span strong,.progress-label-top-right .progress-bar span strong{font-weight:600}.progress-label-right .progress-bar span{max-width:85px;top:0}.progress-label-top-right .progress-bar span{max-width:47%;top:-30px}.progress-label-left.progress-sm .progress-bar span,.progress-label-top-right.progress-sm .progress-bar span{font-size:12px}.progress-sm .progress-bar{line-height:14px}.progress-xs .progress-bar{line-height:6px}.progress-bar-remaining{background:0 0}.progress-container{position:relative}.progress-container.progress-description-left{padding-left:90px}.progress-container.progress-label-right{padding-right:90px}.progress-description{margin-bottom:10px;max-width:52%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.progress-description .count{font-size:20px;font-weight:300;line-height:1;margin-right:5px}.progress-description .fa,.progress-description .pficon{font-size:14px;margin-right:3px}.progress-description-left .progress-description{left:0;margin-bottom:0;max-width:85px;position:absolute;top:0}.progress-description .tooltip{white-space:normal}.search-pf.has-button{border-collapse:separate;display:table}.search-pf.has-button .form-group{display:table-cell;width:100%}.search-pf.has-button .form-group .btn{-webkit-box-shadow:none;box-shadow:none;float:left;margin-left:-1px}.search-pf.has-button .form-group .btn.btn-lg{font-size:14.5px}.search-pf.has-button .form-group .btn.btn-sm{font-size:10.7px}.search-pf.has-button .form-group .form-control{float:left}.search-pf .has-clear .clear{background:0 0;background:rgba(255,255,255,0);border:0;height:25px;line-height:1;padding:0;position:absolute;right:1px;top:1px;width:28px}.search-pf .has-clear .clear:focus{outline:0}.search-pf .has-clear .form-control{padding-right:30px}.search-pf .has-clear .form-control::-ms-clear{display:none}.search-pf .has-clear .input-lg+.clear{height:31px;width:28px}.search-pf .has-clear .input-sm+.clear{height:20px;width:28px}.search-pf .has-clear .input-sm+.clear span{font-size:10px}.search-pf .has-clear .search-pf-input-group{position:relative}.sidebar-header{border-bottom:1px solid #ececec;padding-bottom:11px;margin:50px 0 20px}.sidebar-header .actions{margin-top:-2px}.sidebar-pf .sidebar-header+.list-group{border-top:0;margin-top:-10px}.sidebar-pf .sidebar-header+.list-group .list-group-item{background:0 0;border-color:#ececec;padding-left:0}.sidebar-pf .sidebar-header+.list-group .list-group-item-heading{font-size:12px}.sidebar-pf .nav-category h2{color:#9c9c9c;font-size:12px;font-weight:400;line-height:21px;margin:0;padding:8px 0}.sidebar-pf .nav-category+.nav-category{margin-top:10px}.sidebar-pf .nav-pills>li.active>a{background:#0088ce!important;border-color:#0088ce!important;color:#fff}@media (min-width:768px){.sidebar-pf .nav-pills>li.active>a:after{content:"\f105";font-family:FontAwesome;display:block;position:absolute;right:10px;top:1px}}.sidebar-pf .nav-pills>li.active>a .fa{color:#fff}.sidebar-pf .nav-pills>li>a{border-bottom:1px solid transparent;border-radius:0;border-top:1px solid transparent;color:#363636;font-size:13px;line-height:21px;padding:1px 20px}.sidebar-pf .nav-pills>li>a:hover{background:#def3ff;border-color:#bee1f4}.sidebar-pf .nav-pills>li>a .fa{color:#6a7079;font-size:15px;margin-right:10px;text-align:center;vertical-align:middle;width:15px}.sidebar-pf .nav-stacked{margin-left:-20px;margin-right:-20px}.sidebar-pf .nav-stacked li+li{margin-top:0}.sidebar-pf .panel{background:0 0}.sidebar-pf .panel-body{padding:6px 20px}.sidebar-pf .panel-body .nav-pills>li>a{padding-left:37px}.sidebar-pf .panel-heading{padding:9px 20px}.sidebar-pf .panel-title{font-size:12px}.sidebar-pf .panel-title>a:before{display:inline-block;margin-left:1px;margin-right:4px;width:9px}.sidebar-pf .panel-title>a.collapsed:before{margin-left:3px;margin-right:2px}@media (min-width:767px){.sidebar-header-bleed-left{margin-left:-20px}.sidebar-header-bleed-left>h2{margin-left:20px}.sidebar-header-bleed-right{margin-right:-20px}.sidebar-header-bleed-right .actions{margin-right:20px}.sidebar-header-bleed-right>h2{margin-right:20px}.sidebar-header-bleed-right+.list-group{margin-right:-20px}.sidebar-pf .panel-group .panel-default,.sidebar-pf .treeview{border-left:0;border-right:0;margin-left:-20px;margin-right:-20px}.sidebar-pf .treeview{margin-top:5px}.sidebar-pf .treeview .list-group-item{padding-left:20px;padding-right:20px}.sidebar-pf .treeview .list-group-item.node-selected:after{content:"\f105";font-family:FontAwesome;display:block;position:absolute;right:10px;top:1px}}@media (min-width:768px){.sidebar-pf{background:#fafafa}.sidebar-pf.sidebar-pf-left{border-right:1px solid #d1d1d1}.sidebar-pf.sidebar-pf-right{border-left:1px solid #d1d1d1}.sidebar-pf>.nav-category,.sidebar-pf>.nav-stacked{margin-top:5px}}@-webkit-keyframes rotation{from{-webkit-transform:rotate(0)}to{-webkit-transform:rotate(359deg)}}@keyframes rotation{from{transform:rotate(0)}to{transform:rotate(359deg)}}.spinner{-webkit-animation:rotation .6s infinite linear;animation:rotation .6s infinite linear;border-bottom:4px solid rgba(3,3,3,.25);border-left:4px solid rgba(3,3,3,.25);border-right:4px solid rgba(3,3,3,.25);border-radius:100%;border-top:4px solid rgba(3,3,3,.75);height:24px;margin:0 auto;position:relative;width:24px}.spinner.spinner-inline{display:inline-block;margin-right:3px}.spinner.spinner-lg{border-width:5px;height:30px;width:30px}.spinner.spinner-sm{border-width:3px;height:18px;width:18px}.spinner.spinner-xs{border-width:2px;height:12px;width:12px}.spinner.spinner-inverse{border-bottom-color:rgba(255,255,255,.25);border-left-color:rgba(255,255,255,.25);border-right-color:rgba(255,255,255,.25);border-top-color:rgba(255,255,255,.75)}.ie9 .spinner{background:url(../img/spinner.gif) no-repeat;border:0}.ie9 .spinner.spinner-inverse{background-image:url(../img/spinner-inverse.gif)}.ie9 .spinner.spinner-inverse-lg{background-image:url(../img/spinner-inverse-lg.gif)}.ie9 .spinner.spinner-inverse-sm{background-image:url(../img/spinner-inverse-sm.gif)}.ie9 .spinner.spinner-inverse-xs{background-image:url(../img/spinner-inverse-xs.gif)}.ie9 .spinner.spinner-lg{background-image:url(../img/spinner-lg.gif)}.ie9 .spinner.spinner-sm{background-image:url(../img/spinner-sm.gif)}.ie9 .spinner.spinner-xs{background-image:url(../img/spinner-xs.gif)}.prettyprint .atn,.prettyprint .com,.prettyprint .fun,.prettyprint .var{color:#3f9c35}.prettyprint .atv,.prettyprint .str{color:#a30000}.prettyprint .clo,.prettyprint .dec,.prettyprint .kwd,.prettyprint .opn,.prettyprint .pln,.prettyprint .pun{color:#363636}.prettyprint .lit,.prettyprint .tag,.prettyprint .typ{color:#00659c}.prettyprint ol.linenums{margin-bottom:0}.table>tbody>tr>td,.table>tbody>tr>th,.table>tfoot>tr>td,.table>tfoot>tr>th,.table>thead>tr>td,.table>thead>tr>th{padding:2px 10px 3px}.table>tbody>tr>td>a:hover,.table>tbody>tr>th>a:hover,.table>tfoot>tr>td>a:hover,.table>tfoot>tr>th>a:hover,.table>thead>tr>td>a:hover,.table>thead>tr>th>a:hover{text-decoration:none}.table>tbody>tr>th,.table>tfoot>tr>th,.table>thead>tr>th{font-family:'Open Sans';font-style:normal;font-weight:600}.table>thead{background-clip:padding-box;background-color:#f5f5f5;background-image:-webkit-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:-o-linear-gradient(top,#fafafa 0,#ededed 100%);background-image:linear-gradient(to bottom,#fafafa 0,#ededed 100%);background-repeat:repeat-x;filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#fffafafa', endColorstr='#ffededed', GradientType=0)}.table-bordered{border:1px solid #d1d1d1}.table-bordered>tbody>tr>td,.table-bordered>tbody>tr>th,.table-bordered>tfoot>tr>td,.table-bordered>tfoot>tr>th,.table-bordered>thead>tr>td,.table-bordered>thead>tr>th{border:1px solid #d1d1d1}.table-bordered>thead>tr>td,.table-bordered>thead>tr>th{border-bottom-width:1px}.table-striped>tbody>tr:nth-of-type(even){background-color:#f5f5f5}.table-striped>tbody>tr:nth-of-type(odd){background-color:transparent}.table-hover>tbody>tr:hover>td,.table-hover>tbody>tr:hover>th{background-color:#def3ff;border-bottom-color:#7dc3e8}.table-treegrid span.indent{margin-left:10px;margin-right:10px}.table-treegrid span.icon{display:inline-block;font-size:13px;margin-right:5px;min-width:10px;text-align:center}.table-treegrid span.collapse-icon,.table-treegrid span.expand-icon{cursor:pointer}.table-treegrid>tbody>tr.odd{background-color:#f5f5f5}.nav-tabs{font-size:14px}.nav-tabs>li>a{color:#4d5258;margin-right:-1px;padding-bottom:5px;padding-top:5px}.nav-tabs>li>a:active,.nav-tabs>li>a:focus,.nav-tabs>li>a:hover{background:0 0;border-color:#ededed;color:#252525}.nav-tabs>li>.dropdown-menu{border-top:0;border-color:#ededed}.nav-tabs>li>.dropdown-menu.pull-right{right:-1px}.nav-tabs+.nav-tabs-pf{font-size:12px}.nav-tabs+.nav-tabs-pf>li:first-child>a{padding-left:15px}.nav-tabs+.nav-tabs-pf>li:first-child>a:before{left:15px!important}.nav-tabs .open>a,.nav-tabs .open>a:focus,.nav-tabs .open>a:hover{background-color:transparent;border-color:#ededed}@media (min-width:768px){.nav-tabs-pf.nav-justified{border-bottom:1px solid #ededed}}.nav-tabs-pf.nav-justified>li:first-child>a{padding-left:15px}.nav-tabs-pf.nav-justified>li>a{border-bottom:0}.nav-tabs-pf.nav-justified>li>a:before{left:0!important;right:0!important}.nav-tabs-pf>li{margin-bottom:0}.nav-tabs-pf>li.active>a:before{background:#0088ce;bottom:-1px;content:'';display:block;height:2px;left:15px;position:absolute;right:15px}.nav-tabs-pf>li.active>a,.nav-tabs-pf>li.active>a:active,.nav-tabs-pf>li.active>a:focus,.nav-tabs-pf>li.active>a:hover{background-color:transparent;border:0!important;color:#0088ce}.nav-tabs-pf>li.active>a:active:before,.nav-tabs-pf>li.active>a:before,.nav-tabs-pf>li.active>a:focus:before,.nav-tabs-pf>li.active>a:hover:before{background:#0088ce}.nav-tabs-pf>li:first-child>a{padding-left:0}.nav-tabs-pf>li:first-child>a:before{left:0!important}.nav-tabs-pf>li>a{border:0;line-height:1;margin-right:0;padding-bottom:10px;padding-top:10px}.nav-tabs-pf>li>a:active:before,.nav-tabs-pf>li>a:focus:before,.nav-tabs-pf>li>a:hover:before{background:#bbb;bottom:-1px;content:'';display:block;height:2px;left:15px;position:absolute;right:15px}.nav-tabs-pf>li>.dropdown-menu{left:15px;margin-top:1px}.nav-tabs-pf>li>.dropdown-menu.pull-right{left:auto;right:15px}.nav-tabs-pf .open>a,.nav-tabs-pf .open>a:focus,.nav-tabs-pf .open>a:hover{background-color:transparent}.tooltip{font-size:12px;line-height:1.4}.tooltip-inner{padding:7px 12px;text-align:left}.h1,.h2,h1,h2{font-weight:300}.page-header .actions{margin-top:8px}.page-header .actions a>.pficon{margin-right:4px}@media (min-width:767px){.page-header-bleed-left{margin-left:-20px}.page-header-bleed-right{margin-right:-20px}.page-header-bleed-right .actions{margin-right:20px}}
\ No newline at end of file
--
-2.21.1
+2.28.0
+
-From 751cb8d5cb432bcb9d5c7ada7c365a12ca6a95ee Mon Sep 17 00:00:00 2001
+From c69eb7c719c91d5e7f2be2d4d5e471d3111cf2e3 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 39/78] install/ui/index.html: Change branding to IPA and
+Subject: [PATCH 39/93] install/ui/index.html: Change branding to IPA and
Identity Management
---
@@ -1082,7 +1120,7 @@ Subject: [PATCH 39/78] install/ui/index.html: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/index.html b/install/ui/index.html
-index bc0f0cd1e..d1eacaf53 100644
+index bc0f0cd..d1eacaf 100644
--- a/install/ui/index.html
+++ b/install/ui/index.html
@@ -2,7 +2,7 @@
@@ -1095,12 +1133,13 @@ index bc0f0cd1e..d1eacaf53 100644
<!--[if IE]>
<meta id="ie-detector">
--
-2.21.1
+2.28.0
-From 8a4169a5d81b3c2376081d61a3beaf6601e318cf Mon Sep 17 00:00:00 2001
+
+From a773fe485555a73d594116fc9f1acc7d28728a0c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 40/78] install/ui/less/brand.less: Change branding to IPA and
+Subject: [PATCH 40/93] install/ui/less/brand.less: Change branding to IPA and
Identity Management
---
@@ -1108,7 +1147,7 @@ Subject: [PATCH 40/78] install/ui/less/brand.less: Change branding to IPA and
1 file changed, 50 insertions(+), 53 deletions(-)
diff --git a/install/ui/less/brand.less b/install/ui/less/brand.less
-index c9030bb0b..7488eaf91 100644
+index c9030bb..7488eaf 100644
--- a/install/ui/less/brand.less
+++ b/install/ui/less/brand.less
@@ -20,58 +20,55 @@
@@ -1222,12 +1261,13 @@ index c9030bb0b..7488eaf91 100644
}
\ No newline at end of file
--
-2.21.1
+2.28.0
+
-From 2946405ea45ea7163c520c367f764808f112d7f2 Mon Sep 17 00:00:00 2001
+From b0f0bac0f7cb307de0dcb3b3b70319a67c0cf16a Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 41/78] install/ui/less/patternfly.less: Change branding to IPA
+Subject: [PATCH 41/93] install/ui/less/patternfly.less: Change branding to IPA
and Identity Management
---
@@ -1235,7 +1275,7 @@ Subject: [PATCH 41/78] install/ui/less/patternfly.less: Change branding to IPA
1 file changed, 48 insertions(+)
diff --git a/install/ui/less/patternfly.less b/install/ui/less/patternfly.less
-index a2e30c85b..97a8d5c26 100644
+index a2e30c8..97a8d5c 100644
--- a/install/ui/less/patternfly.less
+++ b/install/ui/less/patternfly.less
@@ -129,3 +129,51 @@
@@ -1291,12 +1331,13 @@ index a2e30c85b..97a8d5c26 100644
+@navbar-pf-navbar-utility-open-bg-color: #5b6165;
+@navbar-pf-navbar-utility-open-border-color: #6c6e70;
--
-2.21.1
+2.28.0
-From beb52f0f27401d439755107be31e74210343e784 Mon Sep 17 00:00:00 2001
+
+From 8373bb029e9f01647643174ec6cd35cf29a4140b Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 42/78] install/ui/reset_password.html: Change branding to IPA
+Subject: [PATCH 42/93] install/ui/reset_password.html: Change branding to IPA
and Identity Management
---
@@ -1304,7 +1345,7 @@ Subject: [PATCH 42/78] install/ui/reset_password.html: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/reset_password.html b/install/ui/reset_password.html
-index e5700c964..a4ea1ce0e 100644
+index e5700c9..a4ea1ce 100644
--- a/install/ui/reset_password.html
+++ b/install/ui/reset_password.html
@@ -2,7 +2,7 @@
@@ -1317,12 +1358,13 @@ index e5700c964..a4ea1ce0e 100644
<!--[if IE]>
<meta id="ie-detector">
--
-2.21.1
+2.28.0
+
-From 288607c7080be4f35a00b853f3de9fdd0752376d Mon Sep 17 00:00:00 2001
+From 7aa607335fa7fd1b95a5b5bb44674f3e1f45ddac Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 43/78] install/ui/src/freeipa/widgets/App.js: Change branding
+Subject: [PATCH 43/93] install/ui/src/freeipa/widgets/App.js: Change branding
to IPA and Identity Management
---
@@ -1330,7 +1372,7 @@ Subject: [PATCH 43/78] install/ui/src/freeipa/widgets/App.js: Change branding
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/src/freeipa/widgets/App.js b/install/ui/src/freeipa/widgets/App.js
-index 3a139555a..b0f75885d 100644
+index 3a13955..b0f7588 100644
--- a/install/ui/src/freeipa/widgets/App.js
+++ b/install/ui/src/freeipa/widgets/App.js
@@ -187,7 +187,7 @@ define(['dojo/_base/declare',
@@ -1343,12 +1385,13 @@ index 3a139555a..b0f75885d 100644
return this.brand_node;
--
-2.21.1
+2.28.0
-From 5573b887c32228f2c404413fd58560da95ef954d Mon Sep 17 00:00:00 2001
+
+From 47e67dd83c26507fe2a40c7dab437379d891b460 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 44/78] install/ui/sync_otp.html: Change branding to IPA and
+Subject: [PATCH 44/93] install/ui/sync_otp.html: Change branding to IPA and
Identity Management
---
@@ -1356,7 +1399,7 @@ Subject: [PATCH 44/78] install/ui/sync_otp.html: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/sync_otp.html b/install/ui/sync_otp.html
-index 5814b6c57..36a51ca62 100644
+index 5814b6c..36a51ca 100644
--- a/install/ui/sync_otp.html
+++ b/install/ui/sync_otp.html
@@ -2,7 +2,7 @@
@@ -1369,12 +1412,13 @@ index 5814b6c57..36a51ca62 100644
<!--[if IE]>
<meta id="ie-detector">
--
-2.21.1
+2.28.0
+
-From 86d40a59a18f9b1439387bf8d5794437be0fb8b9 Mon Sep 17 00:00:00 2001
+From b87532edeebde90e4b293dff3e6ec4d14fe85d08 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 45/78] install/ui/test/data/ipa_init_commands.json: Change
+Subject: [PATCH 45/93] install/ui/test/data/ipa_init_commands.json: Change
branding to IPA and Identity Management
---
@@ -1382,7 +1426,7 @@ Subject: [PATCH 45/78] install/ui/test/data/ipa_init_commands.json: Change
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/install/ui/test/data/ipa_init_commands.json b/install/ui/test/data/ipa_init_commands.json
-index c35946b34..6d3667473 100644
+index 8fa4999..4b51d97 100644
--- a/install/ui/test/data/ipa_init_commands.json
+++ b/install/ui/test/data/ipa_init_commands.json
@@ -8689,7 +8689,7 @@
@@ -1404,12 +1448,13 @@ index c35946b34..6d3667473 100644
"no_update"
],
--
-2.21.1
+2.28.0
-From 7e027d4836251b4f824b5e420e8ef6cfa8bb4505 Mon Sep 17 00:00:00 2001
+
+From 72fea1fb9d0de429cb8f2b1774dfd0df8d0ee685 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 46/78] install/ui/test/data/ipa_init_objects.json: Change
+Subject: [PATCH 46/93] install/ui/test/data/ipa_init_objects.json: Change
branding to IPA and Identity Management
---
@@ -1417,7 +1462,7 @@ Subject: [PATCH 46/78] install/ui/test/data/ipa_init_objects.json: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/install/ui/test/data/ipa_init_objects.json b/install/ui/test/data/ipa_init_objects.json
-index 6f9b13e92..08aaafd61 100644
+index 6f9b13e..08aaafd 100644
--- a/install/ui/test/data/ipa_init_objects.json
+++ b/install/ui/test/data/ipa_init_objects.json
@@ -21190,7 +21190,7 @@
@@ -1430,12 +1475,13 @@ index 6f9b13e92..08aaafd61 100644
"cli_metavar" : "INT",
"default" : 0,
--
-2.21.1
+2.28.0
+
-From 799fc53a7d6503d76452617998da0a936527116c Mon Sep 17 00:00:00 2001
+From 29125fa720c618e7ee73f0613138dd250fca2e5d Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 47/78] ipaclient/install/client.py: Change branding to IPA and
+Subject: [PATCH 47/93] ipaclient/install/client.py: Change branding to IPA and
Identity Management
---
@@ -1443,10 +1489,10 @@ Subject: [PATCH 47/78] ipaclient/install/client.py: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
-index 34b2d1a6e..d3bffb05f 100644
+index 175a56c..e6f364d 100644
--- a/ipaclient/install/client.py
+++ b/ipaclient/install/client.py
-@@ -2033,7 +2033,7 @@ def install_check(options):
+@@ -2069,7 +2069,7 @@ def install_check(options):
global client_domain
global cli_basedn
@@ -1456,12 +1502,13 @@ index 34b2d1a6e..d3bffb05f 100644
print("")
--
-2.21.1
+2.28.0
-From 2c5f5f196ec959eed754b0966fc80daa1d1b6ff7 Mon Sep 17 00:00:00 2001
+
+From 419fba1f044fd8bae44e0345d4a1553e01e69bdd Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:40 +0300
-Subject: [PATCH 48/78] ipaclient/remote_plugins/2_114/otptoken.py: Change
+Subject: [PATCH 48/93] ipaclient/remote_plugins/2_114/otptoken.py: Change
branding to IPA and Identity Management
---
@@ -1469,7 +1516,7 @@ Subject: [PATCH 48/78] ipaclient/remote_plugins/2_114/otptoken.py: Change
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/ipaclient/remote_plugins/2_114/otptoken.py b/ipaclient/remote_plugins/2_114/otptoken.py
-index 632c97ea2..d3edb589d 100644
+index 632c97e..d3edb58 100644
--- a/ipaclient/remote_plugins/2_114/otptoken.py
+++ b/ipaclient/remote_plugins/2_114/otptoken.py
@@ -132,7 +132,7 @@ class otptoken(Object):
@@ -1500,12 +1547,13 @@ index 632c97ea2..d3edb589d 100644
),
parameters.Int(
--
-2.21.1
+2.28.0
+
-From 521d5c9ebee2fe4df8650ebdc53b91d25232d631 Mon Sep 17 00:00:00 2001
+From 9ee6cabb2996ce6ebf34a3d521c854aab8de92a2 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 49/78] ipaclient/remote_plugins/2_156/otptoken.py: Change
+Subject: [PATCH 49/93] ipaclient/remote_plugins/2_156/otptoken.py: Change
branding to IPA and Identity Management
---
@@ -1513,7 +1561,7 @@ Subject: [PATCH 49/78] ipaclient/remote_plugins/2_156/otptoken.py: Change
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/ipaclient/remote_plugins/2_156/otptoken.py b/ipaclient/remote_plugins/2_156/otptoken.py
-index 0b2b54c6e..e674d465d 100644
+index 0b2b54c..e674d46 100644
--- a/ipaclient/remote_plugins/2_156/otptoken.py
+++ b/ipaclient/remote_plugins/2_156/otptoken.py
@@ -132,7 +132,7 @@ class otptoken(Object):
@@ -1544,12 +1592,13 @@ index 0b2b54c6e..e674d465d 100644
),
parameters.Int(
--
-2.21.1
+2.28.0
-From 0a29cb7c05dfc8a75afdbdadcb9c7a67e9e90b50 Mon Sep 17 00:00:00 2001
+
+From 61cfaa8ab75ed6075076b8da960382fc4e76a35d Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 50/78] ipaclient/remote_plugins/2_164/otptoken.py: Change
+Subject: [PATCH 50/93] ipaclient/remote_plugins/2_164/otptoken.py: Change
branding to IPA and Identity Management
---
@@ -1557,7 +1606,7 @@ Subject: [PATCH 50/78] ipaclient/remote_plugins/2_164/otptoken.py: Change
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/ipaclient/remote_plugins/2_164/otptoken.py b/ipaclient/remote_plugins/2_164/otptoken.py
-index 0b2b54c6e..e674d465d 100644
+index 0b2b54c..e674d46 100644
--- a/ipaclient/remote_plugins/2_164/otptoken.py
+++ b/ipaclient/remote_plugins/2_164/otptoken.py
@@ -132,7 +132,7 @@ class otptoken(Object):
@@ -1588,12 +1637,13 @@ index 0b2b54c6e..e674d465d 100644
),
parameters.Int(
--
-2.21.1
+2.28.0
+
-From fec6eff7f15ff4ae4bf28d816ca4b231f77b15ca Mon Sep 17 00:00:00 2001
+From 82b07fb868dce69b7f1531b9b518f168531113fc Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 51/78] ipalib/pkcs10.py: Change branding to IPA and Identity
+Subject: [PATCH 51/93] ipalib/pkcs10.py: Change branding to IPA and Identity
Management
---
@@ -1601,7 +1651,7 @@ Subject: [PATCH 51/78] ipalib/pkcs10.py: Change branding to IPA and Identity
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipalib/pkcs10.py b/ipalib/pkcs10.py
-index 2756c8568..590ce0757 100644
+index 2756c85..590ce07 100644
--- a/ipalib/pkcs10.py
+++ b/ipalib/pkcs10.py
@@ -2,7 +2,7 @@ from __future__ import print_function
@@ -1614,12 +1664,13 @@ index 2756c8568..590ce0757 100644
file=sys.stderr
)
--
-2.21.1
+2.28.0
-From e364a5187b1a49ea81653f5282825485a58827df Mon Sep 17 00:00:00 2001
+
+From df262a92dc2ea0db0bd4902a196f0867c682fd45 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 52/78] ipalib/rpc.py: Change branding to IPA and Identity
+Subject: [PATCH 52/93] ipalib/rpc.py: Change branding to IPA and Identity
Management
---
@@ -1627,10 +1678,10 @@ Subject: [PATCH 52/78] ipalib/rpc.py: Change branding to IPA and Identity
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipalib/rpc.py b/ipalib/rpc.py
-index 1ef0f5e95..f1be90522 100644
+index 01746cb..c3d0513 100644
--- a/ipalib/rpc.py
+++ b/ipalib/rpc.py
-@@ -284,7 +284,7 @@ class _JSONPrimer(dict):
+@@ -282,7 +282,7 @@ class _JSONPrimer(dict):
Prepare a data structure for JSON serialization. In an ideal world, priming
could be handled by the default hook of json.dumps(). Unfortunately the
@@ -1640,12 +1691,13 @@ index 1ef0f5e95..f1be90522 100644
The primer uses a couple of tricks to archive maximum performance:
--
-2.21.1
+2.28.0
+
-From e1367d8a71cd5d1aa0f57793238577fa69324594 Mon Sep 17 00:00:00 2001
+From 969752d92a1f20cf6fb777c43193edf94c8d9833 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 53/78] ipalib/util.py: Change branding to IPA and Identity
+Subject: [PATCH 53/93] ipalib/util.py: Change branding to IPA and Identity
Management
---
@@ -1653,10 +1705,10 @@ Subject: [PATCH 53/78] ipalib/util.py: Change branding to IPA and Identity
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipalib/util.py b/ipalib/util.py
-index e0c658c51..3378db043 100644
+index e3a510f..f63ae1b 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
-@@ -236,7 +236,7 @@ def normalize_zone(zone):
+@@ -242,7 +242,7 @@ def normalize_zone(zone):
def get_proper_tls_version_span(tls_version_min, tls_version_max):
"""
This function checks whether the given TLS versions are known in
@@ -1666,12 +1718,13 @@ index e0c658c51..3378db043 100644
`ipalib.constants: TLS_VERSIONS, TLS_VERSION_MINIMAL`).
--
-2.21.1
+2.28.0
-From e980e233c6c48fe2ebc8d10f5bd18db5dea6ff94 Mon Sep 17 00:00:00 2001
+
+From c72847fcf0feef3a2404c82934e1c67a3d8f3e72 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 54/78] ipalib/x509.py: Change branding to IPA and Identity
+Subject: [PATCH 54/93] ipalib/x509.py: Change branding to IPA and Identity
Management
---
@@ -1679,10 +1732,10 @@ Subject: [PATCH 54/78] ipalib/x509.py: Change branding to IPA and Identity
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipalib/x509.py b/ipalib/x509.py
-index 1f612a379..dfe66e1b4 100644
+index 0ee710f..402e0e9 100644
--- a/ipalib/x509.py
+++ b/ipalib/x509.py
-@@ -88,7 +88,7 @@ SAN_KRB5PRINCIPALNAME = '1.3.6.1.5.2.2'
+@@ -92,7 +92,7 @@ SAN_KRB5PRINCIPALNAME = '1.3.6.1.5.2.2'
class IPACertificate:
"""
A proxy class wrapping a python-cryptography certificate representation for
@@ -1692,12 +1745,13 @@ index 1f612a379..dfe66e1b4 100644
def __init__(self, cert, backend=None):
"""
--
-2.21.1
+2.28.0
+
-From 38ca6711b3cb6c24c9ae16e172339a680613f2af Mon Sep 17 00:00:00 2001
+From d74025cc8306ea5ab1a75105109b82d4eb31d723 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 55/78] ipaserver/advise/plugins/legacy_clients.py: Change
+Subject: [PATCH 55/93] ipaserver/advise/plugins/legacy_clients.py: Change
branding to IPA and Identity Management
---
@@ -1705,7 +1759,7 @@ Subject: [PATCH 55/78] ipaserver/advise/plugins/legacy_clients.py: Change
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/ipaserver/advise/plugins/legacy_clients.py b/ipaserver/advise/plugins/legacy_clients.py
-index 2a56922b8..0e322fe96 100644
+index 2a56922..0e322fe 100644
--- a/ipaserver/advise/plugins/legacy_clients.py
+++ b/ipaserver/advise/plugins/legacy_clients.py
@@ -94,7 +94,7 @@ class config_redhat_sssd_before_1_9(config_base_legacy_client):
@@ -1745,12 +1799,13 @@ index 2a56922b8..0e322fe96 100644
'are all Red Hat based platforms.')
--
-2.21.1
+2.28.0
-From f6fa8b8edd7a4123cf3f409c169e4eee12a3ed3c Mon Sep 17 00:00:00 2001
+
+From ddd2cde38edb70271ba593e3b05c77c3c62c075c Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 56/78] ipaserver/advise/plugins/smart_card_auth.py: Change
+Subject: [PATCH 56/93] ipaserver/advise/plugins/smart_card_auth.py: Change
branding to IPA and Identity Management
---
@@ -1758,7 +1813,7 @@ Subject: [PATCH 56/78] ipaserver/advise/plugins/smart_card_auth.py: Change
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/ipaserver/advise/plugins/smart_card_auth.py b/ipaserver/advise/plugins/smart_card_auth.py
-index c43c74e5b..ce50cec83 100644
+index 0709ec4..a067f36 100644
--- a/ipaserver/advise/plugins/smart_card_auth.py
+++ b/ipaserver/advise/plugins/smart_card_auth.py
@@ -97,7 +97,7 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):
@@ -1785,12 +1840,13 @@ index c43c74e5b..ce50cec83 100644
"allow smart card logins to desktop")
--
-2.21.1
+2.28.0
+
-From 4b528a73ed9d914997f8e7ed44076211e6fef239 Mon Sep 17 00:00:00 2001
+From ee5e37f145d55536232681eb3cce6e4a17bffcb3 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 57/78] ipaserver/install/dns.py: Change branding to IPA and
+Subject: [PATCH 57/93] ipaserver/install/dns.py: Change branding to IPA and
Identity Management
---
@@ -1798,10 +1854,10 @@ Subject: [PATCH 57/78] ipaserver/install/dns.py: Change branding to IPA and
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/install/dns.py b/ipaserver/install/dns.py
-index 9f08e86f9..7d6d7fe7c 100644
+index 9cd8978..b51b92b 100644
--- a/ipaserver/install/dns.py
+++ b/ipaserver/install/dns.py
-@@ -151,7 +151,7 @@ def install_check(standalone, api, replica, options, hostname):
+@@ -154,7 +154,7 @@ def install_check(standalone, api, replica, options, hostname):
if standalone:
print("==============================================================================")
@@ -1811,12 +1867,13 @@ index 9f08e86f9..7d6d7fe7c 100644
print("This includes:")
print(" * Configure DNS (bind)")
--
-2.21.1
+2.28.0
-From b4bf196e8f7eb5193d5be111820b9b9d13b7c25c Mon Sep 17 00:00:00 2001
+
+From bab43eae498b96e574aea685a5790608aca8cd96 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 58/78] ipaserver/install/ipa_kra_install.py: Change branding
+Subject: [PATCH 58/93] ipaserver/install/ipa_kra_install.py: Change branding
to IPA and Identity Management
---
@@ -1824,7 +1881,7 @@ Subject: [PATCH 58/78] ipaserver/install/ipa_kra_install.py: Change branding
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ipaserver/install/ipa_kra_install.py b/ipaserver/install/ipa_kra_install.py
-index 2d6e4bf09..076c20666 100644
+index 159f02e..04ac94b 100644
--- a/ipaserver/install/ipa_kra_install.py
+++ b/ipaserver/install/ipa_kra_install.py
@@ -93,7 +93,7 @@ class KRAInstall(admintool.AdminTool):
@@ -1846,12 +1903,13 @@ index 2d6e4bf09..076c20666 100644
'''
--
-2.21.1
+2.28.0
+
-From 2831a3d84888547b38803681019f9f5bdfb34b2e Mon Sep 17 00:00:00 2001
+From ac3620bc3050bad623be7f47de35b76485f3236b Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 59/78] ipaserver/install/plugins/dns.py: Change branding to
+Subject: [PATCH 59/93] ipaserver/install/plugins/dns.py: Change branding to
IPA and Identity Management
---
@@ -1859,7 +1917,7 @@ Subject: [PATCH 59/78] ipaserver/install/plugins/dns.py: Change branding to
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/ipaserver/install/plugins/dns.py b/ipaserver/install/plugins/dns.py
-index baa19c38e..a7a1748d9 100644
+index ad875b4..9d6ca47 100644
--- a/ipaserver/install/plugins/dns.py
+++ b/ipaserver/install/plugins/dns.py
@@ -161,11 +161,11 @@ class update_ipaconfigstring_dnsversion_to_ipadnsversion(Updater):
@@ -1904,12 +1962,13 @@ index baa19c38e..a7a1748d9 100644
"""
backup_filename = u'dns-forwarding-empty-zones-%Y-%m-%d-%H-%M-%S.ldif'
--
-2.21.1
+2.28.0
-From 76ae883950cbe20c50f456ddc7d24d209d78232e Mon Sep 17 00:00:00 2001
+
+From 2fdf8d86d71afff004b14998649ef45c460fa6e8 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 60/78] ipaserver/install/replication.py: Change branding to
+Subject: [PATCH 60/93] ipaserver/install/replication.py: Change branding to
IPA and Identity Management
---
@@ -1917,10 +1976,10 @@ Subject: [PATCH 60/78] ipaserver/install/replication.py: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
-index 1fefe3ebf..87794b7f4 100644
+index e8407f3..95bb810 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
-@@ -1760,7 +1760,7 @@ class ReplicationManager:
+@@ -1799,7 +1799,7 @@ class ReplicationManager:
Ensure that the 'cn=replication managers,cn=sysaccounts' group exists
and contains the principals for master and remote replica
@@ -1930,12 +1989,13 @@ index 1fefe3ebf..87794b7f4 100644
"""
my_dn = DN(
--
-2.21.1
+2.28.0
+
-From 4324a4f3653d3322ef75406b0b9b2cd68fb17995 Mon Sep 17 00:00:00 2001
+From 6225f0e67f618460d4327950effdeb2a15f4ba96 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 61/78] ipaserver/install/server/install.py: Change branding to
+Subject: [PATCH 61/93] ipaserver/install/server/install.py: Change branding to
IPA and Identity Management
---
@@ -1943,10 +2003,10 @@ Subject: [PATCH 61/78] ipaserver/install/server/install.py: Change branding to
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
-index afce0d73a..b62c08baa 100644
+index c0d33f3..103cfcc 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
-@@ -414,7 +414,7 @@ def install_check(installer):
+@@ -427,7 +427,7 @@ def install_check(installer):
print("======================================="
"=======================================")
@@ -1956,12 +2016,13 @@ index afce0d73a..b62c08baa 100644
print("")
print("This includes:")
--
-2.21.1
+2.28.0
-From 55b2630e53494d831fb65a0c520aabe1c895b13d Mon Sep 17 00:00:00 2001
+
+From 53f918cd0bc8c7633007986f61a091ee267db634 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 62/78] ipaserver/install/server/replicainstall.py: Change
+Subject: [PATCH 62/93] ipaserver/install/server/replicainstall.py: Change
branding to IPA and Identity Management
---
@@ -1969,10 +2030,10 @@ Subject: [PATCH 62/78] ipaserver/install/server/replicainstall.py: Change
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
-index 71ea091a3..0ea48f18e 100644
+index f75f5fd..73967a2 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
-@@ -619,7 +619,7 @@ def check_domain_level_is_supported(current):
+@@ -623,7 +623,7 @@ def check_domain_level_is_supported(current):
above_upper_bound = current > constants.MAX_DOMAIN_LEVEL
if under_lower_bound or above_upper_bound:
@@ -1982,12 +2043,13 @@ index 71ea091a3..0ea48f18e 100644
"this domain. The Domain Level needs to be "
"raised before installing a replica with "
--
-2.21.1
+2.28.0
+
-From 649e159570278e417922a68e23c2fc44ef6eeb44 Mon Sep 17 00:00:00 2001
+From f6f4a5cc0f0e4d5ba28aa7ed849fb4ced31e74f3 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 63/78] ipaserver/plugins/certmap.py: Change branding to IPA
+Subject: [PATCH 63/93] ipaserver/plugins/certmap.py: Change branding to IPA
and Identity Management
---
@@ -1995,7 +2057,7 @@ Subject: [PATCH 63/78] ipaserver/plugins/certmap.py: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/plugins/certmap.py b/ipaserver/plugins/certmap.py
-index ee8f0c15f..cdbc38f70 100644
+index ee8f0c1..cdbc38f 100644
--- a/ipaserver/plugins/certmap.py
+++ b/ipaserver/plugins/certmap.py
@@ -614,7 +614,7 @@ class certmap_match(Search):
@@ -2008,12 +2070,13 @@ index ee8f0c15f..cdbc38f70 100644
"""
sssd = _sssd()
--
-2.21.1
+2.28.0
-From 926ce56e094b8b54c10d867d9c1150d73af088f5 Mon Sep 17 00:00:00 2001
+
+From bca6ca20a626caf6425381ce6f90c762fdbad32f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 64/78] ipaserver/plugins/otptoken.py: Change branding to IPA
+Subject: [PATCH 64/93] ipaserver/plugins/otptoken.py: Change branding to IPA
and Identity Management
---
@@ -2021,7 +2084,7 @@ Subject: [PATCH 64/78] ipaserver/plugins/otptoken.py: Change branding to IPA
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ipaserver/plugins/otptoken.py b/ipaserver/plugins/otptoken.py
-index 72ed5393d..46e4d5e8d 100644
+index 72ed539..46e4d5e 100644
--- a/ipaserver/plugins/otptoken.py
+++ b/ipaserver/plugins/otptoken.py
@@ -245,7 +245,7 @@ class otptoken(LDAPObject):
@@ -2034,12 +2097,13 @@ index 72ed5393d..46e4d5e8d 100644
autofill=True,
flags=('no_update'),
--
-2.21.1
+2.28.0
+
-From aaa3824fd7e96be447529183033aa37cad016264 Mon Sep 17 00:00:00 2001
+From f17dbc16c6c0a40775c412af960d89982c6dd786 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 65/78] ipaserver/plugins/sudorule.py: Change branding to IPA
+Subject: [PATCH 65/93] ipaserver/plugins/sudorule.py: Change branding to IPA
and Identity Management
---
@@ -2047,7 +2111,7 @@ Subject: [PATCH 65/78] ipaserver/plugins/sudorule.py: Change branding to IPA
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ipaserver/plugins/sudorule.py b/ipaserver/plugins/sudorule.py
-index 643215985..68baa0174 100644
+index 6432159..68baa01 100644
--- a/ipaserver/plugins/sudorule.py
+++ b/ipaserver/plugins/sudorule.py
@@ -47,7 +47,7 @@ give certain users (or groups of users) the ability to run some (or all)
@@ -2069,165 +2133,906 @@ index 643215985..68baa0174 100644
""") + _("""
To enable the binddn run the following command to set the password:
--
-2.21.1
+2.28.0
-From 4285adc257bfdf7eb836c4bfdb61a8e34aa0e87d Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 66/78] po/de.po: Change branding to IPA and Identity
- Management
+
+From 412f3c83d2d634a3803eb4dd64d6476690065e43 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:27:35 +0200
+Subject: [PATCH 66/93] client/man/ipa-client-samba.1: Change branding to IPA
+ and Identity Management
---
- po/de.po | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ client/man/ipa-client-samba.1 | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/po/de.po b/po/de.po
-index 8f9c2209b..95626fc68 100644
---- a/po/de.po
-+++ b/po/de.po
-@@ -3668,7 +3668,7 @@ msgstr "TOTP Sychnronisierungsfenster"
- msgid "TOTP authentication Window"
- msgstr "TOTP Authentifizierungsfenster"
+diff --git a/client/man/ipa-client-samba.1 b/client/man/ipa-client-samba.1
+index ea83715..5ed6c71 100644
+--- a/client/man/ipa-client-samba.1
++++ b/client/man/ipa-client-samba.1
+@@ -1,7 +1,7 @@
+ .\" A man page for ipa-client-samba
+ .\" Copyright (C) 2008-2016 FreeIPA Contributors see COPYING for license
+ .\"
+-.TH "ipa-client-samba" "1" "Jun 10 2019" "FreeIPA" "FreeIPA Manual Pages"
++.TH "ipa-client-samba" "1" "Jun 10 2019" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+ ipa\-client\-samba \- Configure Samba file server on an IPA client
+ .SH "SYNOPSIS"
+@@ -39,7 +39,7 @@ The ipa\-client\-samba script assumes that the machine has alreaby been enrolled
+ .SS "IPA Master Requirements"
+ At least one IPA master must hold a \fBTrust Controller\fR role. This can be achieved by running ipa\-adtrust\-install on the IPA master. The utility will configure IPA master to be a domain controller for IPA domain.
--msgid "TOTP token / FreeIPA server time difference"
-+msgid "TOTP token / IPA server time difference"
- msgstr "Differenz zwischen Token und Serverzeit"
+-IPA master holding a \fBTrust Controller\fR role has also to have support for a special service command to create SMB service, \fBipa service-add-smb\fR. This command is available with FreeIPA 4.8.0 or later release.
++IPA master holding a \fBTrust Controller\fR role has also to have support for a special service command to create SMB service, \fBipa service-add-smb\fR. This command is available with IPA 4.8.0 or later release.
- msgid "Target"
+ .SH "OPTIONS"
+ .SS "BASIC OPTIONS"
--
-2.21.1
+2.28.0
-From 68b461d299352e515457ff2ef8a40d82afc35bc0 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 67/78] po/es.po: Change branding to IPA and Identity
- Management
+
+From 74bd1541d58e30319c99ac42a78f78b4e65a8117 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:28:22 +0200
+Subject: [PATCH 67/93] contrib/lite-server.py: Change branding to IPA and
+ Identity Management
---
- po/es.po | 20 ++++++++++----------
- 1 file changed, 10 insertions(+), 10 deletions(-)
+ contrib/lite-server.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/po/es.po b/po/es.po
-index b9e9fc126..6970d31f5 100644
---- a/po/es.po
-+++ b/po/es.po
-@@ -3101,7 +3101,7 @@ msgid ""
- "The profile configuration format is the raw property-list format\n"
- "used by Dogtag Certificate System. The XML format is not supported.\n"
- "\n"
--"The following restrictions apply to profiles managed by FreeIPA:\n"
-+"The following restrictions apply to profiles managed by IPA:\n"
- "\n"
- "- When importing a profile the \"profileId\" field, if present, must\n"
- " match the ID given on the command line.\n"
-@@ -3159,7 +3159,7 @@ msgstr ""
- "propiedad\n"
- "usado por Dogtag Certificate System. No está soportado el formato XML.\n"
- "\n"
--"A los perfiles manejados por FreeIPA se les aplican las siguientes "
-+"A los perfiles manejados por IPA se les aplican las siguientes "
- "restricciones:\n"
- "\n"
- "- Cuando se importa un perfil el campo \"profileId\", si está presente, debe "
-@@ -4948,7 +4948,7 @@ msgid ""
- "commands as root or another user while providing an audit trail of the\n"
- "commands and their arguments.\n"
- "\n"
--"FreeIPA provides a means to configure the various aspects of Sudo:\n"
-+"IPA provides a means to configure the various aspects of Sudo:\n"
- " Users: The user(s)/group(s) allowed to invoke Sudo.\n"
- " Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
- "Sudo.\n"
-@@ -4963,7 +4963,7 @@ msgid ""
- "are evaluated (if the client supports it). This order is an integer and\n"
- "must be unique.\n"
- "\n"
--"FreeIPA provides a designated binddn to use with Sudo located at:\n"
-+"IPA provides a designated binddn to use with Sudo located at:\n"
- "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
- "\n"
- "To enable the binddn run the following command to set the password:\n"
-@@ -4971,7 +4971,7 @@ msgid ""
- "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
- "dc=com\n"
- "\n"
--"For more information, see the FreeIPA Documentation to Sudo.\n"
-+"For more information, see the IPA Documentation to Sudo.\n"
- msgstr ""
- "\n"
- "Reglas Sudo\n"
-@@ -4984,7 +4984,7 @@ msgstr ""
- "auditoria de\n"
- " los comandos y sus argumentos.\n"
- "\n"
--"FreeIPA proporciona un medio para configurar diversos aspectos de Sudo:\n"
-+"IPA proporciona un medio para configurar diversos aspectos de Sudo:\n"
- " Users: Los usuario(s)/grupos(s) que tienen permitido llamar a Sudo.\n"
- " Hosts: Loshost(s)/grupo(s) de host a los que el usuario permite llamar a "
- "Sudo.\n"
-@@ -5002,7 +5002,7 @@ msgstr ""
- "será evaluada\n"
- "(si el cliente lo soporta). Este orden es un entero y debe ser único.\n"
- "\n"
--"FreeIPA suministra un binddn designado para usar con Sudo situado en :\n"
-+"IPA suministra un binddn designado para usar con Sudo situado en :\n"
- "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
- "\n"
- "Para habilitar el binddn ejecute el siguiente comando para fijar la "
-@@ -5011,7 +5011,7 @@ msgstr ""
- "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
- "dc=com\n"
- "\n"
--"Para más información, vea la Documentación FreeIPA para Sudo.\n"
-+"Para más información, vea la Documentación IPA para Sudo.\n"
-
- msgid ""
- "\n"
-@@ -12742,8 +12742,8 @@ msgstr "Variación del tiempo de autenticación TOTP (segundos)"
- msgid "TOTP synchronization time variance (seconds)"
- msgstr "Variación del tiempo de sincronización TOTP (segundos)"
+diff --git a/contrib/lite-server.py b/contrib/lite-server.py
+index 51f7c08..badbfdb 100755
+--- a/contrib/lite-server.py
++++ b/contrib/lite-server.py
+@@ -140,7 +140,7 @@ class StaticFilesMiddleware(SharedDataMiddleware):
--msgid "TOTP token / FreeIPA server time difference"
--msgstr "Ficha TOTP / Diferencia de hora del servidor FreeIPA"
-+msgid "TOTP token / IPA server time difference"
-+msgstr "Ficha TOTP / Diferencia de hora del servidor IPA"
- msgid "Take a revoked certificate off hold."
- msgstr "Tomar un certificado revocado de espera."
+ def init_api(ccname):
+- """Initialize FreeIPA API from command line
++ """Initialize IPA API from command line
+ """
+ from ipalib import __file__ as ipalib_file
+ from ipalib import api
--
-2.21.1
+2.28.0
-From 1d49558b613ae9f1c763e3108166b47a59b743be Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 68/78] po/fr.po: Change branding to IPA and Identity
- Management
+
+From 46c3a350be1140eb7fbb529586bf11c986bbc8ae Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:28:56 +0200
+Subject: [PATCH 68/93] ipaserver/dcerpc.py: Change branding to IPA and
+ Identity Management
---
- po/fr.po | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
+ ipaserver/dcerpc.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/po/fr.po b/po/fr.po
-index 88253e172..23a4ba3ea 100644
---- a/po/fr.po
-+++ b/po/fr.po
-@@ -2575,17 +2575,17 @@ msgstr ""
-
- msgid ""
- "\n"
--"FreeIPA provides a designated binddn to use with Sudo located at:\n"
-+"IPA provides a designated binddn to use with Sudo located at:\n"
- "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
- msgstr ""
- "\n"
--"FreeIPA permet la désignation d'un « binddn » à utiliser avec sudo situé "
-+"IPA permet la désignation d'un « binddn » à utiliser avec sudo situé "
- "à :\n"
- "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
+index ff56270..753d171 100644
+--- a/ipaserver/dcerpc.py
++++ b/ipaserver/dcerpc.py
+@@ -1483,7 +1483,7 @@ def fetch_domains(api, mydomain, trustdomain, creds=None, server=None):
+ def communicate(td):
+ td.init_lsa_pipe(td.info['dc'])
+ netr_pipe = netlogon.netlogon(td.binding, td.parm, td.creds)
+- # Older FreeIPA versions used netr_DsrEnumerateDomainTrusts call
++ # Older IPA versions used netr_DsrEnumerateDomainTrusts call
+ # but it doesn't provide information about non-domain UPNs associated
+ # with the forest, thus we have to use netr_DsRGetForestTrustInformation
+ domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], None, 0)
+--
+2.28.0
+
+
+From c9ccf5ec0927e25a32060a556e5248d3bc3cda66 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:29:21 +0200
+Subject: [PATCH 69/93] ipaserver/install/ipa_cert_fix.py: Change branding to
+ IPA and Identity Management
+
+---
+ ipaserver/install/ipa_cert_fix.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipaserver/install/ipa_cert_fix.py b/ipaserver/install/ipa_cert_fix.py
+index 1b2f543..735fcd7 100644
+--- a/ipaserver/install/ipa_cert_fix.py
++++ b/ipaserver/install/ipa_cert_fix.py
+@@ -45,7 +45,7 @@ msg = """
+ WARNING
- msgid ""
- "\n"
--"FreeIPA provides a means to configure the various aspects of Sudo:\n"
+ ipa-cert-fix is intended for recovery when expired certificates
+-prevent the normal operation of FreeIPA. It should ONLY be used
++prevent the normal operation of IPA. It should ONLY be used
+ in such scenarios, and backup of the system, especially certificates
+ and keys, is STRONGLY RECOMMENDED.
+
+--
+2.28.0
+
+
+From 8f24640b50dc24dbae3f24726d2a05993d9a42b7 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:29:43 +0200
+Subject: [PATCH 70/93] ipaserver/plugins/config.py: Change branding to IPA and
+ Identity Management
+
+---
+ ipaserver/plugins/config.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
+index e96e519..ace66e5 100644
+--- a/ipaserver/plugins/config.py
++++ b/ipaserver/plugins/config.py
+@@ -462,7 +462,7 @@ class config(LDAPObject):
+
+ known_domains = self.gather_trusted_domains()
+
+- # add FreeIPA domain to the list of domains. This one is always enabled
++ # add IPA domain to the list of domains. This one is always enabled
+ known_domains.update({self.api.env.domain: True})
+
+ for domain in submitted_domains:
+--
+2.28.0
+
+
+From cbc3d2ebc95d5d27a142846a016a2f947b21d369 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:30:01 +0200
+Subject: [PATCH 71/93] ipaserver/plugins/certprofile.py: Change branding to
+ IPA and Identity Management
+
+---
+ ipaserver/plugins/certprofile.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipaserver/plugins/certprofile.py b/ipaserver/plugins/certprofile.py
+index ffede6e..978fce8 100644
+--- a/ipaserver/plugins/certprofile.py
++++ b/ipaserver/plugins/certprofile.py
+@@ -57,7 +57,7 @@ PROFILE CONFIGURATION FORMAT:
+ The profile configuration format is the raw property-list format
+ used by Dogtag Certificate System. The XML format is not supported.
+
+-The following restrictions apply to profiles managed by FreeIPA:
++The following restrictions apply to profiles managed by IPA:
+
+ - When importing a profile the "profileId" field, if present, must
+ match the ID given on the command line.
+--
+2.28.0
+
+
+From dbc6bef407c6a0907965281f61f1d271972bf5ac Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Fri, 3 Apr 2020 14:30:20 +0200
+Subject: [PATCH 72/93] doc/designs/adtrust/samba-domain-member.md: Change
+ branding to IPA and Identity Management
+
+---
+ doc/designs/adtrust/samba-domain-member.md | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/doc/designs/adtrust/samba-domain-member.md b/doc/designs/adtrust/samba-domain-member.md
+index 95e3c01..83e84dd 100644
+--- a/doc/designs/adtrust/samba-domain-member.md
++++ b/doc/designs/adtrust/samba-domain-member.md
+@@ -46,11 +46,11 @@ performing a remote authentication using Kerberos, a remote system has to
+ present a Kerberos ticket to the domain member's SMB service, like with any
+ other Kerberos services.
+
+-To operate as a domain member in a FreeIPA domain, thus, Samba needs a FreeIPA
+-master to be configured as a domain controller and a FreeIPA client needs to be
++To operate as a domain member in a IPA domain, thus, Samba needs a IPA
++master to be configured as a domain controller and a IPA client needs to be
+ configured in a specific way to allow Samba to talk to a domain controller.
+ This document overviews a set of implementation tasks to achieve the domain
+-member operation. Most of these tasks are related to FreeIPA components but
++member operation. Most of these tasks are related to IPA components but
+ some of changes required do belong to Samba itself.
+
+ ## Domain member configuration overview
+@@ -102,16 +102,16 @@ password rotation.
+
+ The knowledge of the machine account password is recorded in a special
+ database, `secrets.tdb`, during the process of a machine join to the domain.
+-For FreeIPA client the join process is different from the one Samba uses for
++For IPA client the join process is different from the one Samba uses for
+ Active Directory, thus we need to seed the machine account password separately
+-to enrolling FreeIPA client. Note that FreeIPA machine enrollment does not
++to enrolling IPA client. Note that IPA machine enrollment does not
+ allow to share clear text machine account password as it is not recorded
+ anywhere.
+
+ ## Domain controller side configuration overview
+
+ See [samba-domain-controller] for the details of how Samba domain controller is
+-set up and configured in FreeIPA.
++set up and configured in IPA.
+
+ ## Changes required on domain member
+
+--
+2.28.0
+
+
+From 0f0f606a3fee4607a57110f429b38a6fb38d5dea Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:36:01 +0100
+Subject: [PATCH 73/93] po/ipa.pot: Change branding to IPA and Identity
+ Management
+
+---
+ po/ipa.pot | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/po/ipa.pot b/po/ipa.pot
+index e49bb7e..56dab55 100644
+--- a/po/ipa.pot
++++ b/po/ipa.pot
+@@ -25055,7 +25055,7 @@ msgstr ""
+ #: ipaclient/remote_plugins/2_164/otptoken.py:266
+ #: ipaclient/remote_plugins/2_164/otptoken.py:556
+ #: ipaserver/plugins/otptoken.py:248
+-msgid "TOTP token / FreeIPA server time difference"
++msgid "TOTP token / IPA server time difference"
+ msgstr ""
+
+ #: ipaclient/remote_plugins/2_114/otptoken.py:140
+@@ -28858,7 +28858,7 @@ msgid ""
+ "commands as root or another user while providing an audit trail of the\n"
+ "commands and their arguments.\n"
+ "\n"
+-"FreeIPA provides a means to configure the various aspects of Sudo:\n"
++"IPA provides a means to configure the various aspects of Sudo:\n"
+ " Users: The user(s)/group(s) allowed to invoke Sudo.\n"
+ " Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
+ "Sudo.\n"
+@@ -28873,7 +28873,7 @@ msgid ""
+ "are evaluated (if the client supports it). This order is an integer and\n"
+ "must be unique.\n"
+ "\n"
+-"FreeIPA provides a designated binddn to use with Sudo located at:\n"
++"IPA provides a designated binddn to use with Sudo located at:\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ "\n"
+ "To enable the binddn run the following command to set the password:\n"
+@@ -31529,7 +31529,7 @@ msgid ""
+ "The profile configuration format is the raw property-list format\n"
+ "used by Dogtag Certificate System. The XML format is not supported.\n"
+ "\n"
+-"The following restrictions apply to profiles managed by FreeIPA:\n"
++"The following restrictions apply to profiles managed by IPA:\n"
+ "\n"
+ "- When importing a profile the \"profileId\" field, if present, must\n"
+ " match the ID given on the command line.\n"
+@@ -36221,7 +36221,7 @@ msgid ""
+ "commands as root or another user while providing an audit trail of the\n"
+ "commands and their arguments.\n"
+ "\n"
+-"FreeIPA provides a means to configure the various aspects of Sudo:\n"
++"IPA provides a means to configure the various aspects of Sudo:\n"
+ " Users: The user(s)/group(s) allowed to invoke Sudo.\n"
+ " Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
+ "Sudo.\n"
+@@ -36236,7 +36236,7 @@ msgid ""
+ "are evaluated (if the client supports it). This order is an integer and\n"
+ "must be unique.\n"
+ "\n"
+-"FreeIPA provides a designated binddn to use with Sudo located at:\n"
++"IPA provides a designated binddn to use with Sudo located at:\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ "\n"
+ "To enable the binddn run the following command to set the password:\n"
+@@ -36244,7 +36244,7 @@ msgid ""
+ "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
+ "dc=com\n"
+ "\n"
+-"For more information, see the FreeIPA Documentation to Sudo.\n"
++"For more information, see the IPA Documentation to Sudo.\n"
+ msgstr ""
+
+ #: ipaclient/remote_plugins/2_49/sudorule.py:382
+@@ -39846,7 +39846,7 @@ msgid ""
+ "The profile configuration format is the raw property-list format\n"
+ "used by Dogtag Certificate System. The XML format is not supported.\n"
+ "\n"
+-"The following restrictions apply to profiles managed by FreeIPA:\n"
++"The following restrictions apply to profiles managed by IPA:\n"
+ "\n"
+ "- When importing a profile the \"profileId\" field, if present, must\n"
+ " match the ID given on the command line.\n"
+@@ -49076,7 +49076,7 @@ msgstr ""
+ #: ipaserver/plugins/sudorule.py:49
+ msgid ""
+ "\n"
+-"FreeIPA provides a means to configure the various aspects of Sudo:\n"
++"IPA provides a means to configure the various aspects of Sudo:\n"
+ " Users: The user(s)/group(s) allowed to invoke Sudo.\n"
+ " Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
+ "Sudo.\n"
+@@ -49099,7 +49099,7 @@ msgstr ""
+ #: ipaserver/plugins/sudorule.py:62
+ msgid ""
+ "\n"
+-"FreeIPA provides a designated binddn to use with Sudo located at:\n"
++"IPA provides a designated binddn to use with Sudo located at:\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ msgstr ""
+
+--
+2.28.0
+
+
+From 05e5469dfac9361cdfae113947faeefa7fd0be17 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 74/93] client/man/epn.conf.5: Change branding to IPA and
+ Identity Management
+
+---
+ client/man/epn.conf.5 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/client/man/epn.conf.5 b/client/man/epn.conf.5
+index 60508d2..9f0ec59 100644
+--- a/client/man/epn.conf.5
++++ b/client/man/epn.conf.5
+@@ -16,7 +16,7 @@
+ .\"
+ .\" Author: Rob Crittenden <rcritten@@redhat.com>
+ .\"
+-.TH "EPN.CONF" "5" "April 28, 2020" "FreeIPA" "FreeIPA Manual Pages"
++.TH "EPN.CONF" "5" "April 28, 2020" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+ epn.conf \- Expiring Password Notification configuration file
+ .SH "SYNOPSIS"
+--
+2.28.0
+
+
+From 334dc4d3b5509b10bb5bbf5f13b06604260c83af Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 75/93] client/man/ipa-epn.1: Change branding to IPA and
+ Identity Management
+
+---
+ client/man/ipa-epn.1 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/client/man/ipa-epn.1 b/client/man/ipa-epn.1
+index 124fd45..5e8438b 100644
+--- a/client/man/ipa-epn.1
++++ b/client/man/ipa-epn.1
+@@ -15,7 +15,7 @@
+ .\" along with this program. If not, see <http://www.gnu.org/licenses/>.
+ .\"
+ .\"
+-.TH "IPA-EPN" "1" "April 24, 2020" "FreeIPA" "FreeIPA Manual Pages"
++.TH "IPA-EPN" "1" "April 24, 2020" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+ ipa\-epn \- Send expiring password nofications
+ .SH "SYNOPSIS"
+--
+2.28.0
+
+
+From b8f4a8717acacbaed2b89fcad4d0e7e52db33302 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 76/93] install/share/ipaca_default.ini: Change branding to IPA
+ and Identity Management
+
+---
+ install/share/ipaca_default.ini | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/install/share/ipaca_default.ini b/install/share/ipaca_default.ini
+index e71edac..3a3dfd0 100644
+--- a/install/share/ipaca_default.ini
++++ b/install/share/ipaca_default.ini
+@@ -2,7 +2,7 @@
+ # Dogtag PKI configuration file
+ #
+ # The ipaca_default.ini contains hard-coded defaults that cannot be modified
+-# by a user without breaking FreeIPA internals.
++# by a user without breaking IPA internals.
+ #
+ # Note: "%" must be quoted as "%%".
+ #
+--
+2.28.0
+
+
+From 8ebd6ce9596ca0871772ae6eac4e61e4e2aecd1b Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 77/93] install/tools/man/ipa-acme-manage.1: Change branding to
+ IPA and Identity Management
+
+---
+ install/tools/man/ipa-acme-manage.1 | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/install/tools/man/ipa-acme-manage.1 b/install/tools/man/ipa-acme-manage.1
+index 07ee48d..e15d25b 100644
+--- a/install/tools/man/ipa-acme-manage.1
++++ b/install/tools/man/ipa-acme-manage.1
+@@ -1,17 +1,17 @@
+ .\"
+ .\" Copyright (C) 2020 FreeIPA Contributors see COPYING for license
+ .\"
+-.TH "ipa-acme-manage" "1" "Jun 2 2020" "FreeIPA" "FreeIPA Manual Pages"
++.TH "ipa-acme-manage" "1" "Jun 2 2020" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+-ipa\-acme\-manage \- Manage the FreeIPA ACME service
++ipa\-acme\-manage \- Manage the IPA ACME service
+ .SH "SYNOPSIS"
+ ipa\-acme\-manage enable|disable|status
+ .SH "DESCRIPTION"
+
+ Use the \fIipa-acme-manage\fR command to enable, disable or retrieve
+-the status of the ACME service on a FreeIPA CA server.
++the status of the ACME service on a IPA CA server.
+
+-In a FreeIPA topology all CA servers capable of ACME will
++In a IPA topology all CA servers capable of ACME will
+ have the ACME service deployed. The service is not enabled
+ by default. It is expected that the ACME service will either be
+ enabled on all CA servers, or disabled on all CA servers. However
+@@ -33,6 +33,6 @@ Display the status of the ACME service.
+
+ 1 if an error occurred
+
+-2 if the host is not a FreeIPA server
++2 if the host is not a IPA server
+
+ 3 if the host is not a CA server
+--
+2.28.0
+
+
+From 44e59d1aa53d0f24eff221c6dcfcbb0e47833736 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 78/93] install/tools/man/ipa-cert-fix.1: Change branding to
+ IPA and Identity Management
+
+---
+ install/tools/man/ipa-cert-fix.1 | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/install/tools/man/ipa-cert-fix.1 b/install/tools/man/ipa-cert-fix.1
+index 3edef31..1ce6559 100644
+--- a/install/tools/man/ipa-cert-fix.1
++++ b/install/tools/man/ipa-cert-fix.1
+@@ -1,7 +1,7 @@
+ .\"
+ .\" Copyright (C) 2019 FreeIPA Contributors see COPYING for license
+ .\"
+-.TH "ipa-cert-fix" "1" "Mar 25 2019" "FreeIPA" "FreeIPA Manual Pages"
++.TH "ipa-cert-fix" "1" "Mar 25 2019" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+ ipa\-cert\-fix \- Renew expired certificates
+ .SH "SYNOPSIS"
+@@ -9,7 +9,7 @@ ipa\-cert\-fix [options]
+ .SH "DESCRIPTION"
+
+ \fIipa-cert-fix\fR is a tool for recovery when expired certificates
+-prevent the normal operation of FreeIPA. It should ONLY be used in
++prevent the normal operation of IPA. It should ONLY be used in
+ such scenarios, and backup of the system, especially certificates
+ and keys, is \fBSTRONGLY RECOMMENDED\fR.
+
+@@ -22,7 +22,7 @@ This tool cannot renew certificates signed by external CAs. To
+ install new, externally-signed HTTP, LDAP or KDC certificates, use
+ \fIipa-server-certinstall(1)\fR.
+
+-\fIipa-cert-fix\fR will examine FreeIPA and Certificate System
++\fIipa-cert-fix\fR will examine IPA and Certificate System
+ certificates and renew certificates that are expired, or close to
+ expiry (less than two weeks). If any "shared" certificates are
+ renewed, \fIipa-cert-fix\fR will set the current server to be the CA
+--
+2.28.0
+
+
+From 48d4752286f1bd8ca8089348d1c68275b37cbd6f Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 79/93] install/tools/man/ipa-crlgen-manage.1: Change branding
+ to IPA and Identity Management
+
+---
+ install/tools/man/ipa-crlgen-manage.1 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/install/tools/man/ipa-crlgen-manage.1 b/install/tools/man/ipa-crlgen-manage.1
+index 1fa48ce..f17573b 100644
+--- a/install/tools/man/ipa-crlgen-manage.1
++++ b/install/tools/man/ipa-crlgen-manage.1
+@@ -1,7 +1,7 @@
+ .\"
+ .\" Copyright (C) 2019 FreeIPA Contributors see COPYING for license
+ .\"
+-.TH "ipa-crlgen-manage" "1" "Feb 12 2019" "FreeIPA" "FreeIPA Manual Pages"
++.TH "ipa-crlgen-manage" "1" "Feb 12 2019" "IPA" "IPA Manual Pages"
+ .SH "NAME"
+ ipa\-crlgen\-manage \- Enables or disables CRL generation
+ .SH "SYNOPSIS"
+--
+2.28.0
+
+
+From 253ba05abbe1899c7eaf9cdaf23014a7773243bd Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 80/93] ipaclient/remote_plugins/2_114/sudorule.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_114/sudorule.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ipaclient/remote_plugins/2_114/sudorule.py b/ipaclient/remote_plugins/2_114/sudorule.py
+index 808720e..4b02073 100644
+--- a/ipaclient/remote_plugins/2_114/sudorule.py
++++ b/ipaclient/remote_plugins/2_114/sudorule.py
+@@ -24,7 +24,7 @@ give certain users (or groups of users) the ability to run some (or all)
+ commands as root or another user while providing an audit trail of the
+ commands and their arguments.
+
+-FreeIPA provides a means to configure the various aspects of Sudo:
++IPA provides a means to configure the various aspects of Sudo:
+ Users: The user(s)/group(s) allowed to invoke Sudo.
+ Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
+ Allow Command: The specific command(s) permitted to be run via Sudo.
+@@ -37,7 +37,7 @@ An order can be added to a sudorule to control the order in which they
+ are evaluated (if the client supports it). This order is an integer and
+ must be unique.
+
+-FreeIPA provides a designated binddn to use with Sudo located at:
++IPA provides a designated binddn to use with Sudo located at:
+ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
+
+ To enable the binddn run the following command to set the password:
+--
+2.28.0
+
+
+From 6f09a8be31d9929ee6863808a1497c3f27d6252f Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 81/93] ipaclient/remote_plugins/2_156/certprofile.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_156/certprofile.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipaclient/remote_plugins/2_156/certprofile.py b/ipaclient/remote_plugins/2_156/certprofile.py
+index b612342..1727f6d 100644
+--- a/ipaclient/remote_plugins/2_156/certprofile.py
++++ b/ipaclient/remote_plugins/2_156/certprofile.py
+@@ -55,7 +55,7 @@ PROFILE CONFIGURATION FORMAT:
+ The profile configuration format is the raw property-list format
+ used by Dogtag Certificate System. The XML format is not supported.
+
+-The following restrictions apply to profiles managed by FreeIPA:
++The following restrictions apply to profiles managed by IPA:
+
+ - When importing a profile the "profileId" field, if present, must
+ match the ID given on the command line.
+--
+2.28.0
+
+
+From d8213c572ff439f7833fd80d15c67706cb5a4063 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 82/93] ipaclient/remote_plugins/2_156/sudorule.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_156/sudorule.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ipaclient/remote_plugins/2_156/sudorule.py b/ipaclient/remote_plugins/2_156/sudorule.py
+index 5d185ed..d475e68 100644
+--- a/ipaclient/remote_plugins/2_156/sudorule.py
++++ b/ipaclient/remote_plugins/2_156/sudorule.py
+@@ -24,7 +24,7 @@ give certain users (or groups of users) the ability to run some (or all)
+ commands as root or another user while providing an audit trail of the
+ commands and their arguments.
+
+-FreeIPA provides a means to configure the various aspects of Sudo:
++IPA provides a means to configure the various aspects of Sudo:
+ Users: The user(s)/group(s) allowed to invoke Sudo.
+ Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
+ Allow Command: The specific command(s) permitted to be run via Sudo.
+@@ -37,7 +37,7 @@ An order can be added to a sudorule to control the order in which they
+ are evaluated (if the client supports it). This order is an integer and
+ must be unique.
+
+-FreeIPA provides a designated binddn to use with Sudo located at:
++IPA provides a designated binddn to use with Sudo located at:
+ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
+
+ To enable the binddn run the following command to set the password:
+--
+2.28.0
+
+
+From dc5781178e7902c2aa99e34d1f59add4a4289ceb Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 83/93] ipaclient/remote_plugins/2_164/certprofile.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_164/certprofile.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipaclient/remote_plugins/2_164/certprofile.py b/ipaclient/remote_plugins/2_164/certprofile.py
+index b612342..1727f6d 100644
+--- a/ipaclient/remote_plugins/2_164/certprofile.py
++++ b/ipaclient/remote_plugins/2_164/certprofile.py
+@@ -55,7 +55,7 @@ PROFILE CONFIGURATION FORMAT:
+ The profile configuration format is the raw property-list format
+ used by Dogtag Certificate System. The XML format is not supported.
+
+-The following restrictions apply to profiles managed by FreeIPA:
++The following restrictions apply to profiles managed by IPA:
+
+ - When importing a profile the "profileId" field, if present, must
+ match the ID given on the command line.
+--
+2.28.0
+
+
+From c9fdd62a896eac4a9a1ab1c49dce93701a12b2b8 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 84/93] ipaclient/remote_plugins/2_164/sudorule.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_164/sudorule.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ipaclient/remote_plugins/2_164/sudorule.py b/ipaclient/remote_plugins/2_164/sudorule.py
+index 5d185ed..d475e68 100644
+--- a/ipaclient/remote_plugins/2_164/sudorule.py
++++ b/ipaclient/remote_plugins/2_164/sudorule.py
+@@ -24,7 +24,7 @@ give certain users (or groups of users) the ability to run some (or all)
+ commands as root or another user while providing an audit trail of the
+ commands and their arguments.
+
+-FreeIPA provides a means to configure the various aspects of Sudo:
++IPA provides a means to configure the various aspects of Sudo:
+ Users: The user(s)/group(s) allowed to invoke Sudo.
+ Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
+ Allow Command: The specific command(s) permitted to be run via Sudo.
+@@ -37,7 +37,7 @@ An order can be added to a sudorule to control the order in which they
+ are evaluated (if the client supports it). This order is an integer and
+ must be unique.
+
+-FreeIPA provides a designated binddn to use with Sudo located at:
++IPA provides a designated binddn to use with Sudo located at:
+ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
+
+ To enable the binddn run the following command to set the password:
+--
+2.28.0
+
+
+From a7f9d11f32a6f2ff0cbba60e078c2557704703a9 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 17:38:57 +0100
+Subject: [PATCH 85/93] ipaclient/remote_plugins/2_49/sudorule.py: Change
+ branding to IPA and Identity Management
+
+---
+ ipaclient/remote_plugins/2_49/sudorule.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ipaclient/remote_plugins/2_49/sudorule.py b/ipaclient/remote_plugins/2_49/sudorule.py
+index 3d01ecd..912a0b1 100644
+--- a/ipaclient/remote_plugins/2_49/sudorule.py
++++ b/ipaclient/remote_plugins/2_49/sudorule.py
+@@ -24,7 +24,7 @@ give certain users (or groups of users) the ability to run some (or all)
+ commands as root or another user while providing an audit trail of the
+ commands and their arguments.
+
+-FreeIPA provides a means to configure the various aspects of Sudo:
++IPA provides a means to configure the various aspects of Sudo:
+ Users: The user(s)/group(s) allowed to invoke Sudo.
+ Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke Sudo.
+ Allow Command: The specific command(s) permitted to be run via Sudo.
+@@ -37,13 +37,13 @@ An order can be added to a sudorule to control the order in which they
+ are evaluated (if the client supports it). This order is an integer and
+ must be unique.
+
+-FreeIPA provides a designated binddn to use with Sudo located at:
++IPA provides a designated binddn to use with Sudo located at:
+ uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
+
+ To enable the binddn run the following command to set the password:
+ LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -ZZ -D "cn=Directory Manager" uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com
+
+-For more information, see the FreeIPA Documentation to Sudo.
++For more information, see the IPA Documentation to Sudo.
+ """)
+
+ register = Registry()
+--
+2.28.0
+
+
+From d121657377c727b7c444045e3a980572476a31af Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 86/93] po/de.po: Change branding to IPA and Identity
+ Management
+
+---
+ po/de.po | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/po/de.po b/po/de.po
+index 0685c23..275ac3f 100644
+--- a/po/de.po
++++ b/po/de.po
+@@ -3642,7 +3642,7 @@ msgstr "TOTP Sychnronisierungsfenster"
+ msgid "TOTP authentication Window"
+ msgstr "TOTP Authentifizierungsfenster"
+
+-msgid "TOTP token / FreeIPA server time difference"
++msgid "TOTP token / IPA server time difference"
+ msgstr "Differenz zwischen Token und Serverzeit"
+
+ msgid "Target"
+--
+2.28.0
+
+
+From d1ee5f4c8f60e390b6dc5b82514cde56c41aab4e Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 87/93] po/es.po: Change branding to IPA and Identity
+ Management
+
+---
+ po/es.po | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/po/es.po b/po/es.po
+index 89c0ee1..9d94232 100644
+--- a/po/es.po
++++ b/po/es.po
+@@ -3056,7 +3056,7 @@ msgid ""
+ "The profile configuration format is the raw property-list format\n"
+ "used by Dogtag Certificate System. The XML format is not supported.\n"
+ "\n"
+-"The following restrictions apply to profiles managed by FreeIPA:\n"
++"The following restrictions apply to profiles managed by IPA:\n"
+ "\n"
+ "- When importing a profile the \"profileId\" field, if present, must\n"
+ " match the ID given on the command line.\n"
+@@ -3114,7 +3114,7 @@ msgstr ""
+ "propiedad\n"
+ "usado por Dogtag Certificate System. No está soportado el formato XML.\n"
+ "\n"
+-"A los perfiles manejados por FreeIPA se les aplican las siguientes "
++"A los perfiles manejados por IPA se les aplican las siguientes "
+ "restricciones:\n"
+ "\n"
+ "- Cuando se importa un perfil el campo \"profileId\", si está presente, debe "
+@@ -4903,7 +4903,7 @@ msgid ""
+ "commands as root or another user while providing an audit trail of the\n"
+ "commands and their arguments.\n"
+ "\n"
+-"FreeIPA provides a means to configure the various aspects of Sudo:\n"
++"IPA provides a means to configure the various aspects of Sudo:\n"
+ " Users: The user(s)/group(s) allowed to invoke Sudo.\n"
+ " Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
+ "Sudo.\n"
+@@ -4918,7 +4918,7 @@ msgid ""
+ "are evaluated (if the client supports it). This order is an integer and\n"
+ "must be unique.\n"
+ "\n"
+-"FreeIPA provides a designated binddn to use with Sudo located at:\n"
++"IPA provides a designated binddn to use with Sudo located at:\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ "\n"
+ "To enable the binddn run the following command to set the password:\n"
+@@ -4926,7 +4926,7 @@ msgid ""
+ "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
+ "dc=com\n"
+ "\n"
+-"For more information, see the FreeIPA Documentation to Sudo.\n"
++"For more information, see the IPA Documentation to Sudo.\n"
+ msgstr ""
+ "\n"
+ "Reglas Sudo\n"
+@@ -4939,7 +4939,7 @@ msgstr ""
+ "auditoria de\n"
+ " los comandos y sus argumentos.\n"
+ "\n"
+-"FreeIPA proporciona un medio para configurar diversos aspectos de Sudo:\n"
++"IPA proporciona un medio para configurar diversos aspectos de Sudo:\n"
+ " Users: Los usuario(s)/grupos(s) que tienen permitido llamar a Sudo.\n"
+ " Hosts: Loshost(s)/grupo(s) de host a los que el usuario permite llamar a "
+ "Sudo.\n"
+@@ -4957,7 +4957,7 @@ msgstr ""
+ "será evaluada\n"
+ "(si el cliente lo soporta). Este orden es un entero y debe ser único.\n"
+ "\n"
+-"FreeIPA suministra un binddn designado para usar con Sudo situado en :\n"
++"IPA suministra un binddn designado para usar con Sudo situado en :\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ "\n"
+ "Para habilitar el binddn ejecute el siguiente comando para fijar la "
+@@ -4966,7 +4966,7 @@ msgstr ""
+ "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
+ "dc=com\n"
+ "\n"
+-"Para más información, vea la Documentación FreeIPA para Sudo.\n"
++"Para más información, vea la Documentación IPA para Sudo.\n"
+
+ msgid ""
+ "\n"
+@@ -12604,8 +12604,8 @@ msgstr "Variación del tiempo de autenticación TOTP (segundos)"
+ msgid "TOTP synchronization time variance (seconds)"
+ msgstr "Variación del tiempo de sincronización TOTP (segundos)"
+
+-msgid "TOTP token / FreeIPA server time difference"
+-msgstr "Ficha TOTP / Diferencia de hora del servidor FreeIPA"
++msgid "TOTP token / IPA server time difference"
++msgstr "Ficha TOTP / Diferencia de hora del servidor IPA"
+
+ msgid "Take a revoked certificate off hold."
+ msgstr "Tomar un certificado revocado de espera."
+--
+2.28.0
+
+
+From c21b51f2d19889f928202452ca6572f042ff8d72 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 88/93] po/fr.po: Change branding to IPA and Identity
+ Management
+
+---
+ po/fr.po | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/po/fr.po b/po/fr.po
+index c8b99e2..ac602cc 100644
+--- a/po/fr.po
++++ b/po/fr.po
+@@ -2575,17 +2575,17 @@ msgstr ""
+
+ msgid ""
+ "\n"
+-"FreeIPA provides a designated binddn to use with Sudo located at:\n"
++"IPA provides a designated binddn to use with Sudo located at:\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+ msgstr ""
+ "\n"
+-"FreeIPA permet la désignation d'un « binddn » à utiliser avec sudo situé "
++"IPA permet la désignation d'un « binddn » à utiliser avec sudo situé "
+ "à :\n"
+ "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+
+ msgid ""
+ "\n"
+-"FreeIPA provides a means to configure the various aspects of Sudo:\n"
+"IPA provides a means to configure the various aspects of Sudo:\n"
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
@@ -2259,7 +3064,7 @@ index 88253e172..23a4ba3ea 100644
"\n"
"- Lors de l'import d'un profil, le champ « profileId » s'il est présent "
"doit\n"
-@@ -15658,8 +15658,8 @@ msgstr "Durée de la fenêtre d'authentification TOTP (secondes)"
+@@ -15617,8 +15617,8 @@ msgstr "Durée de la fenêtre d'authentification TOTP (secondes)"
msgid "TOTP synchronization time variance (seconds)"
msgstr "Variance temporelle de synchronisation TOTP (secondes)"
@@ -2271,12 +3076,38 @@ index 88253e172..23a4ba3ea 100644
msgid "TSIG record"
msgstr "Enregistrement TSIG"
--
-2.21.1
+2.28.0
-From 28d5217ccc838e037f60dbdfce72ae0eaa1fbdd8 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 69/78] po/ru.po: Change branding to IPA and Identity
+
+From b9123b82127a918effcb62b06c537f0f1e1193ff Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 89/93] po/ipa.pot: Change branding to IPA and Identity
+ Management
+
+---
+ po/ipa.pot | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/po/ipa.pot b/po/ipa.pot
+index 56dab55..8848bb9 100644
+--- a/po/ipa.pot
++++ b/po/ipa.pot
+@@ -1,5 +1,5 @@
+ # SOME DESCRIPTIVE TITLE.
+-# Copyright (C) YEAR FreeIPA Contributors
++# Copyright (C) YEAR IPA Contributors
+ # This file is distributed under the same license as the freeipa package.
+ # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+ #
+--
+2.28.0
+
+
+From bddd0a70b16f2921b498aaa39f353401fd37466c Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 90/93] po/ru.po: Change branding to IPA and Identity
Management
---
@@ -2284,10 +3115,10 @@ Subject: [PATCH 69/78] po/ru.po: Change branding to IPA and Identity
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/po/ru.po b/po/ru.po
-index 7d663a7a8..699979b74 100644
+index 47ae8a4..ffeb889 100644
--- a/po/ru.po
+++ b/po/ru.po
-@@ -5308,17 +5308,17 @@ msgstr ""
+@@ -5261,17 +5261,17 @@ msgstr ""
msgid ""
"\n"
@@ -2308,7 +3139,7 @@ index 7d663a7a8..699979b74 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -5330,7 +5330,7 @@ msgid ""
+@@ -5283,7 +5283,7 @@ msgid ""
" Options: The various Sudoers Options that can modify Sudo's behavior.\n"
msgstr ""
"\n"
@@ -2317,7 +3148,7 @@ index 7d663a7a8..699979b74 100644
" Users: пользователь (пользователи) или группа (группы), которые могут "
"вызывать Sudo.\n"
" Hosts: узел (узлы) или группа (группы) узлов, пользователи которых могут "
-@@ -7826,7 +7826,7 @@ msgid ""
+@@ -7779,7 +7779,7 @@ msgid ""
"The profile configuration format is the raw property-list format\n"
"used by Dogtag Certificate System. The XML format is not supported.\n"
"\n"
@@ -2326,7 +3157,7 @@ index 7d663a7a8..699979b74 100644
"\n"
"- When importing a profile the \"profileId\" field, if present, must\n"
" match the ID given on the command line.\n"
-@@ -7880,7 +7880,7 @@ msgstr ""
+@@ -7833,7 +7833,7 @@ msgstr ""
"свойств, который используется системой сертификации Dogtag Certificate "
"System. Поддержка формата XML не предусмотрена.\n"
"\n"
@@ -2335,7 +3166,7 @@ index 7d663a7a8..699979b74 100644
"\n"
"- При импорте профиля значение поля \"profileId\", если это поле имеется, "
"должно совпадать с идентификатором, указанным в командной строке.\n"
-@@ -7936,7 +7936,7 @@ msgid ""
+@@ -7889,7 +7889,7 @@ msgid ""
"The profile configuration format is the raw property-list format\n"
"used by Dogtag Certificate System. The XML format is not supported.\n"
"\n"
@@ -2344,7 +3175,7 @@ index 7d663a7a8..699979b74 100644
"\n"
"- When importing a profile the \"profileId\" field, if present, must\n"
" match the ID given on the command line.\n"
-@@ -7992,7 +7992,7 @@ msgstr ""
+@@ -7945,7 +7945,7 @@ msgstr ""
"свойств, который используется системой сертификации Dogtag Certificate "
"System. Поддержка формата XML не предусмотрена.\n"
"\n"
@@ -2353,7 +3184,7 @@ index 7d663a7a8..699979b74 100644
"\n"
"- При импорте профиля значение поля \"profileId\", если это поле имеется, "
"должно совпадать с идентификатором, указанным в командной строке.\n"
-@@ -13772,7 +13772,7 @@ msgid ""
+@@ -13725,7 +13725,7 @@ msgid ""
"commands as root or another user while providing an audit trail of the\n"
"commands and their arguments.\n"
"\n"
@@ -2362,7 +3193,7 @@ index 7d663a7a8..699979b74 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -13787,7 +13787,7 @@ msgid ""
+@@ -13740,7 +13740,7 @@ msgid ""
"are evaluated (if the client supports it). This order is an integer and\n"
"must be unique.\n"
"\n"
@@ -2371,7 +3202,7 @@ index 7d663a7a8..699979b74 100644
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
"To enable the binddn run the following command to set the password:\n"
-@@ -13825,7 +13825,7 @@ msgstr ""
+@@ -13778,7 +13778,7 @@ msgstr ""
"пользователя \"root\" или другого пользователя, вместе с тем предоставляя "
"журнал аудита команд и их аргументов.\n"
"\n"
@@ -2380,7 +3211,7 @@ index 7d663a7a8..699979b74 100644
" Users: пользователь (пользователи) или группа (группы), которые могут "
"вызывать Sudo.\n"
" Hosts: узел (узлы) или группа (группы) узлов, пользователи которых могут "
-@@ -13846,7 +13846,7 @@ msgstr ""
+@@ -13799,7 +13799,7 @@ msgstr ""
"Порядок определяется числовым индексом (целое число), который не должен "
"повторяться.\n"
"\n"
@@ -2389,7 +3220,7 @@ index 7d663a7a8..699979b74 100644
"Sudo:\n"
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
-@@ -13887,7 +13887,7 @@ msgid ""
+@@ -13840,7 +13840,7 @@ msgid ""
"commands as root or another user while providing an audit trail of the\n"
"commands and their arguments.\n"
"\n"
@@ -2398,7 +3229,7 @@ index 7d663a7a8..699979b74 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -13902,7 +13902,7 @@ msgid ""
+@@ -13855,7 +13855,7 @@ msgid ""
"are evaluated (if the client supports it). This order is an integer and\n"
"must be unique.\n"
"\n"
@@ -2407,7 +3238,7 @@ index 7d663a7a8..699979b74 100644
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
"To enable the binddn run the following command to set the password:\n"
-@@ -13910,7 +13910,7 @@ msgid ""
+@@ -13863,7 +13863,7 @@ msgid ""
"ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
"dc=com\n"
"\n"
@@ -2416,7 +3247,7 @@ index 7d663a7a8..699979b74 100644
msgstr ""
"\n"
"Правила Sudo\n"
-@@ -13921,7 +13921,7 @@ msgstr ""
+@@ -13874,7 +13874,7 @@ msgstr ""
"пользователя \"root\" или другого пользователя, вместе с тем предоставляя "
"журнал аудита команд и их аргументов.\n"
"\n"
@@ -2425,7 +3256,7 @@ index 7d663a7a8..699979b74 100644
" Users: пользователь (пользователи) или группа (группы), которые могут "
"вызывать Sudo.\n"
" Hosts: узел (узлы) или группа (группы) узлов, пользователи которых могут "
-@@ -13942,7 +13942,7 @@ msgstr ""
+@@ -13895,7 +13895,7 @@ msgstr ""
"Порядок определяется числовым индексом (целое число), который не должен "
"повторяться.\n"
"\n"
@@ -2434,7 +3265,7 @@ index 7d663a7a8..699979b74 100644
"Sudo:\n"
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
-@@ -13951,7 +13951,7 @@ msgstr ""
+@@ -13904,7 +13904,7 @@ msgstr ""
"ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
"dc=com\n"
"\n"
@@ -2443,7 +3274,7 @@ index 7d663a7a8..699979b74 100644
msgid ""
"\n"
-@@ -27252,8 +27252,8 @@ msgstr "Отклонение по времени TOTP-аутентификаци
+@@ -27149,8 +27149,8 @@ msgstr "Отклонение по времени TOTP-аутентификаци
msgid "TOTP synchronization time variance (seconds)"
msgstr "Отклонение по времени TOTP-синхронизации (в секундах)"
@@ -2455,12 +3286,38 @@ index 7d663a7a8..699979b74 100644
msgid "TSIG record"
msgstr "Запись TSIG"
--
-2.21.1
+2.28.0
-From 41e8beb8aa6bcaf48de38b48939fdf40cf8819b5 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 70/78] po/uk.po: Change branding to IPA and Identity
+
+From 2f862e5f4c7601a8bc50c9334ca5d3a59d7f8a57 Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 91/93] po/tr.po: Change branding to IPA and Identity
+ Management
+
+---
+ po/tr.po | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/po/tr.po b/po/tr.po
+index 9eccfe4..cf9b98a 100644
+--- a/po/tr.po
++++ b/po/tr.po
+@@ -1,5 +1,5 @@
+ # SOME DESCRIPTIVE TITLE.
+-# Copyright (C) YEAR FreeIPA Contributors
++# Copyright (C) YEAR IPA Contributors
+ # This file is distributed under the same license as the freeipa package.
+ # Oğuz Ersen <oguzersen@protonmail.com>, 2020.
+ msgid ""
+--
+2.28.0
+
+
+From aa4d887e7cef21959c4b4b3db57f6bd9ced965eb Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:58 +0100
+Subject: [PATCH 92/93] po/uk.po: Change branding to IPA and Identity
Management
---
@@ -2468,10 +3325,10 @@ Subject: [PATCH 70/78] po/uk.po: Change branding to IPA and Identity
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/po/uk.po b/po/uk.po
-index a17396796..ca864c8a4 100644
+index 0757e2f..fd1de90 100644
--- a/po/uk.po
+++ b/po/uk.po
-@@ -5403,17 +5403,17 @@ msgstr ""
+@@ -5411,17 +5411,17 @@ msgstr ""
msgid ""
"\n"
@@ -2492,7 +3349,7 @@ index a17396796..ca864c8a4 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -5425,7 +5425,7 @@ msgid ""
+@@ -5433,7 +5433,7 @@ msgid ""
" Options: The various Sudoers Options that can modify Sudo's behavior.\n"
msgstr ""
"\n"
@@ -2501,7 +3358,7 @@ index a17396796..ca864c8a4 100644
" Users: користувачі або групи, які можуть викликати sudo.\n"
" Hosts: вузли або групи вузлів, користувачі якого можуть викликати sudo.\n"
" Allow Command: специфічні команди, які можна виконувати за допомогою "
-@@ -7948,7 +7948,7 @@ msgid ""
+@@ -9393,7 +9393,7 @@ msgid ""
"The profile configuration format is the raw property-list format\n"
"used by Dogtag Certificate System. The XML format is not supported.\n"
"\n"
@@ -2510,7 +3367,7 @@ index a17396796..ca864c8a4 100644
"\n"
"- When importing a profile the \"profileId\" field, if present, must\n"
" match the ID given on the command line.\n"
-@@ -8002,7 +8002,7 @@ msgstr ""
+@@ -9447,7 +9447,7 @@ msgstr ""
"властивостей, що використовується системою сертифікації Dogtag.\n"
"Підтримки формату XML не передбачено.\n"
"\n"
@@ -2519,7 +3376,7 @@ index a17396796..ca864c8a4 100644
"\n"
"- Під час імпортування профілю поле «profileId», якщо таке є, має\n"
" містити значення, що збігається з ідентифікатором, вказаним у рядку "
-@@ -8059,7 +8059,7 @@ msgid ""
+@@ -9504,7 +9504,7 @@ msgid ""
"The profile configuration format is the raw property-list format\n"
"used by Dogtag Certificate System. The XML format is not supported.\n"
"\n"
@@ -2528,7 +3385,7 @@ index a17396796..ca864c8a4 100644
"\n"
"- When importing a profile the \"profileId\" field, if present, must\n"
" match the ID given on the command line.\n"
-@@ -8114,7 +8114,7 @@ msgstr ""
+@@ -9559,7 +9559,7 @@ msgstr ""
"властивостей, що використовується системою сертифікації Dogtag.\n"
"Підтримки формату XML не передбачено.\n"
"\n"
@@ -2537,7 +3394,7 @@ index a17396796..ca864c8a4 100644
"\n"
"- Під час імпортування профілю поле «profileId», якщо таке є, має\n"
" містити значення, що збігається з ідентифікатором, вказаним у рядку "
-@@ -13887,7 +13887,7 @@ msgid ""
+@@ -15481,7 +15481,7 @@ msgid ""
"commands as root or another user while providing an audit trail of the\n"
"commands and their arguments.\n"
"\n"
@@ -2546,7 +3403,7 @@ index a17396796..ca864c8a4 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -13902,7 +13902,7 @@ msgid ""
+@@ -15496,7 +15496,7 @@ msgid ""
"are evaluated (if the client supports it). This order is an integer and\n"
"must be unique.\n"
"\n"
@@ -2555,7 +3412,7 @@ index a17396796..ca864c8a4 100644
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
"To enable the binddn run the following command to set the password:\n"
-@@ -13940,7 +13940,7 @@ msgstr ""
+@@ -15534,7 +15534,7 @@ msgstr ""
"користувача, зберігаючи водночас журнал виконання команд та\n"
"аргументів.\n"
"\n"
@@ -2564,7 +3421,7 @@ index a17396796..ca864c8a4 100644
" Users: користувачі або групи, які можуть викликати sudo.\n"
" Hosts: вузли або групи вузлів, користувачі якого можуть викликати sudo.\n"
" Allow Command: специфічні команди, які можна виконувати за допомогою "
-@@ -13958,7 +13958,7 @@ msgstr ""
+@@ -15552,7 +15552,7 @@ msgstr ""
"обробки записів (якщо такий порядок передбачено на клієнтському боці).\n"
"Порядок визначається числовим індексом, який не повинен повторюватися.\n"
"\n"
@@ -2573,7 +3430,7 @@ index a17396796..ca864c8a4 100644
"розташовано у\n"
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
-@@ -13998,7 +13998,7 @@ msgid ""
+@@ -15592,7 +15592,7 @@ msgid ""
"commands as root or another user while providing an audit trail of the\n"
"commands and their arguments.\n"
"\n"
@@ -2582,7 +3439,7 @@ index a17396796..ca864c8a4 100644
" Users: The user(s)/group(s) allowed to invoke Sudo.\n"
" Hosts: The host(s)/hostgroup(s) which the user is allowed to to invoke "
"Sudo.\n"
-@@ -14013,7 +14013,7 @@ msgid ""
+@@ -15607,7 +15607,7 @@ msgid ""
"are evaluated (if the client supports it). This order is an integer and\n"
"must be unique.\n"
"\n"
@@ -2591,7 +3448,7 @@ index a17396796..ca864c8a4 100644
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
"To enable the binddn run the following command to set the password:\n"
-@@ -14021,7 +14021,7 @@ msgid ""
+@@ -15615,7 +15615,7 @@ msgid ""
"ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
"dc=com\n"
"\n"
@@ -2600,7 +3457,7 @@ index a17396796..ca864c8a4 100644
msgstr ""
"\n"
"Правила sudo\n"
-@@ -14032,7 +14032,7 @@ msgstr ""
+@@ -15626,7 +15626,7 @@ msgstr ""
"користувача, зберігаючи водночас журнал виконання команд та\n"
"аргументів.\n"
"\n"
@@ -2609,7 +3466,7 @@ index a17396796..ca864c8a4 100644
" Users: користувачі або групи, які можуть викликати sudo.\n"
" Hosts: вузли або групи вузлів, користувачі якого можуть викликати sudo.\n"
" Allow Command: специфічні команди, які можна виконувати за допомогою "
-@@ -14050,7 +14050,7 @@ msgstr ""
+@@ -15644,7 +15644,7 @@ msgstr ""
"обробки записів (якщо такий порядок передбачено на клієнтському боці).\n"
"Порядок визначається числовим індексом, який не повинен повторюватися.\n"
"\n"
@@ -2618,7 +3475,7 @@ index a17396796..ca864c8a4 100644
"розташовано у\n"
"uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
"\n"
-@@ -14059,7 +14059,7 @@ msgstr ""
+@@ -15653,7 +15653,7 @@ msgstr ""
"ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
"dc=com\n"
"\n"
@@ -2627,24 +3484,25 @@ index a17396796..ca864c8a4 100644
msgid ""
"\n"
-@@ -27264,8 +27264,8 @@ msgstr "Відхилення часу розпізнавання TOTP (у сек
+@@ -29242,8 +29242,8 @@ msgstr "Відхилення часу розпізнавання TOTP (у сек
msgid "TOTP synchronization time variance (seconds)"
msgstr "Відхилення часу синхронізації TOTP (у секундах)"
-msgid "TOTP token / FreeIPA server time difference"
--msgstr "Часова розбіжність між ключем TOTP і сервером FreeIPA"
+-msgstr "Часова розбіжність між ключем TOTP і сервером FreeIPA"
+msgid "TOTP token / IPA server time difference"
-+msgstr "Часова розбіжність між ключем TOTP і сервером IPA"
++msgstr "Часова розбіжність між ключем TOTP і сервером IPA"
msgid "TSIG record"
msgstr "Запис TSIG"
--
-2.21.1
+2.28.0
-From 703f4aa1ba942db3f614190de1dc291216d20e86 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Sun, 7 Oct 2018 12:25:41 +0300
-Subject: [PATCH 71/78] po/zh_CN.po: Change branding to IPA and Identity
+
+From 9de5307e8111992181a775d3bd9bf279033c1b1e Mon Sep 17 00:00:00 2001
+From: Thomas Woerner <twoerner@redhat.com>
+Date: Wed, 18 Nov 2020 18:07:59 +0100
+Subject: [PATCH 93/93] po/zh_CN.po: Change branding to IPA and Identity
Management
---
@@ -2652,7 +3510,7 @@ Subject: [PATCH 71/78] po/zh_CN.po: Change branding to IPA and Identity
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/po/zh_CN.po b/po/zh_CN.po
-index dec79967d..bc2269701 100644
+index 1963a5f..480c958 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -298,7 +298,7 @@ msgstr ""
@@ -2673,7 +3531,7 @@ index dec79967d..bc2269701 100644
" 用户：用户/用户组允许调用Sudo。\n"
" 主机：主机/主机组上的用户允许调用Sudo。\n"
" 允许的命令：指定命令允许通过Sudo来运行。\n"
-@@ -9923,8 +9923,8 @@ msgstr "TOTP认证时间差异（秒）"
+@@ -9885,8 +9885,8 @@ msgstr "TOTP认证时间差异（秒）"
msgid "TOTP synchronization time variance (seconds)"
msgstr "TOTP同步时间差异（秒）"
@@ -2685,222 +3543,5 @@ index dec79967d..bc2269701 100644
msgid "TSIG record"
msgstr "TSIG记录"
--
-2.21.1
-
-From 51756934d7214104a0da2a5a57d74194ecb054c9 Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:27:35 +0200
-Subject: [PATCH 72/78] client/man/ipa-client-samba.1: Change branding to IPA
- and Identity Management
-
----
- client/man/ipa-client-samba.1 | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/client/man/ipa-client-samba.1 b/client/man/ipa-client-samba.1
-index ea83715ff..5ed6c7150 100644
---- a/client/man/ipa-client-samba.1
-+++ b/client/man/ipa-client-samba.1
-@@ -1,7 +1,7 @@
- .\" A man page for ipa-client-samba
- .\" Copyright (C) 2008-2016 FreeIPA Contributors see COPYING for license
- .\"
--.TH "ipa-client-samba" "1" "Jun 10 2019" "FreeIPA" "FreeIPA Manual Pages"
-+.TH "ipa-client-samba" "1" "Jun 10 2019" "IPA" "IPA Manual Pages"
- .SH "NAME"
- ipa\-client\-samba \- Configure Samba file server on an IPA client
- .SH "SYNOPSIS"
-@@ -39,7 +39,7 @@ The ipa\-client\-samba script assumes that the machine has alreaby been enrolled
- .SS "IPA Master Requirements"
- At least one IPA master must hold a \fBTrust Controller\fR role. This can be achieved by running ipa\-adtrust\-install on the IPA master. The utility will configure IPA master to be a domain controller for IPA domain.
-
--IPA master holding a \fBTrust Controller\fR role has also to have support for a special service command to create SMB service, \fBipa service-add-smb\fR. This command is available with FreeIPA 4.8.0 or later release.
-+IPA master holding a \fBTrust Controller\fR role has also to have support for a special service command to create SMB service, \fBipa service-add-smb\fR. This command is available with IPA 4.8.0 or later release.
-
- .SH "OPTIONS"
- .SS "BASIC OPTIONS"
---
-2.21.1
-
-From 9cb31fd0f81511252170f539b354a67b2bd1e96a Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:28:22 +0200
-Subject: [PATCH 73/78] contrib/lite-server.py: Change branding to IPA and
- Identity Management
-
----
- contrib/lite-server.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/contrib/lite-server.py b/contrib/lite-server.py
-index bd73b0763..9feffdada 100755
---- a/contrib/lite-server.py
-+++ b/contrib/lite-server.py
-@@ -139,7 +139,7 @@ class StaticFilesMiddleware(SharedDataMiddleware):
-
-
- def init_api(ccname):
-- """Initialize FreeIPA API from command line
-+ """Initialize IPA API from command line
- """
- from ipalib import __file__ as ipalib_file
- from ipalib import api
---
-2.21.1
-
-From a8bc392551a963cb33e3e9748a771fd0f1201541 Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:28:56 +0200
-Subject: [PATCH 74/78] ipaserver/dcerpc.py: Change branding to IPA and
- Identity Management
-
----
- ipaserver/dcerpc.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/dcerpc.py b/ipaserver/dcerpc.py
-index 27d075425..8d3384f12 100644
---- a/ipaserver/dcerpc.py
-+++ b/ipaserver/dcerpc.py
-@@ -1483,7 +1483,7 @@ def fetch_domains(api, mydomain, trustdomain, creds=None, server=None):
- def communicate(td):
- td.init_lsa_pipe(td.info['dc'])
- netr_pipe = netlogon.netlogon(td.binding, td.parm, td.creds)
-- # Older FreeIPA versions used netr_DsrEnumerateDomainTrusts call
-+ # Older IPA versions used netr_DsrEnumerateDomainTrusts call
- # but it doesn't provide information about non-domain UPNs associated
- # with the forest, thus we have to use netr_DsRGetForestTrustInformation
- domains = netr_pipe.netr_DsRGetForestTrustInformation(td.info['dc'], None, 0)
---
-2.21.1
-
-From 8bcae9d325453cae61cbc18b9114e9ba8b716993 Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:29:21 +0200
-Subject: [PATCH 75/78] ipaserver/install/ipa_cert_fix.py: Change branding to
- IPA and Identity Management
-
----
- ipaserver/install/ipa_cert_fix.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/install/ipa_cert_fix.py b/ipaserver/install/ipa_cert_fix.py
-index 6b952d34f..e79d7ddc4 100644
---- a/ipaserver/install/ipa_cert_fix.py
-+++ b/ipaserver/install/ipa_cert_fix.py
-@@ -45,7 +45,7 @@ msg = """
- WARNING
-
- ipa-cert-fix is intended for recovery when expired certificates
--prevent the normal operation of FreeIPA. It should ONLY be used
-+prevent the normal operation of IPA. It should ONLY be used
- in such scenarios, and backup of the system, especially certificates
- and keys, is STRONGLY RECOMMENDED.
-
---
-2.21.1
-
-From 8e3fb91139f51439164b38003cf0917af137158d Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:29:43 +0200
-Subject: [PATCH 76/78] ipaserver/plugins/config.py: Change branding to IPA and
- Identity Management
-
----
- ipaserver/plugins/config.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
-index e96e51971..ace66e589 100644
---- a/ipaserver/plugins/config.py
-+++ b/ipaserver/plugins/config.py
-@@ -462,7 +462,7 @@ class config(LDAPObject):
-
- known_domains = self.gather_trusted_domains()
-
-- # add FreeIPA domain to the list of domains. This one is always enabled
-+ # add IPA domain to the list of domains. This one is always enabled
- known_domains.update({self.api.env.domain: True})
-
- for domain in submitted_domains:
---
-2.21.1
-
-From 65a663bd7fb5559316f1a8e5f04e0d4827bfb0b6 Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:30:01 +0200
-Subject: [PATCH 77/78] ipaserver/plugins/certprofile.py: Change branding to
- IPA and Identity Management
-
----
- ipaserver/plugins/certprofile.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ipaserver/plugins/certprofile.py b/ipaserver/plugins/certprofile.py
-index 6e2e91dc6..03fbe4d3e 100644
---- a/ipaserver/plugins/certprofile.py
-+++ b/ipaserver/plugins/certprofile.py
-@@ -57,7 +57,7 @@ PROFILE CONFIGURATION FORMAT:
- The profile configuration format is the raw property-list format
- used by Dogtag Certificate System. The XML format is not supported.
-
--The following restrictions apply to profiles managed by FreeIPA:
-+The following restrictions apply to profiles managed by IPA:
-
- - When importing a profile the "profileId" field, if present, must
- match the ID given on the command line.
---
-2.21.1
-
-From 0801d5ad45d4fa9b64e0bfb4152af658ead0e514 Mon Sep 17 00:00:00 2001
-From: Thomas Woerner <twoerner@redhat.com>
-Date: Fri, 3 Apr 2020 14:30:20 +0200
-Subject: [PATCH 78/78] doc/designs/adtrust/samba-domain-member.md: Change
- branding to IPA and Identity Management
-
----
- doc/designs/adtrust/samba-domain-member.md | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/doc/designs/adtrust/samba-domain-member.md b/doc/designs/adtrust/samba-domain-member.md
-index 95e3c014c..83e84ddb8 100644
---- a/doc/designs/adtrust/samba-domain-member.md
-+++ b/doc/designs/adtrust/samba-domain-member.md
-@@ -46,11 +46,11 @@ performing a remote authentication using Kerberos, a remote system has to
- present a Kerberos ticket to the domain member's SMB service, like with any
- other Kerberos services.
-
--To operate as a domain member in a FreeIPA domain, thus, Samba needs a FreeIPA
--master to be configured as a domain controller and a FreeIPA client needs to be
-+To operate as a domain member in a IPA domain, thus, Samba needs a IPA
-+master to be configured as a domain controller and a IPA client needs to be
- configured in a specific way to allow Samba to talk to a domain controller.
- This document overviews a set of implementation tasks to achieve the domain
--member operation. Most of these tasks are related to FreeIPA components but
-+member operation. Most of these tasks are related to IPA components but
- some of changes required do belong to Samba itself.
-
- ## Domain member configuration overview
-@@ -102,16 +102,16 @@ password rotation.
-
- The knowledge of the machine account password is recorded in a special
- database, `secrets.tdb`, during the process of a machine join to the domain.
--For FreeIPA client the join process is different from the one Samba uses for
-+For IPA client the join process is different from the one Samba uses for
- Active Directory, thus we need to seed the machine account password separately
--to enrolling FreeIPA client. Note that FreeIPA machine enrollment does not
-+to enrolling IPA client. Note that IPA machine enrollment does not
- allow to share clear text machine account password as it is not recorded
- anywhere.
-
- ## Domain controller side configuration overview
-
- See [samba-domain-controller] for the details of how Samba domain controller is
--set up and configured in FreeIPA.
-+set up and configured in IPA.
-
- ## Changes required on domain member
-
---
-2.21.1
+2.28.0
diff --git a/SOURCES/1002-4.8.0-Remove-csrgen.patch b/SOURCES/1002-4.8.0-Remove-csrgen.patch
index 8b7e374..e6ba316 100644
--- a/SOURCES/1002-4.8.0-Remove-csrgen.patch
+++ b/SOURCES/1002-4.8.0-Remove-csrgen.patch
@@ -100,23 +100,23 @@ https://bugzilla.redhat.com/show_bug.cgi?id=1432630
delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl
delete mode 100644 ipatests/test_ipaclient/test_csrgen.py
-diff -urN freeipa-4.8.0/freeipa.spec.in freeipa-4.8.0.removed_csrgen/freeipa.spec.in
---- freeipa-4.8.0/freeipa.spec.in 2019-06-29 10:01:30.458735813 +0200
-+++ freeipa-4.8.0.removed_csrgen/freeipa.spec.in 2019-07-03 13:24:38.471222723 +0200
-@@ -1247,13 +1247,6 @@
- %dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
- %{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
- %{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
--%dir %{python3_sitelib}/ipaclient/csrgen
--%dir %{python3_sitelib}/ipaclient/csrgen/profiles
--%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
--%dir %{python3_sitelib}/ipaclient/csrgen/rules
--%{python3_sitelib}/ipaclient/csrgen/rules/*.json
--%dir %{python3_sitelib}/ipaclient/csrgen/templates
--%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
- %{python3_sitelib}/ipaclient-*.egg-info
-
-
+#diff -urN freeipa-4.8.0/freeipa.spec.in freeipa-4.8.0.removed_csrgen/freeipa.spec.in
+#--- freeipa-4.8.0/freeipa.spec.in 2019-06-29 10:01:30.458735813 +0200
+#+++ freeipa-4.8.0.removed_csrgen/freeipa.spec.in 2019-07-03 13:24:38.471222723 +0200
+#@@ -1247,13 +1247,6 @@
+# %dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
+# %{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
+# %{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
+#-%dir %{python3_sitelib}/ipaclient/csrgen
+#-%dir %{python3_sitelib}/ipaclient/csrgen/profiles
+#-%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
+#-%dir %{python3_sitelib}/ipaclient/csrgen/rules
+#-%{python3_sitelib}/ipaclient/csrgen/rules/*.json
+#-%dir %{python3_sitelib}/ipaclient/csrgen/templates
+#-%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
+# %{python3_sitelib}/ipaclient-*.egg-info
+#
+#
diff -urN freeipa-4.8.0/ipaclient/csrgen/profiles/caIPAserviceCert.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/caIPAserviceCert.json
--- freeipa-4.8.0/ipaclient/csrgen/profiles/caIPAserviceCert.json 2019-07-03 08:42:41.844539797 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/caIPAserviceCert.json 1970-01-01 01:00:00.000000000 +0100
diff --git a/SOURCES/1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch b/SOURCES/1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch
index 981d18c..1c9c5b8 100644
--- a/SOURCES/1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch
+++ b/SOURCES/1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch
@@ -35,19 +35,19 @@ This reverts commit d986e844bbd37ccc7a532175631a55acd315cda3.
# - systemd
# - 389-ds-base-dev
# - libssl-dev
-diff --git a/freeipa.spec.in b/freeipa.spec.in
-index b6eb79593..a4682497a 100755
---- a/freeipa.spec.in
-+++ b/freeipa.spec.in
-@@ -191,7 +191,7 @@ BuildRequires: libsss_idmap-devel
- BuildRequires: libsss_certmap-devel
- BuildRequires: libsss_nss_idmap-devel >= %{sssd_version}
- BuildRequires: nodejs(abi)
--BuildRequires: python3-rjsmin
-+BuildRequires: uglify-js
- BuildRequires: libverto-devel
- BuildRequires: libunistring-devel
- # 0.13.0: https://bugzilla.redhat.com/show_bug.cgi?id=1584773
+#diff --git a/freeipa.spec.in b/freeipa.spec.in
+#index b6eb79593..a4682497a 100755
+#--- a/freeipa.spec.in
+#+++ b/freeipa.spec.in
+#@@ -191,7 +191,7 @@ BuildRequires: libsss_idmap-devel
+# BuildRequires: libsss_certmap-devel
+# BuildRequires: libsss_nss_idmap-devel >= %{sssd_version}
+# BuildRequires: nodejs(abi)
+#-BuildRequires: python3-rjsmin
+#+BuildRequires: uglify-js
+# BuildRequires: libverto-devel
+# BuildRequires: libunistring-devel
+# # 0.13.0: https://bugzilla.redhat.com/show_bug.cgi?id=1584773
diff --git a/install/ui/build/freeipa/Makefile.am b/install/ui/build/freeipa/Makefile.am
index f4d97819e..05e82f4da 100644
--- a/install/ui/build/freeipa/Makefile.am
@@ -98,37 +98,37 @@ index 2c4e0ecac..0772532d4 100644
-Full Dojo license is in LICENSE file.
+Full Dojo license is in LICENSE file.
\ No newline at end of file
-diff --git a/install/ui/util/compile.sh b/install/ui/util/compile.sh
-index 1516b815f..d14f90ab0 100755
---- a/install/ui/util/compile.sh
-+++ b/install/ui/util/compile.sh
-@@ -26,14 +26,14 @@ RDIR=$DIR/../release
- usage() {
- cat <<-__EOF__;
- NAME
-- compile.sh - Compiles layer file of Dojo build using Python rjsmin.
-+ compile.sh - Compiles layer file of Dojo build using uglify.js.
- Deletes all other files.
-
- SYNOPSIS
- path/to/compile.sh [--help] --release RELEASE --layer NAME/NAME
-
- DESCRIPTION
-- Compiles layer file of Dojo build output using Python rjsmin.
-+ Compiles layer file of Dojo build output using uglify.js.
- Deletes all other files.
-
- OPTIONS
-@@ -105,7 +105,7 @@ if [[ ! $OUTPUT_FILE ]] ; then
- OUTPUT_FILE=$RDIR/$RELEASE/$LAYER.js
- fi
-
--# compile using python rjsmin
-+# compile using uglifyjs
- echo "Minimizing: $RDIR/$RELEASE/$LAYER.js"
- echo "Target file: $OUTPUT_FILE"
--${PYTHON:-python3} -m rjsmin < $RDIR/$RELEASE/$LAYER.js > $OUTPUT_FILE
-+uglifyjs $RDIR/$RELEASE/$LAYER.js > $OUTPUT_FILE
---
-2.26.2
+#diff --git a/install/ui/util/compile.sh b/install/ui/util/compile.sh
+#index 1516b815f..d14f90ab0 100755
+#--- a/install/ui/util/compile.sh
+#+++ b/install/ui/util/compile.sh
+#@@ -26,14 +26,14 @@ RDIR=$DIR/../release
+# usage() {
+# cat <<-__EOF__;
+# NAME
+#- compile.sh - Compiles layer file of Dojo build using Python rjsmin.
+#+ compile.sh - Compiles layer file of Dojo build using uglify.js.
+# Deletes all other files.
+#
+# SYNOPSIS
+# path/to/compile.sh [--help] --release RELEASE --layer NAME/NAME
+#
+# DESCRIPTION
+#- Compiles layer file of Dojo build output using Python rjsmin.
+#+ Compiles layer file of Dojo build output using uglify.js.
+# Deletes all other files.
+#
+# OPTIONS
+#@@ -105,7 +105,7 @@ if [[ ! $OUTPUT_FILE ]] ; then
+# OUTPUT_FILE=$RDIR/$RELEASE/$LAYER.js
+# fi
+#
+#-# compile using python rjsmin
+#+# compile using uglifyjs
+# echo "Minimizing: $RDIR/$RELEASE/$LAYER.js"
+# echo "Target file: $OUTPUT_FILE"
+#-${PYTHON:-python3} -m rjsmin < $RDIR/$RELEASE/$LAYER.js > $OUTPUT_FILE
+#+uglifyjs $RDIR/$RELEASE/$LAYER.js > $OUTPUT_FILE
+#--
+#2.26.2
diff --git a/SOURCES/freeipa-4.8.7.tar.gz.asc b/SOURCES/freeipa-4.8.7.tar.gz.asc
deleted file mode 100644
index 0dae99e..0000000
--- a/SOURCES/freeipa-4.8.7.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEEhAodHH8+xLL+UwQ1RxniuKu/YhoFAl7hNhYACgkQRxniuKu/
-Yhq2rxAAnK8YHbQtivjssWz6BBRiU5TKootA3fSqfvbhACYG14629/Dpc5IIkYZ1
-0AE4CUFA7Oi92emFbxrLJyeSuxuzTxSVmydJ5HW/OTkRRSnmjL5oeBg2D++B9OaO
-qVAXRZbi5YNfW5y//9BIRzCGw0RHpbR/QjZ1ipDymky6nr5IS+EhfZ0iHeEyiNXd
-OP3OJv538HSvRrv3mJvz52pKVfegw1OTd8yUnmuPEc9ClQfPQHjXqsOeFYCbR8fg
-59y0twMMrOc2J4eL0OkNE/By+o+1vAMUwEs736sCdbJJPigerfuK0e7ZxP+x98BP
-bmIBxv7eUf20Rn3An7+vTqQP60V4tS+FOnc2LD3OpHH4vy34ovWZfYZWVKbg0z1+
-5E/0TWifhlibbRZctDaxkZfFVchQnixHnO0Awv8wNxRzh/XvvsTPz1zJXk5kHk3r
-Ws2/GbeWTiJLe8sIXJz0MNTayWLnsDJG6BCRf+K0HwCdL80p4TG71dTwa9PW5HEy
-UklxW/zfr+chS1AszNgb8wJa6WtDHfQnktJwSSj7CkD3JdUVx+L/cJiOfbCM+WUi
-BRzhVhNUDX/FkpGUyvC4AYXX+wcwHph9BDChUDqcG886aIK28TAsie3Vwz/F7hKP
-TYpF1+YIImcRfUQ737pnbHL12o5yzfhkBfD2GMsojEd0x71B3PY=
-=B33Z
------END PGP SIGNATURE-----
diff --git a/SOURCES/freeipa-4.9.0rc3.tar.gz.asc b/SOURCES/freeipa-4.9.0rc3.tar.gz.asc
new file mode 100644
index 0000000..a53a7fa
--- /dev/null
+++ b/SOURCES/freeipa-4.9.0rc3.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEhAodHH8+xLL+UwQ1RxniuKu/YhoFAl/SSecACgkQRxniuKu/
+YhrlPQ//a+dJrg29AsJIYlLbFqcR3IEtCtt7H2Mr6TJ2xWWg1oLTJhQslrf82YeN
+WznHHj09cHV1Ga0kGJmg+KhudpC7OFviUvxrz69+N3j6/+39OeWvOAEUQgCphZ7G
+/UnBTxW2Fhf8zklFf+vT7phcE0YemY4GNjyYJqni4/9uua0Q8pJJQTy30Yw6UrDL
+pXHjTVXgQv7Ryf/LWEMOaHKUGiZCsL59Chrp5uaefzIat8pHG2xnf1Ah6tUwG4Fs
+rf4QfgUW7Q2nwrAmZKzPvp3wQVFZZ5CiklSO9hfRwZ9De1wIdlUD66cmcE2TeJla
+7DpsfQPSCrghwmvPYpeJcwG2DrPoz3i1j14BQ//LqhAmsvJy5iFg3+tF1YcNYqnP
+neGK3/6QeUvKKe5H7VGMAA4N4YDMri8a8/QKgqG1lWf+X7x8d2lwlib2JNpNnN7N
+TlVTRWhKRvQyBn23uSdcLXdaVdU4Z++7yhHcveyGGDVtElFWeSV83d3ekVZ4rsoq
+stv7S2Ay8D6pH7fVd2aXA9i+r12BCF3Lmrikc+g+aAuJV5K3GwoCBwgWLCs0WXru
+Q67j99HZ4R+A4cNMZ8+VAUIzZT7S62aHX75lGgw/e3CvGoiIEosa01YdXiP+DT6V
+JFH5PnuKStu8LqrFpICgHFrFKQAHopKO9JVINGHwQB426xycwaM=
+=0OcN
+-----END PGP SIGNATURE-----
diff --git a/SPECS/ipa.spec b/SPECS/ipa.spec
index ba9d77e..db3673a 100644
--- a/SPECS/ipa.spec
+++ b/SPECS/ipa.spec
@@ -1,12 +1,24 @@
+# ipatests enabled by default, can be disabled with --without ipatests
+%bcond_without ipatests
+# default to not use XML-RPC in Rawhide, can be turned around with --with ipa_join_xml
+# On RHEL 8 we should use --with ipa_join_xml
+%bcond_without ipa_join_xml
+
+# Linting is disabled by default, needed for upstream testing
+%bcond_with lint
+
+# Build documentation with sphinx
+%bcond_with doc
+
+# Build Python wheels
+%bcond_with wheels
+
# 389-ds-base 1.4 no longer supports i686 platform, build only client
# packages, https://bugzilla.redhat.com/show_bug.cgi?id=1544386
-%if 0%{?fedora} >= 28 || 0%{?rhel} > 7
- %ifarch %{ix86}
- %{!?ONLY_CLIENT:%global ONLY_CLIENT 1}
- %endif
+%ifarch %{ix86}
+ %{!?ONLY_CLIENT:%global ONLY_CLIENT 1}
%endif
-
# Define ONLY_CLIENT to only make the ipa-client and ipa-python
# subpackages
%{!?ONLY_CLIENT:%global ONLY_CLIENT 0}
@@ -16,37 +28,27 @@
%global enable_server_option --enable-server
%endif
-# Build ipatests
-%if 0%{?rhel}
+%if %{ONLY_CLIENT}
%global with_ipatests 0
%endif
-%if ! %{ONLY_CLIENT}
- %{!?with_ipatests:%global with_ipatests 1}
-%endif
-%if 0%{?with_ipatests}
+
+# Whether to build ipatests
+%if %{with ipatests}
%global with_ipatests_option --with-ipatests
%else
%global with_ipatests_option --without-ipatests
%endif
-# Python 2/3 packages and default Python interpreter
-%if 0%{?rhel} > 7
- %global with_default_python 3
-%endif
-
-%if 0%{?fedora} >= 29
- # F29 only supports Python 3 as default Python
- %global with_default_python 3
+# Whether to use XML-RPC with ipa-join
+%if %{with ipa_join_xml}
+ %global with_ipa_join_xml_option --with-ipa-join-xml
+%else
+ %global with_ipa_join_xml_option --without-ipa-join-xml
%endif
-%{!?with_default_python:%global with_default_python 3}
-
-%global with_python3 1
-%global python %{__python3}
-
# lint is not executed during rpmbuild
# %%global with_lint 1
-%if 0%{?with_lint}
+%if %{with lint}
%global linter_options --enable-pylint --with-jslint
%else
%global linter_options --disable-pylint --without-jslint
@@ -68,43 +70,45 @@
%global python_netaddr_version 0.7.19
# Require 4.7.0 which brings Python 3 bindings
%global samba_version 4.12.3-12
-%global slapi_nis_version 0.56.4
-# Require 3.14.3-24 - Allow ipa_ods_exporter_t domain to read krb5_keytab files
-# SELinux context for /etc/named directory, RHBZ#1759495
%global selinux_policy_version 3.14.3-52
-%global slapi_nis_version 0.56.1-4
+%global slapi_nis_version 0.56.4
%global python_ldap_version 3.1.0-1
# python3-lib389
# Fix for "Installation fails: Replica Busy"
# https://pagure.io/389-ds-base/issue/49818
%global ds_version 1.4.2.4-6
-%global httpd_version 2.4.6-31
+# Fix for TLS 1.3 PHA, RHBZ#1775158
+%global httpd_version 2.4.37-21
+%global bind_version 9.11.20-6
%else
# Fedora
%global package_name freeipa
%global alt_name ipa
-# Fix for CVE-2018-20217
-%global krb5_version 1.17-17
-%global krb5_kdb_version 7.0
+# Fix for CVE-2020-28196
+%global krb5_version 1.18.2-29
# 0.7.16: https://github.com/drkjam/netaddr/issues/71
%global python_netaddr_version 0.7.16
# Require 4.7.0 which brings Python 3 bindings
# Require 4.12 which has DsRGetForestTrustInformation access rights fixes
-#global samba_version 2:4.12
-%global samba_version 2:4.9.0
-# SELinux context for /etc/named directory, RHBZ#1759495
-#global selinux_policy_version 3.14.3-52
-%global selinux_policy_version 3.14.3-41
-#global slapi_nis_version 0.56.4
-%global slapi_nis_version 0.56.3
+%global samba_version 2:4.12.10
+
+# 3.14.5-45 or later includes a number of interfaces fixes for IPA interface
+%global selinux_policy_version 3.14.5-45
+%global slapi_nis_version 0.56.5
+
+%global krb5_kdb_version 8.0
# fix for segfault in python3-ldap, https://pagure.io/freeipa/issue/7324
%global python_ldap_version 3.1.0-1
-# Fix for create suffix
-# https://pagure.io/389-ds-base/issue/49984
-%global ds_version 1.4.1.1
+# 1.4.3 moved nsslapd-db-locks to cn=bdb sub-entry
+# https://pagure.io/freeipa/issue/8515
+%global ds_version 1.4.3
+
+# Fix for TLS 1.3 PHA, RHBZ#1775146
+%global httpd_version 2.4.41-9
+%global bind_version 9.11.24-1
# Don't use Fedora's Python dependency generator on Fedora 30/rawhide yet.
# Some packages don't provide new dist aliases.
# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/
@@ -112,26 +116,45 @@
# Fedora
%endif
+# BIND employs 'pkcs11' OpenSSL engine instead of native PKCS11
+# Fedora 31+ uses OpenSSL engine, as well as Fedora ELN (RHEL9)
+%if 0%{?fedora} || 0%{?rhel} >= 9
+ %global openssl_pkcs11_version 0.4.10-6
+ %global softhsm_version 2.5.0-4
+%else
+ %global with_bind_pkcs11 1
+%endif
+
+%if 0%{?rhel} == 8
# PKIConnection has been modified to always validate certs.
# https://pagure.io/freeipa/issue/8379
%global pki_version 10.9.0-0.4
+%else
+# New KRA profile, ACME support
+# https://pagure.io/freeipa/issue/8545
+%global pki_version 10.10.0-2
+%endif
-# https://pagure.io/certmonger/issue/90
+# RHEL 8.3+, F32+ has 0.79.13
%global certmonger_version 0.79.7-3
-# NSS release with fix for p11-kit-proxy issue, affects F28
-# https://pagure.io/freeipa/issue/7810
-%if 0%{?fedora} == 28
-%global nss_version 3.41.0-3
-%else
+# RHEL 8.2+, F32+ has 3.58
%global nss_version 3.44.0-4
-%endif
-%global sssd_version 2.2.3-11
+# RHEL 8.3+, F32+
+%global sssd_version 2.4.0
-%define krb5_base_version %(LC_ALL=C rpm -q --qf '%%{VERSION}' krb5-devel | grep -Eo '^[^.]+\.[^.]+')
+%define krb5_base_version %(LC_ALL=C /usr/bin/pkgconf --modversion krb5 | grep -Eo '^[^.]+\.[^.]+' || echo %krb5_version)
%global kdcproxy_version 0.4-3
+%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
+# systemd with resolved enabled
+# see https://pagure.io/freeipa/issue/8275
+%global systemd_version 246.6-3
+%else
+%global systemd_version 239
+%endif
+
%global plugin_dir %{_libdir}/dirsrv/plugins
%global etc_systemd_dir %{_sysconfdir}/systemd/system
%global gettext_domain ipa
@@ -140,22 +163,29 @@
# Work-around fact that RPM SPEC parser does not accept
# "Version: @VERSION@" in freeipa.spec.in used for Autoconf string replacement
-%define IPA_VERSION 4.8.7
+%define IPA_VERSION 4.9.0
+# Release candidate version -- uncomment with one percent for RC versions
+%global rc_version rc3
%define AT_SIGN @
# redefine IPA_VERSION only if its value matches the Autoconf placeholder
%if "%{IPA_VERSION}" == "%{AT_SIGN}VERSION%{AT_SIGN}"
%define IPA_VERSION nonsense.to.please.RPM.SPEC.parser
%endif
+%define NON_DEVELOPER_BUILD ("%{lua: print(rpm.expand('%{suffix:%IPA_VERSION}'):find('^dev'))}" == "nil")
+
Name: %{package_name}
Version: %{IPA_VERSION}
-Release: 12%{?dist}
+Release: 0.5%{?rc_version:.%rc_version}%{?dist}
Summary: The Identity, Policy and Audit system
License: GPLv3+
URL: http://www.freeipa.org/
-Source0: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz
-Source1: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz.asc
+Source0: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz
+# Only use detached signature for the distribution builds. If it is a developer build, skip it
+%if %{NON_DEVELOPER_BUILD}
+Source1: https://releases.pagure.org/freeipa/freeipa-%{version}%{?rc_version}.tar.gz.asc
+%endif
# RHEL spec file only: START: Change branding to IPA and Identity Management
# Moved branding logos and background to redhat-logos-ipa-80.4:
@@ -164,31 +194,14 @@ Source1: https://releases.pagure.org/freeipa/freeipa-%{version}.tar.gz.as
# RHEL spec file only: END: Change branding to IPA and Identity Management
# RHEL spec file only: START
-Patch0001: 0001-WebUI-Fix-IPA-Error-3007-RequirmentError-while-addin_rhbz#1757045.patch
-Patch0002: 0002-EPN-does-not-ship-its-default-configuration_rhbz#1847999.patch
-Patch0003: 0003-Use-256-bit-AJP-secret_rhbz#1849914.patch
-Patch0004: 0004-baseuser-fix-ipanthomedirectorydrive-option-name_rhbz#1851411.patch
-Patch0005: 0005-selinux-don-t-audit-rules-deny-fetching-trust-topology_rhbz#1845596.patch
-Patch0006: 0006-fix-iPAddress-cert-issuance-for-1-host-service_rhbz#1846352.patch
-Patch0007: 0007-Specify-cert_paths-when-calling-PKIConnection_rhbz#1849155.patch
-Patch0008: 0008-Add-missing-SELinux-rule-for-ipa-custodia.sock_rhbz#1857157.patch
-Patch0009: 0009-ipa-client-install-use-the-authselect-backup-during_rhbz#1810179.patch
-Patch0010: 0010-Replace-SSLCertVerificationError-with-CertificateErr_rhbz#1858318.patch
-Patch0011: 0011-Fix-AVC-denial-during-ipa-adtrust-install---add-agents_rhbz#1859213.patch
-Patch0012: 0012-CAless-installation-set-the-perms-on-KDC-cert-file_rhbz#1863616.patch
-Patch0013: 0013-IPA-EPN-Use-a-helper-to-retrieve-LDAP-attributes-fro_rhbz#1866938.patch
-Patch0014: 0014-IPA-EPN-enhance-input-validation_rhbz#1866291.patch
-Patch0015: 0015-IPA-EPN-Fix-SMTP-connection-error-handling_rhbz#1863079.patch
-Patch0016: 0016-Set-mode-of-etc-ipa-ca.crt-to-0644-in-CA-less-instal_rhbz#1870202.patch
-Patch0017: 0017-SELinux-Policy-let-custodia-replicate-keys_rhbz#1868432.patch
-Patch0018: 0018-dogtaginstance.py-add-debug-to-pkispawn_rhbz#1879604.patch
-Patch0019: 0019-SELinux-add-dedicated-policy-for-ipa-pki-retrieve-key-ipatests-enhance-TestSubCAkeyReplication_rhbz#1870202.patch
-Patch0020: 0020-SELinux-do-not-double-define-node_t-and-pki_tomcat_c_rhbz#1870202.patch
+%if 0%{?rhel} == 8 && %{NON_DEVELOPER_BUILD}
Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch
Patch1002: 1002-4.8.0-Remove-csrgen.patch
Patch1003: 1003-Revert-WebUI-use-python3-rjsmin-to-minify-JavaScript.patch
+%endif
# RHEL spec file only: END
+
# For the timestamp trick in patch application
BuildRequires: diffstat
@@ -198,20 +211,29 @@ BuildRequires: openldap-devel
# DAL version change may cause code crash or memory leaks, it is better to fail early.
BuildRequires: krb5-kdb-version = %{krb5_kdb_version}
BuildRequires: krb5-kdb-devel-version = %{krb5_kdb_version}
+BuildRequires: krb5-devel >= %{krb5_version}
+BuildRequires: pkgconfig(krb5)
+%if %{with ipa_join_xml}
# 1.27.4: xmlrpc_curl_xportparms.gssapi_delegation
BuildRequires: xmlrpc-c-devel >= 1.27.4
+%else
+BuildRequires: libcurl-devel
+BuildRequires: jansson-devel
+%endif
BuildRequires: popt-devel
BuildRequires: gcc
BuildRequires: make
BuildRequires: pkgconfig
+BuildRequires: pkgconf
BuildRequires: autoconf
BuildRequires: automake
+BuildRequires: make
BuildRequires: libtool
BuildRequires: gettext
BuildRequires: gettext-devel
BuildRequires: python3-devel
BuildRequires: python3-setuptools
-BuildRequires: systemd
+BuildRequires: systemd >= %{systemd_version}
# systemd-tmpfiles which is executed from make install requires apache user
BuildRequires: httpd
BuildRequires: nspr-devel
@@ -224,17 +246,23 @@ BuildRequires: samba-devel >= %{samba_version}
BuildRequires: libtalloc-devel
BuildRequires: libtevent-devel
BuildRequires: libuuid-devel
+BuildRequires: libpwquality-devel
BuildRequires: libsss_idmap-devel
BuildRequires: libsss_certmap-devel
-# 1.15.3: sss_nss_getlistbycert (https://pagure.io/SSSD/sssd/issue/3050)
BuildRequires: libsss_nss_idmap-devel >= %{sssd_version}
-BuildRequires: nodejs
+BuildRequires: nodejs(abi)
+# use old dependency on RHEL 8 for now
+%if 0%{?fedora} >= 31 || 0%{?rhel} >= 9
+BuildRequires: python3-rjsmin
+%else
BuildRequires: uglify-js
+%endif
BuildRequires: libverto-devel
BuildRequires: libunistring-devel
# 0.13.0: https://bugzilla.redhat.com/show_bug.cgi?id=1584773
# 0.13.0-2: fix for missing dependency on python-six
BuildRequires: python3-lesscpy >= 0.13.0-2
+BuildRequires: cracklib-dicts
# ONLY_CLIENT
%endif
@@ -249,11 +277,12 @@ BuildRequires: python3-netaddr >= %{python_netaddr_version}
BuildRequires: python3-pyasn1
BuildRequires: python3-pyasn1-modules
BuildRequires: python3-six
+BuildRequires: python3-psutil
#
# Build dependencies for wheel packaging and PyPI upload
#
-%if 0%{?with_wheels}
+%if %{with wheels}
BuildRequires: dbus-glib-devel
BuildRequires: libffi-devel
BuildRequires: python3-tox
@@ -266,14 +295,22 @@ BuildRequires: python3-wheel
# with_wheels
%endif
+%if %{with doc}
+BuildRequires: python3-sphinx
+BuildRequires: python3-m2r
+%endif
+
#
# Build dependencies for lint and fastcheck
#
-%if 0%{?with_lint}
+%if %{with lint}
+BuildRequires: git
BuildRequires: jsl
+BuildRequires: nss-tools
BuildRequires: rpmlint
BuildRequires: softhsm
+BuildRequires: keyutils
BuildRequires: python3-augeas
BuildRequires: python3-cffi
BuildRequires: python3-cryptography >= 1.6
@@ -281,6 +318,7 @@ BuildRequires: python3-custodia >= 0.3.1
BuildRequires: python3-dateutil
BuildRequires: python3-dbus
BuildRequires: python3-dns >= 1.15
+BuildRequires: python3-docker
BuildRequires: python3-gssapi >= 1.2.0
BuildRequires: python3-jinja2
BuildRequires: python3-jwcrypto >= 0.4.2
@@ -298,7 +336,7 @@ BuildRequires: python3-polib
BuildRequires: python3-pyasn1
BuildRequires: python3-pyasn1-modules
BuildRequires: python3-pycodestyle
-%if 0%{?fedora} >= 29
+%if 0%{?fedora} || 0%{?rhel} > 8
# https://bugzilla.redhat.com/show_bug.cgi?id=1648299
BuildRequires: python3-pylint >= 2.1.1-2
%else
@@ -313,6 +351,7 @@ BuildRequires: python3-sss
BuildRequires: python3-sss-murmur
BuildRequires: python3-sssdconfig >= %{sssd_version}
BuildRequires: python3-systemd
+BuildRequires: python3-yaml
BuildRequires: python3-yubico
# with_lint
%endif
@@ -328,7 +367,7 @@ BuildRequires: krb5-server >= %{krb5_version}
%endif
# Build dependencies for SELinux policy
-%if 0%{?with_selinux}
+%if %{with selinux}
BuildRequires: selinux-policy-devel >= %{selinux_policy_version}
%endif
@@ -353,7 +392,8 @@ Requires: 389-ds-base >= %{ds_version}
Requires: openldap-clients > 2.4.35-4
Requires: nss-tools >= %{nss_version}
Requires(post): krb5-server >= %{krb5_version}
-Requires(post): krb5-kdb-version = %{krb5_kdb_version}
+Requires(post): krb5-server >= %{krb5_base_version}
+Requires: krb5-kdb-version = %{krb5_kdb_version}
Requires: krb5-pkinit-openssl >= %{krb5_version}
Requires: cyrus-sasl-gssapi%{?_isa}
Requires: chrony
@@ -369,17 +409,19 @@ Requires: mod_session >= %{httpd_version}
# 0.9.9: https://github.com/adelton/mod_lookup_identity/pull/3
Requires: mod_lookup_identity >= 0.9.9
Requires: acl
-Requires: systemd-units >= 38
+Requires: systemd-units >= %{systemd_version}
+Requires(pre): systemd-units >= %{systemd_version}
+Requires(post): systemd-units >= %{systemd_version}
+Requires(preun): systemd-units >= %{systemd_version}
+Requires(postun): systemd-units >= %{systemd_version}
Requires(pre): shadow-utils
-Requires(pre): systemd-units
-Requires(post): systemd-units
Requires: selinux-policy >= %{selinux_policy_version}
Requires(post): selinux-policy-base >= %{selinux_policy_version}
Requires: slapi-nis >= %{slapi_nis_version}
Requires: pki-ca >= %{pki_version}
Requires: pki-kra >= %{pki_version}
-Requires(preun): systemd-units
-Requires(postun): systemd-units
+# pki-acme package was split out in pki-10.10.0
+Requires: (pki-acme >= %{pki_version} if pki-ca >= 10.10.0)
Requires: policycoreutils >= 2.1.12-5
Requires: tar
Requires(pre): certmonger >= %{certmonger_version}
@@ -395,6 +437,8 @@ Requires: oddjob
# 0.7.0-2: https://pagure.io/gssproxy/pull-request/172
Requires: gssproxy >= 0.7.0-2
Requires: sssd-dbus >= %{sssd_version}
+Requires: libpwquality
+Requires: cracklib-dicts
Provides: %{alt_name}-server = %{version}
Conflicts: %{alt_name}-server
@@ -412,8 +456,10 @@ Obsoletes: %{name}-server <= 4.2.0
Conflicts: nss-pam-ldapd < 0.8.4
# RHEL spec file only: START: Do not build tests
+%if 0%{?rhel} == 8
# ipa-tests subpackage was moved to separate srpm
Conflicts: ipa-tests < 3.3.3-9
+%endif
# RHEL spec file only: END: Do not build tests
%description server
@@ -444,7 +490,14 @@ Requires: python3-lxml
Requires: python3-pki >= %{pki_version}
Requires: python3-pyasn1 >= 0.3.2-2
Requires: python3-sssdconfig >= %{sssd_version}
+Requires: python3-psutil
Requires: rpm-libs
+# Indirect dependency: use newer urllib3 with TLS 1.3 PHA support
+%if 0%{?rhel}
+Requires: python3-urllib3 >= 1.24.2-3
+%else
+Requires: python3-urllib3 >= 1.25.7
+%endif
%description -n python3-ipaserver
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -460,9 +513,9 @@ Summary: Common files used by IPA server
BuildArch: noarch
Requires: %{name}-client-common = %{version}-%{release}
Requires: httpd >= %{httpd_version}
-Requires: systemd-units >= 38
+Requires: systemd-units >= %{systemd_version}
Requires: custodia >= 0.3.1
-%if 0%{?rhel} > 7
+%if 0%{?rhel} >= 8
Requires: redhat-logos-ipa >= 80.4
%endif
@@ -484,11 +537,18 @@ Summary: IPA integrated DNS server with support for automatic DNSSEC signing
BuildArch: noarch
Requires: %{name}-server = %{version}-%{release}
Requires: bind-dyndb-ldap >= 11.2-2
-Requires: bind >= 9.11.0-6.P2
-Requires: bind-utils >= 9.11.0-6.P2
-Requires: bind-pkcs11 >= 9.11.0-6.P2
-Requires: bind-pkcs11-utils >= 9.11.0-6.P2
-Requires: opendnssec >= 1.4.6-4
+Requires: bind >= %{bind_version}
+Requires: bind-utils >= %{bind_version}
+%if %{with bind_pkcs11}
+Requires: bind-pkcs11 >= %{bind_version}
+Requires: bind-pkcs11-utils >= %{bind_version}
+%else
+Requires: softhsm >= %{softhsm_version}
+Requires: openssl-pkcs11 >= %{openssl_pkcs11_version}
+%endif
+# See https://bugzilla.redhat.com/show_bug.cgi?id=1825812
+# RHEL 8.3+ and Fedora 32+ have 2.1
+Requires: opendnssec >= 2.1.6-5
%{?systemd_requires}
Provides: %{alt_name}-server-dns = %{version}
@@ -511,8 +571,9 @@ Requires: %{name}-common = %{version}-%{release}
Requires: samba >= %{samba_version}
Requires: samba-winbind
Requires: libsss_idmap
+%if 0%{?rhel}
Obsoletes: ipa-idoverride-memberof-plugin <= 0.1
-
+%endif
Requires(post): python3
Requires: python3-samba
Requires: python3-libsss_nss_idmap
@@ -553,9 +614,14 @@ Requires: krb5-workstation >= %{krb5_version}
Requires: authselect >= 0.4-2
Requires: curl
# NIS domain name config: /usr/lib/systemd/system/*-domainname.service
+# All Fedora 28+ and RHEL8+ contain the service in hostname package
Requires: hostname
Requires: libcurl >= 7.21.7-2
+%if %{with ipa_join_xml}
Requires: xmlrpc-c >= 1.27.4
+%else
+Requires: jansson
+%endif
Requires: sssd-ipa >= %{sssd_version}
Requires: certmonger >= %{certmonger_version}
Requires: nss-tools >= %{nss_version}
@@ -579,8 +645,10 @@ Obsoletes: %{alt_name}-admintools < 4.4.1
Obsoletes: %{name}-admintools < 4.4.1
Provides: %{name}-admintools = %{version}-%{release}
+%if 0%{?rhel} == 8
# Conflict with crypto-policies < 20200629-1 to get AD-SUPPORT policy module
Conflicts: crypto-policies < 20200629-1
+%endif
%description client
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -609,16 +677,18 @@ Requires: cifs-utils
This package provides command-line tools to deploy Samba domain member
on the machine enrolled into a FreeIPA environment
-%if ! %{ONLY_CLIENT}
%package client-epn
Summary: Tools to configure Expiring Password Notification in IPA
Group: System Environment/Base
Requires: %{name}-client = %{version}-%{release}
+Requires: systemd-units >= %{systemd_version}
+Requires(post): systemd-units >= %{systemd_version}
+Requires(preun): systemd-units >= %{systemd_version}
+Requires(postun): systemd-units >= %{systemd_version}
%description client-epn
This package provides a service to collect and send expiring password
notifications via email (SMTP).
-%endif
%package -n python3-ipaclient
Summary: Python libraries used by IPA client
@@ -630,7 +700,6 @@ Requires: python3-ipalib = %{version}-%{release}
Requires: python3-augeas
Requires: python3-dns >= 1.15
Requires: python3-jinja2
-# RHEL spec file only: DELETED: Remove csrgen
%description -n python3-ipaclient
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -641,7 +710,6 @@ and integration with Active Directory based infrastructures (Trusts).
If your network uses IPA for authentication, this package should be
installed on every client machine.
-
%package client-common
Summary: Common files used by IPA client
BuildArch: noarch
@@ -649,6 +717,12 @@ BuildArch: noarch
Provides: %{alt_name}-client-common = %{version}
Conflicts: %{alt_name}-client-common
Obsoletes: %{alt_name}-client-common < %{version}
+# python2-ipa* packages are no longer available in 4.8.
+Obsoletes: python2-ipaclient < 4.8.0-1
+Obsoletes: python2-ipalib < 4.8.0-1
+Obsoletes: python2-ipaserver < 4.8.0-1
+Obsoletes: python2-ipatests < 4.8.0-1
+
%description client-common
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -744,11 +818,11 @@ Obsoletes: %{alt_name}-common < %{version}
Conflicts: %{alt_name}-python < %{version}
-%if 0%{?with_selinux}
+%if %{with selinux}
# This ensures that the *-selinux package and all it’s dependencies are not
# pulled into containers and other systems that do not use SELinux. The
# policy defines types and file contexts for client and server.
-Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
+Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
%endif
%description common
@@ -760,7 +834,7 @@ and integration with Active Directory based infrastructures (Trusts).
If you are using IPA, you need to install this package.
-%if 0%{?with_ipatests}
+%if %{with ipatests}
%package -n python3-ipatests
Summary: IPA tests and test tools
@@ -769,18 +843,25 @@ BuildArch: noarch
Requires: python3-ipaclient = %{version}-%{release}
Requires: python3-ipaserver = %{version}-%{release}
Requires: iptables
-Requires: ldns-utils
Requires: python3-coverage
Requires: python3-cryptography >= 1.6
+%if 0%{?fedora}
+# These packages do not exist on RHEL and for ipatests use
+# they are installed on the controller through other means
+Requires: ldns-utils
Requires: python3-polib
Requires: python3-pytest >= 3.9.1
Requires: python3-pytest-multihost >= 0.5
Requires: python3-pytest-sourceorder
+Requires: sshpass
+%endif
Requires: python3-sssdconfig >= %{sssd_version}
Requires: tar
Requires: xz
Requires: openssh-clients
-Requires: sshpass
+%if 0%{?rhel}
+AutoReqProv: no
+%endif
%description -n python3-ipatests
IPA is an integrated solution to provide centrally managed Identity (users,
@@ -790,11 +871,11 @@ features for further integration with Linux based clients (SUDO, automount)
and integration with Active Directory based infrastructures (Trusts).
This package contains tests that verify IPA functionality under Python 3.
-# with_ipatests
+# with ipatests
%endif
-%if 0%{?with_selinux}
+%if %{with selinux}
# SELinux subpackage
%package selinux
Summary: FreeIPA SELinux policy
@@ -805,12 +886,11 @@ Requires(post): selinux-policy-%{selinuxtype}
%description selinux
Custom SELinux policy module for FreeIPA
-# with_selinux
+# with selinux
%endif
%prep
-# RHEL spec file only: START
# Update timestamps on the files touched by a patch, to avoid non-equal
# .pyc/.pyo files across the multilib peers within a build, where "Level"
# is the patch prefix option (e.g. -p1)
@@ -826,9 +906,7 @@ UpdateTimestamps() {
done
}
-%setup -n freeipa-%{version} -q
-
-# RHEL spec file only: START
+%setup -n freeipa-%{version}%{?rc_version} -q
# To allow proper application patches to the stripped po files, strip originals
pushd po
@@ -843,28 +921,17 @@ for p in %patches ; do
UpdateTimestamps -p1 $p
done
-# RHEL spec file only: END
-
-# RHEL spec file only: START
-# Moved branding logos and background to redhat-logos-ipa-80.4:
-# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
-# product-name.png
-# RHEL spec file only: END
-
%build
-# RHEL spec file only: START
-autoreconf -i -f
-# RHEL spec file only: END
-
# PATH is workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1005235
export PATH=/usr/bin:/usr/sbin:$PATH
export PYTHON=%{__python3}
+autoreconf -ivf
%configure --with-vendor-suffix=-%{release} \
%{enable_server_option} \
%{with_ipatests_option} \
- %{linter_options} \
- --with-ipaplatform=rhel
+ %{with_ipa_join_xml_option} \
+ %{linter_options}
# run build in default dir
# -Onone is workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1398405
@@ -884,18 +951,29 @@ make %{?_smp_mflags} check VERBOSE=yes LIBDIR=%{_libdir}
# All files and directories created by spec install should be marked as ghost.
# (These are typically configuration files created by IPA installer.)
# All other artifacts should be created by make install.
-#
-%{__make} python_install DESTDIR=%{?buildroot} INSTALL="%{__install} -p"
-
-# default installation
-# This installs all Python packages twice and overrides the ipa-test
-# commands. We'll fix the command links later with ln --force.
%make_install
+# don't package ipasphinx for now
+rm -rf %{buildroot}%{python3_sitelib}/ipasphinx*
+
+%if %{with ipatests}
+mv %{buildroot}%{_bindir}/ipa-run-tests %{buildroot}%{_bindir}/ipa-run-tests-%{python3_version}
+mv %{buildroot}%{_bindir}/ipa-test-config %{buildroot}%{_bindir}/ipa-test-config-%{python3_version}
+mv %{buildroot}%{_bindir}/ipa-test-task %{buildroot}%{_bindir}/ipa-test-task-%{python3_version}
+ln -rs %{buildroot}%{_bindir}/ipa-run-tests-%{python3_version} %{buildroot}%{_bindir}/ipa-run-tests-3
+ln -rs %{buildroot}%{_bindir}/ipa-test-config-%{python3_version} %{buildroot}%{_bindir}/ipa-test-config-3
+ln -rs %{buildroot}%{_bindir}/ipa-test-task-%{python3_version} %{buildroot}%{_bindir}/ipa-test-task-3
+ln -frs %{buildroot}%{_bindir}/ipa-run-tests-%{python3_version} %{buildroot}%{_bindir}/ipa-run-tests
+ln -frs %{buildroot}%{_bindir}/ipa-test-config-%{python3_version} %{buildroot}%{_bindir}/ipa-test-config
+ln -frs %{buildroot}%{_bindir}/ipa-test-task-%{python3_version} %{buildroot}%{_bindir}/ipa-test-task
+# with_ipatests
+%endif
+
# remove files which are useful only for make uninstall
find %{buildroot} -wholename '*/site-packages/*/install_files.txt' -exec rm {} \;
+%if 0%{?rhel}
# RHEL spec file only: START
# Moved branding logos and background to redhat-logos-ipa-80.4:
# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
@@ -904,6 +982,7 @@ rm -f %{buildroot}%{_usr}/share/ipa/ui/images/header-logo.png
rm -f %{buildroot}%{_usr}/share/ipa/ui/images/login-screen-background.jpg
rm -f %{buildroot}%{_usr}/share/ipa/ui/images/login-screen-logo.png
rm -f %{buildroot}%{_usr}/share/ipa/ui/images/product-name.png
+%endif
# RHEL spec file only: END
%find_lang %{gettext_domain}
@@ -955,18 +1034,6 @@ mkdir -p %{buildroot}%{_sysconfdir}/cron.d
# ONLY_CLIENT
%endif
-%if %{ONLY_CLIENT}
-# Remove ipa-epn parts as we don't have ipa-epn systemd integration generated
-# for client-only build
-rm %{buildroot}/%{_sbindir}/ipa-epn
-rm %{buildroot}/%{_sysconfdir}/ipa/epn.conf
-rm -rf %{buildroot}/%{_sysconfdir}/ipa/epn
-rm %{buildroot}/%{_mandir}/man1/ipa-epn.1*
-rm %{buildroot}/%{_mandir}/man5/epn.conf.5*
-rm %{buildroot}/%{_unitdir}/ipa-epn.service
-rm %{buildroot}/%{_unitdir}/ipa-epn.timer
-%endif
-
%if ! %{ONLY_CLIENT}
%post server
@@ -983,7 +1050,7 @@ fi
%posttrans server
# don't execute upgrade and restart of IPA when server is not installed
-%{python} -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
+%{__python3} -c "import sys; from ipalib import facts; sys.exit(0 if facts.is_ipa_configured() else 1);" > /dev/null 2>&1
if [ $? -eq 0 ]; then
# This is necessary for Fedora system upgrades which by default
@@ -999,6 +1066,11 @@ if [ $? -eq 0 ]; then
if [ $? -eq 0 ]; then
/bin/systemctl restart ipa.service >/dev/null
fi
+
+ /bin/systemctl is-enabled ipa-ccache-sweep.timer >/dev/null 2>&1
+ if [ $? -eq 1 ]; then
+ /bin/systemctl enable ipa-ccache-sweep.timer>/dev/null
+ fi
fi
# END
@@ -1062,7 +1134,7 @@ fi
%posttrans server-trust-ad
-%{python} -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
+%{__python3} -c "import sys; from ipalib import facts; sys.exit(0 if facts.is_ipa_configured() else 1);" > /dev/null 2>&1
if [ $? -eq 0 ]; then
# NOTE: systemd specific section
/bin/systemctl try-restart httpd.service >/dev/null 2>&1 || :
@@ -1080,6 +1152,17 @@ fi
# ONLY_CLIENT
%endif
+%preun client-epn
+%systemd_preun ipa-epn.service
+%systemd_preun ipa-epn.timer
+
+%postun client-epn
+%systemd_postun ipa-epn.service
+%systemd_postun ipa-epn.timer
+
+%post client-epn
+%systemd_post ipa-epn.service
+%systemd_post ipa-epn.timer
%post client
if [ $1 -gt 1 ] ; then
@@ -1103,20 +1186,17 @@ if [ $1 -gt 1 ] ; then
cp /etc/ipa/ca.crt /var/lib/ipa-client/pki/ca-bundle.pem
fi
- %{python} -c 'from ipaclient.install.client import configure_krb5_snippet; configure_krb5_snippet()' >>/var/log/ipaupgrade.log 2>&1
- fi
-
- if [ $restore -ge 2 ]; then
- %{python} -c 'from ipaclient.install.client import update_ipa_nssdb; update_ipa_nssdb()' >/var/log/ipaupgrade.log 2>&1
- fi
-
- if [ $restore -ge 2 ]; then
- sed -E --in-place=.orig 's/^(HostKeyAlgorithms ssh-rsa,ssh-dss)$/# disabled by ipa-client update\n# \1/' /etc/ssh/ssh_config
+ %{__python3} -c 'from ipaclient.install.client import configure_krb5_snippet; configure_krb5_snippet()' >>/var/log/ipaupgrade.log 2>&1
+ %{__python3} -c 'from ipaclient.install.client import update_ipa_nssdb; update_ipa_nssdb()' >>/var/log/ipaupgrade.log 2>&1
+ SSH_CLIENT_SYSTEM_CONF="/etc/ssh/ssh_config"
+ if [ -f "$SSH_CLIENT_SYSTEM_CONF" ]; then
+ sed -E --in-place=.orig 's/^(HostKeyAlgorithms ssh-rsa,ssh-dss)$/# disabled by ipa-client update\n# \1/' "$SSH_CLIENT_SYSTEM_CONF"
+ fi
fi
fi
-%if 0%{?with_selinux}
+%if %{with selinux}
# SELinux contexts are saved so that only affected files can be
# relabeled after the policy module installation
%pre selinux
@@ -1138,7 +1218,7 @@ fi
%endif
-%triggerin client -- openssh-server
+%triggerin client -- openssh-server < 8.2
# Has the client been configured?
restore=0
test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
@@ -1174,6 +1254,38 @@ if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
fi
+%triggerin client -- openssh-server >= 8.2
+# Has the client been configured?
+restore=0
+test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
+
+if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
+ # If the snippet already exists, skip
+ if [ ! -f '/etc/ssh/sshd_config.d/04-ipa.conf' ]; then
+ # Take the values from /etc/ssh/sshd_config and put them in 04-ipa.conf
+ grep -E '^(PubkeyAuthentication|KerberosAuthentication|GSSAPIAuthentication|UsePAM|ChallengeResponseAuthentication|AuthorizedKeysCommand|AuthorizedKeysCommandUser)' /etc/ssh/sshd_config 2>/dev/null > /etc/ssh/sshd_config.d/04-ipa.conf
+ # Remove the values from sshd_conf
+ sed -ri '
+ /^(PubkeyAuthentication|KerberosAuthentication|GSSAPIAuthentication|UsePAM|ChallengeResponseAuthentication|AuthorizedKeysCommand|AuthorizedKeysCommandUser)[ \t]/ d
+ ' /etc/ssh/sshd_config
+
+ /bin/systemctl condrestart sshd.service 2>&1 || :
+ fi
+ # If the snippet has been created, ensure that it is included
+ # either by /etc/ssh/sshd_config.d/*.conf or directly
+ if [ -f '/etc/ssh/sshd_config.d/04-ipa.conf' ]; then
+ if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/\*\.conf' /etc/ssh/sshd_config 2> /dev/null ; then
+ if ! grep -E -q '^\s*Include\s*/etc/ssh/sshd_config.d/04-ipa\.conf' /etc/ssh/sshd_config 2> /dev/null ; then
+ # Include the snippet
+ echo "Include /etc/ssh/sshd_config.d/04-ipa.conf" > /etc/ssh/sshd_config.ipanew
+ cat /etc/ssh/sshd_config >> /etc/ssh/sshd_config.ipanew
+ mv -fZ --backup=existing --suffix .ipaold /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
+ fi
+ fi
+ fi
+fi
+
+
%if ! %{ONLY_CLIENT}
%files server
@@ -1202,14 +1314,11 @@ fi
%{_sbindir}/ipa-pkinit-manage
%{_sbindir}/ipa-crlgen-manage
%{_sbindir}/ipa-cert-fix
+%{_sbindir}/ipa-acme-manage
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
%{_libexecdir}/certmonger/ipa-server-guard
%dir %{_libexecdir}/ipa
-%dir %{_libexecdir}/ipa/custodia
-%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-dmldap
-%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-pki-tomcat
-%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-pki-tomcat-wrapped
-%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-ra-agent
+%{_libexecdir}/ipa/ipa-ccache-sweeper
%{_libexecdir}/ipa/ipa-custodia
%{_libexecdir}/ipa/ipa-custodia-check
%{_libexecdir}/ipa/ipa-httpd-kdcproxy
@@ -1218,6 +1327,11 @@ fi
%{_libexecdir}/ipa/ipa-pki-wait-running
%{_libexecdir}/ipa/ipa-otpd
%{_libexecdir}/ipa/ipa-print-pac
+%dir %{_libexecdir}/ipa/custodia
+%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-dmldap
+%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-pki-tomcat
+%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-pki-tomcat-wrapped
+%attr(755,root,root) %{_libexecdir}/ipa/custodia/ipa-custodia-ra-agent
%dir %{_libexecdir}/ipa/oddjob
%attr(0755,root,root) %{_libexecdir}/ipa/oddjob/org.freeipa.server.conncheck
%attr(0755,root,root) %{_libexecdir}/ipa/oddjob/org.freeipa.server.trust-enable-agent
@@ -1229,6 +1343,8 @@ fi
%attr(644,root,root) %{_unitdir}/ipa.service
%attr(644,root,root) %{_unitdir}/ipa-otpd.socket
%attr(644,root,root) %{_unitdir}/ipa-otpd@.service
+%attr(644,root,root) %{_unitdir}/ipa-ccache-sweep.service
+%attr(644,root,root) %{_unitdir}/ipa-ccache-sweep.timer
# END
%attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so
%attr(755,root,root) %{plugin_dir}/libipa_enrollment_extop.so
@@ -1237,7 +1353,6 @@ fi
%attr(755,root,root) %{plugin_dir}/libipa_uuid.so
%attr(755,root,root) %{plugin_dir}/libipa_modrdn.so
%attr(755,root,root) %{plugin_dir}/libipa_lockout.so
-%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
%attr(755,root,root) %{plugin_dir}/libipa_dns.so
%attr(755,root,root) %{plugin_dir}/libipa_range_check.so
%attr(755,root,root) %{plugin_dir}/libipa_otp_counter.so
@@ -1270,6 +1385,7 @@ fi
%{_mandir}/man1/ipa-pkinit-manage.1*
%{_mandir}/man1/ipa-crlgen-manage.1*
%{_mandir}/man1/ipa-cert-fix.1*
+%{_mandir}/man1/ipa-acme-manage.1*
%files -n python3-ipaserver
@@ -1294,6 +1410,7 @@ fi
%{_usr}/share/ipa/kdcproxy.wsgi
%{_usr}/share/ipa/ipaca*.ini
%{_usr}/share/ipa/*.ldif
+%exclude %{_datadir}/ipa/ipa-cldap-conf.ldif
%{_usr}/share/ipa/*.uldif
%{_usr}/share/ipa/*.template
%dir %{_usr}/share/ipa/advise
@@ -1326,10 +1443,15 @@ fi
%{_usr}/share/ipa/ui/js/freeipa/core.js
%dir %{_usr}/share/ipa/ui/js/plugins
%dir %{_usr}/share/ipa/ui/images
+%if 0%{?rhel}
%{_usr}/share/ipa/ui/images/facet-*.png
# Moved branding logos and background to redhat-logos-ipa-80.4:
# header-logo.png, login-screen-background.jpg, login-screen-logo.png,
# product-name.png
+%else
+%{_usr}/share/ipa/ui/images/*.jpg
+%{_usr}/share/ipa/ui/images/*.png
+%endif
%dir %{_usr}/share/ipa/wsgi
%{_usr}/share/ipa/wsgi/plugins.py*
%dir %{_sysconfdir}/ipa
@@ -1387,6 +1509,8 @@ fi
%{_sbindir}/ipa-adtrust-install
%{_usr}/share/ipa/smb.conf.empty
%attr(755,root,root) %{_libdir}/samba/pdb/ipasam.so
+%attr(755,root,root) %{plugin_dir}/libipa_cldap.so
+%{_datadir}/ipa/ipa-cldap-conf.ldif
%{_mandir}/man1/ipa-adtrust-install.1*
%ghost %{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so
%{_sysconfdir}/dbus-1/system.d/oddjob-ipa-trust.conf
@@ -1416,6 +1540,8 @@ fi
%{_mandir}/man1/ipa-client-automount.1*
%{_mandir}/man1/ipa-certupdate.1*
%{_mandir}/man1/ipa-join.1*
+%dir %{_libexecdir}/ipa/acme
+%{_libexecdir}/ipa/acme/certbot-dns-ipa
%files client-samba
%doc README.md Contributors.txt
@@ -1423,7 +1549,7 @@ fi
%{_sbindir}/ipa-client-samba
%{_mandir}/man1/ipa-client-samba.1*
-%if ! %{ONLY_CLIENT}
+
%files client-epn
%doc README.md Contributors.txt
%dir %{_sysconfdir}/ipa/epn
@@ -1435,7 +1561,7 @@ fi
%attr(644,root,root) %{_unitdir}/ipa-epn.timer
%attr(600,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn.conf
%attr(644,root,root) %config(noreplace) %{_sysconfdir}/ipa/epn/expire_msg.template
-%endif
+
%files -n python3-ipaclient
%doc README.md Contributors.txt
@@ -1455,7 +1581,17 @@ fi
%dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
%{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
%{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
+%if 0%{?rhel}
# RHEL spec file only: DELETED: Remove csrgen
+%else
+%dir %{python3_sitelib}/ipaclient/csrgen
+%dir %{python3_sitelib}/ipaclient/csrgen/profiles
+%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
+%dir %{python3_sitelib}/ipaclient/csrgen/rules
+%{python3_sitelib}/ipaclient/csrgen/rules/*.json
+%dir %{python3_sitelib}/ipaclient/csrgen/templates
+%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
+%endif
%{python3_sitelib}/ipaclient-*.egg-info
@@ -1493,7 +1629,7 @@ fi
%doc README.md Contributors.txt
%license COPYING
%dir %{_usr}/share/ipa
-
+%dir %{_libexecdir}/ipa
%files -n python3-ipalib
%doc README.md Contributors.txt
@@ -1507,7 +1643,7 @@ fi
%{python3_sitelib}/ipaplatform-*.egg-info
-%if 0%{?with_ipatests}
+%if %{with ipatests}
%files -n python3-ipatests
@@ -1515,6 +1651,12 @@ fi
%license COPYING
%{python3_sitelib}/ipatests
%{python3_sitelib}/ipatests-*.egg-info
+%{_bindir}/ipa-run-tests-3
+%{_bindir}/ipa-test-config-3
+%{_bindir}/ipa-test-task-3
+%{_bindir}/ipa-run-tests-%{python3_version}
+%{_bindir}/ipa-test-config-%{python3_version}
+%{_bindir}/ipa-test-task-%{python3_version}
%{_bindir}/ipa-run-tests
%{_bindir}/ipa-test-config
%{_bindir}/ipa-test-task
@@ -1522,28 +1664,84 @@ fi
%{_mandir}/man1/ipa-test-config.1*
%{_mandir}/man1/ipa-test-task.1*
-# with_ipatests
+# with ipatests
%endif
-%if 0%{?with_selinux}
+%if %{with selinux}
%files selinux
%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
-# with_selinux
+# with selinux
%endif
%changelog
-* Wed Sep 23 2020 Thomas Woerner <twoerner@redhat.com> - 4.8.7-12
-- Require selinux sub package in the proper version
- Related: RHBZ#1868432
-- SELinux: do not double-define node_t and pki_tomcat_cert_t
- Related: RHBZ#1868432
-- SELinux: add dedicated policy for ipa-pki-retrieve-key + ipatests
- Related: RHBZ#1868432
-- dogtaginstance.py: add --debug to pkispawn
- Resolves: RHBZ#1879604
+* Fri Dec 11 2020 Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.5.rc3
+- Upstream pre release FreeIPA 4.9.0rc3
+ Related: RHBZ#1891832
+
+* Fri Dec 4 2020 Alexander Bokovoy <abokovoy@redhat.com> - 4.9.0-0.3.rc2
+- Remove ipa-server dependency from ipa-selinux subpackage
+- Related: RHBZ#1891832
+
+* Fri Dec 4 2020 Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.2.rc2
+- Upstream pre release FreeIPA 4.9.0rc2
+ Related: RHBZ#1891832
+- Synchronize spec file with upstream and Fedora
+ Related: RHBZ#1891832
+- Traceback while doing ipa-backup
+ Resolves: RHBZ#1901068
+- ipa-client-install changes system wide ssh configuration
+ Resolves: RRBZ#1544379
+- ipa-kdb: support subordinate/superior UPN suffixes
+ Resolves: RHBZ#1891056
+- KRA Transport and Storage Certificates do not renew
+ Resolves: RHBZ#1872603
+- Move where the restore state is marked during IPA server upgrade
+ Resolves: RHBZ#1569011
+- Intermittent IdM Client Registration Failures
+ Resolves: RHBZ#1812871
+- Nightly test failure in test_acme.py::TestACME::test_third_party_certs
+ (updates-testing)
+ Resolves: RHBZ#1903025
+- Add IPA RA Agent to ACME group on the CA
+ Resolves: RHBZ#1902727
+
+* Mon Nov 23 2020 Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.1.rc1
+- Fix requirement for python3-kdcproxy, add no autoreqprov for ipatests sub
+ package
+ Related: RHBZ#1891832
+
+* Mon Nov 23 2020 Thomas Woerner <twoerner@redhat.com> - 4.9.0-0.rc1
+- Upstream pre release FreeIPA 4.9.0rc1
+ Resolves: RHBZ#1891832
+- Requirements and design for libpwquality integration
+ Resolves: RHBZ#1340463
+- When parsing options require name/value pairs
+ Resolves: RHBZ#1357495
+- WebUI: Fix issue with opening links in new tab/window
+ Resolves: RHBZ#1484088
+- Use a state to determine if a 389-ds upgrade is in progress
+ Resolves: RHBZ#1569011
+- Unlock user accounts after a password reset and replicate that unlock to
+ all IdM servers
+ Resolves: RHBZ#1784657
+- Set the certmonger subject with a string, not an object
+ Resolves: RHBZ#1810148
+- Implement ACME certificate enrolment
+ Resolves: RHBZ#1851835
+- [WebUI] Backport jQuery patches from newer versions of the library (e.g.
+ 3.5.0)
+ Resolves: RHBZ#1859249
+- It is not possible to edit KDC database when the FreeIPA server is running
+ Resolves: RHBZ#1875001
+- Fix nsslapd-db-lock tuning of BDB backend
+ Resolves: RHBZ#1882340
+- ipa-kdb: support subordinate/superior UPN suffixes
+ Resolves: RHBZ#1891056
+- wgi/plugins.py: ignore empty plugin directories
+ Resolves: RHBZ#1894800
* Thu Sep 10 2020 Thomas Woerner <twoerner@redhat.com> - 4.8.7-11
- SELinux Policy: let custodia replicate keys