IPAv3_300_beta1

IPAv3_300_beta1#

The FreeIPA team is proud to announce version FreeIPA v3.0.0 beta 1.

It can be downloaded from http://www.freeipa.org/page/Downloads.

A build is available in Fedora rawhide or for Fedora 17 via the freeipa-devel repo on www.freeipa.org: http://freeipa.org/downloads/freeipa-devel.repo

For additional information see the AD Trust design page http://freeipa.org/page/IPAv3_AD_trust and the AD Trust testing page http://freeipa.org/page/IPAv3_testing_AD_trust.

Highlights in 3.0.0#

  • Support for AD Trust

  • Per-domain DNS permissions

  • DNS persistent search enabled by default, new zones are seen immediately

  • New DNS resolver library

  • Migration improvements

  • The last administrator cannot be removed

  • Forms-based password reset

  • Redesigned action panels in UI

  • Sessions for command-line users

  • Tool to configure automount client, ipa-client-automount

Upgrading#

An IPA server can be upgraded simply by installing updated rpms. The server does not need to be shut down in advance.

If you have multiple servers you may upgrade them one at a time. It is expected that all servers will be upgraded in a relatively short period (days or weeks not months). They should be able to co-exist peacefully but new features will not be available on old servers and enrolling a new client against an old server will result in the SSH keys not being uploaded.

Downgrading a server once upgraded is not supported.

Upgrading from 2.2.0 should work but has not been fully tested. Proceed with caution.

An enrolled client does not need the new packages installed unless you want to re-enroll it. SSH keys for already installed clients are not uploaded, you will have to re-enroll the client or manually upload the keys.

Feedback#

Please provide comments, bugs and other feedback via the freeipa-devel mailing list: http://www.redhat.com/mailman/listinfo/freeipa-devel

Detailed changelog including 2.2.0#

The development of 3.0 occurred simultaneously with 2.2.0 so there is some overlap.

Adam Young (10):

  • enable proxy for dogtag

  • split metadata call

  • Make mod_nss renegotiation configuration a public function

  • Execute pki proxy setup when server is upgraded if needed

  • Force the upgrade of pki-setup when upgrading the RPMS

  • Fix dynamic display of UI tabs based on rights

  • remove enrolled column

  • Add priority to pwpolicy list

  • Remove delegation from browser config

  • ignore generated services file.

Alexander Bokovoy (61):

  • Propagate environment when it is required.

  • Incorrect name in examples of ipa help hbactest

  • Unroll groups when testing HBAC rules

  • Convert server install code to platform-independent access to system services

  • Convert client-side tools to platform-independent access to system services

  • Convert installation tools to platform-independent access to system services

  • Cleanup whitespace

  • Introduce platform-specific adaptation for services used by FreeIPA.

  • When external host is specified in HBAC rule, allow its use in simulation

  • Unroll StrEnum values when displaying help

  • Configure pam_krb5 on the client only if sssd is not configured

  • Setup and restore ntp configuration on the client side properly

  • Fix ‘referenced before assignment’ warning

  • Before kinit, try to sync time with the NTP servers of the domain we are joining

  • Increase number of ‘getent passwd attempts’ to 10

  • Force kerberos realm to be a string

  • Include indirect membership and canonicalize hosts during HBAC rules testing

  • Refactor backup_and_replace_hostname() into a flexible config modification tool

  • Write KRB5REALM to /etc/sysconfig/krb5kdc and make use of common backup_config_and_replace_variables() tool

  • Refactor authconfig use in ipa-client-install

  • Document –preserve-sssd option of ipa-client-install

  • Use set class instead of dictview class as set is wider supported

  • hbactest fails while you have svcgroup in hbacrule

  • Add support for systemd environments and use it to support Fedora 16

  • Spin for connection success also when socket is not (yet) available

  • Update spec file to use systemd on Fedora 16 and above

  • Quote multiple workers option

  • Check for Python.h during build of py_default_encoding extension

  • Add configure check for libintl.h

  • Create directories for client install

  • Add “Extending FreeIPA” developer guide

  • Small fix to the guide CSS: enable vertical scroll bar

  • Rename included snippets to avoid problems with pylint

  • Fix dependency for samba4-devel package

  • Merge branch ‘master’ of git+ssh://git.fedorahosted.org/git/freeipa

  • Check through all LDAP servers in the domain during IPA discovery

  • Validate sudo RunAsUser/RunAsGroup arguments

  • Allow hbactest to work with HBAC rules exceeding default IPA limits

  • Add management of inifiles to allow manipulation of systemd units

  • Handle upgrade issues with systemd in Fedora 16 and above

  • Adopt to python-ldap 2.4.6 by removing unused references which are not available in python-ldap anymore

  • When changing multiple booleans with setsebool, pass each of them separately.

  • Add separate attribute to store trusted domain SID

  • Use dedicated keytab for Samba

  • Add trust management for Active Directory trusts

  • Use fully qualified PDC name when contacting for extended DN information

  • Perform case-insensitive searches for principals on TGS requests

  • Properly handle multiple IP addresses per host when installing trust support

  • Restart KDC after installing trust support to allow MS PAC generation

  • Add trust-related ACIs

  • get_fqdn() moved to ipaserver.installutils

  • ipa-sam: update sid_to_id() interface to follow passdb API changes in Samba

  • Add python-crypto to build requires for AD server-side code

  • Move AD trust support code to freeipa-server-trust-ad subpackage

  • restart dirsrv as part of ipa-adtrust-install

  • Re-format ipa-adtrust-install final message to be within 80 characters wide

  • Use correct SID attribute for trusted domains

  • Rename ‘ipa trust-add-ad’ to ‘ipa trust-add –type=ad’

  • Support requests for DOMAIN$ account for trusted domains in ipasam module

  • Add error condition handling to the SASL bind callback in ipasam

  • Add support for external group members

Endi S. Dewata (105):

  • Fixed browser configuration pages

  • Hide activation/deactivation link from regular users.

  • Fixed problem selecting value from combobox

  • Fixed inconsistent layout for password reset dialog.

  • Removed ‘Hide already enrolled’ checkbox.

  • Replaced page dirty dialog title.

  • Updated add and delete association dialog titles.

  • Removed unnecessary HBAC/sudo rule category modification.

  • Fixed command partial failure handling.

  • Fixed default map type in automount map adder dialog.

  • Fixed host OTP status.

  • Fixed host keytab status after setting OTP.

  • Fixed host adder dialog to show default DNS zone.

  • Fixed hard-coded UI messages.

  • Fixed problem adding hostgroup into netgroup.

  • Fixed problem with combobox.

  • Fixed hard-coded UI message in entity.js.

  • Fixed missing permission filter field.

  • Fixed problem with combobox using Sahi

  • Fixed unit test for entity select widget.

  • Fixed layout problem in permission adder dialog.

  • Fixed sudo rule association dialogs.

  • Fixed missing optional field.

  • Fixed labels for run-as users and groups.

  • Fixed problem opening host adder dialog.

  • Removed entitlement menu.

  • Fixed posix group checkbox.

  • Fixed columns in HBAC/sudo rules list pages.

  • Removed HBAC rule type.

  • Fixed missing cancel button in unprovisioning dialog.

  • Fixed problem enabling/disabling DNS zone.

  • Fixed problem enrolling member with the same name.

  • Modified dialog to use sections.

  • Removed undo flags from dialog field specs.

  • Fixed problem on combobox with search limit.

  • Fixed problem displaying special characters.

  • Updated DNS zone details page.

  • Replaced description text fields with text areas.

  • Fixed add/delete arrows position.

  • Fixed duplicate entries in enrollment dialog.

  • Updated color scheme.

  • Fixed tab and dialog widths.

  • Use editable combobox for service type.

  • Disable enroll button if nothing selected.

  • Fixed missing default shell field.

  • I18n clean-up.

  • Disable sudo options Delete button if nothing selected.

  • Added confirmation when adding multiple entries.

  • Added selectable labels for radio buttons.

  • Fixed dependency problem in UI test.

  • Fixed inconsistent required/optional attributes.

  • Removed HBAC deny rule warning.

  • Fixed host Enrolled column.

  • Fixed problem clearing validation error on checkboxes.

  • Fixed “enroll” labels.

  • Merged widget’s metadata and param_info.

  • Refactored validation code.

  • Fixed inconsistent image names.

  • Fixed inconsistent details facet validation.

  • Added password field in user adder dialog.

  • Fixed blank krbtpolicy and config pages.

  • Moved facet code into facet.js.

  • Added extensible UI framework.

  • Added current password field.

  • Fixed problem changing page in association facet.

  • Updated sample data.

  • Added paging on search facet.

  • Refactored permission target section.

  • Removed develop.js.

  • Added commands into metadata.

  • Refactored entity object resolution.

  • Fixed ipa.js for sessions.

  • Fixed entity definition in test cases.

  • Added support for radio buttons in table widget.

  • Fixed entity metadata resolution.

  • Refactored facet.load().

  • Added HBAC Test page.

  • Fixed navigation buttons for HBAC Test.

  • Fixed search filter in HBAC Test.

  • Added external fields for HBAC Test.

  • Fixed CSS for HBAC Test

  • Fixed I18n labels for HBAC Test

  • Fixed matched/unmatched checkboxes in HBAC Test

  • Added HBAC Test input validation.

  • Fixed problem loading DNS records.

  • Fixed unmatched checkbox name.

  • Fixed combobox icon position.

  • Fixed combobox search icon position.

  • Reload UI when the user changes.

  • Reload UI on server upgrade.

  • Added account status into user search facet.

  • Added policies into user details page.

  • Load user data and policies in a single batch.

  • Added instructions to generate CSR.

  • Fixed problem removing automount keys and DNS records.

  • Enabled paging on self-service permissions and delegations.

  • Enabled paging on automount keys.

  • Show disabled entries in gray.

  • Fixed inconsistent status labels.

  • Fixed host managed-by adder dialog.

  • Added icons for status column.

  • Hide Add/Delete buttons in self-service mode.

  • Use fixed font when displaying certificate.

  • Show password expiration date.

  • Fixed boot.ldif permission.

JR Aquino (5):

  • Create Tool for Enabling/Disabling Managed Entry Plugins

  • Replication: Adjust replica installation to omit processing memberof computations

  • Improve sudorule documentation

  • Create FreeIPA CLI Plugin for the 389 Auto Membership plugin

  • Move Managed Entries into their own container in the replicated space.

Jan Cholasta (42):

  • Make sure messagebus is running prior to starting certmonger.

  • Verify that passwords specified through command line options of ipa-server-install meet the length requirement.

  • Add option to install without the automatic redirect to the Web UI.

  • Search for users in all the naming contexts present on the directory server.

  • Add subscription-manager dependency for RHEL.

  • Verify that the external CA certificate files are correct.

  • Check that install hostname matches the server hostname.

  • Fix client install on IPv6 machines.

  • Fix ipa-replica-prepare always warning the user about not using the system hostname.

  • Validate name_from_ip parameter of dnszone.

  • Add a function for formatting network locations of the form host:port for use in URLs.

  • Work around pkisilent bugs.

  • Disallow deletion of global password policy.

  • Don’t leak passwords through kdb5_ldap_util command line arguments.

  • Remove more redundant configuration values from krb5.conf.

  • Finalize plugin initialization on demand.

  • Parse comma-separated lists of values in all parameter types. This can be enabled for a specific parameter by setting the “csv” option to True.

  • Fix make-lint crash under certain circumstances.

  • Fix attempted write to attribute of read-only object.

  • Add LDAP schema for SSH public keys.

  • Add LDAP ACIs for SSH public key schema.

  • Add support for SSH public keys to user and host objects.

  • Add API initialization to ipa-client-install.

  • Move the nsupdate functionality to separate function in ipa-client-install.

  • Update host SSH public keys on the server during client install.

  • Configure ssh and sshd during ipa-client-install.

  • Base64-decode unicode values in Bytes parameters.

  • Add SSH service to platform-specific services.

  • Move the compat module from ipalib to ipapython.

  • Configure SSH features of SSSD in ipa-client-install.

  • Wait for child process to terminate after receiving SIGINT in ipautil.run.

  • Parse zone indices in IPv6 addresses in CheckedIPAddress.

  • Fix uses of O=REALM instead of the configured certificate subject base.

  • Fix the procedure for getting default values of command parameters.

  • Change parameters to use only default_from for dynamic default values.

  • Check whether the default user group is POSIX when adding new user with –noprivate.

  • Check configured maximum user login length on user rename.

  • Fix internal error when renaming user with an empty string.

  • Refactor exc_callback invocation.

  • Set the “KerberosAuthentication” option in sshd_config to “no” instead of “yes”.

  • Redo boolean value encoding.

  • SSH configuration fixes.

John Dennis (38):

  • DN objects should support the insert method

  • Test DN object non-latin Unicode support

  • convert unittests to use DN objects

  • invalid i18n string in dns.py

  • update LINGUAS file, add missing po files

  • Update all po files

  • compute accurate translation statistics

  • add documentation validation to makeapi tool

  • internationalize help topics

  • internationalize cli help framework

  • improve i18n docstring extraction

  • Fix Spanish po translation file

  • Unable to Download Certificate with Browser

  • Add log manager module

  • modify codebase to utilize IPALogManager, obsoletes logging

  • IPAdmin undefined anonymous parameter lists

  • subclass SimpleLDAPObject

  • Restore default log level in server to INFO

  • If “make rpms” fails so will the next make

  • Remove old RPMROOT contents before it is used for rpmbuild

  • update i18n pot file for branch master

  • Add ipa_memcached service

  • add session manager and cache krb auth

  • Update pot file and list of explicit Python files needing translation

  • pulled new po files from Transifex

  • update translation pot file

  • Tweak the session auth to reflect developer consensus.

  • Implement session activity timeout

  • Implement password based session login

  • Log a message when returning non-success HTTP result

  • Replace broken i18n shell test with Python test

  • improve handling of ds instances during uninstall

  • Use indexed format specifiers in i18n strings

  • text unit test should validate using installed mo file

  • Validate DN & RDN parameters for migrate command

  • don’t append basedn to container if it is included

  • Fix name error in hbactest

  • validate i18n strings when running “make lint”

Lars Sjostrom (1):

  • Add disovery domain if client domain is different from server domain

Marko Myllynen (2):

  • include <stdint.h> for uintptr_t

  • Don’t remove /tmp when removing temp cert dir

Martin Kosek (171):

  • Add missing attribute labels for sudorule

  • Fix automountkey-mod

  • Fix automountlocation-import conflicts

  • ipa-client-install breaks network configuration

  • Fix sudo help and summaries

  • Let Bind track data changes

  • Improve man pages structure

  • Improve ipa-join man page

  • Fix permissions in installers

  • Fix configure.jar permissions

  • Set bind and bind-dyndb-ldap min nvr

  • Fix pylint false positive in hbactest module

  • ipactl does not stop dirsrv

  • dirsrv is not stopped correctly in the fallback

  • Remove checks for ds-replication plugin

  • Fix /usr/bin/ipa dupled server list

  • Revert “Always require SSL in the Kerberos authorization block.”

  • Fix error messages in hbacrule

  • Fix LDAPCreate search failure

  • Fix HBAC tests hostnames

  • ipa-client assumes a single namingcontext

  • migrate process cannot handle multivalued pkey attribute

  • Be more clear about selfsign option

  • Install tools crash when password prompt is interrupted

  • Improve ipa-replica-prepare DNS check

  • Prevent collisions of hostgroup and netgroup

  • Make sure ipa-client-install returns correct error code

  • Improve default user/group object class validation

  • Fix i18n in config plugin

  • Fix dnszone-add name_from_ip server validation

  • Improve handling of GIDs when migrating groups

  • ipa-client-install hangs if the discovered server is unresponsive

  • Optimize member/memberof searches in LDAP

  • Make IPv4 address parsing more strict

  • Check hostname resolution sanity

  • Hostname used by IPA must be a system hostname

  • Check /etc/hosts file in ipa-server-install

  • Fix ipa-client-install -U option alignment

  • Improve hostgroup/netgroup collision checks

  • Fix client krb5 domain mapping and DNS

  • Add –zonemgr/–admin-mail validator

  • Fix ipa-managed-entries password option long form

  • Create pkey-only option for find commands

  • Fix ipa-server-install answer cache

  • Fix ipa-replica-conncheck port labels

  • Allow custom server backend encoding

  • Fix DNS zone –allow-dynupdate option behavior

  • Improve DNS record data validation

  • Polish ipa config help

  • Hosts file not updated when IP is passed as option

  • Fix API.txt

  • Fix LDAP object parameter encoding

  • Remove redundant information from API.txt

  • Fix ipa-managed-entries bind procedure

  • Let PublicError accept Gettext objects

  • Fix coverity issues in client CLI tools

  • Enable automember for upgraded servers

  • Make ipa-server-install clean after itself

  • Add –delattr option to complement –setattr/–addattr

  • Revert “Add DNS service records for Windows”

  • Improve zonemgr validator and normalizer

  • Change default DNS zone manager to hostmaster

  • Fix config migration option

  • Ask for user confirmation in ipa-server-install

  • Add connection failure recovery to IPAdmin

  • Add DNS check to conncheck port probe

  • Refactor dnsrecord processing

  • Fix Parameter csv parsing

  • Improve CLI output for complex commands

  • Create per-type DNS API

  • Fix maxvalue in DNS plugin

  • Fix LDAP add calls in replication module

  • Prevent service restart failures in ipa-replica-install

  • Fix LDAP updates in ipa-replica-install

  • Let replicas install without DNS

  • Restore ACI when aci_mod fails

  • Add missing –pkey-only option for selfservice and delegation

  • Replace float with Decimal

  • Improve host-add error message

  • Fix ipa-server-install for dual NICs

  • Fix selfservice-find crashes

  • Mark optional DNS record parts

  • Fix ldap2 combine_filters for ldap2.MATCH_NONE

  • Add missing managing hosts filtering options

  • Improve netgroup-add error messages

  • Fix TXT record parsing

  • Fix NSEC record conversion

  • Add SRV record target validator

  • Add data field for A6 record

  • Improve dnszone-add error message

  • Improve migration help

  • Fix raw format for ACI commands

  • Improve password change error message

  • Remove debug messages

  • Add argument help to CLI

  • Return proper DN in netgroup-add

  • Remove unused options from ipa-managed-entries

  • Add Petr Viktorín to Contributors.txt

  • Ease zonemgr restrictions

  • Update schema for bind-dyndb-ldap

  • Global DNS options

  • Query and transfer ACLs for DNS zones

  • Add DNS conditional forwarding

  • Add API for PTR sync control

  • Add gidnumber minvalue

  • Add reverse DNS record when forward is created

  • Sanitize UDP checks in conncheck

  • Add client hostname requirements to man

  • Add SSHFP update policy for existing zones

  • Improve dns error message

  • Improve dnsrecord-add interactive mode

  • Improve hostname and domain name validation

  • Improve FQDN handling in DNS and host plugins

  • Improve hostname verification in install tools

  • Fix typos in ipa-replica-manage man page

  • Remove memberPrincipal for deleted replicas

  • Fix encoding for setattr/addattr/delattr

  • Add help for new structured DNS framework

  • Improve dnsrecord interactive help

  • Ignore case in yes/no prompts

  • Refresh resolvers after DNS install

  • Fix migration plugin compat check

  • Fix ipa-replica-manage TLS connection error

  • Treat UPGs correctly in winsync replication

  • Allow port numbers for idnsForwarders

  • Add missing global options in dnsconfig

  • Fix precallback validators in DNS plugin

  • Harden raw record processing in DNS plugin

  • Fix LDAP effective rights control with python-ldap 2.4.x

  • Avoid deleting DNS zone when a context is reused

  • Fix default SOA serial format

  • Amend permissions for new DNS attributes

  • Improve user awareness about dnsconfig

  • Fix dnsrecord-del interactive mode

  • Tolerate UDP port failures in conncheck

  • Improve automount indirect map error message

  • Forbid public access to DNS tree

  • Configure SELinux for httpd during upgrades

  • Fix installation when server hostname is not in a default domain

  • Return correct record name in DNS plugin

  • Fix dnsrecord_add interactive mode

  • Fix DNS and permissions unit tests

  • Raise proper exception when LDAP limits are exceeded

  • Do not fail migration because of duplicate groups

  • Fix help of –hostname option in ipa-client-install

  • Sort password policies properly with –pkey-only

  • Improve error message in zonemgr validator

  • Make ipa 2.2 client capable of joining an older server

  • Fix python Requires in Fedora 17 build

  • Remove ipa-server-install LDAP update errors

  • Remove LDAP limits from DNS service

  • Replace DNS client based on acutil with python-dns

  • Fix default_server configuration in ipapython.config

  • Reset krbtpolicy when a unit test is finished

  • Add rename option for DNS records

  • permission-find missed some results with –pkey-only option

  • Allow relative DNS name in NS validator

  • Fill new DNS zone update policy by default

  • Improve migration NotFound error

  • Fix dnszone-mod –forwader option help string

  • Add sysupgrade state file

  • Enable persistent search by default

  • Enable psearch on upgrades

  • Only set sebools when necessary

  • Password change capability for form-based auth

  • Remove trust work unit test failures

  • Decimal parameter conversion and normalization

  • Remove ipaNTHash from global allow ACI

  • Add missing libsss_idmap Requires on freeipa-server-trust-ad

  • Per-domain DNS record permissions

  • Create default range entry after upgrade

Nalin Dahyabhai (5):

  • list users from nested groups, too

  • note that PKCS#12 files also contain private keys, and that the “pkinit” options refer to the KDC’s credentials

  • index the fqdn and macAddress attributes for the sake of the compat plugin

  • create a “cn=computers” compat area populated with ieee802Device entries corresponding to computers with fqdn and macAddress attributes

  • add a pair of ethers maps for computers with hardware addresses on file

Ondrej Hamada (26):

  • Misleading Keytab field

  • Client install root privileges check

  • Sort password policy by priority

  • Client install checks for nss_ldap

  • User-add random password support

  • HBAC test optional sourcehost option

  • localhost.localdomain clients refused to join

  • Leave nsds5replicaupdateschedule parameter unset

  • Fix ‘no-reverse’ option description

  • Memberof attribute control and update

  • Validate attributes in permission-add

  • Migration warning when compat enabled

  • ipa-client-install not calling authconfig

  • More exception handlers in ipa-client-install

  • Search allowed attributes in superior objectclasses

  • Typos in FreeIPA messages

  • Netgroup nisdomain and hosts validation

  • Confusing default user groups

  • Unable to rename permission object

  • Fix empty external member processing

  • Allow one letter net/hostgroups names

  • permission-mod prompts for all parameters

  • ipa-server-install reword message

  • Always set ipa_hostname for sssd.conf

  • Case sensitive renaming of objects

  • Change random passwords behaviour

Petr Viktorin (60):

  • Switch –group and –membergroup in example for delegation

  • Fix/add options in ipa-managed-entries man page

  • Honor default home directory and login shell in user_add

  • Clean up i18n strings

  • Internationalization for HBAC and ipalib.output

  • Make ipausers a non-posix group on new installs

  • Add extra checking function to XMLRPC test framework

  • Add common helper for interactive prompts

  • Make sure the nolog argument to ipautil.run is not a bare string

  • Use stricter semantics when checking IP address for DNS records

  • Use reboot from /sbin

  • Allow removing sudo commands with special characters from command groups

  • Enforce that required attributes can’t be set to None in CRUD Update

  • Mark most config options as required

  • Don’t crash when searching with empty relationship options

  • Remove ipausers’ gidnumber from tests

  • Use nose tools to check for exceptions

  • Only split CSV in the client, quote instead of escaping

  • Add missing BuildRequires

  • Use valid argument names in tests

  • Add CLI parsing tests

  • Allow multi-line CSV parameters

  • Move test skipping to class setup

  • Fix little test errors

  • Test the batch plugin

  • Defer conversion and validation until after –{add,del,set}attr are handled

  • Limit permission and selfservice names to alphanumerics, -, _, space

  • Convert –setattr values for attributes marked no_update

  • Fix expected error messages in tests

  • Remove pattern_errmsg from API.txt

  • Pass make-test arguments through to Nose

  • Document the ‘nonempty’ flag

  • Additional tests for pwpolicy

  • Update hostname validator error messages in tests

  • Do not use extra command options in the automount plugin

  • Do not crash on empty reverse member options

  • Do not crash on empty –setattr, –getattr, –addattr

  • Don’t fail when adding default objectclasses using config-mod

  • Remove duplicate and unused utility code

  • Validate externalhost (when added by –addattr/–setattr)

  • Do not use extra command options in ACI, permission, selfservice

  • Check for empty/single value parameters before calling callbacks

  • Disallow ‘<’ and non-ASCII characters in the DM password

  • Fix the pwpolicy_find post_callback

  • Disallow setattr on no_update/no_create params

  • Provide a better error message when deleting nonexistent attributes

  • Move install script error handling to a common function

  • Add more automount tests

  • Add samba4-python to BuildRequires

  • Prevent deletion of the last admin

  • Only allow root to run update plugins

  • Clean keytabs before installing new keys into them

  • Fix update plugin order

  • Rework the CallbackInterface

  • Improve ipa-client-install debug output

  • Improve autodiscovery logging

  • Fail on unknown Command options

  • Typo fixes

  • Improve output validation

  • Explicitly filter options that permission-{add,mod} passes to aci-{add,mod}

Petr Vobornik (158):

  • error dialog for batch command

  • Uncheck checkboxes in association after deletion

  • Show error in adding associations

  • Validation of details facet before update https://fedorahosted.org/freeipa/ticket/1676 The ticket is a duplicate of server error, but it revealed few UI errors.

  • Modify serial associator to use batch

  • Modifying sudo options refreshes the whole page

  • Enable update and reset button only if dirty

  • Attributes table not scrollable

  • Fixed: JavaScript type error in entitlement page

  • Fixed inconsistency in enabling delete buttons

  • Code cleanup: widget creation

  • Fixed: Column header for attributes table should be full width

  • Fixed: Enrolment dialog offers to add entity to reflexive association.

  • Fixed: Some widgets do not have space for validation error message

  • Disables gid field if not posix group in group adder dialog

  • Fixed links to images in config and migration pages

  • Split Web UI initialization to several smaller calls #2

  • Split Web UI initialization to several smaller calls

  • Added missing fields to password policy page

  • Fixed: Unable to add external user for RunAs User for Sudo rules

  • Circular entity dependency

  • Fixed: Duplicate CSS definitions

  • Fixing infinite loop in UI navigation unit test.

  • Minor visual enhancement of required indicator

  • Page is cleared before it is visible

  • Field for DNS SOA class changed to combobox with options

  • Extending facet’s mechanism of gathering changes

  • Added cross browser support of Array.indexOf method

  • Splitting widget into widget and field

  • Splitting basic widgets into visual widgets and fields

  • Improved fields dirty status detection logic

  • Builders and collections for fields and widgets

  • Removing sections as special type of object

  • Added possibility to define facet/dialog specific policies

  • Modifying users to work with new concept

  • Modifying hosts to work with new concept

  • Modifying dns to work with new concept

  • Modifying services to work with new concept

  • Separation of writable update from field load method

  • Modifying ACI to work with new concept

  • Modifying groups to work with new concept

  • Code cleanup of HBAC, Sudo rules

  • Changing definition of basic fields in section from factory to type

  • Modifying automount to work with new concept

  • Fixed unit tests after widget refactoring

  • Removed usage of bitwise assignment operators in logical operations

  • Search facets show translated boolean values

  • Better displaying of long names in tables and facet headers

  • Additional better displaying of long names

  • Reordered facets in ACI

  • Association facets are read only in self service

  • Added facet tabs coloring

  • Fixed displaying of external records in rule association widgets

  • Distinguishing of external values in association tables

  • Better table column width computing

  • Fixed labels in Sudo, HBAC rules

  • Parsing of IPv4 and IPv6 addresses

  • Added support of custom field validators

  • Added validation logic to multivalued text field

  • Added client-side validation of A and AAAA DNS records

  • Fixed IPv6 validation special case: single colon

  • Added support for memberof attribute in permission

  • Added IP address validator to Host and DNS record adder dialog

  • Fixed entity link disabling

  • Fixed content type check in login_password

  • Improved usability of login dialog

  • Removed CSV creation from UI

  • Fixed mask validation in network_validator

  • Fixed checkbox value in table without pkey

  • Certificate serial number in hex format - ui testing data

  • Fixed evaluating checkbox dirty status

  • Better hbactest validation message

  • Content is no more overwritten by error message

  • Show_content on refresh success

  • Fixed rpm build warning - extension.js listed twice

  • Add support of new options in dnsconfig

  • DNS forwarder validator

  • Added mac address to host page

  • Facet expiration flag

  • Inter-facet expiration

  • Reworked netgroup Web UI to allow setting user/host category

  • Fixed: permission attrs table didn’t update its available options on load

  • Added attrs field to permission for target=subtree

  • DNS forward policy: checkboxes changed to radio buttons

  • Removed mutex option from checkboxes

  • Removal of memberofindirect_permissons from privileges

  • User is notified that password needs to be reset in forms-based login

  • Added permission field to delegation

  • Paging disable for password policies

  • General builder support

  • Action lists

  • Control buttons

  • Redefined details control buttons

  • Redefined search control buttons

  • Hide search facet add/delete buttons in self-service

  • Batch action for search page control buttons

  • General details facet actions

  • Consistent change of entry status.

  • Instructions to generate cert use certutil instead of openssl

  • Host page fixed to work with disabled DNS support

  • Improved calculation of max pkey length in facet header

  • Correction of nested search facets tab labels

  • Refactored action list and control buttons to use shared list of actions

  • Refactored entities to use changed actions concept

  • Action panel

  • User password widget modified.

  • Action panel for user

  • Added missing i18n in action list and action panel

  • Add shadow to dialog

  • Enable reset password action according to attribute perrmission

  • Added cancel button to service unprovision dialog

  • Removal of illegal options in JSON-RPC calls

  • Added links to netgroup member tables

  • Text widget’s dirty state is changed on various input methods

  • Change json serialization to serialize useful data

  • Removal of illegal options in association dialog

  • Update of serverconfig ipaconfigstring options

  • Action panel for host enrollment

  • Action panel for service provisioning

  • Separate reset password page

  • Added password reset capabilities to unauthorized dialog

  • Set network.http.sendRefererHeader to 2 on browser config

  • Custom Web UI error message for IPA error 911

  • Trust Web UI

  • Same password validator

  • Action panel for certificates

  • Web UI password is going to expire in n days notification

  • Refactored associatin facet to use facet buttons with actions

  • Continuation of removing of not supported command options from Web UI

  • UI for SELinux user mapping

  • Added refresh button for UI

  • Modifying DNS UI to benefit from new DNS API

  • Added paging to DNS record search facet

  • Navigation and redirection to various facets

  • Automember UI

  • Automember UI - default groups

  • Automember UI - Fixed I18n labels

  • Removed question marks from field labels

  • UI support for ssh keys

  • Redirection to PTR records from A,AAAA records

  • Fixed problem when attributes_widget was displaying empty option

  • Added missing configuration options

  • Static metadata update - new DNS options

  • New checkboxes option: Mutual exclusive

  • DNS Zone UI: added new attributes

  • DNS UI: added A,AAAA create reverse options to adder dialog

  • Fixed displaying of A6 Record

  • New UI for DNS global configuration

  • Moved is_empty method from field to IPA object

  • Making validators to return true result if empty

  • Fixed DNS record add handling of 4304 error

  • Added unsupported_validator

  • Fixed redirection in Add and edit in automember hostgroup.

  • Fixed selection of single value in combobox

  • Multiple fields for one attribute

  • Added attrs to permission when target is group or filter

  • Added logout button

  • Forms based authentication UI

Rob Crittenden (191):

  • Add information on setting api.env.host in the ipactl.8 man page

  • Log each command in a batch separately.

  • Do batch logging on successful commands too, not just failures.

  • Fix wording in examples of delegation plugin.

  • Suppress 389-ds debug output when starting services

  • Fix thread deadlock by using pthreads library instead of NSPR.

  • Change the way has_keytab is determined, also check for password.

  • Add additional pam ftp services to HBAC, and a ftp HBAC service group

  • Add label for HBAC services to show as members

  • Add option to only prompt once for passwords, use in entitle_register

  • Retrieve password/keytab state when modifying a host.

  • Disable reverse lookups in ipa-join and ipa-getkeytab

  • Remove more 389-ds files/directories on uninstallation.

  • Remove 389-ds upgrade state during uninstall

  • Set min nvr of pki-ca to 9.0.12 for fix in BZ 700505

  • Add common is_installed() fn, better uninstall logging, check for errors.

  • Add external source hosts to HBAC.

  • Roll back changes if client installation fails.

  • Add netgroup as possible memberOf for hostgroups

  • Sort lists so order is predictable and tests pass as expected.

  • Suppress managed netgroups from showing as memberof hostgroups.

  • Use the IPA server cert profile in the installer.

  • Set min nvr of 389-ds-base to 1.2.9.7-1 for BZ 728605

  • Don’t allow a OTP to be set on an enrolled host

  • Remove normalizer that made role, privilege and permission names lower-case

  • Improved handling for ipa-pki-proxy.conf

  • The precendence on the modrdn plugin was set in the wrong location.

  • Update ipa-ldap-updater man page saying it is not an end-user utility

  • Skip the cert validator if the csr we are passed in is a valid filename

  • Change the Requires for the server and server-selinux for proper order

  • Suppress managed netgroups as indirect members of hosts.

  • The return value of restorecon is not reliable, ignore it.

  • Normalize uid in user principal to lower-case and do validation

  • Shut down duplicated file handle when HTTP response code is not 200.

  • Don’t log one-time password in logs when configuring client.

  • Always require SSL in the Kerberos authorization block.

  • Include failed service and service groups in hbac rule management

  • Add regular expression pattern to host names.

  • Detect CA installation type in ipa-replica-prepare and ipa-ca-install.

  • Require current password when using passwd to change your own password.

  • Migration: don’t assume there is only one naming context, add logging.

  • When calculating indirect membership don’t test nesting on users and hosts.

  • Fix DNS permissions and membership in privileges

  • Fix upgrades of selfsign server

  • Make ipa-join work against an LDAP server that disallows anon binds

  • Fix has_upg() to work with relocated managed entries configuration.

  • Work around limits not being updatable in 389-ds.

  • Save the value of hostname even if it doesn’t appear in /etc/sysconfig/network

  • Add explicit instructions to ipa-replica-manage for winsync replication

  • Set min nvr of 389-ds-base to 1.2.10-0.4.a4 for limits fixes (740942, 742324)

  • Handle an empty value in a name/value pair in config_replace_variables()

  • Update all LDAP configuration files that we can.

  • If our domain is already configured in sssd.conf start with a new config.

  • Fix typo in invalid PTR record error message

  • Fix problems in help system

  • Fix nis netgroup config entry so users appear in netgroup triple.

  • Don’t allow default objectclass list to be empty.

  • Remove calls to has_managed_entries()

  • Fix copy/paste error in parameter description.

  • Add Ondrej Hamada to Contributors.txt

  • Don’t check for 389-instances.

  • Clarify usage of –posix argument in group plugin.

  • Add plugin framework to LDAP updates.

  • Fix some issues introduced when rebasing update patch

  • Remove extraneous trailing single quote in nis.uldif

  • Mark some attributes required to match the schema.

  • Use absolute paths when trying to find certmonger request id.

  • Reorder privileges so that memberof for permissions are generated properly

  • Add SELinux user mapping framework.

  • Require an HTTP Referer header in the server. Send one in ipa tools.

  • Display the value of memberOf ACIs in permission plugin.

  • Fix two typos in role help.

  • Configure s4u2proxy during installation.

  • Document the ping plugin.

  • Catch exception when trying to list missing managed entries definitions

  • Fix some typos in automember help and paramters.

  • Add labels so HBAC and Sudo rules show under hosts/hostgroups.

  • Use correct template variable for hosts, FQDN.

  • In sudo when the category is all do not allow members, and vice versa.

  • Update and package ipa-upgradeconfig man page.

  • Fix deletion of HBAC Rules when there are SELinux user maps defined

  • Add support for storing MAC address in host entries.

  • Don’t try to bind on TLS failure

  • Check for the existence of a replication agreement before deleting it.

  • %ghost the UI files that we install/create on the fly

  • Make submount automount maps work.

  • Require minimum SSF 56, confidentially. Also ensure minssf <= maxssf.

  • Consolidate external member code into two functions in baseldap.py

  • Make ipaconfigstring modifiable by users.

  • Don’t use sets when calculating the modlist so order is preserved.

  • Add update files for SELinuxUserMap

  • Add update file for new schema in v2.2/3.0

  • Stop and uninstall ipa_kpasswd on upgrade, fix dbmodules in krb5.conf

  • Don’t set delegation flag in client, we’re using S4U2Proxy now

  • Update S4U2proxy delegation list when creating replicas

  • Correct update syntax in 30-s4u2proxy.update

  • Remove Apache ccache on upgrade.

  • Add S4U2Proxy delegation permissions on upgrades

  • Disable false pylint error in freeipa-systemd-upgrade

  • Enable ipa_memcached when upgrading

  • Configure ipa_memcached when a replica is installed.

  • Use FQDN in place of FQHN for consistency in sub_dict.

  • Set min for 389-ds-base to 1.2.10.1-1 to fix install segfault, schema replication.

  • Limit the change password permission so it can’t change admin passwords

  • Don’t allow “Modify Group membership” permission to manage admins

  • Add the -v option to sslget to provide more verbose errors

  • Make sure memberof is in replication attribute exclusion list.

  • Don’t check for schema uniqueness when comparing in ldapupdate.

  • Add Conflicts on mod_ssl because it interferes with mod_proxy and dogtag

  • Don’t allow IPA master hosts or important services be deleted.

  • Catch public exceptions when creating the LDAP context in WSGI.

  • Don’t consider virtual attributes when validating custom objectclasses

  • Add Requires to ipa-client on oddjob-mkhomedir

  • Fix managing winsync replication agreements with ipa-replica-manage

  • Check for duplicate winsync agreement before trying to set one up.

  • Remove unused kpasswd.keytab and ldappwd files if they exist.

  • Make sure 389-ds is running when adding memcache service in upgrade.

  • Don’t run restorecon if SELinux is disabled or not present.

  • Limit allowed characters in a netgroup name to alpha, digit, -, _ and .

  • Don’t call memberof task when re-initializing a replica.

  • Fix bad merge of not calling memberof task when re-initializing a replica

  • Add support defaultNamingContext and add –basedn to migrate-ds

  • Fix nested netgroups in NIS.

  • Warn that deleting replica is irreversible, try to detect reconnection.

  • Don’t set migrated user’s GID to that of default users group.

  • Don’t delete system users that are added during installation.

  • Only apply validation rules when adding and updating.

  • subclass HTTP_Status from plugable.Plugin, fix not_found tests

  • Make hostnames adhere to new standards in HBAC tests

  • Fix WSGI error handling

  • Add status command to retrieve user lockout status

  • Add support for sudoOrder

  • Make hostnames adhere to new standards in hbactest plugin tests

  • Fix API.txt and VERSION to reflect new sudoOrder option.

  • Add –noac option to ipa-client-install man page

  • Do kinit in client before connecting to backend

  • Only warn if ipa-getkeytab doesn’t get all requested enctypes.

  • Fix NSS no_init in the NSSHTTPS class

  • Set minimum version of selinux-policy to pick up memcached fix

  • Fix nsslapd-anonlimitsdn dn in cn=config

  • Set SELinux boolean httpd_manage_ipa so ipa_memcached will work.

  • Don’t set dbdir in the connection until after the connection is created.

  • Display serial number as HEX (DECIMAL) when showing certificates.

  • Add subject key identifier to the dogtag server cert profile.

  • Configure a basic ldap.conf for OpenLDAP in /etc/openldap/ldap.conf

  • Import the ipaserver plugins based on context, not env.in_server.

  • Don’t allow hosts and services of IPA masters to be disabled.

  • Use a consistent parameter name in errors, defaulting to cli_name.

  • No longer shell escape the DM password when calling pkisilent.

  • Fix test failure testing rename with an invalid hostname.

  • Fix attributes that contain DNs when migrating.

  • Normalize the primary key value to lowercase during migration.

  • Fix unit tests to work with new comma-support, validation requirements

  • Set minimum version of 389-ds-base to 1.2.10.4-2 to fix upgrade issue

  • Set nsslapd-minssf-exclude-rootdse to on so the DSE is always available.

  • Add requires on python-krbV to client subpackage

  • Fix failure count interval attribute name in query for password policy.

  • Handle updating replication agreements that lack nsDS5ReplicatedAttributeList

  • Don’t create private groups for migrated users, check for valid gidnumber

  • Add updated Output format for batch to API.txt

  • Make revocation_reason required when revoking a certificate.

  • Add missing comma to list of services that cannot be disabled.

  • Return consistent value when hostcat and usercat is all.

  • Dereference pointer when comparing password history in qsort compare.

  • Configure certmonger to execute restart scripts on renewal.

  • Remove the running state when uninstalling DS instances.

  • Return consistent expiration message for forms-based login

  • Use mixed-case for Read DNS Entries permission

  • Update docs for user-status, always show disabled, time for each server.

  • Revert “Search allowed attributes in superior objectclasses”

  • Revert “Validate attributes in permission-add”

  • Return LDAP_SUCCESS on mods on a referral entry.

  • Fix overlapping cn param/option issue, pass cn as aciname in find

  • Implement permission/aci find by subtree

  • Include more information when IP address is not local during installation.

  • Validate on the user-provided domain name in the installer.

  • During replication installation see if an agreement already exists.

  • Check for locked-out user before incrementing lastfail.

  • Retry retrieving ldap principals when setting up replication.

  • Normalize uid to lower case in winsync.

  • Enforce sizelimit in permission-find, post_callback returns truncated

  • If SELinux is enabled ensure we also have restorecon.

  • Store session cookie in ccache for cli users

  • Add flag to ipa-client-install to managed order of ipa_server in sssd

  • Increase LimitRequestFieldSize in Apache config to support a 64KiB PAC

  • Add logging to ipa-upgradeconfig

  • Configure automount using autofs or sssd.

  • Defer adding ipa-cifs-delegation-targets until the Updates phase.

  • Add missing option to range_add in API.txt

  • Fix compatibility with Fedora 18.

  • Become IPA v3 beta 1 (3.0.0.pre1)

Simo Sorce (104):

  • Set VERSION to 2.99.0 on the 3.0 development branch

  • Fix build warnings

  • ipa-pwd_extop: use endian.h instead of nih function

  • krbinstance: use helper function to get realm suffix

  • ipa-pwd-extop: Remove unused variables and code to set them

  • ipa-pwd-extop: do not append mkvno to krbExtraData

  • ipa-pwd-extop: Use the proper mkvno number in keys

  • ipa-pwd-extop: re-indent code using old style

  • ipa-pwd-extop: Use common krb5 structs from kdb.h

  • ipa-pwd-extop: Move encryption of keys in common

  • ipa-pwd-extop: Move encoding in common too

  • ipa-pwd-extop: make encsalt parsing function common

  • ipa-kdb: Initial plugin skeleton

  • ipa-kdb: add exports file

  • ipa-kdb: initialize module functions

  • ipa-kdb: implement get_time function

  • ipa-kdb: add common utility ldap wrapper functions

  • ipa-kdb: functions to get principal

  • ipa-kdb: add function to free principals

  • ipa-kdb: add functions to delete principals

  • ipa-kdb: add function to iterate over principals

  • ipa-kdb: add functions to change principals

  • ipa-kdb: Get/Store Master Key directly from LDAP

  • ipa-kdb: implement function to retrieve password policies

  • ipa-kdb: implement change_pwd function

  • util: add password policy manipulation functions

  • ipa-pwd-extop: Use common password policy code

  • ipa-kdb: add password policy support

  • ipa-pwd-extop: Allow kadmin to set krb keys

  • ipa-kdb: Change install to use the new ipa-kdb kdc backend

  • install: Remove uid=kdc user

  • ipa-kdb: Be flexible

  • install: Use proper case for boolean values

  • daemons: Remove ipa_kpasswd

  • schema: Split ipadns definitions from basev2 ones

  • v3-schema: Add new ipaExternalGroup objectclass

  • install: We do not need a ldap password anymore

  • install: We do not need a kpasswd keytab anymore

  • conncheck: Fix List of ports to check

  • ipa-kdb: Properly set password expiration time.

  • schema: Add new attributes and objectclasses for AD Trusts

  • conncheck: Additional check to verify the admin password is ok

  • ipa-pwd-extop: Fix segfault in password change.

  • ipa-pwd-extop: Enforce old password checks

  • ipa-kdb: Fix expiration time calculation

  • ipa-client-install: Fix joining when LDAP access is restricted

  • replica-prepare: anonymous binds may be disallowed

  • ipa-kdb: Fix legacy password hashes generation

  • updates: Change default limits on ldap searches

  • ipa-kdb: Fix memory leak

  • Modify random salt creation for interoperability

  • Amend #2038 fix

  • Fix CID 10742: Unchecked return value

  • Fix CID 10743: Unchecked return value

  • Fix CID 10745: Unchecked return value

  • Fix CID 11019: Resource leak

  • Fix CID 11020: Resource leak

  • Fix CID 11021: Resource leak

  • Fix CID 11022: Resource leak

  • Fix CID 11023: Resource leak

  • Fix CID 11024: Resource leak

  • Fix CID 11025: Resource leak

  • Fix CID 11026: Resource leak

  • Fix CID 11027: Wrong sizeof argument

  • Add support for generating PAC for AS requests for user principals

  • MS-PAC: Add support for verifying PAC in TGS requests

  • Add missing copyright header

  • Add NT domain GUID attribute.

  • Create skeleton CLDAP server as a DS plugin

  • ipa-cldap: Implement worker thread.

  • ipa-cldap: Decode CLDAP request.

  • ipa-cldap: Create netlogon blob

  • ipa-cldap: send cldap reply

  • ipa-kdb: Support re-signing PAC with different checksum

  • spec: We do not need krb5-server-ldap anymore

  • ipa-kdb: fix free() of uninitialized var

  • ipa-kdb: Remove unused CFLAGS/LIBS from Makefiles

  • ipa-kdb: fix memleaks in ipa_kdb_mspac.c

  • ipa-kdb: Fix copy and paste typo

  • ipa-kdb: Delegation ACL schema

  • ipa-kdb: enhance deref searches

  • ipa-kdb: Add delgation access control support

  • ipa-kdb: return properly when no PAC is available

  • ipa-cldap: Support clients asking for default domain

  • ipa-kdb: Verify the correct checksum in PAC validation

  • ipa-kdb: Create PAC’s KDC checksum with right key

  • Fix replication setup

  • slapi-plugins: use thread-safe ldap library

  • ipa-kdb: add AS auditing support

  • ipa-kdb: Avoid lookup on modify if possible

  • ipa-kdb: set krblastpwdchange only when keys have been effectively changed

  • Remove compat defines

  • Require krb5 1.10

  • ipa-kdb: Fix ACL evaluator

  • policy: add function to check lockout policy

  • ipa-kdb: fix delegation acl check

  • Fix ticket checks when using either s4u2proxy or a delegated krbtgt

  • Fix memleak and silence Coverity defects

  • Fix MS-PAC checks when using s4u2proxy

  • Fix theoretical leak discovered by coverity

  • Fix migration code password setting.

  • Fix setting domain_sid

  • ipa-kdb: Add MS-PAC on constrained delegation.

  • Add support for disabling KDC writes

Sumit Bose (32):

  • Call standard_logging_setup() before any logging is done

  • Add ipa-adtrust-install utility

  • Fix ACIs in ipa-adtrust-install

  • Update samba LDAP schema

  • Fix typo in v3 base schema

  • Add admin SIDs

  • ipa-pwd-extop: allow password change on all connections with SSF>1

  • Add DNS service records for Windows

  • Add DNS service records for Windows

  • Move our own domain info into cn=etc

  • Add trust objectclass and attributes to v3 schema

  • Use new objectclasses and attributes for trust

  • Fix some pylint warnings

  • Add ipasam samba passdb backend

  • activate CLDAP

  • Make pwd-extop aware of new ipaNTHash attribute

  • Add a second module init call for newer samba versions

  • Use exop instead of kadmin.local

  • ipasam: remove unused struct elements

  • Move some krb5 keys related functions from ipa-client to util

  • Add sidgen postop and task

  • Filter groups in the PAC

  • Add configure check for C Unit-Test framework check

  • Add external domain extop DS plugin

  • Use lower case names in LDAP to meet freeIPA convention

  • Extend LDAP schema

  • Add objects for initial ID range

  • Set RID bases for local domain during ipa-adtrust-install

  • Add CLI for ID ranges

  • Add range check preop plugin

  • Use DN objects instead of strings in adtrustinstance

  • Set samba_portmapper SELinux boolean during ipa-adtrust-install

Yuri Chornoivan (1):

  • Fix typos