Highlights in 4.7.0

The FreeIPA team would like to announce FreeIPA 4.7.0 release!

It can be downloaded from http://www.freeipa.org/page/Downloads.

Highlights in 4.7.0#

Enhancements#

mod_ssl#

IPA has switched to mod_ssl as the crypto engine for Apache. This change will be made automatically when upgrading.

NSS sqlite database#

Fedora 28 changed the default database format type from dbm to sqlite. Theoretically there should be no end-user difference but you will see different file names for your NSS databases: cert9.db, key4.db and pkcs11.txt.

authselect#

Fedora 28 switched to a new PAM configuration tool, authselect. https://fedoraproject.org/wiki/Changes/Authselect

Time server change to chronyd#

The ntpd service was deprecated in F28. It was replaced by chronyd. The client also uses chrony as its time client.

https://www.freeipa.org/page/V4/ntpd_deprecation/chronyd_support

Python 3#

FreeIPA now fully supports Python 3 and can be installed without any python 2 dependencies.

Known Issues#

Bug fixes#

FreeIPA 4.7.0 includes all of the bug fixes and enhancements from 4.6.1 - 4.6.4.

There are more than 170 bug fixes, details of which can be seen in the list of resolved tickets below.

Upgrading#

Upgrade instructions are available on Upgrade page.

Feedback#

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on Freenode.

Resolved tickets#

  • 7615 ipa_tests: ipa-replica-prepare stuck on user input

  • 7550 [WebUI] extend host test suite

  • 7547 ui_tests: checkbox click fix

  • 7546 ui_tests: improve “field_validation” method

  • 7544 ui_tests: extend test_selinuxusermap.py suite

  • 7542 CLI and Web UI allow to add more then one radius server into radius proxy

  • 7540 Extend WebUI test_krbpolicy suite with the following test cases:

  • 7535 ipa-restore fails because tmp/etc/ipa/ca.crt is missing

  • 7526 IdM servers:/usr/share/ipa/html/ca.crt does not include the complete chain

  • 7520 ipa certmap-match throwing “ipa: ERROR: an internal error has occurred”

  • 7519 Adding SSH keys for AD users as I created overrides

  • 7510 validate_selinuxuser does not allow a period in selinux user identifier

  • 7505 WebUI tests: Extend netgroup tests

  • 7503 multiple occurrences of profileId in certprofile causes incorrect behaviour

  • 7485 Extending webui user group test

  • 7474 ipa-server-install –uninstall on replica fails with “NoOptionError: No option ‘ldap_uri’ in section: ‘global’”

  • 7473 ERROR: No valid Negotiate header in server response

  • 7468 test_host.py::test_host::test_crud is failing in nightly tests

  • 7463 test_webui: add user life-cycles tests

  • 7447 test_create_host_with_ip is not fully covering possible return errors

  • 7436 ipa: Please log something after restarting the KDC

  • 7433 CRL url on replicas gets incorrectly redirected

  • 7432 make fasttest fails on fresh clone. fedora26

  • 7425 ipa-server-install with different IP fails on /usr/sbin/pkispawn -s CA

  • 7424 Improve Realm Domains doc text

  • 7411 Simplify CA, TLS and bytes warning configuration of LDAP connections

  • 7400 Add excludearch for i686 because 389-ds is no longer doing 32-bit builds

  • 7397 ipa host-add –ip-address… returns Internal error when forward-policy=none is defined

  • 7394 file conflicts between python2-mod_wsgi and freeipa-server

  • 7393 Installing 4.6.3-1 in rawhide/F28 fails with DuplicateEntry enabling TLS in 389-ds

  • 7390 cert-request: issuance of malformed certificate causes IPA Internal Error

  • 7389 F-27 upgrade to 4.6.3-1 fails with KRA update

  • 7383 user-add: user creation proceeds when password is wrong

  • 7381 Drop PyOpenSSL requirement

  • 7380 Possible regression for limited OTP characters in host-add

  • 7378 ipa-ods-exporter fails with socket activation did not return socket

  • 7374 IPA ‘Generate OTP’ option in web gui does not show OTP code when no reverse zone is managed

  • 7373 “An internal error has occurred” show up when trying to add a user to the Member User table in Vault.

  • 7371 uninstalling replica leaves orphained data in ldap

  • 7359 [RFE] extend topology plugin to clean up a removed replica ldap/ principal

  • 7357 IntegrationTests do not fail even if the uninstall process fails

  • 7342 admins group is not including all permissions of Role “User Administrator”

  • 7338 FreeIPA server install/upgrade does not process schema.d/ files correctly

  • 7335 Integration tests are not collecting all logs

  • 7330 ipa-server-install –uninstall does not return error code on error

  • 7318 Cannot uninstall ipaserver after fresh install - {‘desc’: “Can’t contact LDAP server”, ‘errno’: 111, ‘info’: ‘Connection refused’}

  • 7315 Packaging: use pylint 1.7.5 and remove disable for import stat

  • 7313 trust integration tests need to override test_establish_trust method when using different trust-add options

  • 7308 Help for ipa trust-add –range-type

  • 7299 RPM post-install scripts fail because they are run with python2

  • 7294 python3 incompatibility in vault_archive

  • 7275 Viewing DNS Records with WebUI fails

  • 7254 test_caless: fix http.p12 is not valid and provide domain_level for replica tests

  • 7253 Custodia keys are not removed on uninstall

  • 7240 ipa-dnskeysyncd broken (and ipactl doesn’t tell)

  • 7226 Remove remaining references to Firefox configuration extension

  • 7220 Third KRA installation in topology fails

  • 7210 Firefox reports insecure TLS configuration when visiting FreeIPA web UI after standard server deployment

  • 7208 freeipa: binary RPMs require both Python 2 and Python 3

  • 7190 Wrong info message from tasks.py

  • 7189 make check is failed

  • 7187 ipa-replica-manage should provide a debug option

  • 7186 testing: get back command outputs when running tests

  • 7162 [ipatests] disable replication debugging for 389-ds logs in integration tests

  • 7157 [tracker] pyasn1 fails to parse kerberos principal name

  • 7155 test_caless: add caless to external CA test

  • 7154 test_external_ca: switch to python-cryptography

  • 7151 ipa-server-upgrade performs unneeded steps to stop tracking/start tracking certs

  • 7150 Ipa-server-install update dse.ldif with wrong SELinux context

  • 7148 py3: ipa cert-request –principal –database fails with BytesWarning: str() on a bytes instance

  • 7143 “unknown command ‘undefined’” error when changing user’s password via the web UI

  • 7136 ipa-restore command doesn’t exit with failure if wrong directory manager’s password is provided

  • 7135 Server deployment still sets up Firefox extension, this is no longer necessary and broken on F27+

  • 7134 ipa param-find: command displays internal error

  • 7132 [4.6] PyPI packages are broken

  • 7131 Finish Python3 support

  • 7129 ipa-server/replica-install fails with: “exception: BytesWarning: Comparison between bytes and string” when using ‘–dirsrv-config-file’ parameter

  • 7124 [ipatests] - forced_client_reenrollment-domlevel-1 test suite fails due to missing dns records

  • 7119 kdc_proxy: kinit admin fails with “Cannot contact any KDC for realm ‘IPA.TEST’ while getting initial credentials”

  • 7115 ipa-pki-retrieve-key: failure results in crash report

  • 7033 vault: TypeError: … is not JSON serializable

  • 7027 Use TLS for cert-find

  • 7012 Users can delete their last active OTP token

  • 6994 RFE: Remove 389-ds tuning step

  • 6968 Consider moving upgrades from rpm install post

  • 6874 pylint 1.7.1 fails

  • 6858 RFE - Option to add custom OID or display name in IPA Cert

  • 6851 Don’t use ctypes.util.find_library in ipaclient

  • 6844 ipa-restore fails when umask is set to 0027

  • 6721 While performing ipa-server-upgrade, sssd goes offline and stalls the upgrade process

  • 6703 Enable ephemeral KRA requests

  • 6609 A CA administrator fails to add CA for Insufficient ‘add’ privilege

  • 5922 ipa vault-archive overwrites an existing value without warning

  • 5887 IDNA domains does not work under py3

  • 5813 ipa-kra-install disrupts bind-dyndb-ldap

  • 5776 webui: some data disappear from user details page after the save action is performed

  • 5638 Port client code to Python 3

  • 5442 [tracker] SELinux ‘execmem’ denials

  • 7624 [WebUI] wrong link to browser configuration guide on Login page

  • 7609 [py37] Import from collections.abc

  • 7604 ipa-client-install –mkhomedir doesn’t enable oddjobd

  • 7591 [freeipa] Drop requirements for ‘initscripts’ from specfile

  • 7590 lightweight subca: ca-show fails on replica

  • 7589 cacert renew fails on replica

  • 7585 Update to python3-lesscpy 0.13

  • 7581 Translated text is formed incorrectly (API Browser)

  • 7562 Regression: authselect 0.4-3 breaks FreeIPA sudo rules

  • 7560 Do not depend on gnupg (1.x), use gnupg2

  • 7559 UI LoginScreen widget cannot be translated

  • 7536 [F28] SubCA failing, keys are orphan

  • 7533 ipa-advise: remove plugin config-fedora-authconfig

  • 7530 external CA replica installation fails with CA_UNREACHABLE

  • 7529 AVC denials and errors for IPA server installed on Fedora28

  • 7524 ipa-client-install fails because of missing file /usr/share/ipa/freeipa.template

  • 7523 external CA installation: step two reports self-signed configuration

  • 7516 [F28] ipa-ca-install fails on replica

  • 7515 ipa-advise config-server-for-smart-card-auth refers to nss.conf despite the migration to ssl.conf

  • 7514 Allow to create Kerberos services without a corresponding host object

  • 7513 Allow Kerberos services to be members of IPA groups

  • 7500 FreeIPA can remove svrcore-devel requirement

  • 7498 [F28] CA replica fails with could not find certificate named “caSigningCert cert-pki-ca”

  • 7491 Unknown user ‘ipaapi’ when updating packages

  • 7490 installutils.set_directive doesn’t handle debian ssl.conf properly

  • 7489 Test test_caless_TestCertInstall is failing in nightly

  • 7478 [F28] ipa-backup fails with “Failed to execute authconfig command”

  • 7471 [F28] replica pkispawn fails

  • 7469 ipa-replica-prepare fail with “stat: path should be string, bytes, os.PathLike or integer, not NoneType”

  • 7466 [F28] Replica installs fails with CA_REJECTED caused by ACIError

  • 7465 [F28] oddjobd not started, replica install fails with dbus error in conn check

  • 7464 CI is failing with pkispawn timeout

  • 7461 Hardening of topology plugin to prevent erronous deletion of a replica agreement

  • 7426 DogtagInstance.backup_config creates backup with wrong owner

  • 7421 Store HTTPD private keys encrypted

  • 7418 [RFE] Improve ipa-client-install behaviour when non-standard ldap.conf is used

  • 7415 CA installer need to check availability of port 8080

  • 7410 ipa-replica-install –add-agents option doesn’t install trust-agent on replica

  • 7396 ipa-client-automount –uninstall should return errcode CLIENT_NOT_CONFIGURED

  • 7377 Investigate and define plan of authconfig replacement in FreeIPA

  • 7354 Fedora 28: Support NSSDB SQL format

  • 7322 cert_find –subject is not finding by cert subject

  • 7311 Update ui_driver to allow set path for geckodriver.log

  • 7310 Integration tests don’t collect logs from other replicas

  • 7309 Integration tests: CA-less -> CA-ful promotion; post-promotion checks

  • 7304 double ca acl provoke console error.

  • 7302 test_external_ca: add selfsigned > external_ca > selfsigned test case

  • 7301 Drop dependency on Python nose

  • 7300 test_x509: test very long OID

  • 7295 Build freeIPA with Python3 in @freeipa/freeipa-master-nightly

  • 7278 Run WebUI unit test in TravisCI

  • 7274 ipa-replica-install fails with PIN error [ CA-less environment ]

  • 7263 Typo in login screen

  • 7258 typo in accounts menu

  • 7257 DNSSEC isn’t supported in Python3

  • 7251 f.flush() or os.fsync() don’t sync

  • 7246 Report CA Subject DN and subject base before installing.

  • 7239 Using –auto-reverse and –allow-zone-overlap does not skip zone overlap check

  • 7225 CLI: view command / plugin help in pager

  • 7224 Logging: ipa-replica-conncheck is missing a /n

  • 7207 ipa-server-install should prevent installations with single label domains

  • 7201 ipa-replica-manage re-initialize TypeError: ‘NoneType’ object does not support item assignment

  • 7183 /etc/gssproxy/10-ipa.conf not removed on uninstall

  • 7095 [tracker] please rotate & compress /var/lib/pki/pki-tomcat/logs/ca/debug

  • 7049 Prepare for NSS switch default database to sqlite in F-27

  • 7024 freeipa depends on ntp

  • 6931 custodia user isn’t created when FreeIPA RPMs are installed

  • 6890 Quickstart guide: mention how to open firewall ports

  • 6884 ipa group-del gives ipa: ERROR: Insufficient access: but still deletes group

  • 6843 ipa-backup does not create log file at /var/log/

  • 6837 make ipa.conf and named.conf portable

  • 6760 Improve console message for “ipa-server-install –uninstall” command

  • 6604 Make pylint and jsl optional (and other issues)

  • 6589 client should require /etc/krb5.conf.d/

  • 6450 pylint: cyclic dep check sometimes makes build fail

  • 4853 Utilize system-wide crypto-policies

  • 4140 Configure the NSS shared database model in IPA servers

  • 3757 [RFE] Allow IPA to use either mod_ssl or mod_nss

  • 2536 Create DOAP description for the IPA project

Detailed changelog since 4.6.4#

Armando Neto (9)#

  • Disable Pylint 2.0 violations

  • Fix Pylint 2.0 violations

  • Fix pylint 2.0 conditional-related violations

  • Fix pylint 2.0 return-related violations

  • Replace file.flush() calls with flush_sync() helper

  • ipa-server-install: fix zonemgr argument validator

  • ipa-client-install: Update how comments are added by ipachangeconf

  • ui_tests: fix test_config::test_size_limits

  • Prevent the creation on users and groups with numeric characters only

Alexander Bokovoy (28)#

  • ipaserver/dcerpc.py: handle indirect topology conflicts

  • pylint3: workaround false positives reported for W1662

  • group: allow services as members of groups

  • service: allow creating services without a host to manage them

  • group-del: add a warning to logs when password policy could not be removed

  • idoverrideuser-add: allow adding ssh key in web ui

  • ACL: Allow hosts to remove services they manage

  • install: validate AD trust-related options in installers

  • replication: support error messages from 389-ds 1.3.5 or later

  • upgrade: treat duplicate entry when updating as not an error

  • Allow anonymous access to parentID attribute

  • upgrade: Run configuration upgrade under empty ccache collection

  • use LDAP Whoami command when creating an OTP token

  • Update template directory with new variables when upgrading ipa.conf.template

  • Processing of server roles should ignore errors.EmptyResult

  • ipaserver/plugins/trust.py: pep8 compliance

  • trust: detect and error out when non-AD trust with IPA domain name exists

  • ipaserver/plugins/trust.py; fix some indenting issues

  • ipa-extdom-extop: refactor nsswitch operations

  • test_dns_plugin: cope with missing IPv6 in Travis

  • travis-ci: collect logs from cmocka tests

  • ipa-kdb: override krb5.conf when testing KDC code in cmocka

  • adtrust: filter out subdomains when defining our topology to AD

  • ipa-replica-manage: implicitly ignore initial time skew in force-sync

  • ds: ignore time skew during initial replication step

  • Make sure upgrade also checks for IPv6 stack

  • OTP import: support hash names with HMAC- prefix

  • dsinstance: Restore context after changing dse.ldif

Abhijeet Kasurde (3)#

  • Trivial typo fix.

  • ipatests: Fix interactive prompt in ca_less tests

  • tests: correct usage of hostname in logger in tasks

Alexander Koksharov (4)#

  • Fix replica_promotion-domlevel0 test failures

  • preventing ldap principal to be deleted

  • ensuring 389-ds plugins are enabled after install

  • kra-install: better warning message

amitkuma (13)#

  • Match Common Name attribute in Subject

  • ipa vault-archive overwrites an existing value without warning

  • ipa-advise: remove plugin config-fedora-authconfig

  • RFE: ipa client should setup openldap for GSSAPI

  • Correcting detect typo in server.m4

  • Correction of management spelling.

  • clear sssd cache when uninstalling client

  • clear sssd cache when uninstalling client

  • Error message while adding idrange with untrusted domain

  • Removing extra spaces present in man ipa-server-install

  • ipa-advise for smartcards updated

  • Custom ca-subject logging

  • Documenting kinit_lifetime in /etc/ipa/default.conf

Anuja More (5)#

  • Test for ipa-client-install should not use hardcoded admin principal

  • Test that host can remove there own services

  • Test for ipa-replica-install fails with PIN error for CA-less env.

  • Adding test-cases for ipa-cacert-manage

  • Adding test-cases for ipa-cacert-manage

Aleksei Slaikovskii (17)#

  • Revert “Fixing TestBackupAndRestore::test_full_backup_and_restore_with_removed_users”

  • Uninstall fix for named-pkcs11

  • Radius proxy multiservers fix

  • test_backup_and_restore.py Fix logging

  • Enable and start oddjobd after ipa-restore if it’s not running.

  • Fixing translation problems

  • test_backup_and_restore.py AssertionError fix

  • ipalib/frontend.py output_for_cli loops optimization

  • View plugin/command help in pager

  • ipa-restore: Set umask to 0022 while restoring

  • Prevent installation with single label domains

  • Add a notice to restart ipa services after certs are installed

  • Fix TypeError while ipa-restore is restoring a backup

  • ipaclient.plugins.dns: Cast DNS name to unicode

  • Less confusing message for PKINIT configuration during install

  • Make tox tests to generate results in JUnit XML

  • Make WebUI unit tests to generate results as JUnit

Brian J. Murrell (1)#

  • Move ETag disabling to /ipa virtual server

Christian Heimes (191)#

  • Remove needless use of %defatt

  • Add more RHEL customizations to spec file

  • Update builddep command in BUILD.txt

  • Use python2_sitelib in spec file

  • Fedora 29: No longer build python2-ipaserver

  • Add pylint ignore to magic config.Env attributes

  • Teach pylint how our api works

  • Fix ipa console filename

  • Create helper function to upload to temp file

  • Add tab completion and history to ipa console

  • Handle races in replica config

  • pylint 2.0: node.path is a list

  • Fix XPASS in test_installation

  • Mark all expected failures as strict

  • Fix DNSSEC install regression

  • Wait for client certificates

  • Auto-retry failed certmonger requests

  • Tune DS replication settings

  • Fix race condition in get_locations_records()

  • Fix CA topology warning

  • Delay enabling services until end of installer

  • Only create DNS SRV records for ready server

  • Query for server role IPA master

  • Cleanup shebang and executable bit

  • Import ABCs from collections.abc

  • Require JSS 4.4.5 with replication fixes

  • Extend Sub CA replication test

  • pylint: Class node has been renamed to ClassDef

  • Pythhon3.7: re module has no re._pattern_type

  • Catch ACIError instead of invalid credentials

  • Fix permission of public files in upgrader

  • Make /etc/httpd/alias world readable & executable

  • Always make ipa.p11-kit world-readable

  • Ensure that public cert and CA bundle are readable

  • Use 4 WSGI workers on 64bit systems

  • Fix replication races in Dogtag admin code

  • Use common replication wait timeout of 5min

  • Improve and fix timeout bug in wait_for_entry()

  • Remove restarted_named and xfail

  • Tests: Set default TTL for DNS zones to 1 sec

  • Always set ca_host when installing replica

  • Start to deprecate Python 2 and 3.5

  • Sort and shuffle SRV record by priority and weight

  • Increase WSGI process count to 5 on 64bit

  • Fedora 29 renamed fedora-domainname.service

  • Use python3-lesscpy 0.13.0

  • Split external_ca PR-CI into two jobs

  • Always build Python 3 packages

  • Make Python 2 build dependency optional

  • Use one Custodia peer to retrieve all secrets

  • Move client templates to separate directory

  • Print version string in installer

  • Backport gzip.decompress for Python 2

  • Require JSS 4.4.4 with fix for sub CA replication

  • Refuse PORT, HOST in /etc/openldap/ldap.conf

  • Apply sane LDAP settings to C code

  • Use sane default settings for ldap connections

  • Add test case for allow-create-keytab

  • Use GnuPG 2 for backup/restore

  • Use GnuPG 2 for symmentric encryption

  • Require python-ldap >= 3.1.0

  • Reproducer for issue 5923 (bytes in error response)

  • Run PR-CI with Fedora 28

  • Revert “Validate the Directory Manager password”

  • Create missing /etc/httpd/alias for ipasession.key

  • Only run subset of external CA tests

  • Require Dogtag 10.6.1

  • Require nss with fix for nickname bug

  • ipa-client package needs sssd-tool

  • Make ipatests’ create_external_ca a script

  • Load certificate files as binary data

  • Remove contrib/nssciphersuite

  • Compatibility with pytest 3.4

  • Use shutil to copy file

  • Use single Custodia instance in installers

  • Add augeas dependency to client package

  • Create users in server-common pre hook

  • Require 389-ds-base >= 1.4.0.8-1

  • CA replica PKCS12 workaround for SQL NSSDB

  • Add nsds5ReplicaReleaseTimeout to replica config

  • Fix Python dependencies

  • Remove os.chdir() from test_ipap11helper

  • certdb: Move chdir into subprocess call

  • Provide ldap_uri in Custodia uninstaller

  • Defer import of ipaclient.csrgen

  • Require more recent glibc on F27

  • Load librpm on demand for IPAVersion

  • Fix installer CA port check for port 8080

  • Temporarily disable authconfig backup and restore

  • Cleanup and remove more files on uninstall

  • Fix compatibility with latest pytest

  • More cleanup after uninstall

  • Require Dogtag PKI >= 10.6

  • Keep owner when backing up CA.cfg

  • Pylint 1.8.3 fixes

  • Relax message check in test_create_host_with_ip

  • Make fasttest pass without ~/.ipa/default.conf

  • Instrument installer to profile steps

  • autoconf prefers Python 3 over 2

  • Simplify Python package installation

  • Move DNS related files to server-dns package

  • Silence GCC warning in ipa_extdom

  • Silence GCC warning in ipa-kdb

  • Remove unused modutils wrappers from NSS/CertDB

  • Update /etc/ipa/nssdb in client scripts

  • NSS: Force restore of SELinux context

  • NSSDB: Let certutil decide its default db type

  • Prepare migration of mod_nss NSSDB to sql format

  • certmonger: Use explicit storage format

  • Remove deprecated -p option from ipa-dns-install

  • Add mocked test for named crypto policy update

  • Upgrade named.conf to include crypto policy

  • Use system-wide crypto-policies on Fedora

  • Add better CalledProcessError and run() logging

  • freeipa-server no longer supports i686 arch on F28

  • ipa-custodia-checker now uses python3 shebang

  • Unified ldap_initialize() function

  • Fix multiple uninstallation of server

  • Fix i18n test for Chinese translation

  • Run API and ACI under Python 2 and 3

  • Generate same API.txt under Python 2 and 3

  • Replace wsgi package conflict with config file

  • Restart named-pkcs11 after KRA installation

  • Update existing 389-DS cn=RSA,cn=encryption config

  • Replace hard-coded paths with path constants

  • Bump python-ldap version to fix syncrepl bug

  • Bump SELinux policy for DNSSEC

  • ipa-server-upgrade now checks custodia server keys

  • DNSSEC code cleanup

  • DNSSEC: Reformat lines to address PEP8 violations

  • Decode ODS commands

  • Run DNSSEC under Python 3

  • More DNSSEC house keeping

  • Remove unused PyOpenSSL from spec file

  • Give ODS socket a bit of time

  • Require dbus-python on F27

  • Fix pylint error in ipapython/dn.py

  • Lower python-ldap requirement for F27

  • ipa-run-tests: make –ignore absolute, too

  • Sort external schema files

  • LGTM: unnecessary else in for loop

  • LGTM: Use explicit string concatenation

  • LGTM: raise handle_not_found()

  • LGTM: Fix multiple use before assignment

  • LGTM: Remove redundant assignment

  • LGTM: Fix exception in permission_del

  • LGTM: Membership test with a non-container

  • LGTM: Name unused variable in loop

  • LGTM: Use of exit() or quit()

  • LGTM: Silence unmatchable dollar

  • Make fastlint even faster

  • ipa-run-tests: replace chdir with plugin

  • Include ipa_krb5.h without util prefix

  • Custodia uninstall: Don’t fail when LDAP is down

  • Require python-ldap 3.0.0b2

  • Use pylint 1.7.5 with fix for bad python3 import

  • Vault: Add argument checks to encrypt/decrypt

  • Fix pylint warnings inconsistent-return-statements

  • Travis: Add workaround for missing IPv6 support

  • Replace nose with unittest and pytest

  • Add safe DirectiveSetter context manager

  • More log in verbs

  • Address more ‘to login’

  • Fix grammar error: Log out

  • Fix grammar in login screen

  • Add make targets for fast linting and testing

  • Add marker needs_ipaapi and option to skip tests

  • Add python_requires to Python package metadata

  • Remove Custodia keys on uninstall

  • NSSDB: use preferred convert command

  • Skip test_rpcclient_context in client tests

  • Update to python-ldap 3.0.0

  • Update builddep command to install Python 3 and tox deps

  • Add workaround for pytest 3.3.0 bug

  • Fix dict iteration bug in dnsrecord_show

  • Reproducer for bug in structured dnsrecord_show

  • Use Python 3 on Travis

  • Prevent installation of Py2 and Py3 mod_wsgi

  • Require UTF-8 fs encoding

  • libotp: add libraries after objects

  • Run tox tests for PyPI packages on Travis

  • Support sqlite NSSDB

  • Py3: Fix vault tests

  • Test script for ipa-custodia

  • ipa-custodia: use Dogtag’s alias/pwdfile.txt

  • Use namespace-aware meta importer for ipaplatform

  • Remove ignore_import_errors

  • Backup ipa-custodia conf and keys

  • Py3: fix fetching of tar files

  • Use os.path.isfile() and isdir()

  • Block PyOpenSSL to prevent SELinux execmem in wsgi

David Kupka (2)#

  • schema: Fix internal error in param-{find,show} with nonexistent object

  • tests: Add LDAP URI to ldappasswd explicitly

Felipe Barreto (38)#

  • Adding xfail to failing tests

  • Fixing tests on TestReplicaManageDel

  • Fixing TestCASpecificRUVs::test_replica_uninstall_deletes_ruvs

  • Fixing TestBackupAndRestore::test_full_backup_and_restore_with_removed_users

  • Adding GSSPROXY_CONF to be backed up on ipa-backup

  • Reverting commit 6b145bf3e696e6d40b74055ccdf8d14da7828a09

  • Fix TestSubCAkeyReplication providing the right path to pki log

  • temp commit: adding test to PR CI run

  • Adding right parameters to install IPA in TestInstallMasterReservedIPasForwarder

  • Changing Django’s CoC to reflect FreeIPA CoC

  • Adding Django’s Code of Conduct

  • prci: Bump ci-master-f27 template to 1.0.3

  • Adding more tests to PR CI

  • Fixing cleanup process in test_caless

  • WebUI Tests: changing the ActionsChains.move_to_element to a new approach

  • WebUI Tests: fixing test_user.py::test_test_noprivate_posix

  • WebUI Tests: Changing how the initial load process is done

  • WebUI Tests: fixing test_range test case

  • WebUI Tests: changing how the login screen is detected

  • WebUI Tests: refactoring login method to be more readable

  • WebUI Tests: fixing test_navigation

  • WebUI Tests: fixing test_group

  • WebUI Tests: fixing test_hbac

  • Check if replication agreement exist before enable/disable it

  • Make IntegrationTest fail if an error happened during uninstall

  • IntegrationTests now collects logs from all test methods

  • Fixing vault-add-member to be compatible with py3

  • Fixing test_backup_and_restore assert to do not rely on the order

  • Fixing test_testconfig with proper asserts

  • Warning the user when using a loopback IP as forwarder

  • Removing replica-s4u2proxy.ldif since it’s not used anymore

  • Fix log capture when running pytests_multihosts commands

  • Checks if replica-s4u2proxy.ldif should be applied

  • Fixing tox and pylint errors

  • Fixing param-{find,show} and output-{find,show} commands

  • Checks if Dir Server is installed and running before IPA installation

  • Changing idoverrideuser-* to treat objectClass case insensitively

  • Fixing how sssd.conf is updated when promoting a client to replica

François Cami (1)#

Florence Blanc-Renaud (38)#

  • ipa client uninstall: clean the state store when restoring hostname

  • Add test for ticket 7604: ipa-client-install –mkhomedir doesn’t enable oddjobd

  • ipa-client-install: enable and start oddjobd if mkhomedir

  • fix dependency for *-domainname.service file

  • Installer: configure authselect with-sudo

  • Test for 7526

  • ipa-server-install: publish complete cert chain in /usr/share/ipa/html/ca.crt

  • authselect migration: use stable interface to query current config

  • authselect test: skip test if authselect is not available

  • ipa-advise: adapt config-client-for-smart-card-auth to authselect

  • Revert commit d705320ec136abc2fcf524f2b63a76d3fc0ba97a

  • New tests for authselect migration

  • Migration from authconfig to authselect

  • ipa-advise config-server-for-smart-card-auth: use mod-ssl

  • ipa-replica-install: make sure that certmonger picks the right master

  • ipa-restore: remove /etc/httpd/conf.d/nss.conf

  • ipa-server-install: handle error when calling kdb5_util create

  • ipa host-add: do not raise exception when reverse record not added

  • ACI: grant access to admins group instead of admin user

  • 389-ds OTP lasttoken plugin: Add unit test

  • User must not be able to delete his last active otp token

  • ipa host-add –ip-address: properly handle NoNameservers

  • test_integration: backup custodia conf and keys

  • Idviews: fix objectclass violation on idview-add

  • Improve help message for ipa trust-add –range-type

  • Fix ca less IPA install on fips mode

  • Fix ipa-replica-install when key not protected by PIN

  • Fix ipa-restore (python2)

  • ipa-getkeytab man page: add more details about the -r option

  • Py3: fix ipa-replica-conncheck

  • Fix ipa-replica-conncheck when called with –principal

  • py3: fix ipa cert-request –database …

  • ipa-cacert-manage renew: switch from ext-signed CA to self-signed

  • ipa-server-upgrade: do not add untracked certs to the request list

  • ipa-server-upgrade: fix the logic for tracking certs

  • Fix ipa-server-upgrade with server cert tracking

  • Python3: Fix winsync replication agreement

  • Fix ipa config-mod –ca-renewal-master

Fraser Tweedale (52)#

  • Add missing space in error string

  • Handle compressed responses from Dogtag

  • install: fix reported external CA configuration

  • csrgen: fix when attribute shortname is lower case

  • csrgen: drive-by docstring

  • csrgen: support initialising OpenSSL adaptor with key object

  • py3: fix csrgen error handling

  • certprofile: add tests for config profileId scenarios

  • certprofile: reject config with multiple profileIds

  • Fix upgrade (update_replica_config) in single master mode

  • Add commentary about PKI admin password

  • Fix upgrade when named.conf does not exist

  • replica-install: warn when there is only one CA in topology

  • install: configure dogtag status request timeout

  • upgrade: remove fix_trust_flags procedure

  • ldap2: fix implementation of can_add

  • ipaldap: allow GetEffectiveRights on individual operations

  • Update IPA CA issuer DN upon renewal

  • cert-request: avoid internal error when cert malformed

  • Improve warning message for malformed certificates

  • Don’t use admin cert during KRA installation

  • Add uniqueness constraint on CA ACL name

  • Add tests for installutils.set_directive

  • installutils: refactor set_directive

  • pep8: reduce line lengths in CAInstance.__enable_crl_publish

  • Prevent set_directive from clobbering other keys

  • install: report CA Subject DN and subject base to be used

  • ipa_certupdate: avoid classmethod and staticmethod

  • Run certupdate after promoting to CA-ful deployment

  • ipa-ca-install: run certupdate as initial step

  • CertUpdate: make it easy to invoke from other programs

  • renew_ra_cert: fix update of IPA RA user entry

  • Re-enable some KRA installation tests

  • Use correct version of Python in RPM scripts

  • Remove caJarSigningCert profile and related code

  • CertDB: remove unused method issue_signing_cert

  • Remove XPI and JAR MIME types from httpd config

  • Remove mention of firefox plugin after CA-less install

  • Add missing space in ipa-replica-conncheck error

  • ipa-cacert-manage: avoid some duplicate string definitions

  • ipa-cacert-manage: handle alternative tracking request CA name

  • Add tests for external CA profile specifiers

  • ipa-cacert-manage: support MS V2 template extension

  • certmonger: add support for MS V2 template

  • certmonger: refactor ‘resubmit_request’ and ‘modify’

  • ipa-ca-install: add –external-ca-profile option

  • install: allow specifying external CA template

  • Remove duplicate references to external CA type

  • cli: simplify parsing of arbitrary types

  • py3: fix pkcs7 file processing

  • ipa-pki-retrieve-key: ensure we do not crash

  • issue_server_cert: avoid application of str to bytes

Ganna Kaihorodova (7)#

  • check nsds5ReplicaReleaseTimeout option was set

  • Fix trust tests for Posix Support

  • Fix for integration tests dns_locations

  • Fix in IPA’s multihost fixture

  • TestBasicADTrust.test_ipauser_authentication

  • Fix for test TestInstallMasterReservedIPasForwarder

  • Overide trust methods for integration tests

John Morris (1)#

  • Increase dbus client timeouts during CA install

Justin Stephenson (1)#

  • Skip zone overlap check with auto-reverse

Kaleemullah Siddiqui (1)#

  • Test coverage for multiservers for radius proxy

Martin Basti (3)#

  • py3: bindmgr: fix iteration over bytes

  • py3: ipa-dnskeysyncd: fix bytes issues

  • py3: set samba dependencies

Takeshi MIZUTA (1)#

  • Fix some typos in man page

Michal Reznik (54)#

  • Mark DL0 TestReplicaManageDel tests as xfail

  • ipa_tests: ipa-replica-prepare stuck on user input

  • ui_tests: stabilization fixes

  • ui_tests: extend test_config.py suite

  • ui_tests: fixes for issues with sending key and focus on element

  • ui_tests: add click_undo_button() func

  • ui_tests: extend test_selinuxusermap.py suite

  • ui_tests: improve “field_validation” method

  • ui_tests: checkbox click fix

  • ui_tests: introduce new test_misc cases file

  • ui_driver: extension and modifications related to test_user

  • ui_tests: extend test_user suite

  • test_web_ui: extend ui_driver methods

  • test_webui: add user life-cycles tests

  • ui_tests: run ipa-get/rmkeytab command on UI host

  • ui_tests: select_combobox() fixes

  • ui_tests: test cancel and delete without button

  • ui_tests: make associations cancelable

  • ui_tests: add function to run cmd on UI host

  • ui_tests: add funcs to add/remove users public SSH key

  • ui_tests: add assert_field_required()

  • ui_tests: add assert_notification()

  • ui_tests: add more test cases

  • ui_tests: add more test cases to test_certification

  • ui_tests: add_service() support func in test_service

  • ui_tests: add_host() support func in test_service

  • ui_tests: change get_http_pkey() function

  • test_caless: adjust try/except to capture also IOError

  • ipa_tests: test signing request with subca on replica

  • tests: ca-less to ca-full - remove certupdate

  • ipa_tests: test subca key replication

  • test_caless: add SAN extension to other certs

  • prci: run full external_ca test suite

  • tests: move CA related modules to pytest_plugins

  • test_external_ca: selfsigned->ext_ca->selfsigned

  • test_tasks: add sign_ca_and_transport() function

  • paths: add IPA_CACERT_MANAGE and IPA_CERTUPDATE constants

  • test_caless: test PKINIT install and anchor update

  • test_renewal_master: add ipa csreplica-manage test

  • test_cert_plugin: check if SAN is added with default profile

  • test_help: test “help” command without cache

  • test_x509: test very long OID

  • test_batch_plugin: fix py2/3 failing assertion

  • test_vault: increase WAIT_AFTER_ARCHIVE

  • test_caless: fix http.p12 is not valid

  • test_caless: fix TypeError on domain_level compare

  • manpage: ipa-replica-conncheck - fix minor typo

  • test_external_dns: add missing test cases

  • test_caless: open CA cert in binary mode

  • test_forced_client: decode get_file_contents() result

  • tests: add host zone with overlap

  • tests_py3: decode get_file_contents() result

  • test_caless: add caless to external CA test

  • test_external_ca: switch to python-cryptography

Varun Mylaraiah (5)#

  • ui_tests: extend test_pwpolicy.py suite

  • Extend WebUI test_krbpolicy suite with the following test cases: test_verifying_button (verify button’s action in various scenarios) test_negative_value (verify invalid values) test_verifying_measurement_unit

  • WebUI tests: Extend netgroup tests with more scenarios

  • Fixed improper clean-up in test_host::test_kerberos_flags added closing the notification in kerberos flags

  • WebUI tests: Extend user group tests with more scenarios

Mohammad Rizwan Yusuf (9)#

  • Check if issuer DN is updated after self-signed > external-ca

  • Extended UI test for Certificates

  • Extended UI test for selfservice permission.

  • Test to check second replica installation after master restore

  • Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-/ldif/-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root.

  • Updated the TestExternalCA with the functions introduced for the steps of external CA installation.

  • When the dirsrv service, which gets started during the first ipa-server-install –external-ca phase, is not running when the second phase is run with –external-cert-file options, the ipa-server-install command fail.

  • IANA reserved IP address can not be used as a forwarder. This test checks if ipa server installation throws an error when 0.0.0.0 is specified as forwarder IP address.

  • ipatest: replica install with existing entry on master

Nikhil Dehadrai (1)#

  • Test for improved Custodia key distribution

Armando Neto (1)#

  • ipaserver config plugin: Increase search records minimum limit

Nathaniel McCallum (3)#

  • Revert “Don’t allow OTP or RADIUS in FIPS mode”

  • Increase the default token key size

  • Fix OTP validation in FIPS mode

Petr Čech (3)#

  • webui:tests: Add tests for realmd domains

  • tests: Mark failing tests as failing

  • ipatests: Fix on logs collection

Pavel Picka (2)#

  • Adding WebUI Host test cases

  • WebUI Hostgroups tests cases added

Petr Vobornik (17)#

  • Update Dojo and Dojo builder to 1.13.0

  • WebUI build: use NodeJS instead of Rhino

  • WebUI build: replace uglifyjs with system package

  • Fix test_server_del::TestLastServices

  • server-del do not return early if CA renewal master cannot be changed

  • webui: refresh complex pages after modification

  • Fix order of commands in test for removing topology segments

  • webui tests: fix test_host:test_crud failure

  • realm domains: improve doc text

  • webui: hbactest: add tooltips to ‘enabled’ and ‘disabled’ checkboxes

  • Revert “temp commit to run the affected tests”

  • temp commit to run the affected tests

  • webui:tests: close big notifications in realm domains tests

  • webui:tests: realm domain add with DNS check

  • webui:tests: move DNS test data to separate file

  • fastcheck: do not test context in pycodestyle

  • browser config: cleanup after removal of Firefox extension

Pavel Vomacka (16)#

  • WebUI: make keytab tables on service and host pages writable

  • Include npm related files into Makefile and .gitignore

  • Update jsl.conf in tests subfolder

  • Edit TravisCI conf files to run WebUI unit tests

  • Update README about WebUI unit tests

  • Update tests

  • Create symlink to qunit.js

  • Update jsl to not warn about module in Gruntfile

  • Add Gruntfile and package.json to ui directory

  • Update QUnit CSS file to 2.4.1

  • Update qunit.js to version 2.4.1

  • Extend ui_driver to support geckodriver log_path

  • WebUI: make Domain Resolution Order writable

  • WebUI: Fix calling undefined method during reset passwords

  • WebUI: remove unused parameter from get_whoami_command

  • Adds whoami DS plugin in case that plugin is missing

Rob Crittenden (62)#

  • replicainstall: DS SSL replica install pick right certmonger host

  • Extend CALessBase::installer_server to accept extra_args

  • Handle subyptes in ACIs

  • server install: drop some print statements, change log level

  • Drop attr defaultServerList if removing the last server

  • Improve console logging for ipa-server-install

  • Replace some test case adjectives

  • Suppress missing cn=schema compat on installation

  • Use replace instead of add to set new default ipaSELinuxUserMapOrder

  • Disable Schema Compat plugin during server upgrade

  • Add tests for ipa-restore with DM password validation check

  • Validate the Directory Manager password before starting restore

  • Rename test class for testing simple commands, add test

  • Don’t try to set Kerberos extradata when there is no principal

  • Client install should handle automount unconfigured on uninstall

  • Return unique error when automount is already or not configured

  • VERSION.m4: Set back to git snapshot

  • Become IPA 4.6.90.pre2

  • Update 4.7 translations

  • Fix certificate retrieval in ipa-replica-prepare for DL0

  • Disable message about log in ipa-backup if IPA is not configured

  • Use a regex in installutils.get_directive instead of line splitting

  • Handle whitespace, add separator to regex in set_directive_lines

  • Validate the Directory Manager password before starting restore

  • Log service start/stop/restart message

  • Update project metadata in ipasetup.py.in

  • Allow dot as a valid character in an selinux identity name

  • Remove xfail from CALes test test_http_intermediate_ca

  • Some PKCS#12 errors are reported with full path names

  • ipa-server-certinstall failing, unknown option realm

  • Revert run_pk12util part of 807a5cbe7cc52690336c5095ec6aeeb0a4e8483c

  • Break out of teardown in test_replica_promotion.py if no config

  • Remove the Continuous installer class, it is unused

  • Return a value if exceptions are raised in server uninstall

  • VERSION.m4: Set back to git snapshot

  • Become IPA 4.6.90.pre1

  • Update Contributors.txt

  • Redirect CRL requests to the http port, not the https port

  • Don’t try to backup CS.cfg during upgrade if CA is not configured

  • Don’t return None on mismatched interactive passwords

  • Update smart_card_auth advise script for mod_ssl

  • Add value in set_directive after a commented-out version

  • Don’t backup nss.conf on upgrade with the switch to mod_ssl

  • Enable upgrades from a mod_nss-installed master to mod_ssl

  • Convert ipa-pki-proxy.conf to use mod_ssl directives

  • Remove main function from the certmonger library

  • Use mod_ssl instead of mod_nss for Apache TLS for new installs

  • Fix detection of KRA installation so upgrades can succeed

  • Move Requires: pythonX-sssdconfig into conditional

  • Log contents of files created or modified by IPAChangeConf

  • Don’t manually generate default.conf in server, use IPAChangeConf

  • Enable ephemeral KRA requests

  • Make the path to CS.cfg a class variable

  • Run server upgrade in ipactl start/restart

  • If the cafile is not present or readable then raise an exception

  • Add test to ensure that properties are being set in rpcclient

  • Use the CA chain file from the RPC context

  • Fix cert-find for CA-less installations

  • Use 389-ds provided method for file limits tuning

  • Collect group membership without a size limit

  • Add exec to /var/lib/ipa/sysrestore for install status inquiries

  • Use TLS for the cert-find operation

Robbie Harwood (5)#

  • Fix elements not being removed in otpd_queue_pop_msgid()

  • Move krb5 snippet into freeipa-client-common

  • Enable SPAKE support using krb5.conf.d snippet

  • Log errors from NSS during FIPS OTP key import

  • ipa-kdb: support KDB DAL version 7.0

Rishabh Dave (1)#

  • ipa-ca-install: mention REPLICA_FILE as optional in help

Sumit Bose (1)#

  • ipa-kdb: reinit trusted domain data for enterprise principals

Sumit Bose (2)#

  • ipa-kdb: update trust information in all workers

  • ipa-kdb: use magic value to check if ipadb is used

John L (1)#

  • Remove special characters in host_add random OTP generation

Stanislav Laznicka (84)#

  • Move config directives handling code

  • Travis: ignore ‘line break after binary operator’

  • Allow user administrator to change user homedir

  • mod_ssl: add SSLVerifyDepth for external CA installs

  • Add absolute_import to test_authselect

  • Fix typo in ipa-getkeytab –help

  • Add absolute_import future imports

  • replica-install: pass –ip-address to client install

  • ipa_backup: Backup the password to HTTPD priv key

  • Fix upgrading of FreeIPA HTTPD

  • Remove py35 env from tox testing

  • Encrypt httpd key stored on disk

  • Dogtag configs: rename deprecated options

  • Backup HTTPD’s mod_ssl config and cert-key pair

  • vault: fix vault-retrieve to a file

  • Backup ssl.conf when migrating from mod_nss

  • Move HTTPD cert/key pair to /var/lib/ipa/certs

  • httpinstance fixup: remove commented-out lines

  • httpinstance: fix publishing of CA cert

  • httpinstance: verify priv key belongs to certificate

  • httpinstance: backup mod_nss conf instead of just removing it

  • service: rename import_ca_certs_* to export_*

  • fixup: add ipa-rewrite.conf to ssl.conf on upgrade

  • Make ipa-server-certinstall store HTTPD cert in a file

  • certupdate: don’t update HTTPD NSS db

  • x509: Fix docstring of write_certificate()

  • x509: Remove unused argument of load_certificate_from_file()

  • httpinstance: handle supplied PKCS#12 files in installation

  • mod_ssl migration: fix upload_cacrt.py plugin

  • Fix FileStore.backup_file() not to backup same file

  • Have all the scripts run in python 3 by default

  • replica_prepare: Remove the correct NSS DB files

  • Add a helpful comment to ca.py:install_check()

  • Don’t allow OTP or RADIUS in FIPS mode

  • caless tests: decode cert bytes in debug log

  • caless tests: make debug log of certificates sensible

  • Add indexing to improve host-find performance

  • Add the sub operation for fqdn index config

  • x509: remove subject_base() function

  • x509: remove the strip_header() function

  • py3: pass raw entries to LDIFWriter

  • ipatests: use python3 if built with python3

  • PRCI: use a new template for py3 testing

  • travis: pep8 changes to pycodestyle

  • csrgen_ffi: cast the DN value to unsigned char *

  • Remove pkcs10 module contents

  • Add tests for CertificateSigningRequest

  • parameters: introduce CertificateSigningRequest

  • parameters: relax type checks

  • csrgen: update docstring for py3

  • csrgen: accept public key info as Bytes

  • csrgen_ffi: pass bytes where “char *” is required

  • p11-kit: add serial number in DER format

  • travis: make tests fail if pep8 does not pass

  • Remove the `message` attribute from exceptions

  • rpc: don’t decode cookie_string if it’s None

  • Don’t write p11-kit EKU extension object if no EKU

  • pylint: fix missing module

  • travis: run the same tests in python2/3

  • certmap testing: fix wrong cert construction

  • ldap2: don’t use decode() on str instance

  • client: fix retrieving certs from HTTP

  • uninstall: remove deprecation warning

  • ldif: handle attribute names as strings

  • pkinit: don’t fail when no pkinit servers found

  • pkinit: fix sorting dictionaries

  • travis: remove “fast” from “makecache fast”

  • Change Travis CI container to FreeIPA-owned

  • Change the requirements for pylint in wheel

  • rpcserver: don’t call xmlserver.Command

  • secrets: disable relative-imports for custodia

  • pylint: disable __hash__ for some classes

  • install.util: disable no-value-for-parameter

  • pylint: make unsupported-assignment-operation check local

  • sudocmd: fix unsupported assignment

  • pylint: Iterate through dictionaries

  • parameters: convert Decimal.precision to int

  • dcerpc: disable unbalanced-tuple-unpacking

  • dcerpc: refactor assess_dcerpc_exception

  • pylint: fix no-member in schema plugin

  • csrgen: fix incorrect codec for pyasn BitString

  • pylint: fix not-context-manager false positives

  • travis: temporary workaround for Travis CI

  • Travis: archive logs of py3 jobs

Stanislav Levin (11)#

  • Fix link to browser configuration guide on Login page

  • Fix some untranslatable commands in Web UI API Browser

  • Apply validate_doc() to NO_CLI commands

  • Fix formatted translations of error messages in topology plugin

  • Fix formatted translations of error messages in serverroles plugin

  • Fix formatted translations in trust plugin

  • Fix translation of idrange_* commands description

  • Fix formatted translations in domainlevel plugin

  • Use intended format() method of translation object

  • Add support for format method to translation objects

  • Fix translation of commands description in API Browser

Sudhir Menon (2)#

  • Adding modified DOAP file

  • DOAP Description for IPA Project

Thierry Bordaz (2)#

  • Hardening of topology plugin to prevent erronous deletion of a replica agreement

  • 389-ds-base crashed as part of ipa-server-intall in ipa-uuid

Tibor Dudlák (15)#

  • Use temporary pid file for chronyd -q task

  • Fix format string passed to pytest-multihost

  • Configure chrony with pool when server not set

  • Add enabling chrony daemon when not configured

  • Remove unnecessary option –force-chrony

  • Remove NTP server role while upgrading

  • Removes NTP server role from servroles and description

  • Update man pages for FreeIPA client, replica and server install

  • Adding method to ipa-server-upgrade to cleanup ntpd

  • Add –ntp-pool option to installers

  • FreeIPA server is time synchronization client only

  • Replace ntpd with chronyd in installation

  • Add dependency and paths for chrony

  • Removes ntp from dependencies and behave as there is always -N option

  • Do not check deleted files with `make fastlint`

Timo Aaltonen (9)#

  • Fix HTTPD SSL configuration for Debian.

  • ldapupdate: Add support for Debian multiarch

  • named.conf: Disable duplicate zone on debian, and modify data dir

  • Add mkhomedir support for Debian

  • paths: Fix some path definitions for Debian.

  • constants: Fix HTTPD_GROUP for Debian

  • Create kadm5.acl if it doesn’t exist

  • ipaplatform, ipa.conf: Use paths variables in ipa.conf.template

  • Move config templates from install/conf to install/share

Tomas Krizek (20)#

  • test_dnssec: re-add named-pkcs11 workarounds

  • py3 dnssec: convert hexlify to str

  • py3: bindmgr: fix bytes issues

  • prci: bump ci-master-f27 template to 1.0.2

  • prci: define testing topologies

  • prci: start testing PRs on fedora 27

  • py3 spec: remove python2 dependencies from server-trust-ad

  • py3 spec: remove python2 dependencies from freeipa-server

  • py3 spec: use proper python2 package names

  • ipatests: fix circular import for collect_logs

  • ipatests: collect logs for external_ca test suite

  • prci: add external_ca test

  • ldap: limit the retro changelog to dns subtree

  • spec: bump 389-ds-base to 1.3.7.6-1

  • ipatests: set default 389-ds log level to 0

  • prci: update F26 template

  • spec: bump python-pyasn1 to 0.3.2-2

  • prci: use f26 template for master

  • VERSION: set 4.6 git snapshot

  • Contributors.txt: update

Thorsten Scherf (1)#

  • Add debug option to ipa-replica-manage and remove references to api_env var.