ipa-4.10.1-5
- Resolves: rhbz#2162656 Passwordless (GSSAPI) SSH not working for subdomain - Resolves: rhbz#2166326 Removing the last DNS type for ipa-ca does not work - Resolves: rhbz#2167473 RFE - Add a warning note about possible performance impact of the Auto Member rebuild task - Resolves: rhbz#2168244 requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage pruning command Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
This commit is contained in:
Florence Blanc-Renaud
parent
d5f3f77077
commit
00abb6c62b
|
|
@ -0,0 +1,68 @@
|
|||
From 2857bc69957bde7e59fff1c66c5a83c7f560616b Mon Sep 17 00:00:00 2001
|
||||
From: Florence Blanc-Renaud <flo@redhat.com>
|
||||
Date: Tue, 31 Jan 2023 15:53:08 +0100
|
||||
Subject: [PATCH] automember-rebuild: add a notice about high CPU usage
|
||||
|
||||
The automember-rebuild task may require high CPU usage
|
||||
if many users/hosts/groups are processed.
|
||||
Add a note in the ipa automember-rebuild CLI output
|
||||
and in the WebUI confirmation message.
|
||||
|
||||
Fixes: https://pagure.io/freeipa/issue/9320
|
||||
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
|
||||
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
|
||||
---
|
||||
install/ui/test/data/i18n_messages.json | 2 +-
|
||||
ipaclient/plugins/automember.py | 8 ++++++++
|
||||
ipaserver/plugins/internal.py | 6 +++++-
|
||||
3 files changed, 14 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/install/ui/test/data/i18n_messages.json b/install/ui/test/data/i18n_messages.json
|
||||
index 49d288326d8cea192a16e93a274599805b0ea666..5b735487bf33805e8f0534d378d1497f05a11be8 100644
|
||||
--- a/install/ui/test/data/i18n_messages.json
|
||||
+++ b/install/ui/test/data/i18n_messages.json
|
||||
@@ -7,7 +7,7 @@
|
||||
"actions": {
|
||||
"apply": "Apply",
|
||||
"automember_rebuild": "Rebuild auto membership",
|
||||
- "automember_rebuild_confirm": "Are you sure you want to rebuild auto membership?",
|
||||
+ "automember_rebuild_confirm": "Are you sure you want to rebuild auto membership? In case of a high number of users, hosts or groups, the operation may require high CPU usage.",
|
||||
"automember_rebuild_success": "Automember rebuild membership task completed",
|
||||
"confirm": "Are you sure you want to proceed with the action?",
|
||||
"delete_confirm": "Are you sure you want to delete ${object}?",
|
||||
diff --git a/ipaclient/plugins/automember.py b/ipaclient/plugins/automember.py
|
||||
index df4a2e5a01744e0ff22c74180e13c2e7dc33fbaa..7108dc948753b9f6a4439842bd75e7c5e064bda6 100644
|
||||
--- a/ipaclient/plugins/automember.py
|
||||
+++ b/ipaclient/plugins/automember.py
|
||||
@@ -34,3 +34,11 @@ class automember_add_condition(MethodOverride):
|
||||
flags=['suppress_empty'],
|
||||
),
|
||||
)
|
||||
+
|
||||
+
|
||||
+@register(override=True, no_fail=True)
|
||||
+class automember_rebuild(MethodOverride):
|
||||
+ def interactive_prompt_callback(self, kw):
|
||||
+ msg = _('IMPORTANT: In case of a high number of users, hosts or '
|
||||
+ 'groups, the operation may require high CPU usage.')
|
||||
+ self.Backend.textui.print_plain(msg)
|
||||
diff --git a/ipaserver/plugins/internal.py b/ipaserver/plugins/internal.py
|
||||
index 5ffa7a281548a0658386f8740dbddd96fd0bc7d6..e1e920f8bb49dd8ba8f30b727111bb1316f6a918 100644
|
||||
--- a/ipaserver/plugins/internal.py
|
||||
+++ b/ipaserver/plugins/internal.py
|
||||
@@ -160,7 +160,11 @@ class i18n_messages(Command):
|
||||
"actions": {
|
||||
"apply": _("Apply"),
|
||||
"automember_rebuild": _("Rebuild auto membership"),
|
||||
- "automember_rebuild_confirm": _("Are you sure you want to rebuild auto membership?"),
|
||||
+ "automember_rebuild_confirm": _(
|
||||
+ "Are you sure you want to rebuild auto membership? In case of "
|
||||
+ "a high number of users, hosts or groups, the operation "
|
||||
+ "may require high CPU usage."
|
||||
+ ),
|
||||
"automember_rebuild_success": _("Automember rebuild membership task completed"),
|
||||
"confirm": _("Are you sure you want to proceed with the action?"),
|
||||
"delete_confirm": _("Are you sure you want to delete ${object}?"),
|
||||
--
|
||||
2.39.1
|
||||
|
||||
|
|
@ -0,0 +1,158 @@
|
|||
From 20ff7c16022793c707f6c2b8fb38a801870bc0e2 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Wed, 8 Feb 2023 10:42:58 -0500
|
||||
Subject: [PATCH] Fix setting values of 0 in ACME pruning
|
||||
|
||||
Replace comparisons of "if value" with "if value is not None"
|
||||
in order to handle 0.
|
||||
|
||||
Add a short reference to the man page to indicat that a cert
|
||||
or request retention time of 0 means remove at the next
|
||||
execution.
|
||||
|
||||
Also indicate that the search time limit is in seconds.
|
||||
|
||||
Fixes: https://pagure.io/freeipa/issue/9325
|
||||
|
||||
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
||||
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
|
||||
---
|
||||
doc/designs/expired_certificate_pruning.md | 4 ++--
|
||||
install/tools/man/ipa-acme-manage.1 | 8 +++----
|
||||
ipaserver/install/ipa_acme_manage.py | 28 +++++++++++-----------
|
||||
3 files changed, 20 insertions(+), 20 deletions(-)
|
||||
|
||||
diff --git a/doc/designs/expired_certificate_pruning.md b/doc/designs/expired_certificate_pruning.md
|
||||
index a23e452696ba2a150c4ad5a3e57360ae0a16a338..35ead7b00145b5df44caf542cba277f0e6e08b6a 100644
|
||||
--- a/doc/designs/expired_certificate_pruning.md
|
||||
+++ b/doc/designs/expired_certificate_pruning.md
|
||||
@@ -67,11 +67,11 @@ There are four values each that can be managed for pruning certificates and requ
|
||||
* expired cert/incomplete request time
|
||||
* time unit
|
||||
* LDAP search size limit
|
||||
-* LDAP search time limit
|
||||
+* LDAP search time limit (in seconds)
|
||||
|
||||
The first two configure when an expired certificate or incomplete request will be deleted. The unit can be one of: minute, hour, day, year. By default it is 30 days.
|
||||
|
||||
-The LDAP limits control how many entries are returned and how long the search can take. By default it is 1000 entries and unlimited time.
|
||||
+The LDAP limits control how many entries are returned and how long the search can take. By default it is 1000 entries and unlimited time (0 == unlimited, unit is seconds).
|
||||
|
||||
### Configuration settings
|
||||
|
||||
diff --git a/install/tools/man/ipa-acme-manage.1 b/install/tools/man/ipa-acme-manage.1
|
||||
index e6cec4e4a7fd460c514a72456a2dc9a2e3682ebd..b8383c14f482698d2bcc8b08f0c0bf5882c3c298 100644
|
||||
--- a/install/tools/man/ipa-acme-manage.1
|
||||
+++ b/install/tools/man/ipa-acme-manage.1
|
||||
@@ -79,7 +79,7 @@ For example, "0 0 1 * *" schedules the job to run at 12:00am on the first
|
||||
day of each month.
|
||||
.TP
|
||||
\fB\-\-certretention=CERTRETENTION\fR
|
||||
-Certificate retention time. The default is 30.
|
||||
+Certificate retention time. The default is 30. A value of 0 will remove expired certificates with no delay.
|
||||
.TP
|
||||
\fB\-\-certretentionunit=CERTRETENTIONUNIT\fR
|
||||
Certificate retention units. Valid units are: minute, hour, day, year.
|
||||
@@ -89,10 +89,10 @@ The default is days.
|
||||
LDAP search size limit searching for expired certificates. The default is 1000. This is a client-side limit. There may be additional server-side limitations.
|
||||
.TP
|
||||
\fB\-\-certsearchtimelimit=CERTSEARCHTIMELIMIT\fR
|
||||
-LDAP search time limit searching for expired certificates. The default is 0, no limit. This is a client-side limit. There may be additional server-side limitations.
|
||||
+LDAP search time limit (seconds) searching for expired certificates. The default is 0, no limit. This is a client-side limit. There may be additional server-side limitations.
|
||||
.TP
|
||||
\fB\-\-requestretention=REQUESTRETENTION\fR
|
||||
-Request retention time. The default is 30.
|
||||
+Request retention time. The default is 30. A value of 0 will remove expired requests with no delay.
|
||||
.TP
|
||||
\fB\-\-requestretentionunit=REQUESTRETENTIONUNIT\fR
|
||||
Request retention units. Valid units are: minute, hour, day, year.
|
||||
@@ -102,7 +102,7 @@ The default is days.
|
||||
LDAP search size limit searching for unfulfilled requests. The default is 1000. There may be additional server-side limitations.
|
||||
.TP
|
||||
\fB\-\-requestsearchtimelimit=REQUESTSEARCHTIMELIMIT\fR
|
||||
-LDAP search time limit searching for unfulfilled requests. The default is 0, no limit. There may be additional server-side limitations.
|
||||
+LDAP search time limit (seconds) searching for unfulfilled requests. The default is 0, no limit. There may be additional server-side limitations.
|
||||
.TP
|
||||
\fB\-\-config\-show\fR
|
||||
Show the current pruning configuration
|
||||
diff --git a/ipaserver/install/ipa_acme_manage.py b/ipaserver/install/ipa_acme_manage.py
|
||||
index b7b2111d9edcec2580aa4a485d7a7340146ff065..e7c35ff6fb5b7a30ac9e2c0c18f8db805cf06ee9 100644
|
||||
--- a/ipaserver/install/ipa_acme_manage.py
|
||||
+++ b/ipaserver/install/ipa_acme_manage.py
|
||||
@@ -207,14 +207,14 @@ class IPAACMEManage(AdminTool):
|
||||
self.options.enable,
|
||||
self.options.disable,
|
||||
self.options.cron,
|
||||
- self.options.certretention,
|
||||
+ self.options.certretention is not None,
|
||||
self.options.certretentionunit,
|
||||
- self.options.requestretention,
|
||||
+ self.options.requestretention is not None,
|
||||
self.options.requestretentionunit,
|
||||
- self.options.certsearchsizelimit,
|
||||
- self.options.certsearchtimelimit,
|
||||
- self.options.requestsearchsizelimit,
|
||||
- self.options.requestsearchtimelimit,
|
||||
+ self.options.certsearchsizelimit is not None,
|
||||
+ self.options.certsearchtimelimit is not None,
|
||||
+ self.options.requestsearchsizelimit is not None,
|
||||
+ self.options.requestsearchtimelimit is not None,
|
||||
]
|
||||
)
|
||||
and (self.options.config_show or self.options.run)
|
||||
@@ -226,7 +226,7 @@ class IPAACMEManage(AdminTool):
|
||||
elif self.options.cron:
|
||||
if len(self.options.cron.split()) != 5:
|
||||
self.option_parser.error("Invalid format for --cron")
|
||||
- # dogtag does no validation when setting an option so
|
||||
+ # dogtag does no validation when setting this option so
|
||||
# do the minimum. The dogtag cron is limited compared to
|
||||
# crontab(5).
|
||||
opt = self.options.cron.split()
|
||||
@@ -255,7 +255,7 @@ class IPAACMEManage(AdminTool):
|
||||
'pki-server', command,
|
||||
f'{prefix}.{directive}'
|
||||
]
|
||||
- if value:
|
||||
+ if value is not None:
|
||||
args.extend([str(value)])
|
||||
logger.debug(args)
|
||||
result = run(args, raiseonerr=False, capture_output=True,
|
||||
@@ -350,28 +350,28 @@ class IPAACMEManage(AdminTool):
|
||||
|
||||
# pki-server ca-config-set can only set one option at a time so
|
||||
# loop through all the options and set what is there.
|
||||
- if self.options.certretention:
|
||||
+ if self.options.certretention is not None:
|
||||
ca_config_set('certRetentionTime',
|
||||
self.options.certretention)
|
||||
if self.options.certretentionunit:
|
||||
ca_config_set('certRetentionUnit',
|
||||
self.options.certretentionunit)
|
||||
- if self.options.certsearchtimelimit:
|
||||
+ if self.options.certsearchtimelimit is not None:
|
||||
ca_config_set('certSearchTimeLimit',
|
||||
self.options.certsearchtimelimit)
|
||||
- if self.options.certsearchsizelimit:
|
||||
+ if self.options.certsearchsizelimit is not None:
|
||||
ca_config_set('certSearchSizeLimit',
|
||||
self.options.certsearchsizelimit)
|
||||
- if self.options.requestretention:
|
||||
+ if self.options.requestretention is not None:
|
||||
ca_config_set('requestRetentionTime',
|
||||
self.options.requestretention)
|
||||
if self.options.requestretentionunit:
|
||||
ca_config_set('requestRetentionUnit',
|
||||
self.options.requestretentionunit)
|
||||
- if self.options.requestsearchsizelimit:
|
||||
+ if self.options.requestsearchsizelimit is not None:
|
||||
ca_config_set('requestSearchSizeLimit',
|
||||
self.options.requestsearchsizelimit)
|
||||
- if self.options.requestsearchtimelimit:
|
||||
+ if self.options.requestsearchtimelimit is not None:
|
||||
ca_config_set('requestSearchTimeLimit',
|
||||
self.options.requestsearchtimelimit)
|
||||
if self.options.cron:
|
||||
--
|
||||
2.39.1
|
||||
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
From 4e0ad96fbd9f438c884eeeaa60c2fb0c910a2b61 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Mon, 11 Jul 2022 14:20:32 -0400
|
||||
Subject: [PATCH] Wipe the ipa-ca DNS record when updating system records
|
||||
|
||||
If a server with a CA has been marked as hidden and
|
||||
contains the last A or AAAA address then that address
|
||||
would remain in the ipa-ca entry.
|
||||
|
||||
This is because update-dns-system-records did not delete
|
||||
values, it just re-computed them. So if no A or AAAA
|
||||
records were found then the existing value was left.
|
||||
|
||||
Fixes: https://pagure.io/freeipa/issue/9195
|
||||
|
||||
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
||||
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
|
||||
Reviewed-By: Stanislav Levin <slev@altlinux.org>
|
||||
---
|
||||
ipaserver/dns_data_management.py | 12 +++++++++++-
|
||||
1 file changed, 11 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/ipaserver/dns_data_management.py b/ipaserver/dns_data_management.py
|
||||
index e2bc530ee8a8d7ade853652680c524ccd229205c..aaae5446856aba5e39ca9bb9c03decd434e4f71a 100644
|
||||
--- a/ipaserver/dns_data_management.py
|
||||
+++ b/ipaserver/dns_data_management.py
|
||||
@@ -19,6 +19,7 @@ from dns import (
|
||||
from time import sleep, time
|
||||
|
||||
from ipalib import errors
|
||||
+from ipalib.constants import IPA_CA_RECORD
|
||||
from ipalib.dns import record_name_format
|
||||
from ipapython.dnsutil import DNSName
|
||||
from ipaserver.install import installutils
|
||||
@@ -187,7 +188,7 @@ class IPASystemRecords:
|
||||
|
||||
def __add_ca_records_from_hostname(self, zone_obj, hostname):
|
||||
assert isinstance(hostname, DNSName) and hostname.is_absolute()
|
||||
- r_name = DNSName('ipa-ca') + self.domain_abs
|
||||
+ r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
|
||||
rrsets = None
|
||||
end_time = time() + CA_RECORDS_DNS_TIMEOUT
|
||||
while True:
|
||||
@@ -210,6 +211,7 @@ class IPASystemRecords:
|
||||
|
||||
for rrset in rrsets:
|
||||
for rd in rrset:
|
||||
+ logger.debug("Adding CA IP %s for %s", rd.to_text(), hostname)
|
||||
rdataset = zone_obj.get_rdataset(
|
||||
r_name, rd.rdtype, create=True)
|
||||
rdataset.add(rd, ttl=self.TTL)
|
||||
@@ -461,6 +463,14 @@ class IPASystemRecords:
|
||||
)
|
||||
)
|
||||
|
||||
+ # Remove the ipa-ca record(s). They will be reconstructed in
|
||||
+ # get_base_records().
|
||||
+ r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
|
||||
+ try:
|
||||
+ self.api_instance.Command.dnsrecord_del(
|
||||
+ self.domain_abs, r_name, del_all=True)
|
||||
+ except errors.NotFound:
|
||||
+ pass
|
||||
base_zone = self.get_base_records()
|
||||
for record_name, node in base_zone.items():
|
||||
set_cname_template = record_name in names_requiring_cname_templates
|
||||
--
|
||||
2.39.1
|
||||
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
From 0206369eec8530e96c66986c4ca501d8962193ce Mon Sep 17 00:00:00 2001
|
||||
From: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Date: Mon, 30 Jan 2023 14:22:30 +0200
|
||||
Subject: [PATCH] ipa-kdb: PAC consistency checker needs to handle child
|
||||
domains as well
|
||||
|
||||
When PAC check is performed, we might get a signing TGT instead of the
|
||||
client DB entry. This means it is a principal from a trusted domain but
|
||||
we don't know which one exactly because we only have a krbtgt for the
|
||||
forest root. This happens in MIT Kerberos 1.20 or later where KDB's
|
||||
issue_pac() callback never gets the original client principal directly.
|
||||
|
||||
Look into known child domains as well and make pass the check if both
|
||||
NetBIOS name and SID correspond to one of the trusted domains under this
|
||||
forest root. Move check for the SID before NetBIOS name check because we
|
||||
can use SID of the domain in PAC to find out the right child domain in
|
||||
our trusted domains' topology list.
|
||||
|
||||
Fixes: https://pagure.io/freeipa/issue/9316
|
||||
|
||||
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
||||
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
|
||||
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
||||
---
|
||||
daemons/ipa-kdb/ipa_kdb_mspac.c | 51 +++++++++++++++++++++------------
|
||||
1 file changed, 32 insertions(+), 19 deletions(-)
|
||||
|
||||
diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
||||
index a15050e2166f95c227d2e3c7d238e1ea2fe01235..476d1cb558a53420821ccfb1b794cb6bedce7794 100644
|
||||
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
|
||||
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
|
||||
@@ -1827,11 +1827,43 @@ krb5_error_code filter_logon_info(krb5_context context,
|
||||
bool result;
|
||||
char *domstr = NULL;
|
||||
|
||||
+ ipactx = ipadb_get_context(context);
|
||||
+ if (!ipactx || !ipactx->mspac) {
|
||||
+ return KRB5_KDB_DBNOTINITED;
|
||||
+ }
|
||||
+
|
||||
domain = get_domain_from_realm_update(context, realm);
|
||||
if (!domain) {
|
||||
return EINVAL;
|
||||
}
|
||||
|
||||
+ /* check exact sid */
|
||||
+ result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
|
||||
+ if (!result) {
|
||||
+ struct ipadb_mspac *mspac_ctx = ipactx->mspac;
|
||||
+ result = FALSE;
|
||||
+ /* Didn't match but perhaps the original PAC was issued by a child domain's DC? */
|
||||
+ for (k = 0; k < mspac_ctx->num_trusts; k++) {
|
||||
+ result = dom_sid_check(&mspac_ctx->trusts[k].domsid,
|
||||
+ info->info->info3.base.domain_sid, true);
|
||||
+ if (result) {
|
||||
+ domain = &mspac_ctx->trusts[k];
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ if (!result) {
|
||||
+ domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
|
||||
+ krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
|
||||
+ "expected domain SID = %s, "
|
||||
+ "found domain SID = %s",
|
||||
+ domain->domain_name, domain->domain_sid,
|
||||
+ domstr ? domstr : "<failed to display>");
|
||||
+ talloc_free(domstr);
|
||||
+ return EINVAL;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* At this point we may have changed the domain we look at, */
|
||||
/* check netbios/flat name */
|
||||
if (strcasecmp(info->info->info3.base.logon_domain.string,
|
||||
domain->flat_name) != 0) {
|
||||
@@ -1843,21 +1875,6 @@ krb5_error_code filter_logon_info(krb5_context context,
|
||||
return EINVAL;
|
||||
}
|
||||
|
||||
- /* check exact sid */
|
||||
- result = dom_sid_check(&domain->domsid, info->info->info3.base.domain_sid, true);
|
||||
- if (!result) {
|
||||
- domstr = dom_sid_string(NULL, info->info->info3.base.domain_sid);
|
||||
- if (!domstr) {
|
||||
- return EINVAL;
|
||||
- }
|
||||
- krb5_klog_syslog(LOG_ERR, "PAC Info mismatch: domain = %s, "
|
||||
- "expected domain SID = %s, "
|
||||
- "found domain SID = %s",
|
||||
- domain->domain_name, domain->domain_sid, domstr);
|
||||
- talloc_free(domstr);
|
||||
- return EINVAL;
|
||||
- }
|
||||
-
|
||||
/* Check if this domain has been filtered out by the trust itself*/
|
||||
if (domain->parent != NULL) {
|
||||
for(k = 0; k < domain->parent->len_sid_blocklist_incoming; k++) {
|
||||
@@ -1944,10 +1961,6 @@ krb5_error_code filter_logon_info(krb5_context context,
|
||||
* should include different possibilities into account
|
||||
* */
|
||||
if (info->info->info3.sidcount != 0) {
|
||||
- ipactx = ipadb_get_context(context);
|
||||
- if (!ipactx || !ipactx->mspac) {
|
||||
- return KRB5_KDB_DBNOTINITED;
|
||||
- }
|
||||
count = info->info->info3.sidcount;
|
||||
i = 0;
|
||||
j = 0;
|
||||
--
|
||||
2.39.1
|
||||
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
From a6cb905de74da38d62f9c3bd7957018924282521 Mon Sep 17 00:00:00 2001
|
||||
From: Anuja More <amore@redhat.com>
|
||||
Date: Mon, 30 Jan 2023 19:27:49 +0530
|
||||
Subject: [PATCH] Add test for SSH with GSSAPI auth.
|
||||
|
||||
Added test for aduser with GSSAPI authentication.
|
||||
|
||||
Related : https://pagure.io/freeipa/issue/9316
|
||||
|
||||
Signed-off-by: Anuja More <amore@redhat.com>
|
||||
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
|
||||
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
||||
---
|
||||
ipatests/test_integration/test_trust.py | 46 +++++++++++++++++++++++++
|
||||
1 file changed, 46 insertions(+)
|
||||
|
||||
diff --git a/ipatests/test_integration/test_trust.py b/ipatests/test_integration/test_trust.py
|
||||
index c4b3b99ce1abbc16817b6530939fd9bae3f9500a..0d5b71cb0277a79eed7c34eb7e3d7eb6c09faa5e 100644
|
||||
--- a/ipatests/test_integration/test_trust.py
|
||||
+++ b/ipatests/test_integration/test_trust.py
|
||||
@@ -527,6 +527,35 @@ class TestTrust(BaseTestTrust):
|
||||
.format(self.ad_domain, subordinate_suffix))
|
||||
self.ad.run_command(['powershell', '-c', cmd])
|
||||
|
||||
+ def test_ssh_aduser(self):
|
||||
+ """Test ssh with GSSAPI is working with aduser
|
||||
+
|
||||
+ When kerberos ticket is obtained for child domain user
|
||||
+ and ssh with this ticket should be successful
|
||||
+ with no password prompt.
|
||||
+
|
||||
+ Related : https://pagure.io/freeipa/issue/9316
|
||||
+ """
|
||||
+ testuser = 'testuser@{0}'.format(self.ad_domain)
|
||||
+ testusersub = 'subdomaintestuser@{0}'.format(self.ad_subdomain)
|
||||
+
|
||||
+ def sshuser(host, user):
|
||||
+ tasks.kdestroy_all(host)
|
||||
+ try:
|
||||
+ tasks.kinit_as_user(host, user,
|
||||
+ host.config.ad_admin_password
|
||||
+ )
|
||||
+ ssh_cmd = "ssh -q -K -l {user} {host} hostname"
|
||||
+ valid_ssh = host.run_command(
|
||||
+ ssh_cmd.format(user=user, host=host.hostname)
|
||||
+ )
|
||||
+ assert host.hostname in valid_ssh.stdout_text
|
||||
+ finally:
|
||||
+ tasks.kdestroy_all(host)
|
||||
+
|
||||
+ sshuser(self.master, testuser)
|
||||
+ sshuser(self.master, testusersub)
|
||||
+
|
||||
def test_remove_nonposix_trust(self):
|
||||
self.remove_trust(self.ad)
|
||||
tasks.unconfigure_dns_for_trust(self.master, self.ad)
|
||||
@@ -785,6 +814,23 @@ class TestTrust(BaseTestTrust):
|
||||
assert re.search(
|
||||
testuser_regex, result.stdout_text), result.stdout_text
|
||||
|
||||
+ def test_ssh_adtreeuser(self):
|
||||
+ testuser = 'treetestuser@{0}'.format(self.ad_treedomain)
|
||||
+ self.master.run_command(["id", testuser])
|
||||
+ tasks.clear_sssd_cache(self.master)
|
||||
+ tasks.kdestroy_all(self.master)
|
||||
+ try:
|
||||
+ tasks.kinit_as_user(self.master, testuser,
|
||||
+ password="Secret123456"
|
||||
+ )
|
||||
+ ssh_cmd = "ssh -q -K -l {user} {host} hostname"
|
||||
+ valid_ssh = self.master.run_command(
|
||||
+ ssh_cmd.format(user=testuser, host=self.master.hostname)
|
||||
+ )
|
||||
+ assert self.master.hostname in valid_ssh.stdout_text
|
||||
+ finally:
|
||||
+ tasks.kdestroy_all(self.master)
|
||||
+
|
||||
def test_remove_external_treedomain_trust(self):
|
||||
self.remove_trust(self.tree_ad)
|
||||
tasks.unconfigure_dns_for_trust(self.master, self.ad, self.tree_ad)
|
||||
--
|
||||
2.39.1
|
||||
|
||||
13
freeipa.spec
13
freeipa.spec
|
|
@ -223,7 +223,7 @@
|
|||
|
||||
Name: %{package_name}
|
||||
Version: %{IPA_VERSION}
|
||||
Release: 4%{?rc_version:.%rc_version}%{?dist}
|
||||
Release: 5%{?rc_version:.%rc_version}%{?dist}
|
||||
Summary: The Identity, Policy and Audit system
|
||||
|
||||
License: GPLv3+
|
||||
|
|
@ -256,6 +256,11 @@ Patch0006: 0006-doc-Design-for-certificate-pruning.patch
|
|||
Patch0007: 0007-ipa-acme-manage-add-certificate-request-pruning-mana.patch
|
||||
Patch0008: 0008-doc-add-the-run-command-for-manual-job-execution.patch
|
||||
Patch0009: 0009-tests-add-wrapper-around-ACME-RSNv3-test.patch
|
||||
Patch0010: 0010-automember-rebuild-add-a-notice-about-high-CPU-usage.patch
|
||||
Patch0011: 0011-Fix-setting-values-of-0-in-ACME-pruning.patch
|
||||
Patch0012: 0012-Wipe-the-ipa-ca-DNS-record-when-updating-system-reco.patch
|
||||
Patch0013: 0013-ipa-kdb-PAC-consistency-checker-needs-to-handle-chil.patch
|
||||
Patch0014: 0014-Add-test-for-SSH-with-GSSAPI-auth.patch
|
||||
Patch1001: 1001-Change-branding-to-IPA-and-Identity-Management.patch
|
||||
%endif
|
||||
%endif
|
||||
|
|
@ -1743,6 +1748,12 @@ fi
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Feb 13 2023 Florence Blanc-Renaud <flo@redhat.com> - 4.10.1-5
|
||||
- Resolves: rhbz#2162656 Passwordless (GSSAPI) SSH not working for subdomain
|
||||
- Resolves: rhbz#2166326 Removing the last DNS type for ipa-ca does not work
|
||||
- Resolves: rhbz#2167473 RFE - Add a warning note about possible performance impact of the Auto Member rebuild task
|
||||
- Resolves: rhbz#2168244 requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage pruning command
|
||||
|
||||
* Mon Feb 06 2023 Florence Blanc-Renaud <flo@redhat.com> - 4.10.1-4
|
||||
- Resolves: rhbz#2161284 'ERROR Could not remove /tmp/tmpbkw6hawo.ipabkp' can be seen prior to 'ipa-client-install' command was successful
|
||||
- Resolves: rhbz#2164403 ipa-trust-add with --range-type=ipa-ad-trust-posix fails while creating an ID range
|
||||
|
|
|
|||
Loading…
Reference in New Issue