- Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache
- Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
- Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service
- Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
- Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
- Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
- Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-128238
[RFE] Support storing LWCA private keys on an HSM [rhel-9]
- Resolves: RHEL-126515
RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
- Resolves: RHEL-73399
RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
- Resolves: RHEL-128241
ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
- Resolves: RHEL-126514
[RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
- Resolves: RHEL-124171
Include latest fixes in python3-ipatests package
- Resolves: RHEL-120514
Include fixes in python3-ipatests [rhel-9.8]
- Resolves: RHEL-118609
test_cacert_manage fails due to expired Let's Encrypt R3 certificate
- Resolves: RHEL-107483
ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-100450 eDNS: multiple issues during encrypted DNS setup
- Resolves: RHEL-89907 Privilege escalation from host to domain admin in FreeIPA
- Resolves: RHEL-99315 Include latest fixes in python3-ipatests package
- Resolves: RHEL-98565 ipa-idrange-fix: 'Env' object has no attribute 'basedn'
- Resolves: RHEL-96920 Nightly test failure (rawhide) in test_trust.py::TestTrust::test_server_option_with_unreachable_ad
- Resolves: RHEL-31907 kdb: support storing and retrieving multiple master keys
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-95010 [RFE] Give warning when adding user with UID out of any ID range
- Resolves: RHEL-93890 Include latest fixes in python3-ipatests package
- Resolves: RHEL-93887 ipa idrange-add --help should be more clear about required options
- Resolves: RHEL-93483 Unable to modify IPA config; --ipaconfigstring="" causes internal error
- Resolves: RHEL-88834 kdb: ipadb_get_connection() succeeds but returns null LDAP context
- Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'
- Resolves: RHEL-88900 [RFE] Add check on CA cert expiry for ipa-cert-fix
- Resolves: RHEL-88037 Server installation: dot-forwarder not added as a forwarder
- Resolves: RHEL-86483 Include latest fixes in python3-ipatests package
- Resolves: RHEL-41178 ipa-sidgen: fix memory leak in ipa_sidgen_add_post_op()
- Resolves: RHEL-84481 Protect all IPA service principals
- Resolves: RHEL-84277 [RFE] IDM support UIDs up to 4,294,967,293
- Resolves: RHEL-84276 Ipa client --raw --structured throws internal error
- Resolves: RHEL-82707 Search size limit tooltip has Search time limit tooltip text
- Resolves: RHEL-82089 IPU 9 -> 10: ipa-server breaks the in-place upgrade due to failed scriptlet
- Resolves: RHEL-68800 ipa-migrate with LDIF file from backup of remote server, fails with error 'change collided with another change'
- Resolves: RHEL-30658 ipa-cacert-manage install fails with CAs having the same subject DN (subject key mismatch info)
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-67913 Add DNS over TLS Support, require bind9.18 32:9.18.29-2 and bind-dyndb-ldap 11.11-1
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
- Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-73022
A slow HSM can cause IPA server installation to fail setting up certificate tracking [rhel-9]
- Resolves: RHEL-71261
[RHEL-9.6] Include latest fixes in python3-ipatests package
- Resolves: RHEL-67191
CVE-2024-11029 ipa: Administrative user data leaked through systemd journal [rhel-9.6]
- Resolves: RHEL-59040
KRA installation failure caused by a certificate mismatch in NSS DB and configuration file.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-70760
Fix typo in ipa-migrate log file i.e 'Privledges' to 'Privileges'
- Resolves: RHEL-70481
ipa-server-upgrade fails after established trust with ad
- Resolves: RHEL-69927
add support for python cryptography 44.0.0
- Resolves: RHEL-69908
All user groups are not being included during HSM token validation
- Resolves: RHEL-69900
Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-68448 ipa trust-add fails in FIPS mode with an internal error has occurred
- Resolves: RHEL-69301 Support GSSAPI in Cockpit on IPA servers
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-67414 ipa dns-zone --allow-query '!198.18.2.0/24;any;' fails with Unrecognized IPAddress flags
- Resolves: RHEL-67410 ipa-migrate should also migrate DNS forward zones
- Resolves: RHEL-67409 ipa-migrate in stage mode fails with TypeError: 'NoneType' object is not iterable
- Resolves: RHEL-66964 Include latest fixes in python3-ipatests packages
- Resolves: RHEL-64135 IDP configuration in the IdM WebUI shows Organization is required
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Related: RHEL-59788 Rebase Samba to the latest 4.21.x release
- Fixes: RHEL-61642 Uninstall ACME separately during PKI uninstallation
- Fixes: RHEL-56963 SSSD offline causing test-adtrust-install failure
- Fixes: RHEL-56473 Include latest fixes in python3-ipatests packages
- Fixes: RHEL-48104 Default hbac rules are duplicated on remote server post ipa-migrate in prod-mode
- Fixes: RHEL-45330 [RFE] add a tool to quickly detect and fix issues with IPA ID ranges
- Fixes: RHEL-40376 SID generation task is failing when SELinux is in Enforcing mode
- Fixes: RHEL-4915 Last expired OTP token would be c
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-53500 adtrustinstance only prints issues in check_inst() and does not log them
- Resolves: RHEL-52306 Unconditionally add MS-PAC to global config
- Resolves: RHEL-52300 RFE - Keep the configured value for the "nsslapd-ignore-time-skew" after a "force-sync"
- Resolves: RHEL-52222 ipa-replica/server-install with softhsm needs to check permission/ownership of /var/lib/softhsm/tokens to avoid install failure
- Resolves: RHEL-51944 Include latest fixes in python3-ipatests packages
- Resolves: RHEL-50804 ipa-migrate -Z with invalid cert options fails with 'ValueError: option error'
- Resolves: RHEL-49602 misleading warning for missing ipa-selinux-nfast package on luna hsm h/w
- Resolves: RHEL-27856 'Unable to log in as uid=admin-replica.testrealm.test,ou=people,o=ipaca' during replica install
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-47292 Include latest fixes in python3-ipatests packages
- Resolves: RHEL-47146 Syntax error uninstalling the selinux-luna subpackage
- Resolves: RHEL-46009 ipa-migrate with -Z option fails with ValueError: option error
- Resolves: RHEL-46003 ipa-migrate -V options fails to display version
- Resolves: RHEL-45463 ipa-migrate stage-mode is failing with error: Modifying a mapped attribute in a managed entry is not allowed
- Resolves: RHEL-40890 ipa-server-install: token_password_file read in kra.install_check after calling hsm_validator in ca.install_check
- Resolves: RHEL-40661 Adjust "ipa config-mod --addattr ipaconfigstring=EnforceLDAPOTP" to allow for non OTP users in some cases
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-37285 IPA Web UI not showing replication agreement for non-admin users
- Resolves: RHEL-42703 PSKC.xml issues with ipa_otptoken_import.py
- Resolves: RHEL-41194 ipa-client rpm post script creates always ssh_config.orig even if nothing needs to be changed
- Resolves: RHEL-39477 kdc.crt certificate not getting automatically renewed by certmonger in IPA Hidden replica
- Resolves: RHEL-46559 Include latest fixes in python3-ipatests packages
- Resolves: RHEL-22188 [RFE] Allow IPA SIDgen task to continue if it finds an entity that SID can't be assigned to
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-29928 freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force
- Resolves: RHEL-29691 freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
Signed-off-by: Julien Rische <jrische@redhat.com>
- Related: RHEL-34809
temporarily revert a commit that depends on newer version of python-jwcrypto
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-39140 Rebase ipa to the latest 4.12 version for RHEL 9.5
- Resolves: RHEL-34757 The change for preventing deletion of the admin user caused a regression in disable
- Resolves: RHEL-30553 Depend on nfsv4-client-utils or nfs-utils
- Resolves: RHEL-29762 IPA sidgen fails to create SID for manually set ID for a new range [rhel-9.5.0]
- Resolves: RHEL-26261 Fix replica connection check for use with AD administrator
- Resolves: RHEL-18062 ipa ca-show NAME --certificate-out=file creates empty file when NAME does not exist
- Resolves: RHEL-12149 traceback in ipaserver/dcerpc.py
- Resolves: RHEL-4810 [RFE] FreeIPA-to-FreeIPA migration
- Resolves: RHEL-4807 [RFE] Support in IPA for HSM boxes
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-23377 Enforce OTP for ldap bind (in some scenarios)
- Resolves: RHEL-29745 Unable to re-add broken AD trust - NT_STATUS_INVALID_PARAMETER
- Resolves: RHEL-30905 Backport latest test fixes in ipa
- Resolves: RHEL-28258 vault fails on non-fips client if server is in FIPS mode
- Resolves: RHEL-26154 ipa: freeipa: specially crafted HTTP requests potentially lead to DoS or data exposure
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-12143 'ipa vault-add is failing with ipa: ERROR: an internal error has occurred in FIPS mode
- Resolves: RHEL-25738 ipa-kdb: Cannot determine if PAC generator is available
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-23627 IPA stops working if HTTP/... service principal was created before FreeIPA 4.4.0 and never modified
- Resolves: RHEL-23625 sidgen plugin does not ignore staged users
- Resolves: RHEL-23621 session cookie can't be read
- Resolves: RHEL-22372 Gating-DL1 test failure in test_integration/test_dns_locations.py::TestDNSLocations::()::test_ipa_ca_records
- Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
- Resolves: RHEL-17996 Memory leak in IdM's KDC
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-12589 ipa: Invalid CSRF protection
- Resolves: RHEL-19748 ipa hbac-test did not report that it hit an arbitrary search limit
- Resolves: RHEL-21059 'DogtagCertsConfigCheck' fails, displaying the error message 'Malformed directive: ca.signing.certnickname=caSigningCert cert-pki-ca'
- Resolves: RHEL-21804 ipa client 4.10.2 - Failed to obtain host TGT
- Resolves: RHEL-21809 CA less servers are failing to be added in topology segment for domain suffix
- Resolves: RHEL-21810 ipa-client-install --automount-location does not work
- Resolves: RHEL-21811 Handle change in behavior of pki-server ca-config-show in pki 11.5.0
- Resolves: RHEL-21812 Backport latest test fixes in ipa
- Resolves: RHEL-21813 krb5kdc fails to start when pkinit and otp auth type is enabled in ipa
- Resolves: RHEL-21815 IPA 389ds plugins need to have better logging and tracing
- Resolves: RHEL-21937 Make sure a default NetBIOS name is set if not passed in by ADTrust instance constructor
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: RHEL-14292 Backport latest test fixes in python3-ipatests
- Resolves: RHEL-15443 Server install: failure to install with externally signed CA because of timezone issue
- Resolves: RHEL-15444 Minimum length parameter in pwpolicy cannot be removed with empty string
- Resolves: RHEL-14842 Upstream xmlrpc tests are failing in RHEL9.4
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: rhbz#2231847 RHEL 8.8 & 9.2 fails to create AD trust with STIG applied
- Resolves: rhbz#2232056 Include latest test fixes in python3-ipatests
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: rhbz#2229712 Delete operation protection for admin user
- Resolves: rhbz#2227831 Interrupt request processing in ipadb_fill_info3() if connection to 389ds is lost
- Resolves: rhbz#2227784 libipa_otp_lasttoken plugin memory leak
- Resolves: rhbz#2224570 Improved error messages are needed when attempting to add a non-existing idp to a user
- Resolves: rhbz#2230251 Backport latest test fixes to python3-ipatests
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: rhbz#2192969 Better handling of the command line and web UI cert search and/or list features
- Resolves: rhbz#2214933 Uninstalling of the IPA server is encountering a failure during the unconfiguration of the CA (Unconfiguring CA)
- Resolves: rhbz#2216114 After updating the RHEL from 8.7 to 8.8, IPA services fails to start
- Resolves: rhbz#2216549 Upgrade to 4.9.10-6.0.1 fails: attributes are managed by topology plugin
- Resolves: rhbz#2216611 Backport latest test fixes in python3-ipatests
- Resolves: rhbz#2216872 User authentication failing on OTP validation using multiple tokens, succeeds with password only
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: rhbz#2196426 [Rebase] Rebase ipa to latest 4.10.x release for RHEL 9.3
- Resolves: rhbz#2192969 Better handling of the command line and web UI cert search and/or list features
- Resolves: rhbz#2192625 Better catch of the IPA web UI event "IPA Error 4301:CertificateOperationError", and IPA httpd error CertificateOperationError
- Resolves: rhbz#2188567 IPA client Kerberos configuration incompatible with java
- Resolves: rhbz#2182683 Tolerate absence of PAC ticket signature depending of domain and servers capabilities [rhel-9]
- Resolves: rhbz#2180914 Sequence processing failures for group_add using server context
- Resolves: rhbz#2165880 Add RBCD support to IPA
- Resolves: rhbz#2160399 get_ranges - [file ipa_sidgen_common.c, line 276]: Failed to convert LDAP entry to range struct
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
- Resolves: rhbz#2162656 Passwordless (GSSAPI) SSH not working for subdomain
- Resolves: rhbz#2166326 Removing the last DNS type for ipa-ca does not work
- Resolves: rhbz#2167473 RFE - Add a warning note about possible performance impact of the Auto Member rebuild task
- Resolves: rhbz#2168244 requestsearchtimelimit=0 doesn't seems to be work with ipa-acme-manage pruning command
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
