This can be used for disaster recovery or situation with replication
issues, when only one server is fixed/working and is a source of
truth about CA certs for all the other replicas and clients.
Fixes: https://pagure.io/freeipa/issue/9839
Signed-off-by: Aleksandr Sharov (asharov@redhat.com)
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The ipa-migrate tool reads the content of the source LDAP server
and processes the entries. When the entry is a tombstone it must be
discarded.
In order to detect if the entry is a tombstone, the code checks
if the objectclass attribute contains the value 'nsTombstone'.
The problem is that the key ('objectClass') is not normalized
and may either be 'objectclass' (all lowercase) or 'objectClass'.
Take both cases into account and avoid KeyError exception by
normalizing the attribute + looking for case-insensitive value.
Fixes: https://pagure.io/freeipa/issue/9910
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mark Reynolds <mreynolds@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
There is a non-zero chance that the Kerberos configuration can't
be retrieved. If this fails it should report an error which will
likely fail the operation but otherwise allow the server to
remain running.
A flag was added to not allow the Master key to be returned
but since this manipulates *config and that is NULL...SEGV.
Add a goto to skip that block in the case of failure.
Credit to Viktor Ashirov for identifying the fix. All I did
was write up the patch.
Fixes: https://pagure.io/freeipa/issue/9914
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The upgrade on RHEL9 needs to update /etc/sysconfig/ipa-dnskeysyncd
with DNSSEC_TOKENS_DIR and DNSSEC_SOFTHSM_PIN because those
environment variables are used by the systemd unit for ipa-dnskeysyncd.
Currently the upgrade skips this step because of a wrong comparison when
defining the constants:
HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number == (9,)
The above evaluates to false because osinfo.version_number is a tuple with
(9, minor_version).
Replace the comparison with osinfo.version_number[0] == 9 to make
sure that the upgrade code is properly called on RHEL 9.x
Fixes: https://pagure.io/freeipa/issue/9913
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
In `ipapwd_get_cur_kvno()`, the `Slapi_ValueSet` obtained via
`slapi_attr_get_valueset()` was never freed. This function returns a
copy of the valueset that must be freed by the caller using
`slapi_valueset_free()`.
Add `slapi_valueset_free(svs)` before returning from the function.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_gen_hashes()`, when an error occurred after allocating output
parameters, `*ntvals` was freed but `*nthash` was not.
Add `slapi_ch_free_string(nthash)` to the error cleanup section.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_post_modadd()`, the `pwvals` array returned by
`ipapwd_setPasswordHistory()` was passed to `slapi_mods_add_mod_values()`
but never freed. The `slapi_mods_add_mod_values()` function makes a copy
of the values, so the original array still needs to be freed.
Add `ipapwd_free_slapi_value_array()` call in the cleanup section to
free the array.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()` and `ipapwd_pre_mod()`, the `nt` string returned
by `ipapwd_gen_hashes()` was only freed when `is_smb` was true. When NT
hashes are generated for `is_ipant` entries but `is_smb` is false, the
`nt` string was leaked.
Free `nt`, `ntvals` and `svals` unconditionally.
Fix the error path in `ipapwd_pre_add()` where `nt` and `ntvals` were
leaked when `slapi_entry_attr_replace_sv()` failed for `svals`.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()` and `ipapwd_pre_mod()`, `binddn` is obtained via
`slapi_pblock_get()` with SLAPI_CONN_DN which returns an allocated
string. This string was never freed after use.
Add `slapi_ch_free_string(&binddn)` calls after the bind DN is no longer
needed in both functions.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()`, when processing password from entry extension,
`userpw` was reassigned without freeing the previous value.
Additionally, `enabled` obtained from `ipapwd_getIpaConfigAttr()` was
never freed, and early returns bypassed the cleanup section causing
memory leaks.
Free `userpw` before reassigning it.
Free `enabled` after use.
Replace early `return 0` statements with `goto done` to ensure proper
cleanup of all allocated resources.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_chpwop()`, `ipapwd_setkeytab()`, and `ipapwd_getkeytab()`
functions, `bindDN`/`bind_dn` is obtained via `slapi_pblock_get()` with
SLAPI_CONN_DN which returns an allocated string. This string was never
freed in the cleanup sections of these functions.
Add `slapi_ch_free_string()` calls for the bind DN variables in the
`free_and_return` sections of all three functions.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Extend the EDNS test suite by, adding structured tests for DNS-over-TLS under a enforced policy with IPA and external CAs.
Tests:
TestDNSOverTLS_EnforcedPolicy_IPA_CA
TestDNSOverTLS_EnforcedPolicy_External_CA
Related: https://issues.redhat.com/browse/IDM-1524
Signed-off-by: PRANAV THUBE <pthube@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The base class MigrationTest installation sets up two
separate servers, each with their own DNS. The second
one (replica[0]) is the "new" IPA server and will migrate
data from the "old" one (master).
When manually running these tests in my own environment
they fail because the new server can't connect to the old
one because it doesn't have its IP address. This somehow
works in PR-CI. So add the master IP address on the replica
so it has a way to contact it.
Fixes: https://pagure.io/freeipa/issue/9884
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
When dns is handles externaly and `--auto-reverse` is used to install
ipa-server, installation fails as
```
ipa: ERROR: stderr: Checking DNS domain testrelm.test., please wait ...
Checking DNS domain xx.xx.xx.in-addr.arpa., please wait ...
DNS zone xx.xx.xx.in-addr.arpa. already exists in DNS and is handled by server(s): ['xxx.', 'xxx.', 'xxx.', 'xxx.']
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
```
Allow ipa-server install adding '--allow-zone-overlap' option for these
cases.
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The error only happens in developer mode (when mode=developer instead of
mode=production in /etc/ipa/default.conf). Using object.__setattr__ bypasses
normal attribute assignment which fails in developer mode when trying to set
the class attribute allow_empty_update on an instance.
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
In `ipapwd_set_extradata` free `xdata` after it's not longer needed. It
was leaked because `slapi_value_new_berval()` makes a copy of the data.
In `ipapwd_free_slapi_value_array` free `svals` (caller's pointer)
instead of `sv` (local pointer).
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In various code paths the `ctx` structure was freed, but not `ctx`
resources (`base_dn`, `nss_ctx`, `extdom_instance_counter`) which may
have been allocated.
Plugin didn't have SLAPI_PLUGIN_CLOSE_FN registered, so context was
never freed on server shutdown.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
There is a small bug in the server code that processes
the user-locked situation: while kinit reports `kinit:
Client's credentials have been revoked ...`, the code
expects `kinit: Clients credentials have been revoked ...`
(doesn't contain the apostrophe). By correcting the
message and adding the apostrophe the right message
should be displayed.
Fixes: https://pagure.io/freeipa/issue/9891
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When a trust was establish pre samba 4.23, the trust domain object
could contain ipanttrustattributes = 40 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
and winbind would fail to restart after an upgrade to samba 4.23.
Add a test simulating the situation and calling ipa-server-upgrade
Related: https://pagure.io/freeipa/issue/9892
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
When a trust was established pre samba 4.23, the trust domain object
could contain ipanttrustattributes: 8 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
This value prevents winbind restart.
The current code replaces 0 with LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
but should also handle the case for LSA_TRUST_ATTRIBUTE_WITHIN_FOREST.
In this case we should drop the bit and replace it by FOREST_TRANSITIVE
one because otherwise Samba will skip the domain. Do not change the LDAP
representation to allow older replicas to continue operations.
Fixes: https://pagure.io/freeipa/issue/9892
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The test is moving the date in the future to simulate CA certificate
expiration, then uninstalls the server. If certmonger is working,
the uninstaller may fail with a Dbus Exception.
The test can be fixed with the same strategy as other tests changing
the date: stop certmonger and remove the tracking requests before
uninstallation.
Fixes: https://pagure.io/freeipa/issue/9888
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
If dnsconfd is kept enabled after we are done configuring Unbound for the
encrypted DNS setup, it might overwrite the configuration,
resulting in a broken setup. dnsconfd should be disabled prior to
configuring Unbound during the server/client install process.
Fixes: https://pagure.io/freeipa/issue/9859
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
In some user agents (e.g. Chrome on Windows) after negotiation of
Kerberos auth fails the agent will try negotiating NTML auth. This
will not work but may prompt http basic auth popups before showing the
html login form, confusing the users.
To circumvent this problem mod_auth_gssapi added the option
GssapiNegotiateOnce, sending the negotiate header only once.
References:
[1] Discussion in mod_auth_gssapi:
https://github.com/gssapi/mod_auth_gssapi/discussions/293
Fixes: https://pagure.io/freeipa/issue/5614
Signed-off-by: Finn Krein-Schuch <finn.krein-schuch@sva.de>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Timo Aaltonen
Antonio Torres
Aleksandr Sharov
David Hanina
Florence Blanc-Renaud
Rob Crittenden
PRANAV THUBE
Viktor Ashirov
Mohammad Rizwan
MOHAMMAD SAMI
Anuja More
Carla Martinez
Finn Krein-Schuch
Rafael Guterres Jeffman