Do not need to have duplicates as we include them. They used to be not
exported by Samba but not anymore.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
If a subCA only exists in LDAP then it couldn't be removed.
Allow the process to continue. It will fail in the same way if
it doesn't exist on both Dogtag and IPA.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
With PKI 11.6, pkispawn checks that the certificate provided in
pki_admin_cert_file = /root/.dogtag/pki-tomcat/ca_admin.cert is still
valid.
In this scenario the date is moved past the validy date and IPA
does not refresh the certificate, hence the test fails.
Mark as known issue (ticket https://pagure.io/freeipa/issue/9763)
Related: https://pagure.io/freeipa/issue/9763
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Because of PKI issue #4906, the permissions of
/var/lib/pki/pki-tomcat/conf/ca/CS.cfg
are too permissive when RSN is enabled and the check TomcatFileCheck
from ipahealthcheck.ipa.files fails.
Exclude this check when RSN are enabled.
Related: https://github.com/dogtagpki/pki/issues/4906
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
LDAP expects case-insensitive DNs, so modify LDIF parser to
compare DNs as case-insensitive strings and use case-preserving but
case-insensitive dictionary.
Fixes: https://pagure.io/freeipa/issue/9854
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
There was a time we capped the expiration date at 2038
because otherwise time would overflow. That was fixed.
Add a test to ensure it stays that way.
Fixes: https://pagure.io/freeipa/issue/2496
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The old 32-bit time_t will overflow in 2038. Test that
the IPA certificate loader will be able to parse
certificates far into the future.
Related: https://pagure.io/freeipa/issue/2496
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The test TestIPACommand::test_cacert_manage is using
Let's Encrypt chain to check the ipa-cacert-manage install
command.
The chain isrgrootx1 > r3 must be replaced with
isrgrootx1 > r12 because r3 expired Sep 15.
Fixes: https://pagure.io/freeipa/issue/9857
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Samba 4.23 ignores trust to PIM and 'within the forest' domains. It
didn't know what to do with them in past as well but starting with 4.23
the domain trust entries which have trust attributes with
LSA_TRUST_ATTRIBUTE_PIM_TRUST and LSA_TRUST_ATTRIBUTE_WITHIN_FOREST bits
set will be ignored.
FreeIPA did default to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST for domains
stored with trusted attributes set to 0 or missing. This was behavior in
past for Samba as well. Since FreeIPA only supports forest trust and an
external trust, in both cases we should set explicit LSA trust attribute
bits:
- LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE for the forest trust
- LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE for the external trust
Fixes: https://pagure.io/freeipa/issue/9852
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
[MS-DRSR] 5.64 FOREST_TRUST_INFORMATION defines version of the
ForestTrustInfo structure as 1. We didn't set it so it was defaulting to
zero. Samba validates the version number and rejects ForestTrustInfo
structures from FreeIPA.
Make sure new structures are always set to version 1 and old strutures
fixed up to have version 1.
Fixes: https://pagure.io/freeipa/issue/9852
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
azure webui tests are failing with chromium-140.0.7339.80-1.fc42
Force to install an older version
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The test is performing ssh from the runner to the master
but is using the external_hostname and randomly fails.
Make sure to use the configured hostname instead.
Fixes: https://pagure.io/freeipa/issue/9849
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test was written with a complex logic depending on the
installed version of 389-ds. The command was expected to fail if
version < 1.4.0.22.
Fedora has been shipping the fixed version for a long time already,
and the test can be simplified. Moreover, the code responsible
for retrieving 389 ds version does not work for ds 3.1.3 which
provides a vendorVersion attribute not compliant with python
versioning schema.
Fixes: https://pagure.io/freeipa/issue/9850
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Test scenario:
- install IPA server and client
- store the start date
- request a certificate on the client using ipa-getcert
- check in the journal after start date that the request was done using the
https://.../ipa/json URI
The test obtains the start date on the runner. As a consequence, if the runner
is late compared to the client, it may miss the message in the journal.
The date should rather be obtained on the client.
Fixes: https://pagure.io/freeipa/issue/9848
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When a client or server is configured with DoT, the installer
creates /etc/unbound/conf.d/zzz-ipa.conf with
tls-cert-bundle: /etc/pki/tls/certs/ca-bundle.crt
This certificate bundle does not exist any more in fedora 43+
(https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile)
and the missing file prevents unbound service from starting.
The configuration should rather set
tls-system-cert: yes
in order to rely on the systemwide trust store.
The upgrade is also handled by this change.
Fixes: https://pagure.io/freeipa/issue/9838
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
- Add parametrized test for domain validation covering valid/invalid formats
- Add cross-domain discovery test showing --domain enables discovery when
client is in different domain than IPA domain
- Validate configuration in sssd.conf after successful automount setup
The new tests ensure --domain option works correctly and provides proper
hints for DNS discovery in cross-domain scenarios, reducing user friction
compared to requiring --server specification.
Related: https://pagure.io/freeipa/issue/9780
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Do not use the newest nodesjs24 as it does not provide the /usr/bin/node
command, only /usr/bin/node-24.
Force the use of nodejs22.
Fixes: https://pagure.io/freeipa/issue/9836
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Removed xfail for test_number_of_zones
This test is xpass when executed in IdM-CI
but still failing in PRCI. There is a different configuration
in the 2 CIs and with this we will get a green test
in IdM-CI nightly tests.
Related : https://pagure.io/freeipa/issue/9135
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
During hsm validation temporary directory and files are prepared
by root in base temporary directory which can be private and
thereby not readable by anybody but root. The validation in its
turn, run some checks as pkiuser and fail to read not accessible
resources in such a case.
Hence, to make them available some shared place need to be used,
e.g. /tmp.
Fixes: https://pagure.io/freeipa/issue/9831
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
acl_list was set to prev->tl_data_contents and its value is freed but
then is is freed again outside of the if(). Just reset acl_list pointer
as prev->tl_data_contents is removed unconditionally outside of the RBCD
ACL removal.
Related: https://pagure.io/freeipa/issue/9367
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
For quite some time, even as early as with Fedora 37, we had
Running scriptlet: freeipa-server-trust-ad-4.10.1-1.fc37.x86_64
338/343
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
warning: %post(freeipa-server-trust-ad-4.10.1-1.fc37.x86_64) scriptlet failed,
exit status 1
Error in POSTIN scriptlet in rpm package freeipa-server-trust-ad
when installing freeipa-server-trust-ad, but the whole rpm transaction passed
and the dnf command returned with exit 0. So we did not care about that failure
because, well, it did not get reported in any way it could be caught.
This has changed with recent registry.fedoraproject.org/fedora:rawhide image
which seem so have rpm-5.99.91-1.fc43.x86_64. Now instead of exiting with 0 as
with previous registry.fedoraproject.org/fedora:rawhide images, the dnf exits
with 1, even if the version freeipa-server-trust-ad-4.12.2-14.fc43.x86_64 is
the same in both cases.
Fixes: https://pagure.io/freeipa/issue/9826
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The correct third party trademarks are GitHub and GitLab, and this is
the capitalization that needs to be used for documentation and messages,
when referring to each service.
Fixes: https://pagure.io/freeipa/issue/9811
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Deploying a replica with DNS support using an IPA server DNS with DoT
fails while setting up DNS over TLS. The request for the certificate for
DoT using IPA CA is done after the DNS server for the replica is configured.
The nameserver in /etc/resolv.conf has been changed to 127.0.0.1, but
unbound was not yet configured as a forwarder.
The solution is to move the cert request before the DNS server
configuration. The unbound config from the client deployment is still
working at that moment.
Fixes: https://pagure.io/freeipa/issue/9808
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Unbound is by default configured to do DNSSEC validation with the validator
module. The solution is to set module-config to "iterator".
When the server is built with EDNS client subnet support this should be
changed to "subnetcache iterator" according to the unbound man page.
Fixes: https://pagure.io/freeipa/issue/9805
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The new option is needed to be able to deactivate DNSSEC validation
for unbound.
Unbound is by default configured to do DNSSEC validation with the
validator module.
The solution is to set module-config to "iterator".
When the server is built with EDNS client subnet support this should be
changed to "subnetcache iterator" according to the unbound man page.
Fixes: https://pagure.io/freeipa/issue/9805
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
32BitIdranges testuiste has been included in the
nightly prvi definitions.
Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Fix the test scenario:
create a user with a second krbprincipalname but no
krbcanonical name.
kinit -E with the other name
try ipa-adtrust-install with the other name
It should fail with the error message 'user not found'
Fixes: https://pagure.io/freeipa/issue/9812
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Improve how we process attributes that might include replication state
data. Previously we only cared about ";binary" but there are other
attribute options that are used in IPA. Now we completely break down the
attribute into each option and rebuild it without any repl state options
Fixes: https://pagure.io/freeipa/issue/9784
Signed-off-by: Mark Reynolds <mreynolds@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Since commit 4ed7da378940198cf4415f86d4eb013de6ac6455 in MIT krb5,
kdb5_util sets the required bits on the modification mask of updated
principal entries to enable ipa-kdb to switch the active master key.
This commit creates a "test_fedora_legacy" ipaplatform where the AES
HMAC-SHA2 encryption types are not enabled. "test_mkey_upgrade" uses
this platform to initialize a domain with an aes256-cts-hmac-sha1-96
master key, and test its upgrade to aes256-cts-hmac-sha384-192.
Some parts of the test infrastructure had to be made aware of this new
platform (e.g. firewall integration).
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Provide the master key encryption type and the list of supported
encryption types as ipaplatform.<platform>.tasks methods. This allows
to generate the list at runtime based on the environment (e.g. FIPS) and
override the list depending of the platform.
3DES HMAC-SHA1 encryption type is now removed from supported encryption
types if it is present.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
All MIT krb5 keys are encoded with an encryption type identifier and a
KVNO (key version number). The KVNO is referring to the original
credentials string (and its associated salt) which was used to generate
the key using the derivation function of the associated encryption type.
So far, when a set of Kerberos keys was provided to ipa-kdb, only the
newest KVNO ones were saved in a single "krbPrincipalKey" LDAP
attribute. All the older ones were deleted in the process.
This commit allows to keep older keys by splitting them in multiple
"krbPrincipalKey" attribute based on their KVNO.
Fixes: https://pagure.io/freeipa/issue/9370
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Setting the HSM options in a pki-override-file will
result in a successful installation but it affects the
storage of the token library path. It is stored as None.
We could also instead save the provided value from the
override but an override isn't necessary in this case
since IPA provides command-line options to enable it.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
If ipa-idrange-fix is called on a system where the server is not configured,
it crashes with a Traceback when trying to access api.env.basedn.
Check that IPA server is configured before processing further
ipatests: add test launching ipa-idrange-fix on unconfigured server
Fixes: https://pagure.io/freeipa/issue/9809
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
The admin must always own this name. If another entry has this
value set then remove it.
There is a uniqueness plugin for this attribute so the only two
possibilities are:
- no entry has this value set
- the admin user has this value set
- a different entry has the value set
Still, for robustness purposes, the upgrade plugin will handle
more entries.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
The server commands for nsupdate.txt to define the server with the port
853 have been added for dns_over_tls. These commands do not have a leading
newline. This results in a syntax error as the next line is added to the
command.
Fixes: https://pagure.io/freeipa/issue/9806
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Alexander Bokovoy
Rob Crittenden
Florence Blanc-Renaud
Sam Morris
Anuja More
Wouter Schoot
Antonio Torres
Michal Polovka
Sudhir Menon
Stanislav Levin
David Hanina
Rafael Guterres Jeffman
Thomas Woerner
Mark Reynolds
Julien Rische