This repalces the straight string parsing from IPAv3.0.0.
It should be much more robust and result in a valid
configuration file when complete. aug.save() will
assure that as it will raise an error otherwise.
This will handle the following cases:
* db_library = ipadb.so : do nothing
* db_library is missing, set to ipadb.so
* db_library is something else, replace wih ipadb.so
Fixes: https://pagure.io/freeipa/issue/9862
Related: https://pagure.io/freeipa/issue/5913
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
- Tests to cover both root domain and subdomain users:
- Test that adding AD users/groups without the external group to
HBAC rules fails.
- Test HBAC rule denies SSH access for AD users.
- Test HBAC rule allows SSH access for AD users in external group.
- Test HBAC rule denies sudo access for AD users when rule doesn't
include them.
- Test HBAC rule allows sudo access for AD users in external group.
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
We already have libpwquality plumbed in. The ask here was
to support the quality credits as well.
There are four credits: digits, uppers, lowers and others
These either count complexity towards satisfying the minimum
length or set the minimum number of a type allowed.
If any of the four credits is configured then it will cause
the password policy plugin to go through the libpwquality.
Reminder that libpwquality sets its own min password length
floor that should be overridden already.
If min_classes is set as well then that is still enforced.
Fixes: https://pagure.io/freeipa/issue/9835
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
When executed in IDM-CI the test fails because the file
/etc/resolv.conf is overwritten by Networkmanager.
Use the methods provided by the tasks module to modify
resolver configuration.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
IPA relies on the patch for https://github.com/389ds/389-ds-base/issues/6857
Allow Uniqueness plugin to search uniqueness attributes using custom
matching rules
Provided in 389-ds 3.1.3-2 on fedora 41, 42
3.1.3-7 on fedora 43+
2.7.0-7 on RHEL 9.7
3.1.3-5 on RHEL 10.1
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
With PKI 11.7, requesting a cert with a subca fails.
Mark the tests as xfail for now.
Related: RHEL-108293
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Add a test ensuring that root@REALM cannot be added as
krbcanonicalname
Add a test for PAC enforcement:
try to access a service using a TGT obtained without PAC.
Should fail as PAC is now enforced.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
MS-KILE's PA-PAC-REQUEST sequence allows the Kerberos client to request
a TGT without a PAC. At the moment, there is no way to configure the MIT
KDC to reject such request.
This commit enforces the presence of the PAC when processing TGTs
provided by TGS-REQ. It ensures the server principal of the TGT is the
same as the one in PAC_CLIENT_INFO (i.e. enforces client principal
canonicalization) with integrity check.
Only one exception is applied: this check is skipped for local TGTs on
domain where the MS-PAC generator is not initialized (i.e. domains where
SID generation was not executed yet).
Signed-off-by: Julien Rische <jrische@redhat.com>
This relies on a fix in 389-ds that extends the uniqueness plugin
to be able to compare attributes with different matching syntax.
This will prevent privilege escalation attacks if one of the
attributes is not set on an entry if it is set elsewhere.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Adds a small information note, regarding launching modern webui with
redirect link.
Signed-off-by: David Hanina <dhanina@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Adds modern webui as a submodule. Contains changes in the specfile to
include the `dist` folder of modern webui.
Edits Apache httpd template to allow routing to modern webui, however
old ui is still the default.
Requires https://github.com/freeipa/freeipa-webui/pull/695 to be merged.
Signed-off-by: David Hanina <dhanina@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test is installing a first master with DNS enabled, then a
second master (same domain name, with DNS enabled) in order to
perform migration.
Add --allow-zone-overlap to the 2nd master installation.
Fixes: https://pagure.io/freeipa/issue/9858
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
Do not need to have duplicates as we include them. They used to be not
exported by Samba but not anymore.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
If a subCA only exists in LDAP then it couldn't be removed.
Allow the process to continue. It will fail in the same way if
it doesn't exist on both Dogtag and IPA.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
With PKI 11.6, pkispawn checks that the certificate provided in
pki_admin_cert_file = /root/.dogtag/pki-tomcat/ca_admin.cert is still
valid.
In this scenario the date is moved past the validy date and IPA
does not refresh the certificate, hence the test fails.
Mark as known issue (ticket https://pagure.io/freeipa/issue/9763)
Related: https://pagure.io/freeipa/issue/9763
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Because of PKI issue #4906, the permissions of
/var/lib/pki/pki-tomcat/conf/ca/CS.cfg
are too permissive when RSN is enabled and the check TomcatFileCheck
from ipahealthcheck.ipa.files fails.
Exclude this check when RSN are enabled.
Related: https://github.com/dogtagpki/pki/issues/4906
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
LDAP expects case-insensitive DNs, so modify LDIF parser to
compare DNs as case-insensitive strings and use case-preserving but
case-insensitive dictionary.
Fixes: https://pagure.io/freeipa/issue/9854
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
There was a time we capped the expiration date at 2038
because otherwise time would overflow. That was fixed.
Add a test to ensure it stays that way.
Fixes: https://pagure.io/freeipa/issue/2496
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The old 32-bit time_t will overflow in 2038. Test that
the IPA certificate loader will be able to parse
certificates far into the future.
Related: https://pagure.io/freeipa/issue/2496
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The test TestIPACommand::test_cacert_manage is using
Let's Encrypt chain to check the ipa-cacert-manage install
command.
The chain isrgrootx1 > r3 must be replaced with
isrgrootx1 > r12 because r3 expired Sep 15.
Fixes: https://pagure.io/freeipa/issue/9857
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Samba 4.23 ignores trust to PIM and 'within the forest' domains. It
didn't know what to do with them in past as well but starting with 4.23
the domain trust entries which have trust attributes with
LSA_TRUST_ATTRIBUTE_PIM_TRUST and LSA_TRUST_ATTRIBUTE_WITHIN_FOREST bits
set will be ignored.
FreeIPA did default to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST for domains
stored with trusted attributes set to 0 or missing. This was behavior in
past for Samba as well. Since FreeIPA only supports forest trust and an
external trust, in both cases we should set explicit LSA trust attribute
bits:
- LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE for the forest trust
- LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE for the external trust
Fixes: https://pagure.io/freeipa/issue/9852
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
[MS-DRSR] 5.64 FOREST_TRUST_INFORMATION defines version of the
ForestTrustInfo structure as 1. We didn't set it so it was defaulting to
zero. Samba validates the version number and rejects ForestTrustInfo
structures from FreeIPA.
Make sure new structures are always set to version 1 and old strutures
fixed up to have version 1.
Fixes: https://pagure.io/freeipa/issue/9852
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>
azure webui tests are failing with chromium-140.0.7339.80-1.fc42
Force to install an older version
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The test is performing ssh from the runner to the master
but is using the external_hostname and randomly fails.
Make sure to use the configured hostname instead.
Fixes: https://pagure.io/freeipa/issue/9849
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test was written with a complex logic depending on the
installed version of 389-ds. The command was expected to fail if
version < 1.4.0.22.
Fedora has been shipping the fixed version for a long time already,
and the test can be simplified. Moreover, the code responsible
for retrieving 389 ds version does not work for ds 3.1.3 which
provides a vendorVersion attribute not compliant with python
versioning schema.
Fixes: https://pagure.io/freeipa/issue/9850
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Test scenario:
- install IPA server and client
- store the start date
- request a certificate on the client using ipa-getcert
- check in the journal after start date that the request was done using the
https://.../ipa/json URI
The test obtains the start date on the runner. As a consequence, if the runner
is late compared to the client, it may miss the message in the journal.
The date should rather be obtained on the client.
Fixes: https://pagure.io/freeipa/issue/9848
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When a client or server is configured with DoT, the installer
creates /etc/unbound/conf.d/zzz-ipa.conf with
tls-cert-bundle: /etc/pki/tls/certs/ca-bundle.crt
This certificate bundle does not exist any more in fedora 43+
(https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile)
and the missing file prevents unbound service from starting.
The configuration should rather set
tls-system-cert: yes
in order to rely on the systemwide trust store.
The upgrade is also handled by this change.
Fixes: https://pagure.io/freeipa/issue/9838
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
- Add parametrized test for domain validation covering valid/invalid formats
- Add cross-domain discovery test showing --domain enables discovery when
client is in different domain than IPA domain
- Validate configuration in sssd.conf after successful automount setup
The new tests ensure --domain option works correctly and provides proper
hints for DNS discovery in cross-domain scenarios, reducing user friction
compared to requiring --server specification.
Related: https://pagure.io/freeipa/issue/9780
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Do not use the newest nodesjs24 as it does not provide the /usr/bin/node
command, only /usr/bin/node-24.
Force the use of nodejs22.
Fixes: https://pagure.io/freeipa/issue/9836
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Removed xfail for test_number_of_zones
This test is xpass when executed in IdM-CI
but still failing in PRCI. There is a different configuration
in the 2 CIs and with this we will get a green test
in IdM-CI nightly tests.
Related : https://pagure.io/freeipa/issue/9135
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
During hsm validation temporary directory and files are prepared
by root in base temporary directory which can be private and
thereby not readable by anybody but root. The validation in its
turn, run some checks as pkiuser and fail to read not accessible
resources in such a case.
Hence, to make them available some shared place need to be used,
e.g. /tmp.
Fixes: https://pagure.io/freeipa/issue/9831
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
acl_list was set to prev->tl_data_contents and its value is freed but
then is is freed again outside of the if(). Just reset acl_list pointer
as prev->tl_data_contents is removed unconditionally outside of the RBCD
ACL removal.
Related: https://pagure.io/freeipa/issue/9367
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
For quite some time, even as early as with Fedora 37, we had
Running scriptlet: freeipa-server-trust-ad-4.10.1-1.fc37.x86_64
338/343
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down
warning: %post(freeipa-server-trust-ad-4.10.1-1.fc37.x86_64) scriptlet failed,
exit status 1
Error in POSTIN scriptlet in rpm package freeipa-server-trust-ad
when installing freeipa-server-trust-ad, but the whole rpm transaction passed
and the dnf command returned with exit 0. So we did not care about that failure
because, well, it did not get reported in any way it could be caught.
This has changed with recent registry.fedoraproject.org/fedora:rawhide image
which seem so have rpm-5.99.91-1.fc43.x86_64. Now instead of exiting with 0 as
with previous registry.fedoraproject.org/fedora:rawhide images, the dnf exits
with 1, even if the version freeipa-server-trust-ad-4.12.2-14.fc43.x86_64 is
the same in both cases.
Fixes: https://pagure.io/freeipa/issue/9826
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The correct third party trademarks are GitHub and GitLab, and this is
the capitalization that needs to be used for documentation and messages,
when referring to each service.
Fixes: https://pagure.io/freeipa/issue/9811
Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Deploying a replica with DNS support using an IPA server DNS with DoT
fails while setting up DNS over TLS. The request for the certificate for
DoT using IPA CA is done after the DNS server for the replica is configured.
The nameserver in /etc/resolv.conf has been changed to 127.0.0.1, but
unbound was not yet configured as a forwarder.
The solution is to move the cert request before the DNS server
configuration. The unbound config from the client deployment is still
working at that moment.
Fixes: https://pagure.io/freeipa/issue/9808
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Rob Crittenden
PRANAV THUBE
Anuja More
Florence Blanc-Renaud
Julien Rische
David Hanina
Alexander Bokovoy
Sam Morris
Wouter Schoot
Antonio Torres
Michal Polovka
Sudhir Menon
Stanislav Levin
Rafael Guterres Jeffman
Thomas Woerner