In various code paths the `ctx` structure was freed, but not `ctx`
resources (`base_dn`, `nss_ctx`, `extdom_instance_counter`) which may
have been allocated.
Plugin didn't have SLAPI_PLUGIN_CLOSE_FN registered, so context was
never freed on server shutdown.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
There is a small bug in the server code that processes
the user-locked situation: while kinit reports `kinit:
Client's credentials have been revoked ...`, the code
expects `kinit: Clients credentials have been revoked ...`
(doesn't contain the apostrophe). By correcting the
message and adding the apostrophe the right message
should be displayed.
Fixes: https://pagure.io/freeipa/issue/9891
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When a trust was establish pre samba 4.23, the trust domain object
could contain ipanttrustattributes = 40 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
and winbind would fail to restart after an upgrade to samba 4.23.
Add a test simulating the situation and calling ipa-server-upgrade
Related: https://pagure.io/freeipa/issue/9892
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
When a trust was established pre samba 4.23, the trust domain object
could contain ipanttrustattributes: 8 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
This value prevents winbind restart.
The current code replaces 0 with LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
but should also handle the case for LSA_TRUST_ATTRIBUTE_WITHIN_FOREST.
In this case we should drop the bit and replace it by FOREST_TRANSITIVE
one because otherwise Samba will skip the domain. Do not change the LDAP
representation to allow older replicas to continue operations.
Fixes: https://pagure.io/freeipa/issue/9892
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The test is moving the date in the future to simulate CA certificate
expiration, then uninstalls the server. If certmonger is working,
the uninstaller may fail with a Dbus Exception.
The test can be fixed with the same strategy as other tests changing
the date: stop certmonger and remove the tracking requests before
uninstallation.
Fixes: https://pagure.io/freeipa/issue/9888
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
If dnsconfd is kept enabled after we are done configuring Unbound for the
encrypted DNS setup, it might overwrite the configuration,
resulting in a broken setup. dnsconfd should be disabled prior to
configuring Unbound during the server/client install process.
Fixes: https://pagure.io/freeipa/issue/9859
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
In some user agents (e.g. Chrome on Windows) after negotiation of
Kerberos auth fails the agent will try negotiating NTML auth. This
will not work but may prompt http basic auth popups before showing the
html login form, confusing the users.
To circumvent this problem mod_auth_gssapi added the option
GssapiNegotiateOnce, sending the negotiate header only once.
References:
[1] Discussion in mod_auth_gssapi:
https://github.com/gssapi/mod_auth_gssapi/discussions/293
Fixes: https://pagure.io/freeipa/issue/5614
Signed-off-by: Finn Krein-Schuch <finn.krein-schuch@sva.de>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The hostname "localhost" was harcoded in pki_issue_certificate.
This worked for installations, even without a CA, because this
wasn't called for issuing those certificates.
It fails with ipa-pkinit-enable on a server without a CA because
only attempted the local server which lacks a CA.
Instead detect the CA based on the local capabilities and the
server list of available CAs, preferring the local server if it
has a CA.
Fixes: https://pagure.io/freeipa/issue/9879
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
With the changes related to PKI API, a different error message is
returned when PKI is not reachable.
This breaks the test test_ipahealthcheck_dogtag_ca_connectivity_check.
Update the expected error message.
Fixes: https://pagure.io/freeipa/issue/9881
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
In recent kdcproxy commit 1773f28eeea72ec6efcd433d3b66595c44d1253f, the
use of DNS discovery has been restricted to declared realms in order to
mitigate CVE-2025-59088. The present commit update the
TestHttpKdcProxy::test_ad_user_login_on_client_with_kdcproxy test to
take this change into account.
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The test test_fips.py::TestInstallFIPS::test_dnssec is failing and
the issue is reported upstream at 9785.
Mark the test as xfail for now.
Related: https://pagure.io/freeipa/issue/9785
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
In FIPS mode, ipa server installation fails in a call to
openssl pkcs12 command because the PKCS12 MAC requires PKCS12KDF
which is not an approved FIPS algo.
The fix consists in passing the additional option -nomacver
Fixes: https://pagure.io/freeipa/issue/9878
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This is needed to avoid importing functions and static values
from cainstance.py and krainstance.py. Both import dsinstance.py
which imports lib389 and initializes things that don't work
well within the server API.
They are moved to installutils and ipalib.constants to be more
centralized and reduce imports.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Since renewal now occurs through IPA and not directly via
the CA, restrict the CA profiles to only those certificates
we know about and expect.
The RA Agent cert and the subsystem cert share the same profile
so there is another hoop to jump through in validating that
the subjects are valid and expected.
Since the code runs as ipaapi it does not have access to check
the run status of DS so skip in that case. If it fails, it fails.
Contributions from Fraser Tweedale <ftweedal@redhat.com>
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Two test were failing because the order within the result
keys changed. We shouldn't rely on order so sort the result
and compare that.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
The updated certmonger supports the --json-api flag used
to signal that all requests go through the IPA API.
The updated PKI packages provide fixes for the python API
so that all CA requests can be directed through that instead
of using the REST API directly.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Normally IPA only returns the locally-stored certificate profiles.
In order for certmonger to request CA subsystem certificates using
cert_request we need the full set of profiles. Return them all
when --all is provided and the requesting user has permission.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
certmonger defaults to using the PKI XML API for renewing
CA/KRA subsystem certificates. certmonger supports the
IPA API for renewals by providing --jsonrpc-url
The IPA API will forward requests to the CA via the
PKI python API. IPA will be RPC agnostic this way and
rely on the PKI python API to handle communication.
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
This reduces the reliance on specific REST/XML API in PKI and will
allow the pki client library to choose which RPC API(s) to use.
Add the new, versioned REST endpoint paths (v1, v2) to the httpd
configuration.
This needs additional refactoring once the certprofile
class is ported and the RestClient class can be dropped or
repurposed so some of the duplication can be re-centralized.
Also catch a bare Exception when we can't reach the local
server on port 443 in ipa-ca-install. This is because
proxying isn't configured yet. So catch that Exception and
try again with port 8443 like other exceptions.
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Update the installation code to use the pki python client library to
issue certificates. This is instead of using the `pki` CLI program
and parsing its output strings.
As part of this change, decompose the `pki_issue_certificate`
function into two specialised functions, rather than a single
function with different "modes". This makes the logic easier to
follow (and enables the refactor to be done incrementally).
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
A new command-line option was added, --key-type-size, to define
the type of key to generate and the size of the key, or equivalent.
Only rsa is supported currently but this can be expanded easily if
additional key types are added. Placeholders have been added for
ec and ml-dsa key types but they are not yet supported.
There is also a config plugin option to modify this value. It does
NOT modify any certificates already issued. Changing it will only
apply to new replicas added.
Related: https://pagure.io/freeipa/issue/9738
Also add a test to verify installation key sizes.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
We previously called out to certmonger to have it directly
obtain certificates from the CA. Instead use the CA-generated
/root/ca-admin.p12 certificate to authenticate using the pki
tool to generate the IPA RA certificate.
Then use that certificate to issue the DS, HTTP and KDC
certificates.
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
OID 2.5.4.97 added to the ATTR_NAME_BY_OID list, and cainstance during
2-step installation is re-fetching CA certificate and re-parsing OIDs
based on the list. Example:
cert issuer: <Name(C=CZ,2.5.4.97=LLCCZ-123456789,O=Corp,CN=ROOT)>
DN(cert issuer): CN=ROOT,O=Corp,organizationIdentifier=LLCCZ-123456789,C=CZ
Fixes: https://pagure.io/freeipa/issue/9866
Signed-off-by: Aleksandr Sharov <asharov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Security Architect role was supposed to manage sysaccount objects. But
since description attribute is missing from the list of the managed
permissions, the role is unable to modify 'description' field. Same for
nsAccountLock which needs an explicit ACI.
Fixes: https://pagure.io/freeipa/issue/9875
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The tests for offline caching should not clear SSSD cache
before shutting down the IPA server. Currently most of them
follow the same steps:
- create the rule
- clear the cache
- call run_as_sudo_user (which clears the cache)
- call list_sudo_commands (which clears the cache)
- stop the master
- call run_as_sudo_user with skip_sssd_cache_clear
- call list_sudo_commands with skip_sssd_cache_clear
The scenario is wrong as skip_sssd_cache_clear should also be
added on the calls before the master is stopped.
Fixes: https://pagure.io/freeipa/issue/9874
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
Viktor Ashirov
Carla Martinez
Florence Blanc-Renaud
Antonio Torres
Finn Krein-Schuch
Rafael Guterres Jeffman
Arif Budiman
Rob Crittenden
Julien Rische
Sumedh Sidhaye
Fraser Tweedale
Emilio Herrera
Aleksandr Sharov
Alexander Bokovoy