OID 2.5.4.97 added to the ATTR_NAME_BY_OID list, and cainstance during
2-step installation is re-fetching CA certificate and re-parsing OIDs
based on the list. Example:
cert issuer: <Name(C=CZ,2.5.4.97=LLCCZ-123456789,O=Corp,CN=ROOT)>
DN(cert issuer): CN=ROOT,O=Corp,organizationIdentifier=LLCCZ-123456789,C=CZ
Fixes: https://pagure.io/freeipa/issue/9866
Signed-off-by: Aleksandr Sharov <asharov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Security Architect role was supposed to manage sysaccount objects. But
since description attribute is missing from the list of the managed
permissions, the role is unable to modify 'description' field. Same for
nsAccountLock which needs an explicit ACI.
Fixes: https://pagure.io/freeipa/issue/9875
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The tests for offline caching should not clear SSSD cache
before shutting down the IPA server. Currently most of them
follow the same steps:
- create the rule
- clear the cache
- call run_as_sudo_user (which clears the cache)
- call list_sudo_commands (which clears the cache)
- stop the master
- call run_as_sudo_user with skip_sssd_cache_clear
- call list_sudo_commands with skip_sssd_cache_clear
The scenario is wrong as skip_sssd_cache_clear should also be
added on the calls before the master is stopped.
Fixes: https://pagure.io/freeipa/issue/9874
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
Commands sysaccount-enable/sysaccount-disable allow to lock/unlock the
account. This is exposed via operational attribute `nsAccountLock`
which has to be explicitly requested to query the state. However, if
account wasn't explicitly disabled before, `nsAccountLock` will not be
returned by the LDAP server.
Ensure the nsaccountlock attribute is always retrieved, validated, and
normalized across sysaccount operations.
- Invoke validate_nsaccountlock in create and modify pre-callbacks to
enforce valid values
- Invoke convert_nsaccountlock in create, modify, list, reset, and
policy post-callbacks to normalize the nsaccountlock attribute and
default to False in case it is absent.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
The test edits krb5 client configuration in /etc/krb5.conf in order
to use a KDC proxy, but the configuration has moved to the snippet
file /etc/krb5.conf.d/freeipa-realm.
Fix the file path.
Fixes: https://pagure.io/freeipa/issue/9871
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
When a translation file does not contain any translation, the
build is broken. Remove the zh_Hant file as it is still empty.
Fix es.po
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 62.5% (3055 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.4% (3047 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 62.3% (3045 of 4881 strings)
Translated using Weblate (Spanish)
Currently translated at 59.1% (2886 of 4881 strings)
Co-authored-by: Fco. Javier F. Serrador <fserrador@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/es/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Currently translated at 36.6% (1788 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.9% (1755 of 4881 strings)
Translated using Weblate (Georgian)
Currently translated at 35.8% (1751 of 4881 strings)
Co-authored-by: Temuri Doghonadze <temuri.doghonadze@gmail.com>
Translate-URL: https://translate.fedoraproject.org/projects/freeipa/master/ka/
Translation: freeipa/master
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
A previous commit overwrote the version of freeipa-webui and
went back before the patch that was fixing the copr build.
Refresh to the tip of freeipa-webui to include the copr fix.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Introduce support for LDAP-based system accounts by adding a dedicated
sysaccount plugin with full CLI commands, extending role membership to
include system accounts, and providing warnings for passsync
configuration updates across servers, along with corresponding
documentation and tests.
New Features:
Implement system accounts LDAP object with CLI commands for add,
delete, modify, find, show, enable, and disable.
Enhancements:
Extend role and baseldap plugins to support sysaccount membership
and manage passsync managers with a ServerSysacctMgrUpdateRequired
warning.
Documentation:
Add a design document for system accounts and regenerate API docs
for sysaccount commands and role membership.
Tests:
Update existing role and service plugin tests to cover sysaccount
membership.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Add new attribute, SysAcctManagersDNs, to store list of DNs allowed to
reset user passwords without forcing the users to change them
afterwards.
This list will differ from the use of PassSyncManagersDNs by the fact
that password policy checks will still apply to those password changes.
Fixes: https://pagure.io/freeipa/issue/9842
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
- Test scenarios :
- AD users running commands as root via external groups
- AD users switching to other AD user accounts
- IPA users running commands as AD users
- Sudo rule disable/enable functionality
- Command allow/deny restrictions
- Access denial for users not in sudo rules
- Automated with Cursor+Claude
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
Instead of modifying /etc/krb5.conf with all IPA realm configuration, follow
the practice of creating a separate config snippet file owned by IPA.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Instead of using chromium from the distribution, use the
browser provided with Pupeteer and disbale the sandbox
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The command launching autogen.sh ends with \ and on fedora 43
this causes a build failure
checking build system type... Invalid configuration '\': machine '\-unknown' not recognized
configure: error: /bin/sh ./config.sub \ failed
Remove the trailing \
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Fedora 43 is now available, switch azure CI to this version.
Fixes: IDM-3231
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The Modrdn plugin doesn't check whether the operation it processes is replicated.
This results in duplicate operations on each replica, for example, when deleting a saved user.
To fix this behavior, a check was added to the Modrdn plugin that the operation is not replicated.
Fixes: https://pagure.io/freeipa/issue/9867
Signed-off-by: vectinx <vectinx@yandex.ru>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Collation should be the same for API files or we will end up with
differences between development environments.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
There seem to be a difference between API notes in different files: some
contain CRLF, some LF only, and also some empty lines are present while
they should not be there.
Normalize the remaining API docs.
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: David Hanina <dhanina@redhat.com>
In order to generate the private key for a a LWCA (subca)
on an HSM the name of the subca needs to be the HSM token
name : name_of_subca, e.g. ipa_token:test.
This works fine now without any code changes but it requires
that admins always remember to include the prefix which is
unlikely (everyone makes mistakes). So do it for them if
an HSM is present and a token is not provided. We only support
one token at a time in IPA so for now this is sufficient.
One can also mix-and-match including the token and not.
For example you can run:
$ ipa ca-add test --subject cn=test
$ ipa ca-show ipa_token:test
It shouldn't be an issue if a lwca name contains a colon.
Fixes: https://pagure.io/freeipa/issue/9865
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
The test moves the date in the future, performs checks and in the
teardown method uninstalls and moves the date back to the current time.
It often fails in the teardown part because certmonger is in the process
of renewing the expired certificates.
Apply the same strategy as other tests fiddling with the date:
stop certmonger and remove the tracking requests before uninstallation.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The error message returned by ipa ca-show has changed with PKI 11.7.
Adapt the test to succeed with old and new versions.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Fedora 42 now ships PKI 11.7.0-5 and certmonger 0.79.21-1.
Update the vagrant image to 0.0.9 in order to pull the new versions.
Related: IDM-3437
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Emilio Herrera
Carla Martinez
Aleksandr Sharov
Alexander Bokovoy
Florence Blanc-Renaud
PRANAV THUBE
Arif Budiman
Andi Chandler
Christian Rohr
Pejman Rezaei
Fco. Javier F. Serrador
Weblate Translation Memory
Temuri Doghonadze
Piotr Drąg
Weblate
Rafael Fontenelle
hsu zangmen
Anuja More
vectinx
Rob Crittenden