FreeIPA 4.13.2 ============== .. raw:: mediawiki {{ReleaseDate|2026-07-15}} The FreeIPA team would like to announce FreeIPA 4.13.2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. .. _highlights_in_4.13.2: Highlights in 4.13.2 -------------------- * https://codeberg.org/freeipa/freeipa/issues/10009 When using passwordless authentication methods (PKINIT, passkey, IDP, RADIUS), the KDC was rejecting pre-auth requests if the user's password was expired, even though these methods don't use passwords. The fix ensures that: Passwordless methods are never blocked by an expired password. Password expiration is still enforced when a password-based method (password, OTP, hardened) is actually used, even if passwordless methods are also configured. * https://pagure.io/freeipa/issue/9989 Fix RHEL 8.10 to RHEL 9.8 migration in FIPS mode * WebUI hardening: httpd configuration has been updated with various configuration options that improve security. -------------- .. _known_issues: Known Issues ~~~~~~~~~~~~ * https://codeberg.org/freeipa/freeipa/issues/9920 Failure to sign DNS zone with softhsm 2.7.0 rc1 .. _bug_fixes: Bug fixes ~~~~~~~~~ FreeIPA 4.13.2 is a stabilization release for the features delivered as a part of 4.13 version series. There are more than 60 bug-fixes since FreeIPA 4.13.1 release. Details of the bug-fixes can be seen in the list of resolved tickets below. Upgrading --------- Upgrade instructions are available on `Upgrade `__ page. Feedback -------- Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat. .. _resolved_tickets: Resolved tickets ---------------- - `#8092 `__ Nightly test failure in test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view - `#9529 `__ Nightly test failure (rawhide) in test_webui/test_hostgroup.py::test_hostgroup::test_names_and_button - `#9572 `__ RPM should use sysusers to create accounts - `#9749 `__ add "SameSite" flag to ipa_session cookies - `#9786 `__ Rawhide: test failure in test_integration/test_installation.py::TestInstallWithoutNamed - `#9820 `__ ipalockout_postop is incorrectly warning about locked users - `#9828 `__ ipa-migrate tool is renaming host records & host info in automount information - `#9829 `__ Nightly test failure (rawhide): multiple webui tests failures with firefox 141 - `#9832 `__ IPA compatibility with tomcat 10 - `#9837 `__ Default parameter removes certificates found via cert_find._cert_search - `#9845 `__ ipatests: Port downstream ipa-trust-functional test suite. - `#9897 `__ Server version information disclosure - `#9898 `__ Header X-Content-Type-Options is not set - `#9900 `__ Refine multiple CSP directives - `#9901 `__ CSP: failure to define form-action directive which has no fallback - `#9904 `__ Test failure in test_edns.py::TestDNSOverTLS_EnforcedPolicy_IPA_CA::test_dot_enforced_dns_policy_with_ipa_ca - `#9906 `__ ipa-otpd crash on passkey auth - `#9911 `__ ipatests: Port downstream bash-dns test suite. - `#9916 `__ Azure WebUI tests failing - `#9917 `__ ipatests: Port downstream bash ipa-trust-func-\*test suite. - `#9919 `__ ipa cert-find --certificate= throws - `#9921 `__ ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - `#9922 `__ ipatests: add OTP-based replica promotion coverage - `#9923 `__ ipa-advise client script requires keytab (should just require root access on client system) - `#9924 `__ Names of domains from a trusted forest should be compared case-insensitive - `#9925 `__ Remove deprecated license classifiers. - `#9929 `__ IdM password policy Min lifetime is not enforced when high minlife is set - `#9930 `__ ipatests: Port downstream bash-ipa-join test suite. - `#9931 `__ Add ipa-delegation-cli bash test to upstream xmlrpc test. - `#9935 `__ When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - `#9936 `__ Code analysis issue in ipa-4.9 - `#9938 `__ ipa-migrate doesn't process users' sshpublickeys - `#9939 `__ FreeIPA fails to build on rawhide because of missing npm command - `#9941 `__ PRCI fails on AzurePipeline.freeipa (Docs) due to module absense - `#9942 `__ Replica installation: failure in replica conncheck - `#9943 `__ Pruning is enabled by default with RSN - `#9944 `__ Test failure in test_integration/test_dns.py::TestDNSMisc::test_allow_query_transfer_ipv6 - `#9945 `__ ipatests: Port bash ipa-self-service testsuite. - `#9946 `__ Regression in test_integration/test_pwpolicy.py::TestPWquality::test_graceperiod_not_replicated - `#9947 `__ webui tests: regression in test_webui/test_pwpolicy.py::test_pwpolicy::test_negative_value - `#9948 `__ Extend SELinux policy to allow use of SSSD authentication helpers on non-enrolled hosts - `#9949 `__ freeipa-client %triggerin and %post can fail (rpm scriptlets should never fail, by policy) - `#9950 `__ [ipatests] support for pytest 9 - `#9952 `__ ipatests: Port downstream bash-netgroup-cli test suite. - `#9953 `__ Adding a group with 32Bit Idrange fails. - `#9954 `__ ipa-migrate doesn't properly handle replication conflicts - `#9955 `__ ipa-migrate doesn't migrate IPA locations - `#9957 `__ ipatests: Add downstream bash ipa-getkeytab/ipa-rmkeytab CLI test suite - `#9958 `__ ipa-migrate doesn't migrate custom kerberos password policies - `#9959 `__ ipatests: Port downstream bash-ipa-i18n test suite. - `#9962 `__ race condition with wrong error code during deployment - `#9964 `__ ipatests: Additional tests for ipa-ipa migration scenarios - `#9965 `__ ipatests: Include testscenario for ipa-migrate-ds - `#9968 `__ ipatests: Port downstream bash-ipa-getcert test suite to upstream - `#9970 `__ Nightly test failure (f45+) in test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client - `#9972 `__ Nightly failure in test_replica_promotion.py::TestReplicaPromotionRandomPassword::test_replica_two_step_install - `#9974 `__ ipa ca-show ipa --all failing to list RSN version - `#9979 `__ Schema Compatibility plugin disabling failed while ipa-server-upgrade command - `#9980 `__ Test failure in test_trust_functional.py::TestTrustFunctionalUser::test_su_ad_user (f45+) - `#9981 `__ Test failure for test_ad_user_in_posix_group_fully_qualified - `#9982 `__ Disable TRACE method - `#9983 `__ Nightly test failure (f45+) because of CryptographyDeprecationWarning - `#9989 `__ ipa-replica-install fails in mixed RHEL 8.10 to RHEL 9.8 FIPS environment - `#9992 `__ Move testing to fedora 44 - `#9995 `__ ipatests: testReplicaInForwardZone fails on RHEL teardown: NetworkManager rewrites /etc/resolv.conf after ipa-replica-install --setup-dns - `#10007 `__ Selection of authentication indicators on the host/computer object disappears in GUI after a few minutes - `#10008 `__ Nightly test failure in test_webui/test_translation.py::TestUnauthorizedPage::test_long_text_of_unauthorized_page - `#10009 `__ Passwordless pre-authentication is blocked when user has an expired password - `#10010 `__ ipatests: test_EPN_starttls and test_EPN_ssl fail in FIPS mode due to Postfix MD5 TLS fingerprint digest - `#10011 `__ Fix inverted SSSD xfail in SELinux trust integration tests .. _detailed_changelog_since_4.13.1: Detailed changelog since 4.13.1 ------------------------------- .. _am_rico_monteiro_1: Américo Monteiro (1) ~~~~~~~~~~~~~~~~~~~~~ - Translated using Weblate (Portuguese) `commit `__ .. _alexander_bokovoy_6: Alexander Bokovoy (6) ~~~~~~~~~~~~~~~~~~~~~ - ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized `commit `__ `#9962 `__ - SELinux: expand policy coverage for sssd_mfa_t domain `commit `__ - SELinux: wrap bare gen_require blocks in optional_policy in dnskey section `commit `__ `#9948 `__ - SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers `commit `__ - ipa-sam: use internal Samba method to populate in-memory keytab `commit `__ - SELinux: expand policy coverage for Kerberos usage `commit `__ `#9948 `__ .. _anuja_more_6: Anuja More (6) ~~~~~~~~~~~~~~ - ipatests: add Azure Entra IdP integration tests `commit `__ `#8803 `__ - ipatests: xfail trust sudo/HBAC tests when SSSD is below 2.12 `commit `__ - ipatests: add SSH/GSSAPI AD trust integration tests. `commit `__ `#9845 `__ - ipatests: increase timeout for PR-CI. `commit `__ - ipatests: add HTTP GSSAPI Kerberos authentication tests with AD trust `commit `__ `#9845 `__ - ipatests: add Random Password based replica promotion coverage `commit `__ `#9922 `__ .. _antonio_torres_1: Antonio Torres (1) ~~~~~~~~~~~~~~~~~~ - Back to git snapshots `commit `__ .. _aleksandr_sharov_4: Aleksandr Sharov (4) ~~~~~~~~~~~~~~~~~~~~ - ipa-migrate: migrate custom kerberos password policies `commit `__ `#9958 `__ - ipa-migrate: ignore replication conflicts `commit `__ `#9954 `__ - ipa-migrate: migrate DNS locations `commit `__ `#9955 `__ - ipa-migrate: migrate ssh public keys for users and overrides `commit `__ `#9938 `__ .. _david_hanina_19: David Hanina (19) ~~~~~~~~~~~~~~~~~ - ipatests: Fix webui hostgroup `commit `__ `#9529 `__ - ipatests: unauthorized page through httpd `commit `__ `#10008 `__ - Add referrer-policy `commit `__ - Disable Trace method `commit `__ `#9982 `__ - Fix unauthorized error page `commit `__ - Fix naive Referer check bypass in rpcserver `commit `__ - Enforce Same-Site cookie `commit `__ `#9749 `__ - ipatests: Change the xfail version to sssd 2.12.0 `commit `__ `#9981 `__ - Disallow retrieving software versions `commit `__ `#9897 `__ - Fix flaky notification assert for webui `commit `__ `#8092 `__ - Fix ipa ca-show ipa --all not listing RSN version `commit `__ `#9974 `__ - Allow 32bit gid `commit `__ `#9953 `__ - Return code 0 for all failing scriplets `commit `__ `#9949 `__ - Wait until buttons are clickable `commit `__ `#9829 `__ - Replace None with '' when uninstalling CA `commit `__ `#9921 `__ - Fix cert-find retrieval `commit `__ `#9837 `__ - Remove navigation tests `commit `__ - Fix QUnit import `commit `__ `#9916 `__ - Return nothing if certificate is empty `commit `__ `#9919 `__ .. _erik_belko_2: Erik Belko (2) ~~~~~~~~~~~~~~ - ipatests: Add AD trust NFS automount integration tests `commit `__ - ipatests: Add ipa-getcert request tests for NSS storage `commit `__ `#9968 `__ .. _florence_blanc_renaud_33: Florence Blanc-Renaud (33) ~~~~~~~~~~~~~~~~~~~~~~~~~~ - freeipa.spec: bump samba version `commit `__ - prci definitions: increase test_sudo timeout `commit `__ - ipatests: split test_commands into 2 jobs `commit `__ - ipatests: xfail TestInstallDNSSECFirst `commit `__ - CI: switch testing from fedora 43 to fedora 44 `commit `__ `#9992 `__ - Spec file: move named-related files to server-dns package `commit `__ `#9786 `__ - ipatests: use either cafile or capath for ssl connection `commit `__ - ipatests: adapt to psutil `commit `__ - Azure CI: Use Fedora 44 `commit `__ `#9992 `__ - replica conncheck: use crypto-policies in temp krb5.conf `commit `__ `#9989 `__ - prci definitions: extend test_commands timeout to 6000s `commit `__ - constants: Use 24-byte key to check id TripleDES is supported `commit `__ `#9983 `__ - ipatests: adapt the expected output message `commit `__ `#9980 `__ - ipatests: fix the method add_a_record `commit `__ `#9972 `__ - ipatests: adapt expected output for test_smb `commit `__ `#9970 `__ - CI definitions: split ipa_ipa_migrate into 2 jobs `commit `__ - ipatests: fix migration test `commit `__ `#9964 `__ - Read The Docs: use ubuntu-24.04 instead of ubuntu-20.04 `commit `__ - ipatests: Add selfservice-find cli tests to xmlrpc Add a new Declarative test class test_selfservice_cli_find covering CLI-level behaviour of the selfservice-find command: `commit `__ `#9945 `__ - ipatests: fix the topology for test_32bit_idranges `commit `__ - ipa-migrate: normalize objectClass before building the list `commit `__ `#9954 `__ - Azure CI: remove test_sudo::TestSudo_Functional `commit `__ - azure CI: fix broken package installation `commit `__ - webui tests: update expected max value for krbminpwdlife `commit `__ `#9947 `__ - ipatests: fix install method for BasePWpolicy `commit `__ `#9946 `__ - Spec file: create the systemd-sysusers before oddjob and dbus restart `commit `__ `#9942 `__ - Spec file: build requires /usr/bin/node, /usr/bin/npm `commit `__ `#9939 `__ - ipatests: pruning is enabled when RSN is enabled `commit `__ `#9943 `__ - Doc: remove the constraint on docutils version `commit `__ `#9941 `__ - ipa-join: initialize pointer `commit `__ `#9936 `__ - fetch_domains: Use case-insensitive comparison for domains names `commit `__ `#9924 `__ - ipa-advise: smart card client script does not need krb ticket `commit `__ `#9923 `__ - ipatests: Fix xfail assertion for sssd 2.12.0 `commit `__ .. _olesya_gerasimenko_1: Olesya Gerasimenko (1) ~~~~~~~~~~~~~~~~~~~~~~ - Translated using Weblate (Russian) `commit `__ .. _jay_gondaliya_5: Jay Gondaliya (5) ~~~~~~~~~~~~~~~~~ - ipatests: Ensure kdcproxy logs a timeout warning when AD KDC is unreachable `commit `__ - ipatests: Add ipa selfservice-show and selfservice-mod CLI tests to xmlrpc `commit `__ `#9945 `__ - ipatests: Add user-principal ipa-getkeytab and ipa-rmkeytab cmdline tests `commit `__ `#9957 `__ - ipatests: Add selfservice-add and selfservice-del cli tests `commit `__ `#9945 `__ - ipatests: Add ipa-selfservice users tests to xmlrpc `commit `__ `#9945 `__ - ipatests: Add ipa-selfservice BZ tests to xmlrpc `commit `__ `#9945 `__ .. _julien_rische_6: Julien Rische (6) ~~~~~~~~~~~~~~~~~ - ipatests: test password expiration with passwordless authentication `commit `__ `#10009 `__ - kdb: skip password expiration for passwordless authentication `commit `__ `#10009 `__ - kdb: do not encode string attr null terminator in LDAP `commit `__ `#10007 `__ - kdb: prevent read overrun while loading tl_data `commit `__ - ipa-kdb: warn when tickets are issued without PAC `commit `__ `#9962 `__ - ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized `commit `__ `#9962 `__ .. _mark_reynolds_1: Mark Reynolds (1) ~~~~~~~~~~~~~~~~~ - ipa-migrate - do not convert hostnames/realm for computers and automounts `commit `__ `#9828 `__ .. _andrew_novak_1: Andrew Novak (1) ~~~~~~~~~~~~~~~~ - upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off `commit `__ `#9979 `__ .. _pranav_thube_19: PRANAV THUBE (19) ~~~~~~~~~~~~~~~~~ - ipatests: Add AD trust SELinux user map tests (part 3) `commit `__ `#9845 `__ - Fix inverted SSSD 2.12.0 xfail in SELinux trust tests `commit `__ `#10011 `__ - ipatests: Fix EPN Postfix TLS setup for FIPS mode `commit `__ `#10010 `__ - Document SELinux usermap verify expectations. `commit `__ - ipatests: Add AD trust SELinux user map tests (part 2) `commit `__ `#9845 `__ - PRCI definations updated for trust_selinux_usermap. `commit `__ - ipatests: Add AD trust SELinux user map tests (part 1) `commit `__ `#9845 `__ - ipatests: fix replica forward-zone test teardown resolv.conf restore `commit `__ `#9995 `__ - ipatests: fix dnszone_add SOA MNAME expectation for numeric TLD `commit `__ `#9911 `__ - ipatests: Add trust functional User testcases. `commit `__ `#9917 `__ - ipatests: Extend netgroup test coverage. `commit `__ `#9952 `__ - ipatests: Add XML-RPC tests for i18n user attributes `commit `__ `#9959 `__ - ipatests: Fix test_allow_query_transfer_ipv6 when IPv6 is disabled `commit `__ `#9944 `__ - ipatests: Add DNS integration tests. `commit `__ `#9911 `__ - ipatests: Add DNS bugzilla integration tests. `commit `__ `#9911 `__ - ipatests: Add integration tests for ipa-join command `commit `__ `#9930 `__ - ipatests: Fix resolver state tracking in enforced DNS policy tests. `commit `__ `#9904 `__ - ipatests: Add DNS functional integration tests. `commit `__ `#9911 `__ - ipatests: Move expire_password fixture into TestIPACommand class `commit `__ .. _rob_crittenden_4: Rob Crittenden (4) ~~~~~~~~~~~~~~~~~~ - Skip the lockout alert on no failure count or not max fail `commit `__ `#9820 `__ - Add path to identify the tomcat version for Tomcat 10 `commit `__ `#9832 `__ - Avoid int overflow with pwpolicy minlife `commit `__ `#9929 `__ - Handle IPACertificate types in xmlrpc `commit `__ `#9935 `__ .. _rafael_guterres_jeffman_2: Rafael Guterres Jeffman (2) ~~~~~~~~~~~~~~~~~~~~~~~~~~~ - freeipa.spec.in: Use systemd-sysusers to setup users and groups `commit `__ `#9572 `__ - Remove deprecated license classifier from ipasetup.py.in `commit `__ `#9925 `__ .. _sumit_bose_1: Sumit Bose (1) ~~~~~~~~~~~~~~ - ipa-otpd: do not pass reference of data_out->jdata `commit `__ `#9906 `__ .. _stanislav_levin_1: Stanislav Levin (1) ~~~~~~~~~~~~~~~~~~~ - ipatest: make tests compatible with Pytest 9 `commit `__ `#9950 `__ .. _sudhir_menon_11: Sudhir Menon (11) ~~~~~~~~~~~~~~~~~ - ipatests: add negative and option-validation tests for migrate-ds `commit `__ `#9965 `__ - ipatests: add migrate-ds integration tests for bugs. `commit `__ `#9965 `__ - ipatests: Add hashed password migration scenario to ds-migrate testsuite `commit `__ `#9965 `__ - ipatests: ipa mixed mode and ipa plugins migration. `commit `__ `#9964 `__ - ipatests: Bugzillas for ipa-migrate ds testsuite `commit `__ - ipatests: Add nigthly definitions for ds-migrate `commit `__ - ipatests: ipa-migrate-ds test scenarios `commit `__ - ipatests: Updated nightly definitions for ipa-ipa-migration testsuite `commit `__ - ipatests: Additional tests for ipa-ipa migration testsuite `commit `__ `#9964 `__ - ipatests: Additional tests for 32BitIdranges `commit `__ - ipatests: Add xmlrpc tests for ipa-delegation-cli `commit `__ `#9931 `__ .. _veronika_miticka_2: Veronika Miticka (2) ~~~~~~~~~~~~~~~~~~~~ - Add CSP headers to webui `commit `__ `#9900 `__ `#9901 `__ - Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files `commit `__ `#9898 `__ .. _yuri_chornoivan_1: Yuri Chornoivan (1) ~~~~~~~~~~~~~~~~~~~ - Translated using Weblate (Ukrainian) `commit `__