Ctrl+K

IPAv2_210

IPAv2_210#

__NOTOC__ August 17, 2011

The FreeIPA project team is pleased to announce the availability of the freeIPA 2.1.0 server.

It is available in Fedora 15.

Known Issues#

  • The OCSP URL encoded in dogtag certificates is by default the CA machine that issued the certificate.

Changelog since 2.0.1#

Adam Young (62):

  • Fixed labels for sudo and hbac rules

  • update metadata with label changes

  • define entities using builder and more declarative syntax

  • default all false no longer default to all: true for searches, only specify it for user searches

  • code review fixes

  • make use of new user-find columns.

  • fix JSL error

  • Upgrade to jquery 1.5.2

  • action panel to top tabs

  • remove jquery-cookie library

  • update ipa init a simple script to update the metatdate et alles that comes from the ipa_init batch call

  • whitespace and -x removal

  • create entities on demand. fixed changes from code review

  • automount UI

  • redirect on show error.

  • redirect on error Code for redirecting on error has been moved to IPA.facet so it can be called from both details and assocaiton facets.

  • automount delete key indirect automount maps

  • scrollable content areas

  • dialog scrolling table

  • JSON marshalling list

  • dns multiple records show multiple records that share the same dnsname

  • no redirect on search

  • test for dirty

  • test dirty textarea runs the testdirty check before setting the undo tag for a textarea

  • test dirty multivalue test the multivalue widgets for changes before showing the undo link.

  • test dirty onchange

  • entity select widget for manager

  • hide automount tabs.

  • service host entity select Use the entity select widget for add service

  • entity select undo

  • no redirect on unknown error If the error name is indicates a server wide error, do not attempt to redirect.

  • editable entity_select

  • ipaddress for host add

  • entity select for password policy

  • tooltips for host add

  • automountkey details

  • identify target as section for permissions

  • optional uid

  • validate required fields

  • Generate record type list from metadata

  • shorten url cache state in a javascript variable, and leave on information about the current entity in the URL hash params

  • containing entity pkeys

  • undefined pkeys

  • config fields

  • ipadefaultemaildomain

  • config widgets entity select default group checkbox for migration

  • entity link for password policy

  • validate ints

  • password expiration label

  • HBAC deny warning

  • check required on add

  • clear errors on reset

  • indirect admins

  • entity_select naming

  • remove HBAC warning from static UI

  • dnsrecord-mod ui

  • no dns

  • remove hardcoded DNS label for record name.

  • move dns to identity tab

  • removing setters setup and init

  • dns section header i18n.

  • use other_entity for adder columns

Alexander Bokovoy (10):

  • Convert Bool to TRUE/FALSE when working with LDAP backend

  • Minor typos in the examples

  • Convert nsaccountlock to always work as bool towards Python code

  • Rearrange logging for NSCD daemon.

  • Fix sssd.conf to always have IPA certificate for the domain.

  • Add hbactest command.

  • Modify /etc/sysconfig/network on a client when IPA manages hostname

  • Make proper LDAP configuration reporting for ipa-client-install

  • Ensure network configuration file has proper permissions

  • Pass empty options as empty arrays for supported dns record types.

Endi S. Dewata (114):

  • Fixed undefined label in permission adder dialog box.

  • Initial Selenium test cases.

  • Added functional test runner.

  • Refactored action panel and client area.

  • Refactored builder interface.

  • Refactored search facet.

  • Entitlements.

  • Updated Selenium tests.

  • Merged IPA.cmd() into IPA.command().

  • Entitlement registration.

  • Entitlement import.

  • Entitlement download.

  • Moved adder dialog box into entity.

  • Standardized action panel buttons creation.

  • Entitlement quantity validation.

  • Refactored navigation.

  • Use entity names for tab state.

  • Moved entity contents outside navigation.

  • Added facet container.

  • Fixed self-service UI.

  • Updated Selenium tests.

  • Updated Selenium tests.

  • Updated DNS interface.

  • Added Selenium tests for DNS.

  • Added UUID field for entitlement registration.

  • Added Self-Service and Delegation tests.

  • Customizable facet groups.

  • Read-only association facet.

  • jQuery ordered map.

  • Fixed problem disabling HBAC and SUDO rules.

  • Fixed Ajax error handling.

  • Fixed details tests.

  • Fixed adder dialog title.

  • Fixed Add and Edit without primary key.

  • Fixed Selenium tests.

  • Fixed URL parameter parsing.

  • Added Update and Reset buttons into Dirty dialog.

  • Fixed problem deleting value in text field.

  • Added pagination for associations.

  • Fixed pagination problem.

  • Temporary fix for indirect member tabs.

  • Fixed blank dialog box on internal error.

  • Fixed resizing issues.

  • Added selectable option for table widget.

  • Entitlement status.

  • Fixed tab navigation.

  • Fixed build break.

  • Fixed paging for indirect members.

  • Renamed associate.js to association.js.

  • Fixed self-service links.

  • Merged direct and indirect association facets

  • Storing page number in URL.

  • Removed FreeWay font files.

  • Fixed problem with navigation tabs on reload.

  • Converted entity header into facet header.

  • Added navigation breadcrumb.

  • Added record count into association facet tabs.

  • Added singular entity labels.

  • Fixed entity labels.

  • Fixed DNS records page title.

  • Fixed undo all problem.

  • Removed unused images.

  • Fixed hard-coded messages.

  • Added confirmation dialog for user activation.

  • Fixed button style in Entitlements

  • Removed invalid associations.

  • Added arrow icons for details sections.

  • Fixed object_name usage.

  • Fixed HBAC/Sudo rules associations.

  • Fixed blank self-service page.

  • Fixed dirty dialog problems in HBAC/Sudo rules.

  • Fixed test fixture file name.

  • Fixed missing entitlement import button label

  • Added sudo options.

  • Fixed collapsed table in Chrome.

  • Fixed object_name and object_name_plural internationalization

  • Fixed label capitalization

  • Entity select widget improvements

  • Removed reverse zones from host adder dialog.

  • Fixed host details fields.

  • Added checkbox to remove hosts from DNS.

  • Creating reverse zones from IP address.

  • Removed entitlement registration UUID field.

  • Fixed problem loading data in HBAC/sudo details page.

  • Removed HBAC access time code.

  • Removed custom layouts using HTML templates.

  • Refactored IPA.current_facet().

  • Fixed problem with navigation state loading.

  • Fixed navigation problems.

  • Fixed navigation unit test.

  • Fixed click handlers on certificate buttons.

  • New icons for entitlement buttons

  • Fixed problem bookmarking Policy/IPA Server tabs

  • Fixed problem setting host OTP.

  • Fixed hard-coded labels in sudo rules.

  • Fixed hard-coded label in Find button.

  • Fixed missing section header in sudo command group.

  • Fixed problem unprovisioning service.

  • Fixed missing memberof definition in HBAC service.

  • Added association facets for HBAC and sudo.

  • Fixed certificate buttons.

  • Fixed missing icons.

  • Fixed misaligned search icon.

  • Resizable adder dialog box.

  • Linked entries in HBAC/sudo details page.

  • Fixed 3rd level tab style.

  • Fixed facet group labels.

  • Fixed error after login on IE

  • Fixed host adder dialog.

  • Fixed DNS zone adder dialog.

  • Fixed broken links in ipa_error.css and ipa_migration.css.

  • Fixed problem clicking 3rd level tabs.

  • Fixed link style in dialog box.

  • Fixed problem with buttons in enrollment dialog.

Jakub Hrozek (1):

  • Remove wrong kpasswd sysconfig

Jan Cholasta (34):

  • Fix wording of error message.

  • Add note about ipa-dns-install to ipa-server-install man page.

  • Fix typo in ipa-server-install.

  • Fix uninitialized variables.

  • Fix double definition of output_for_cli.

  • Add lint script for static code analysis.

  • Fix lint false positives.

  • Remove unused classes.

  • Fix some minor issues uncovered by pylint.

  • Fix uninitialized attributes.

  • Run lint during each build.

  • Several improvements of the lint script.

  • Fix issues found by Coverity.

  • Fix regressions introduced by pylint false positive fixes.

  • Assume ipa help for plugins.

  • Parse netmasks in IP addresses passed to server install.

  • Honor netmask in DNS reverse zone setup.

  • Do stricter checking of IP addressed passed to server install.

  • Fix directory manager password validation in ipa-nis-manage.

  • Improve IP address handling in the host-add command.

  • Verify that the hostname is fully-qualified before accessing the service information in ipactl.

  • Remove redundant configuration values from krb5.conf.

  • Replace the ‘private’ option in netgroup-find with ‘managed’.

  • Configure SSSD to store user password if offline.

  • Fix creation of reverse DNS zones.

  • Add ability to specify DNS reverse zone name by IP network address.

  • Fix exit status of ipa-nis-manage enable.

  • Update minimum required version of python-netaddr.

  • Clean up of IP address checks in install scripts.

  • Don’t delete NIS netgroup compat suffix on ‘ipa-nis-manage disable’.

  • Fix ipa-compat-manage not working after recent ipa-nis-manage change.

  • Make sure that hostname specified by user is not an IP address.

  • Fix external CA install.

  • Ask for reverse DNS zone information in attended install right after asking for DNS forwarders, so that DNS configuration is done in one place.

John Dennis (9):

  • Module for DN objects plus unit test

  • assert_deepequal supports callback for equality testing

  • Add backslash escape support for cvs reader

  • Use DN class in get_primary_key_from_dn to return decoded value

  • Update test_role_plugin test to include a comma in a privilege

  • Ticket 1485 - DN pairwise grouping

  • Make AVA, RDN & DN comparison case insensitive. No need for lowercase normalization.

  • Clean up existing DN object usage

  • transifex translation adjustment

Jr Aquino (15):

  • Escape LDAP characters in member and memberof searches

  • Add memberHost and memberUser to default indexes

  • Optimize and dynamically verify group membership

  • Delete the sudoers entry when disabling Schema Compat

  • Return copy of config from ipa_get_config()

  • Typo in host_nis_groups has been creating 2 CN’s

  • Add sudorule and hbacrule to memberof and indirectmemberof attributes

  • Display remaining external hosts when removing from sudorule

  • Raise DuplicateEntry Error when adding a duplicate sudo option

  • Don’t add empty tuple to entry_attrs[‘externalhost’]

  • oneliner correct typo in ipasudorunas_group

  • Return correct “RunAs External Group” when removing members

  • remove escapes from the cvs parser in ipaserver/install/ldapupdate

  • Correct behavior for sudorunasgroup vs sudorunasuser

  • Correct sudo runasuser and runasgroup attributes in schema

Martin Kosek (68):

  • Inconsistent error message for duplicate user

  • Replica installation fails for self-signed server

  • Remove doc from API.txt

  • Revert “Remove doc from API.txt”

  • Password policy commands do not include cospriority

  • Improve DNS PTR record validation

  • Remove unwanted trimming in text fields

  • Need force option in DNS zone adder dialog

  • IPA replica is not started after the reboot

  • Improve Directory Service open port checker

  • Log temporary files in ipa-client-install

  • Prevent uninstalling client on the IPA server

  • pwpolicy-mod doesn’t accept old attribute values

  • Forbid reinstallation in ipa-client-install

  • ipa-client-install uninstall does not work on IPA server

  • LDAP Updater may crash IPA installer

  • NS records not updated by replica

  • Bad return values for ipa-rmkeytab command

  • Update spec with missing BuildRequires for pylint check

  • Let selinux-policy handle port 7390

  • Limit passwd plugin to user container

  • Consolidate man pages and IPA tools help

  • Remove doc from API.txt

  • Improve service manipulation in client install

  • Running ipa-replica-manage as non-root cause errors

  • KDC autodiscovery may fail when domain is not realm

  • A new flag to disable creation of UPG

  • Fix reverse zone creation in ipa-replica-prepare

  • Improve interactive mode for DNS plugin

  • Localization fails for MaxArgumentError

  • Fix forward zone creation in ipa-replica-prepare

  • Connection check program for replica installation

  • Fix support for nss-pam-ldapd

  • Skip know_host check for ipa-replica-conncheck

  • IPA installation with –no-host-dns fails

  • Handle LDAP search references

  • Add ignore lists to migrate-ds command

  • Improve DNS zone creation

  • Add a list of managed hosts

  • Missing krbprincipalname when uid is not set

  • Add port 9443 to replica port checking

  • Fix doc for sudorule runasuser commands

  • Improve IP address handling in IPA option parser

  • Multi-process build problems

  • DNS installation fails when domain and host domain mismatch

  • Fix IPA install for secure umask

  • Allow recursion by default

  • Add DNS record modification command

  • Filter reverse zones in dnszone-find

  • Remove sensitive information from logs

  • Fix ipa-dns-install

  • Fix self-signed replica installation

  • Check IPA configuration in install tools

  • Add new dnszone-find test

  • Fix typo in ipa-replica-prepare

  • Improve long integer type validation

  • Fix sudorule-remove-user

  • Add missing automount summaries

  • Fix man page ipa-csreplica-manage

  • Fix automountkey commands summary

  • Fix invalid issuer in unit tests

  • Hide continue option from automountkey-del

  • Improve error message in ipactl

  • Improve dnszone-add error message

  • Fix idnsUpdatePolicy for reverse zone record

  • Fix client enrollment

  • Update 389-ds-base version

  • Update pki-ca version

Nalin Dahyabhai (1):

  • Select a server with a CA on it when submitting signing requests.

Pavel Zuna (1):

  • Fix gidnumber option of user-add command.

Petr Vobornik (3):

  • fixed empty dns record update

  • Fixed adding host without DNS reverse zone

  • Redirection after changing browser configuration

Rich Megginson (3):

  • winsync enables disabled users in AD

  • modify user deleted in AD crashes winsync

  • memory leak in ipa_winsync_get_new_ds_user_dn_cb

Rob Crittenden (90):

  • Allow a client to enroll using principal when the host has a OTP

  • Make retrieval of the CA during DNS discovery non-fatal.

  • Cache the value of get_ipa_config() in the request context.

  • Change default gecos from uid to first and last name.

  • Fix ORDERING in some attributetypes and remove other unnecessary elements.

  • postalCode should be a string not an integer.

  • Fix traceback in ipa-nis-manage.

  • Suppress –on-master from ipa-client-install command-line and man page.

  • Sort entries returned by *-find by the primary key (if any).

  • The default groups we create should have ipaUniqueId set

  • Always ask members in LDAP*ReverseMember commands.

  • Provide attributelevelrights for the aci components in permission_show.

  • Wait for memberof task and DS to start before proceeding in installation.

  • Convert manager from userid to dn for storage and back for displaying.

  • Modify the default attributes shown in user-find to match the UI design.

  • Ensure that the zonemgr passed to the installer conforms to IA5String.

  • Handle principal not found errors when converting replication a greements

  • Bump version to 2.0.90 to distinguish between 2.0.x

  • Properly handle –no-reverse being passed on the CLI in interactive mode

  • Update min nvr for selinux-policy and pki-ca for F-15+

  • Test for forwarded Kerberos credentials cache in wsgi code.

  • Properly configure nsswitch.conf when using the –no-sssd option.

  • Enable 389-ds SSL host checking by defauilt

  • Configure Managed Entries on replicas.

  • Document that deleting and re-adding a replica requires a dirsrv restart.

  • Fix migration to work between v2 servers and remove search/size limits.

  • Add option to limit the attributes allowed in an entry.

  • Include the word ‘member’ with autogenerated optional member labels.

  • Do a lazy retrieval of the LDAP schema rather than at module load.

  • Add UID, GID and e-mail to the user default attributes.

  • Fix external CA installation

  • Remove root autobind search restriction, fix upgrade logging & error handling

  • Support initializing memberof during replication re-init using GSSAPI

  • Do better detection on status of CA DS instance when installing.

  • Fix indirect member calculation

  • Remove automountinformation as part of the DN for automount.

  • Don’t let a JSON error get lost in cascading errors.

  • Add message output summary to sudorule del, mod and find.

  • Return an error message when revocation reason 7 is used

  • Require an imported certificate’s issuer to match our issuer.

  • On a master configure sssd to only talk to the local master.

  • The IP address provided to ipa-server-install must be local

  • Do lazy LDAP schema retrieval in json handler.

  • Make data type of certificates more obvious/predictable internally.

  • Update translation files

  • Let the framework be able to override the hostname.

  • Make dogtag an optional (and default un-) installed component in a replica.

  • Slight performance improvement by not doing some checking in production mode

  • Set the client auth callback after creating the SSL connection.

  • Add pwd expiration notif (ipapwdexpadvnotify) to config plugin def attr list

  • Enforce class rules when query=True, continue to not run validators.

  • find_entry_by_attr() should fail if multiple entries are found

  • Fix error in AttrValueNotFound exception example

  • Fix test failure in updater when adding values to a single-value attr

  • Reset failed login count to 0 when admin resets password.

  • Disallow direct modifications to enrolledBy.

  • Document registering to an entitlement server with a UUID as not implemented.

  • In sudo labels we should use RunAs and not Run As.

  • Remove the ability to create new HBAC deny rules.

  • Validate that the certificate subject base is in valid DN format.

  • Use information from the certificate subject when setting the NSS nickname.

  • Create tool to manage dogtag replication agreements

  • Fix failing tests due to object name changes

  • Set nickname of the RA to ‘IPA RA’ to avoid confusion with dogtag RA

  • Set the ipa-modrdn plugin precedence to 60 so it runs last

  • Generate a database password by default in all cases.

  • Specify the package name when the replication plugin is missing.

  • Change client enrollment principal prompt to hopefully be clearer.

  • Optionally wait for 389-ds postop plugins to complete

  • A removed external host is shown in output when removing external hosts.

  • Don’t set krbLastPwdChange when setting a host OTP password.

  • Fix regression when calculating external groups.

  • With the external user/group management fixed, correct the unit tests.

  • Set a default minimum value for class Int, handle long values better.

  • Make ipa-client-install error messages more understandable and relevant.

  • Add Alexander Bokovoy and Jan Cholasta to contributors file

  • Only call entry_from_entry() after waiting for the new entry.

  • Hide the HBAC access type attribute now that deny is deprecated.

  • Autofill the default revocation reason

  • Don’t check for leading/trailing spaces in a File parameter

  • Add an arch-specific Requires on cyrus-sasl-gssapi

  • Revert use of ‘can be at least’ to ‘must be at least’ in minvalue validator

  • Don’t leave dangling map if adding an indirect map fails

  • Fix message in test case for checking minimum values

  • When setting a host password don’t set krbPasswordExpiration.

  • Set minimum version of pki-ca to 9.0.10 to pick up new ipa cert profile

  • Deprecated managing users and runas user/group in sudorule add/mod

  • Fix date order in changelog.

  • Re-arrange CA configuration code to reduce the number of restarts.

Simo Sorce (4):

  • Fix resource leaks.

  • ipautil: Preserve environment unless explicitly overridden by caller.

  • install-scripts: avoid using –list with chkconfig

  • Don’t set the password expiration to the current time

Yuri Chornoivan (1):

  • Typos in freeIPA messages and man page

Kyle Baker (5):

  • Background images and tab hover

  • Search bar style and positioning changes

  • List page spacing changes

  • Tab and spacing on list

  • Facet icon swap and tab sizing

Contents