FreeIPA 4.13.2

FreeIPA 4.13.2#

The FreeIPA team would like to announce FreeIPA 4.13.2 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.13.2#

When using passwordless authentication methods (PKINIT, passkey, IDP, RADIUS), the KDC was rejecting pre-auth requests if the user’s password was expired, even though these methods don’t use passwords. The fix ensures that:

Passwordless methods are never blocked by an expired password. Password expiration is still enforced when a password-based method (password, OTP, hardened) is actually used, even if passwordless methods are also configured.

Fix RHEL 8.10 to RHEL 9.8 migration in FIPS mode

  • WebUI hardening: httpd configuration has been updated with various configuration options that improve security.

Known Issues#

Bug fixes#

FreeIPA 4.13.2 is a stabilization release for the features delivered as a part of 4.13 version series.

There are more than 60 bug-fixes since FreeIPA 4.13.1 release. Details of the bug-fixes can be seen in the list of resolved tickets below.

Upgrading#

Upgrade instructions are available on Upgrade page.

Feedback#

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat.

Resolved tickets#

  • #8092 Nightly test failure in test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view

  • #9529 Nightly test failure (rawhide) in test_webui/test_hostgroup.py::test_hostgroup::test_names_and_button

  • #9572 RPM should use sysusers to create accounts

  • #9749 add “SameSite” flag to ipa_session cookies

  • #9786 Rawhide: test failure in test_integration/test_installation.py::TestInstallWithoutNamed

  • #9820 ipalockout_postop is incorrectly warning about locked users

  • #9828 ipa-migrate tool is renaming host records & host info in automount information

  • #9829 Nightly test failure (rawhide): multiple webui tests failures with firefox 141

  • #9832 IPA compatibility with tomcat 10

  • #9837 Default parameter removes certificates found via cert_find._cert_search

  • #9845 ipatests: Port downstream ipa-trust-functional test suite.

  • #9897 Server version information disclosure

  • #9898 Header X-Content-Type-Options is not set

  • #9900 Refine multiple CSP directives

  • #9901 CSP: failure to define form-action directive which has no fallback

  • #9904 Test failure in test_edns.py::TestDNSOverTLS_EnforcedPolicy_IPA_CA::test_dot_enforced_dns_policy_with_ipa_ca

  • #9906 ipa-otpd crash on passkey auth

  • #9911 ipatests: Port downstream bash-dns test suite.

  • #9916 Azure WebUI tests failing

  • #9917 ipatests: Port downstream bash ipa-trust-func-*test suite.

  • #9919 ipa cert-find –certificate= throws

  • #9921 ipa uninstallation is failing with message “‘NoneType’ object has no attribute ‘lower’”

  • #9922 ipatests: add OTP-based replica promotion coverage

  • #9923 ipa-advise client script requires keytab (should just require root access on client system)

  • #9924 Names of domains from a trusted forest should be compared case-insensitive

  • #9925 Remove deprecated license classifiers.

  • #9929 IdM password policy Min lifetime is not enforced when high minlife is set

  • #9930 ipatests: Port downstream bash-ipa-join test suite.

  • #9931 Add ipa-delegation-cli bash test to upstream xmlrpc test.

  • #9935 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))

  • #9936 Code analysis issue in ipa-4.9

  • #9938 ipa-migrate doesn’t process users’ sshpublickeys

  • #9939 FreeIPA fails to build on rawhide because of missing npm command

  • #9941 PRCI fails on AzurePipeline.freeipa (Docs) due to module absense

  • #9942 Replica installation: failure in replica conncheck

  • #9943 Pruning is enabled by default with RSN

  • #9944 Test failure in test_integration/test_dns.py::TestDNSMisc::test_allow_query_transfer_ipv6

  • #9945 ipatests: Port bash ipa-self-service testsuite.

  • #9946 Regression in test_integration/test_pwpolicy.py::TestPWquality::test_graceperiod_not_replicated

  • #9947 webui tests: regression in test_webui/test_pwpolicy.py::test_pwpolicy::test_negative_value

  • #9948 Extend SELinux policy to allow use of SSSD authentication helpers on non-enrolled hosts

  • #9949 freeipa-client %triggerin and %post can fail (rpm scriptlets should never fail, by policy)

  • #9950 [ipatests] support for pytest 9

  • #9952 ipatests: Port downstream bash-netgroup-cli test suite.

  • #9953 Adding a group with 32Bit Idrange fails.

  • #9954 ipa-migrate doesn’t properly handle replication conflicts

  • #9955 ipa-migrate doesn’t migrate IPA locations

  • #9957 ipatests: Add downstream bash ipa-getkeytab/ipa-rmkeytab CLI test suite

  • #9958 ipa-migrate doesn’t migrate custom kerberos password policies

  • #9959 ipatests: Port downstream bash-ipa-i18n test suite.

  • #9962 race condition with wrong error code during deployment

  • #9964 ipatests: Additional tests for ipa-ipa migration scenarios

  • #9965 ipatests: Include testscenario for ipa-migrate-ds

  • #9968 ipatests: Port downstream bash-ipa-getcert test suite to upstream

  • #9970 Nightly test failure (f45+) in test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client

  • #9972 Nightly failure in test_replica_promotion.py::TestReplicaPromotionRandomPassword::test_replica_two_step_install

  • #9974 ipa ca-show ipa –all failing to list RSN version

  • #9979 Schema Compatibility plugin disabling failed while ipa-server-upgrade command

  • #9980 Test failure in test_trust_functional.py::TestTrustFunctionalUser::test_su_ad_user (f45+)

  • #9981 Test failure for test_ad_user_in_posix_group_fully_qualified

  • #9982 Disable TRACE method

  • #9983 Nightly test failure (f45+) because of CryptographyDeprecationWarning

  • #9989 ipa-replica-install fails in mixed RHEL 8.10 to RHEL 9.8 FIPS environment

  • #9992 Move testing to fedora 44

  • #9995 ipatests: testReplicaInForwardZone fails on RHEL teardown: NetworkManager rewrites /etc/resolv.conf after ipa-replica-install –setup-dns

  • #10007 Selection of authentication indicators on the host/computer object disappears in GUI after a few minutes

  • #10008 Nightly test failure in test_webui/test_translation.py::TestUnauthorizedPage::test_long_text_of_unauthorized_page

  • #10009 Passwordless pre-authentication is blocked when user has an expired password

  • #10010 ipatests: test_EPN_starttls and test_EPN_ssl fail in FIPS mode due to Postfix MD5 TLS fingerprint digest

  • #10011 Fix inverted SSSD xfail in SELinux trust integration tests

Detailed changelog since 4.13.1#

Américo Monteiro (1)#

  • Translated using Weblate (Portuguese) commit

Alexander Bokovoy (6)#

  • ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized commit #9962

  • SELinux: expand policy coverage for sssd_mfa_t domain commit

  • SELinux: wrap bare gen_require blocks in optional_policy in dnskey section commit #9948

  • SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers commit

  • ipa-sam: use internal Samba method to populate in-memory keytab commit

  • SELinux: expand policy coverage for Kerberos usage commit #9948

Anuja More (6)#

  • ipatests: add Azure Entra IdP integration tests commit #8803

  • ipatests: xfail trust sudo/HBAC tests when SSSD is below 2.12 commit

  • ipatests: add SSH/GSSAPI AD trust integration tests. commit #9845

  • ipatests: increase timeout for PR-CI. commit

  • ipatests: add HTTP GSSAPI Kerberos authentication tests with AD trust commit #9845

  • ipatests: add Random Password based replica promotion coverage commit #9922

Antonio Torres (1)#

  • Back to git snapshots commit

Aleksandr Sharov (4)#

  • ipa-migrate: migrate custom kerberos password policies commit #9958

  • ipa-migrate: ignore replication conflicts commit #9954

  • ipa-migrate: migrate DNS locations commit #9955

  • ipa-migrate: migrate ssh public keys for users and overrides commit #9938

David Hanina (19)#

Erik Belko (2)#

  • ipatests: Add AD trust NFS automount integration tests commit

  • ipatests: Add ipa-getcert request tests for NSS storage commit #9968

Florence Blanc-Renaud (33)#

  • freeipa.spec: bump samba version commit

  • prci definitions: increase test_sudo timeout commit

  • ipatests: split test_commands into 2 jobs commit

  • ipatests: xfail TestInstallDNSSECFirst commit

  • CI: switch testing from fedora 43 to fedora 44 commit #9992

  • Spec file: move named-related files to server-dns package commit #9786

  • ipatests: use either cafile or capath for ssl connection commit

  • ipatests: adapt to psutil commit

  • Azure CI: Use Fedora 44 commit #9992

  • replica conncheck: use crypto-policies in temp krb5.conf commit #9989

  • prci definitions: extend test_commands timeout to 6000s commit

  • constants: Use 24-byte key to check id TripleDES is supported commit #9983

  • ipatests: adapt the expected output message commit #9980

  • ipatests: fix the method add_a_record commit #9972

  • ipatests: adapt expected output for test_smb commit #9970

  • CI definitions: split ipa_ipa_migrate into 2 jobs commit

  • ipatests: fix migration test commit #9964

  • Read The Docs: use ubuntu-24.04 instead of ubuntu-20.04 commit

  • ipatests: Add selfservice-find cli tests to xmlrpc Add a new Declarative test class test_selfservice_cli_find covering CLI-level behaviour of the selfservice-find command: commit #9945

  • ipatests: fix the topology for test_32bit_idranges commit

  • ipa-migrate: normalize objectClass before building the list commit #9954

  • Azure CI: remove test_sudo::TestSudo_Functional commit

  • azure CI: fix broken package installation commit

  • webui tests: update expected max value for krbminpwdlife commit #9947

  • ipatests: fix install method for BasePWpolicy commit #9946

  • Spec file: create the systemd-sysusers before oddjob and dbus restart commit #9942

  • Spec file: build requires /usr/bin/node, /usr/bin/npm commit #9939

  • ipatests: pruning is enabled when RSN is enabled commit #9943

  • Doc: remove the constraint on docutils version commit #9941

  • ipa-join: initialize pointer commit #9936

  • fetch_domains: Use case-insensitive comparison for domains names commit #9924

  • ipa-advise: smart card client script does not need krb ticket commit #9923

  • ipatests: Fix xfail assertion for sssd 2.12.0 commit

Olesya Gerasimenko (1)#

  • Translated using Weblate (Russian) commit

Jay Gondaliya (5)#

  • ipatests: Ensure kdcproxy logs a timeout warning when AD KDC is unreachable commit

  • ipatests: Add ipa selfservice-show and selfservice-mod CLI tests to xmlrpc commit #9945

  • ipatests: Add user-principal ipa-getkeytab and ipa-rmkeytab cmdline tests commit #9957

  • ipatests: Add selfservice-add and selfservice-del cli tests commit #9945

  • ipatests: Add ipa-selfservice users tests to xmlrpc commit #9945

  • ipatests: Add ipa-selfservice BZ tests to xmlrpc commit #9945

Julien Rische (6)#

  • ipatests: test password expiration with passwordless authentication commit #10009

  • kdb: skip password expiration for passwordless authentication commit #10009

  • kdb: do not encode string attr null terminator in LDAP commit #10007

  • kdb: prevent read overrun while loading tl_data commit

  • ipa-kdb: warn when tickets are issued without PAC commit #9962

  • ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized commit #9962

Mark Reynolds (1)#

  • ipa-migrate - do not convert hostnames/realm for computers and automounts commit #9828

Andrew Novak (1)#

  • upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off commit #9979

PRANAV THUBE (19)#

  • ipatests: Add AD trust SELinux user map tests (part 3) commit #9845

  • Fix inverted SSSD 2.12.0 xfail in SELinux trust tests commit #10011

  • ipatests: Fix EPN Postfix TLS setup for FIPS mode commit #10010

  • Document SELinux usermap verify expectations. commit

  • ipatests: Add AD trust SELinux user map tests (part 2) commit #9845

  • PRCI definations updated for trust_selinux_usermap. commit

  • ipatests: Add AD trust SELinux user map tests (part 1) commit #9845

  • ipatests: fix replica forward-zone test teardown resolv.conf restore commit #9995

  • ipatests: fix dnszone_add SOA MNAME expectation for numeric TLD commit #9911

  • ipatests: Add trust functional User testcases. commit #9917

  • ipatests: Extend netgroup test coverage. commit #9952

  • ipatests: Add XML-RPC tests for i18n user attributes commit #9959

  • ipatests: Fix test_allow_query_transfer_ipv6 when IPv6 is disabled commit #9944

  • ipatests: Add DNS integration tests. commit #9911

  • ipatests: Add DNS bugzilla integration tests. commit #9911

  • ipatests: Add integration tests for ipa-join command commit #9930

  • ipatests: Fix resolver state tracking in enforced DNS policy tests. commit #9904

  • ipatests: Add DNS functional integration tests. commit #9911

  • ipatests: Move expire_password fixture into TestIPACommand class commit

Rob Crittenden (4)#

  • Skip the lockout alert on no failure count or not max fail commit #9820

  • Add path to identify the tomcat version for Tomcat 10 commit #9832

  • Avoid int overflow with pwpolicy minlife commit #9929

  • Handle IPACertificate types in xmlrpc commit #9935

Rafael Guterres Jeffman (2)#

  • freeipa.spec.in: Use systemd-sysusers to setup users and groups commit #9572

  • Remove deprecated license classifier from ipasetup.py.in commit #9925

Sumit Bose (1)#

  • ipa-otpd: do not pass reference of data_out->jdata commit #9906

Stanislav Levin (1)#

  • ipatest: make tests compatible with Pytest 9 commit #9950

Sudhir Menon (11)#

  • ipatests: add negative and option-validation tests for migrate-ds commit #9965

  • ipatests: add migrate-ds integration tests for bugs. commit #9965

  • ipatests: Add hashed password migration scenario to ds-migrate testsuite commit #9965

  • ipatests: ipa mixed mode and ipa plugins migration. commit #9964

  • ipatests: Bugzillas for ipa-migrate ds testsuite commit

  • ipatests: Add nigthly definitions for ds-migrate commit

  • ipatests: ipa-migrate-ds test scenarios commit

  • ipatests: Updated nightly definitions for ipa-ipa-migration testsuite commit

  • ipatests: Additional tests for ipa-ipa migration testsuite commit #9964

  • ipatests: Additional tests for 32BitIdranges commit

  • ipatests: Add xmlrpc tests for ipa-delegation-cli commit #9931

Veronika Miticka (2)#

  • Add CSP headers to webui commit #9900 #9901

  • Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files commit #9898

Yuri Chornoivan (1)#

  • Translated using Weblate (Ukrainian) commit