RHBA-2013:0945 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

Red Hat Identity Management is a centralized authentication, identity management
and authorization solution for both traditional and cloud-based enterprise
environments. It integrates components of the Red Hat Directory Server, MIT
Kerberos, Red Hat Certificate System, NTP, and DNS. It provides web browser and
command-line interfaces. Its administration tools allow an administrator to
quickly install, set up, and administer a group of domain controllers to meet
the authentication and identity management requirements of large-scale Linux and
UNIX deployments.

This update fixes the following bugs:

• Anonymous access to the Identity Management servers can be set to the

"rootdse" option, which means that anonymous clients can only access the rootDSE
LDAP entry. Previously, when all the configured Identity Management servers had
this option enabled, an attempt to enroll the Identity Management client using
the "ipa-client-install" command failed during the discovery phase. This update
provides a patch to fix this bug and "ipa-client-install" proceeds as expected
in the described scenario. (BZ#952741)

• Under certain circumstances, the Identity Management Certificate Authority

(CA) certificate stored in Directory Server was double encoded. This behavior
prevented some of the Identity Management clients from enrolling. With this
update, the CA certificates are encoded and stored in Directory Server properly.
(BZ#964128)

• Previously, the Identity Management server certificate subsystem did not set

the NSS database trust arguments properly after the renewal. Consequently, the
Identity Management server was unable to communicate with the certificate
system. The underlying source code has been modified and the trust arguments are
now set correctly after the renewal. (BZ#964130)

Users of ipa are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 i386
• Red Hat Enterprise Linux Server - AUS 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.4 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 i386
• Red Hat Gluster Storage Server for On-premise 2.1 x86_64
• Red Hat Storage for Public Cloud (via RHUI) 2.1 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 952741 - unattended ipa-client installation fails when anonymous access to LDAP is disabled on IPA servers
• BZ - 964128 - LDAP upload CA cert sometimes double-encodes the value
• BZ - 964130 - ipa cert automatic renew: wrong trust argument assigned to renewed certs

CVEs

(none)

References

(none)