8.71. ipa

Bug Fixes

BZ#904119

Previously, during migration, users were added to the default user group one by one. As a consequence, adding users to a large group was time consuming. With this update, users are now added in batches of 100, which provides a considerable performance boost over the previous method.

BZ#905626

Previously, the Identity Management client installer did not look for all available servers when it tried to enroll a client. Consequently, the enrollment "ipa-client-install" command failed to enroll a client if any of the Identity Management masters were unavailable during the enrollment. With this update, the client installer tries all servers, either auto-discovered from DNS or passed using the "--server" option on the command line, until it finds an available server, and ipa-client-install now works properly.

BZ#906846

Identity Management did not work correctly when migrating from an OpenLDAP server. As a consequence, attempts to retrieve the LDAP schema from the remote server failed. With this update, Identity Management also looks in the "cn=subschema" entry, and migrations from OpenLDAP servers no longer fail.

BZ#907881

Prior to this update, the Identity Management password lockout Directory Server plug-in processed password lockout incorrectly. Consequently, if Identity Management password policy was configured with the Lockout Time value set to 0, user accounts were permanently disabled even though the maximum number of user password failures had not been exceeded. The plug-in has been fixed to process the password lockout time correctly, and the user accounts lockout now works as expected.

BZ#915745

Previously, update files used when upgrading an Identity Management server to a later version did not contain the new Directory Server schema "ipaExternalMember" attribute type and the "ipaExternalGroup" object class. Consequently, neither command-line interface (CLI) commands using the schema elements nor web user interface (Web UI) as a whole worked correctly. This update adds the missing object class and attribute type to the Identity Management update files. The Directory Server schema is now updated during the Identity Management update process, and both CLI commands and the Web UI work properly.

BZ#916209

The Identity Management configuration parser was not able to parse the Kerberos client configuration file (/etc/krb5.conf) when it contained the "includedir" directive. Consequently, the Identity Management ipa-adtrust-install installer, which directly parses and updates Kerberos client configuration, terminated unexpectedly with a syntax error. With this update, the configuration parser processes "includedir" correctly, and ipa-adtrust-install no longer crashes in the described scenario.

BZ#924004

Previously, when the Identity Management client installer was downloading a Certification Authority (CA) certificate from Identity Management server using the LDAP protocol, it did occasionally not fallback to the HTTP protocol. Consequently, Identity Management client installation failed even though the certificate was accessible using the HTTP protocol. With this update, the Identity Management client installer can properly fallback between different protocols when downloading a CA certificate, and it is now able to complete the installation even when download via one protocol fails.

BZ#924009

The Identity Management client installer did not allow re-enrolling of an already enrolled client. Consequently, when a machine or a virtual machine with a configured Identity Management client was being removed or decommissioned without unenrolling the client first, all succeeding client enrollments failed until the client entry was removed from the Identity Management sever. This update adds a "--force-join" option to the Identity Management client installer, and the privileged administrator is now able to re-enroll an Identity Management client.

BZ#924542

Previously, Identity Management Host Based Access Control (HBAC) rules API allowed administrators to specify a "Source Host" component of HBAC rules even though this component had been deprecated. Consequently, unexpected behavior could occur when using the "Source Host" component in HBAC rules. This bug has been fixed; "Source Host" components are now not allowed in HBAC rules, and unexpected behavior of the rules for administrators no longer occurs.

BZ#948928

Under certain circumstances, the Identity Management upgrade process double encoded the Certification Authority (CA) certificate stored in Directory Server. Consequently, some Identity Management clients failed to decode the CA certificate and installing a client failed. With this update, CA certificates are now properly encoded; client installation CA certificate is correctly retrieved from Identity Management server and the installation proceeds as expected.

BZ#950014

In some cases, the Identity Management installation and upgrade process did not update the user and user role membership information in correct order. As a consequence, user roles were occasionally not correctly applied, and users could fail to proceed with privileged actions even though they had been authorized for them (for example, enrollment of an an Identity Management client). Now, the membership information is applied in correct order, and users' privileged actions no longer fail because of incomplete membership information.

BZ#952241

Previously, when an Identity Management public-key infrastructure (PKI) server certificate (auditSigningCert) was being renewed, incorrect trust argument was assigned to the renewed certificate and the server was unable to use it. The certificate renewal procedure has been updated to assign correct trust arguments to the renewed certificates, and Identity Management PKI certificate renewal now works as expected.

BZ#967870

Identity Management server with Active Directory integration support configured replies differently in NetLogon queries compared to Active Directory. The following discrepancies were present in NetLogon behavior:

• No response to NetLogon query when querying over TCP based LDAP
• No response when DnsDomain was not present in the query
• No return of a LDAP_RES_SEARCH_RESULT to sender when query did not match; NetLogon became unresponsive.

As a consequence, these discrepancies could cause errors in utilities which had sent the NetLogon queries. The NetLogon query responder has been fixed, and the above mentioned issues in NetLogon replies no longer occur.

BZ#970541

Identity Management server did not work efficiently in case of entries with many members, such as a large user group. Consequently, Identity Management CLI or Web UI management commands operating with such entries (for example, adding new users, listing groups, or updating them) could last more than 30 seconds. Several improvements have been implemented in the Identity Management server, namely:

• Web UI interface now avoids membership information when it is not required (for example, in group listing)
• Entry membership manipulating commands (for example, adding users to a group) now avoid unnecessary manipulation with membership information
• Missing substring indices for membership attributes have been added.

With these implementations, the performance of Identity Management CLI and Web UI management commands has been significantly improved, especially when dealing with large user groups.

BZ#975431

Previously, the /var/lib/ipa/pki-ca/publish/ directory, where Identity Management public-key infrastructure (PKI) publishes Certificate Revocation List (CRL) exports, contained incorrect ownership and permissions information after the ipa-server package had been reinstalled or upgraded. Consequently, PKI was not able to update CRL in the directory until the ownership and permissions of the directory were manually amended. The Identity Management installer and upgrade script have been fixed to handle the ownership and permissions of the directory correctly, and CRL exports are now updated properly in the described scenario.

BZ#976716

Prior to this update, the Identity Management XML-RPC interface occasionally did not return the correct "Content-Type" header in its replies. Consequently, programs or scripts processing the XML-RPC response could fail to process the response with a validation error. The XML-RPC responder has been fixed to return the correct "Content-Type" header, and programs and scripts are now able to call the Identity Management XML-RPC interface even with strict validation enabled.

BZ#980409

Previously, the Identity Management Active Directory integration did not expect different procedure for populating KERB_VALIDATION_INFO section of MS-PAC extension for a Kerberos ticket done in Microsoft Windows Server 2012, as compared to Microsoft Windows Server 2008. As a consequence, such Kerberos tickets were not accepted due to an incompatibility and could not be used to authenticate or create a Trust with the Microsoft Windows Server 2012. The KERB_VALIDATION_INFO verification has been refactored to filter out unexpected values before further processing, and the Identity Management Active Directory Trust creation no longer fails with Microsoft Windows Server 2012.

BZ#1011044

Previously, the ipa-client-install installation script did not properly detect whether the client had already been installed on the machine or not. As a consequence, the client uninstall script could refuse to restore the machine when it did not recognize the client as installed. Also, the client installation could succeed even on an installed Identity Management client or server machine. This, however, could disrupt the configuration files or Identity management client or server function. With this update, ipa-client-install has been fixed to detect installation properly, and the issues described above no longer occur.

Enhancements

BZ#955698

This update introduces the "userClass" attribute for Identity Management server host entries. Previously, host entries did not contain a free-form attribute usable for host provisioning systems to tag or set a class for a new host, which could then be used by other functions of Identity Management, for example, by the Automatic Membership Assignment module. Administrators and provisioning systems are now able to use the new "userClass" host entry attribute.

BZ#986211

This update adds the "GECOS" field for user entries to Identity Management Web UI. "GECOS" is an important user field as it equals the user's common name presented to the systems, and it should be editable both through CLI and Web UI interfaces. Now, the user's "GECOS" field can be displayed and changed in Identity Management Web UI.