RHBA-2013:0606 - Bug Fix Advisory

Topic

Updated ipa packages that fix five bugs are now available for Red Hat Enterprise
Linux 6.

Description

Red Hat Identity Management is a centralized authentication, identity management
and authorization solution for both traditional and cloud-based enterprise
environments. It integrates components of the Red Hat Directory Server, MIT
Kerberos, Red Hat Certificate System, NTP, and DNS. It provides web browser and
command-line interfaces. Its administration tools allow an administrator to
quickly install, set up, and administer a group of domain controllers to meet
the authentication and identity management requirements of large-scale Linux and
UNIX deployments.

This update fixes the following bugs:

• During migration, users were added to the default users group for each user

added. Adding users to a group which had thousands consumed time and caused a
significant performance slowdown. With this patch, users are now added in
batches of 100, which provides a considerable performance boost over the
previous method. (BZ#908308)

• Identity Management attempts to retrieve the LDAP schema from the remote

server during migration. Previously, such an attempt failed when migrating from
an OpenLDAP server. With this update, Identity Management also looks in
cn=subschema and migrations from OpenLDAP servers no longer fail. (BZ#908400)

• The Identity Management client enrollment "ipa-client-install" command would

fail to enroll a client if any of the Identity Management masters were
unavailable during enrollment. The client installer now tries all servers,
either auto-discovered from DNS or passed via the "--server" option on the
command line, until it finds one that is available and enrolls it in that one.
Now, the Identity Management client enrollment "ipa-client-install" command
functions normally. (BZ#909161)

• Update files, used when upgrading Identity Management server to a higher

version, did not contain one new Directory Server schema attributeType
(ipaExternalMember) and an objectClass (ipaExternalGroup). Consequently,
Identity Management servers, which were updated from a previous version that did
not have this attributeType and objectClass in its base installation, missed the
attributeType and objectClass in its schema. Both command-line interface (CLI)
commands using these schema elements and Web UI as a whole did not function
properly. This update adds the missing objectClass and attributeType to the
Identity Management update files. Currently, Directory Server schema is updated
during the Identity Management update process, and CLI commands and the Web UI
function normally. (BZ#916535)

• The Identity Management configuration parser could not parse the Kerberos

client configuration file (/etc/krb5.conf) when it contained an "includedir"
directive. Consequently, Identity Management servers, which directly parse and
update Kerberos client configuration (namely ipa-adtrust-install) terminated
unexpectedly with a syntax error. With this update, the configuration parser can
handle the "includedir" directive and the ipa-adtrust-install Identity
Management Installer no longer crashes in the described scenario. (BZ#917065)

Users of ipa are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 i386
• Red Hat Enterprise Linux Server - AUS 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.4 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 i386
• Red Hat Gluster Storage Server for On-premise 2.1 x86_64
• Red Hat Storage for Public Cloud (via RHUI) 2.1 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 908308 - Significant decrease in migration performance
• BZ - 908400 - During Migration - If Schema is unavailable migration fails
• BZ - 909161 - ipa-client-install failed to fall over to replica with master down
• BZ - 916535 - Entire 60basev3 schema is not included in update file, other errors

CVEs

(none)

References

(none)