RHBA-2015:2362 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Description

The ipa packages have been upgraded to upstream version 4.2.0. For detailed information about 4.2.0, see the release notes linked to from the References section. (BZ#1204809)

The following enhancements are described in more detail in the Red Hat Enterprise Linux 7.2 Release Notes, linked to from the References section:

• One-way trusts are now supported, and IdM server is a trust agent by default (BZ#1145748, BZ#1206613)
• Multiple certificate profiles (BZ#1200694)
• Password Vault (BZ#1204501)
• Kerberos HTTPS proxy in IdM (BZ#1206534)
• Negotiate authentication streamlined with mod_auth_gssapi (BZ#1200883)
• User life-cycle management capabilities and managing IdM users directly from a standard LDAP client (BZ#1199530, BZ#989091)
• Issuing certificates for user accounts (BZ#1200735)
• Automated migration from WinSync to trusts (BZ#1204205)
• Browser and documentation for the JSON-RPC API available as Technology Preview (BZ#846033)
• DNSSEC available as Technology Preview (BZ#1115294)
• Apache modules for IdM, previously Technology Preview, are now fully supported

Notable bug fixes:

• When using the extdom plug-in to handle large groups, user and group lookups previously failed due to insufficient buffer size. The problem no longer occurs. (BZ#1193759)
• An attempt to install an IdM server previously failed with the following error message in certain situations:

ipalib.errors.LDAPError: failed to decode certificate:
(SEC_ERROR_INVALID_ARGS) security library: invalid arguments.

The source code handling Certificate Authority (CA) certificates during installation has been updated to fix the problem. The error message no longer appears, and the installation completes successfully. (BZ#1194312)

• Several bugs related to the Network Time Protocol (NTP) in IdM have been fixed. (BZ#1196656, BZ#1211708, BZ#1215197, BZ#1215200)
• Command-line and web UI operations involving large groups (for example, groups with 15,000 users) were very slow. The problem sometimes caused commands such as "ipa group-show" to time out. Now, IdM handles such operations faster. (BZ#1204637)
• Several bugs related to using the "ipa trust-add" command have been fixed. (BZ#1216935, BZ#1222047, BZ#1249455)
• Users without admin privileges were previously not allowed to perform certain search operations, such as "ipa zone-find", "ipa hbacrule-find", or "ipa host-find". With this update, non-admin users can successfully perform these search operations as expected. (BZ#1243261, BZ#1246141, BZ#1248524)

Features:

• The "ipa migrate-ds" command now supports different search scopes. The user can specify LDAP search depth for users and groups by adding the "--scope" option, which accepts the "base", "onelevel", or "subtree" values. (BZ#805188)
• It is now possible to map identity certificates from smart cards to user entries in IdM, which improves the centralized authentication functionality. (BZ#1072383)
• This update introduces the "ipa-server-upgrade" utility. The utility automatically upgrades the current IdM server installation. (BZ#1199520)
• Requesting a certificate during IdM client kickstart enrollment no longer requires certmonger to be running. It is possible to successfully request a certificate in the described situation without certmonger, on the condition that the D-Bus daemon is not running.

To use this functionality, set the system bus address to "/dev/null" for the ipa-client-install utility in the kickstart chroot environment:

# env DBUS_SYSTEM_BUS_ADDRESS=unix:path=/dev/null
ipa-client-install

Note that the certmonger service requires a system reboot to start monitoring the certificate obtained in this way. (BZ#1234919)

• The instructions on the IdM web UI browser configuration page have been updated to reflect recent changes to the Mozilla Firefox extension signing policies. (BZ#1261074)

Solution

Users of ipa are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 805188 - [RFE] "ipa migrate-ds" ldapsearches with scope=1
• BZ - 1019272 - With 20000+ users, adding a user to a group intermittently throws Internal server error
• BZ - 1035494 - Unable to add Kerberos principal via kadmin.local
• BZ - 1045153 - ipa-managed-entries --list -p <badpassword> still requires DM password
• BZ - 1108223 - Visible delete buttons in multivalued widget when user doesn't have write rights
• BZ - 1115294 - [RFE] Add support for DNSSEC
• BZ - 1125950 - ipa-server-install --uinstall doesn't remove port 7389 from ldap_port_t
• BZ - 1131907 - [ipa-client-install] cannot write certificate file '/etc/ipa/ca.crt.new': must be string or buffer, not None
• BZ - 1132540 - [RFE] Expose service delegation rules CLI
• BZ - 1145584 - ipaserver/install/cainstance.py creates pkiuser not matching uidgid
• BZ - 1183116 - Remove Requires: subscription-manager
• BZ - 1186054 - permission-add does not prompt to enter --right option in interactive mode
• BZ - 1187524 - Replication agreement with replica not disabled when ipa-restore done without IPA installed
• BZ - 1188195 - Fax number not displayed for user-show when kinit'ed as normal user.
• BZ - 1189034 - "an internal error has occurred" during ipa host-del --updatedns
• BZ - 1194633 - Default trust view can be deleted in lower case
• BZ - 1195339 - ipa-client-install changes the label on various files which causes SELinux denials
• BZ - 1195775 - unsaved changes dialog internally inconsistent
• BZ - 1196455 - ipa-server-install step [8/27]: starting certificate server instance - confusing CA staus message on TLS error
• BZ - 1196656 - [ipa-client][rhel71] enable debugging for spawned commands / ntpd -qgc $tmpfile hangs
• BZ - 1198263 - Limit deadlocks between DS plugin DNA and slapi-nis
• BZ - 1198796 - Text in UI should describe differing LDAP vs Krb behavior for combinations of "User authentication types"
• BZ - 1199520 - [RFE] Introduce single upgrade tool - ipa-server-upgrade
• BZ - 1199527 - [RFE] Use datepicker component for datetime fields
• BZ - 1199530 - [RFE] Provide user lifecycle managment capabilities
• BZ - 1200694 - [RFE] Support for multiple cert profiles
• BZ - 1200728 - [RFE] Replicate PKI Profile information
• BZ - 1200735 - [RFE] Allow issuing certificates for user accounts
• BZ - 1200867 - [RFE] Make OTP validation window configurable
• BZ - 1200883 - [RFE] Switch apache to use mod_auth_gssapi
• BZ - 1204054 - SSSD database is not cleared between installs and uninstalls of ipa
• BZ - 1204205 - [RFE] ID Views: Automated migration tool from Winsync to Trusts
• BZ - 1204501 - [RFE] Add Password Vault (KRA) functionality
• BZ - 1204504 - [RFE] Add access control so hosts can create their own services
• BZ - 1204637 - slow group operations
• BZ - 1204642 - migrate-ds: slow add of users to default group
• BZ - 1204809 - Rebase ipa to 4.2
• BZ - 1205264 - Migration UI Does Not Work When Anonymous Bind is Disabled
• BZ - 1206534 - [RFE] Offer Kerberos over HTTP (kdcproxy) by default
• BZ - 1206613 - [RFE] Configure IPA to be a trust agent by default
• BZ - 1208461 - IPA CA master server update stuck on checking getStatus via https
• BZ - 1209476 - package ipa-client does not require package dbus-python
• BZ - 1211589 - [RFE] Add option to skip the verify_client_version
• BZ - 1211608 - [RFE] Generic support for unknown DNS RR types (RFC 3597)
• BZ - 1211708 - ipa-client-install gets stuck during NTP sync
• BZ - 1215197 - ipa-client-install ignores --ntp-server option during time sync
• BZ - 1215200 - ipa-client-install configures IPA server as NTP source even if IPA server has not ntpd configured
• BZ - 1215735 - ipa-replica-prepare automatically adds a DNS zone
• BZ - 1217009 - OTP sync in UI does not work for TOTP tokens
• BZ - 1217010 - OTP Manager field is not exposed in the UI
• BZ - 1222778 - idoverride group-del can delete user and user-del can delete group
• BZ - 1224769 - copy-schema-to-ca.py does not overwrites schema files
• BZ - 1225866 - display browser config options that apply to the browser.
• BZ - 1228671 - pkispawn fails in ipa-ca-install and ipa-kra-install
• BZ - 1232819 - testing ipa-restore on fresh system install fails
• BZ - 1240939 - Please add dependency on bind-pkcs11
• BZ - 1241941 - kdc component installation of IPA failed
• BZ - 1242036 - Replica install fails to update DNS records
• BZ - 1242884 - Upgrade to 4.2.0 fails when enabling kdc proxy
• BZ - 1242914 - Bump minimal selinux-policy and add booleans to allow calling out oddjobd-activated services
• BZ - 1243652 - Client has missing dependency on memcache
• BZ - 1243835 - [webui] user change password dialog does not work
• BZ - 1244802 - spec: selinux denial during kdcproxy user creation
• BZ - 1245225 - Asymmetric vault drops traceback when the key is not proper
• BZ - 1246132 - trust-fetch-domains: Do not chown keytab to the sssd user
• BZ - 1246136 - Adding a privilege to a permission avoids validation
• BZ - 1246141 - DNS Administrators cannot search in zones
• BZ - 1246143 - User plugin - user-find doesn't work properly with manager option
• BZ - 1246342 - Unapply idview raises internal error
• BZ - 1248102 - [webui] regression - incorrect/no failed auth messages
• BZ - 1248396 - Internal error in DomainValidator.__search_in_dc
• BZ - 1248399 - Missing DNSSEC related files in backup
• BZ - 1248405 - PassSync should be disabled after ipa-winsync-migrate is finished
• BZ - 1249226 - IPA dnssec-validation not working for AD dnsforwardzone
• BZ - 1249455 - ipa trust-add failed CIFS server configuration does not allow access to \\pipe\lsarpc
• BZ - 1250093 - ipa certprofile-import accepts invalid config
• BZ - 1250107 - IPA framework should not allow modifying trust on AD trust agents
• BZ - 1250111 - User lifecycle - preserved users can be assigned membership
• BZ - 1250145 - Add permission for user to bypass caacl enforcement
• BZ - 1250190 - idrange is not added for sub domain
• BZ - 1250192 - Error in ipa trust-fecth-domains
• BZ - 1250928 - Man page for ipa-server-install is out of sync
• BZ - 1251225 - IPA default CAACL does not allow cert-request for services after upgrade
• BZ - 1251553 - Winsync setup fails with unexpected error
• BZ - 1251561 - ipa vault-add Unknown option: ipavaultpublickey
• BZ - 1251579 - ipa vault-add --user should set container owner equal to user on first run
• BZ - 1251854 - ipa aci plugin is not parsing aci's correctly.
• BZ - 1252334 - User life cycle: missing ability to provision a stage user from a preserved user
• BZ - 1252414 - Trust agent install does not detect available replicas to add to master
• BZ - 1252517 - cert-request rejects request with correct krb5PrincipalName SAN
• BZ - 1252555 - ipa vault-find doesn't work for services
• BZ - 1252556 - Missing CLI param and ACL for vault service operations
• BZ - 1252557 - certprofile: improve profile format documentation
• BZ - 1253443 - ipa vault-add creates vault with invalid type
• BZ - 1253480 - ipa vault-add-owner does not fail when adding an existing owner
• BZ - 1253511 - ipa vault-find does not use criteria
• BZ - 1254038 - ipa-replica-install pk12util error returns exit status 10
• BZ - 1254262 - ipa-dnskeysync-replica crash cannot contact kdc
• BZ - 1254304 - Changing vault encryption attributes
• BZ - 1254412 - when dirsrv is off ,upgrade from 7.1 to 7.2 fails with starting CA and named-pkcs11.service
• BZ - 1254637 - Add ACI and permission for managing user userCertificate attribute
• BZ - 1254641 - Remove CSR allowed-extensions restriction
• BZ - 1254689 - Storing big file as a secret in vault raises traceback
• BZ - 1254693 - vault --service does not normalize service principal
• BZ - 1254785 - ipa-client-install does not properly handle dual stacked hosts
• BZ - 1255880 - ipactl status should distinguish between different pki-tomcat services
• BZ - 1256715 - Executing user-del --preserve twice removes the user pernamently
• BZ - 1256840 - [webui] majority of required fields is no longer marked as required
• BZ - 1256842 - [webui] no option to choose trust type when creating a trust
• BZ - 1256853 - Clear text passwords in KRA install log
• BZ - 1257072 - The "Standard Vault" MUST not be the default and must be discouraged
• BZ - 1257074 - The KRA agent cert is stored in a PEM file that is not tracked
• BZ - 1257163 - renaming certificatte profile with --rename option leads to integrity issues
• BZ - 1257968 - kinit stop working after ipa-restore
• BZ - 1258926 - Remove 'DNSSEC is experimental' warnings
• BZ - 1258929 - Uninstallation of IPA leaves extra entry in /etc/hosts
• BZ - 1258944 - DNSSEC daemons may deadlock when processing more than 1 zone
• BZ - 1258964 - revert to use ldapi to add kra agent in KRA install
• BZ - 1258965 - ipa vault: set owner of vault container
• BZ - 1259848 - server closes connection and refuses commands after deleting user that is still logged in
• BZ - 1259996 - AttributeError: 'NameSpace' object has no attribute 'ra_certprofile' while ipa-ca-install
• BZ - 1260663 - crash of ipa-dnskeysync-replica component during ipa-restore
• BZ - 1261074 - Adjust Firefox configuration to new extension signing policy
• BZ - 1261586 - ipa config-mod addattr fails for ipauserobjectclasses
• BZ - 1262315 - Unable to establish winsync replication
• BZ - 1262322 - Failed to backup CS.cfg message in upgrade.
• BZ - 1262996 - ipa vault internal error on replica without KRA
• BZ - 1263337 - IPA Restore failed with installed KRA
• BZ - 1265277 - Fix kdcproxy user creation
• BZ - 1265559 - GSS failure after ipa-restore
• BZ - 1269777 - IPA restore overwrites /etc/passwd and /etc/group files
• BZ - 1270608 - IPA upgrade fails for server with CA cert signed by external CA

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal