RHBA-2016:1036 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Bug fixes:

• The encoding used by Apache Tomcat for the HTTP reason phrase is not compatible with UTF-8 in some locales. IdM attempted to decode certain HTTP reason phrases in non-English locales as UTF-8, which caused the ipa-server-install utility to fail. Now, IdM ignores the HTTP reason phrases, which fixes the bug. (BZ#1303052)
• When installing a server with an externally signed CA certificate, the "ipa-server-install --setup-dns" command did not install the integrated DNS services with the server. The command now installs the DNS services as expected in this situation. (BZ#1303059)
• The "id [ad_user]" command did not show all IdM groups the AD user belonged to. Now, all IdM groups that an AD user belongs to are added to the Privilege Attribute Certificate (PAC), which fixes this bug. (BZ#1304333)
• After the user entered an incorrect old password when resetting the password in the IdM web UI, the password was not changed but IdM did not inform the user about the failure. Now, IdM displays an error message. (BZ#1309362)
• The ipa-replica-install and ipa-ca-install utilities failed when installing a replica of a Red Hat Enterprise Linux 6 master with a self-signed CA certificate. This updates fixes the bug. Note that after running ipa-ca-install, you must run the ipa-certupdate utility.

Also, it is not possible to install a replica with a CA certificate against a master that uses a third-party certificate for the httpd service. To work around this problem, issue a temporary IdM certificate for httpd on the master before installing the replica:

# certutil -d /etc/httpd/alias -L -n [NICKNAME] -r >backup.crt.der
# ipa service-mod HTTP/[HOSTNAME] --certificate=
# ipa-getcert start-tracking -d /etc/httpd/alias -n [NICKNAME]

• p /etc/httpd/alias/pwdfile.txt -C /usr/lib64/ipa/certmonger/restart_httpd

# ipa-getcert resubmit -d /etc/httpd/alias -n [NICKNAME] -K HTTP/[HOSTNAME]

After installing the replica, revert to the original certificate:

# ipa-getcert stop-tracking -d /etc/httpd/alias -n [NICKNAME]
# certutil -d /etc/httpd/alias -D -n [NICKNAME]
# certutil -d /etc/httpd/alias -A -n [NICKNAME] -t ,, -i backup.crt.der
# systemctl restart httpd
(BZ#1309382)

• During server upgrade, the migration of certificate profiles into the LDAP back end sometimes failed, which left the server without functional certificate profiles. Consequently, certificate requests failed with an error. The LDAP profile migration code has been updated and re-adds any missing profiles to the database at every upgrade. The certificate requests work as expected. (BZ#1311468)
• When upgrading an IdM server to version 4.2 or installing the 4.2 version, AD trusts created on the server did not work, even though the server reported the trust status as established and verified. This update fixes the configuration of the sidgen and extdom plug-ins, thus eliminating the problem. If you experienced this problem, recreate all trusts using the ipa trust-add utility. (BZ#1311470)
• The Schema Compatibility plug-in did not expose users from a trusted Active Directory (AD) forest as part of IdM groups even if the group membership was defined in IdM. This prevented legacy clients from subjecting AD users to sudo rules and group-restricting access rules. External members of IdM groups are now resolved and their information exported to the plug-in, thus improving compatibility with legacy clients. (BZ#1311502)
• Server or replica installation sometimes failed when multiple versions of the same certificate, such as before and after renewal, were available to the installer. The installation no longer fails in this situation. (BZ#1324060)

Users of ipa are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1303059 - --setup-dns and other options is forgotten for using an external PKI
• BZ - 1309362 - User should be notified for wrong password in password reset page
• BZ - 1309382 - issues with migration from RHEL 6 self-signed to RHEL 7 CA IPA setup
• BZ - 1311470 - ipa trust-add succeded but after that ipa trust-find returns "0 trusts matched"
• BZ - 1311502 - [RFE] compat tree: show AD members of IPA groups
• BZ - 1324060 - Installers fail when there are multiple versions of the same certificate

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal