RHBA-2016:1043 - Bug Fix Advisory

Topic

Updated slapi-nis packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

The slapi-nis packages contain the NIS server plug-in and the Schema Compatibility plug-in for use with the 389 Directory Server.

This update fixes the following bugs:

• Previously, NIS server support in Red Hat Enterprise Linux Identity Management did not properly propagate information about lockout status of a user to NIS clients. This caused users which were locked out by an IdM administrator to still be able to log in via NIS if the NIS shadow map was enabled in addition to the passwd map. With this update, the NIS server is updated to correctly propagate lockout status information to clients, and systems using both NIS passwd and shadow maps correctly deny access to users which are locked out from IdM. (BZ#1313797)
• The Schema Compatibility plug-in supports exposing users and groups from trusted Active Directory forests with the help of SSSD running on the IdM master server. Previously, the plug-in did not expose these users as part of IdM groups even if the group membership is defined in IdM, which prevented legacy clients from subjecting Active Directory users to sudo rules and group-restricting access rules. This update enables support for resolving external members of IdM groups and exporting their information to the Schema Compatibility plug-in, improving compatibility with legacy clients. (BZ#1311257)
• The Schema Compatibility plug-in supports overriding POSIX attributes of users and groups exposed to legacy clients with ID views. Due to a bug, when a legacy client was binding to a LDAP server using a Distinguished Name (DN) pointing to an overriden user from a non-default ID view, the plug-in was not accepting the DN unless the "uid" attribute was overriden in the ID view as well. For this reason, it was impossible to authenticate to the LDAP server using ID overrides unless the server included an explicit override to the original user ID, which was inconvenient in cases where only a shell or the "uidNumber" or "gidNumber" attributes needed to be overriden.

This update provides a fix which allows for detecting situations where the "uid" attribute is not overriden in the ID view and to fall back to the original user name for authentication purposes. Therefore, it is now possible to use customized ID views without creating explicit overrides for the "uid" attribute in Red Hat Enterprise Linux Identity Management for legacy clients. (BZ#1311012)

Users of slapi-nis are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.2 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1311257 - [RFE] compat tree: show AD members of IPA groups
• BZ - 1313797 - NIS account passwords not disabled when nsAccountLock is TRUE
• BZ - 1327197 - Crash during IPA upgrade due to slapd

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal