RHBA-2016:2404 - Bug Fix Advisory

Topic

An update for ipa is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 747612 - [RFE] IPA should support and manage DNS sites
• BZ - 768316 - [RFE] ipa-getkeytab should auto-detect the ipa server name
• BZ - 825391 - [RFE] Replica installation should provide a means for inheriting nssldap security access settings
• BZ - 837369 - [RFE] Switch to client promotion to replica model
• BZ - 921497 - Incorrect *.py[co] files placement
• BZ - 1029640 - RHEL7 IPA to add DNA Plugin config for dnaRemote support
• BZ - 1084018 - [RFE] Add IdM user password change support for legacy client compat tree
• BZ - 1117306 - [RFE] Allow multiple Principals per host entry (Kerberos aliases)
• BZ - 1146860 - [RFE] Offer OTP generation for host enrollment in the UI
• BZ - 1184628 - Principal canonicalization does not work for principals in IPA realm
• BZ - 1199516 - [RFE] Move replication topology to the shared tree
• BZ - 1200731 - [RFE] Support lightweight sub-CAs
• BZ - 1206588 - [RFE] Visualize FreeIPA server replication topology
• BZ - 1211595 - [RFE] add admins group, ipa masters hostgroup, ssh HBAC rule
• BZ - 1211602 - Hide ipa-server-install KDC master password option (-P)
• BZ - 1219402 - IPA suggests to uninstall a client when the user needs to uninstall a replica
• BZ - 1224057 - [RFE] TGS authorization decisions in KDC based on Authentication Indicator
• BZ - 1234222 - [WebUI] UI error message is not appropriate for "Kerberos principal expiration"
• BZ - 1234223 - [WebUI] General invalid password error message appearing for "Locked user"
• BZ - 1238190 - ipasam unable to lookup group in directory yet manual search works
• BZ - 1250110 - search by users which don't have read rights for all attrs in search_attributes fails
• BZ - 1254267 - ipa-server-install failure applying ldap updates with limits exceeded
• BZ - 1258626 - realmdomains-mod --add-domain command throwing error when doamin already is in forwardzone.
• BZ - 1259020 - ipa-server-adtrust-install doesn't allow NetBIOS-name=EXAMPLE-TEST.COM (dash character)
• BZ - 1260993 - DNSSEC signing enablement on dnszone should throw error message when DNSSEC master not installed
• BZ - 1262747 - dnssec options missing in ipa-dns-install man page
• BZ - 1263764 - Show Certificate displays in useless format
• BZ - 1265900 - Fail installation immediately after dirsrv fails to install using ipa-server-install
• BZ - 1265915 - idoverrideuser-find fails if any SID anchor is not resolvable anymore
• BZ - 1267206 - ipa-server-install uninstall should warn if no installation found
• BZ - 1268027 - ipa-dnskeysync-replica crash with backtrace - LimitsExceeded: limits exceeded for this query
• BZ - 1269089 - Certificate of managed-by host/service fails to resubmit
• BZ - 1269200 - ipa-server crashing while trying to preserve admin user
• BZ - 1271579 - Automember rule expressions disappear from tables on single expression delete
• BZ - 1272491 - [WebUI] Certificate action dropdown does not display all the options after adding new certificate
• BZ - 1275816 - Incomplete ports for IPA ad-trust
• BZ - 1277109 - Add tool tips for Revert, Refresh, Undo, and Undo All in the IPA UI
• BZ - 1277696 - IPA certificate auto renewal fail with "Invalid Credential"
• BZ - 1278330 - installer options are not validated at the beginning of installation
• BZ - 1278426 - Better error message needed for invalid ca-signing-algo option
• BZ - 1279932 - ipa-client-install --request-cert needs workaround in anaconda chroot
• BZ - 1282845 - sshd_config change on ipa-client-install can prevent sshd from starting up
• BZ - 1282935 - ipa upgrade causes vault internal error
• BZ - 1283429 - Default CA ACL rule is not created during ipa-replica-install
• BZ - 1283430 - ipa-kra-install: fails to apply updates
• BZ - 1283748 - Caching of ipaconfig does not work in framework
• BZ - 1283879 - ipa-winsync-migrate: Traceback message should be replaced by "IPA is not configured on this system"
• BZ - 1283943 - IPA DNS Zone/DNS Forward Zone details missing after upgrade from RHEL 7.0 to RHEL 7.2
• BZ - 1284413 - ipa-cacert-manage renew fails on nonexistent ldap connection
• BZ - 1284414 - ipa-otptoken-import fails on nonexistent ldap connection
• BZ - 1285071 - ipa-kra-install fails on replica looking for admin cert file
• BZ - 1286635 - IPA server upgrade fails from RHEL 7.0 to RHEL 7.2 using "yum update ipa* sssd"
• BZ - 1286781 - ipa-nis-manage does not update ldap with all NIS maps
• BZ - 1288967 - Normalize Manager entry in ipa user-add
• BZ - 1290142 - Broken 7.2.0 to 7.2.z upgrade - flawed version comparison
• BZ - 1291140 - ipa client should configure kpasswd_server directive in krb5.conf
• BZ - 1292141 - Rebase to FreeIPA 4.4+
• BZ - 1293870 - User should be notified for wrong password in password reset page
• BZ - 1296140 - Remove redhat-access-plugin-ipa support
• BZ - 1296196 - Sysrestore did not restore state if a key is specified in mixed case
• BZ - 1296214 - DNSSEC key purging is not handled properly
• BZ - 1296216 - ipa-server-upgrade fails if certmonger is not running
• BZ - 1297811 - The ipa -e skip_version_check=1 still issues incompatibility error when called against RHEL 6 server
• BZ - 1298242 - [RFE] API compatibility - compatibility of clients
• BZ - 1298286 - [RFE] IdM Server stable API
• BZ - 1298288 - [RFE] Improve performance in large environments.
• BZ - 1298848 - [RFE] Centralized topology management
• BZ - 1298966 - [RFE] Extend Smart Card support
• BZ - 1300576 - Browser setup page includes instructions for Internet Explorer
• BZ - 1301586 - ipa host-del --updatedns should remove related dns entries.
• BZ - 1301674 - --setup-dns and other options is forgotten for using an external PKI
• BZ - 1301687 - issues with migration from RHEL 6 self-signed to RHEL 7 CA IPA setup
• BZ - 1301901 - [RFE] compat tree: show AD members of IPA groups
• BZ - 1304618 - Residual Files After IPA Server Uninstall
• BZ - 1305144 - ipa-python does not require its dependencies
• BZ - 1305533 - ipa trust-add succeded but after that ipa trust-find returns "0 trusts matched"
• BZ - 1309700 - Process /usr/sbin/winbindd was killed by signal 6
• BZ - 1313798 - Console output post ipa-winsync-migrate command should be corrected.
• BZ - 1314786 - [RFE] External Trust with Active Directory domain
• BZ - 1314837 - Web interface not showing ipa forwarders
• BZ - 1317379 - [EXPERIMENTAL][RFE] Web UI: allow Smart Card authentication
• BZ - 1318169 - Tree-root domains in a trusted AD forest aren't marked as reachable via the forest root
• BZ - 1318903 - ipa server install failing when SUBCA signs the cert
• BZ - 1319003 - ipa-winsync-migrate: Traceback should be fixed with proper console output
• BZ - 1319023 - Include description for 'status' option in man page for ipactl command.
• BZ - 1319912 - ipa-server-install does not completely change hostname and named-pkcs11 fails
• BZ - 1320838 - [RFE] Support IdM Client in a DNS domain controlled by AD
• BZ - 1321092 - Installers fail when there are multiple versions of the same certificate
• BZ - 1327092 - URI details missing and OCSP-URI details are incorrectly displayed when certificate generated using IPA on RHEL 7.2up2.
• BZ - 1328549 - "ipa-kra-install" command reports incorrect message when it is executed on server already installed with KRA.
• BZ - 1328552 - [RFE] Allow users to authenticate with alternative names
• BZ - 1329209 - ipa-nis-manage enable: change service name from 'portmap' to 'rpcbind'
• BZ - 1329275 - ipa-nis-manage command should include status option
• BZ - 1330843 - 'man ipa' should be updated with latest commands
• BZ - 1333755 - ipa cert-request causes internal server error while requesting certificate
• BZ - 1334582 - Inconsistent UI and CLI options for removing certificate hold
• BZ - 1335567 - Update Warning in IdM Web UI API browser
• BZ - 1337484 - EOF is not handled for ipa-client-install command
• BZ - 1338031 - Insufficient 'write' privilege on some attributes for the members of the role which has "User Administrators" privilege.
• BZ - 1339233 - CA installed on replica is always marked as renewal master
• BZ - 1339483 - ipa-server-install fails with ERROR pkinit_cert_files
• BZ - 1341249 - Subsequent external CA installation fails
• BZ - 1343422 - [RFE] Add GssapiImpersonate option
• BZ - 1346883 - Rebase mod_auth_gssapi to 1.4.0
• BZ - 1347928 - Frontpage exposes runtime error with no cookies enabled in browser
• BZ - 1348948 - IPA server install fails with build ipa-server-4.4.0-0.el7.1.alpha1
• BZ - 1349281 - Fix `Conflicts` with ipa-python
• BZ - 1350695 - execution of copy-schema script fails
• BZ - 1351118 - upgrade failed for RHEL-7.3 from RHEL-7.2.z
• BZ - 1351119 - Multiple issues while uninstalling ipa-server
• BZ - 1351140 - ipa-server-install fails to detect hostname from /etc/hosts file
• BZ - 1351142 - CLI is not using session cookies for communication with IPA API
• BZ - 1351153 - AVC seen on Replica during ipa-server upgrade test execution to 7.3
• BZ - 1351276 - ipa-server-install with dns cannot resolve itself to create ipa-ca entry
• BZ - 1351758 - ipa commands not showing expected error messages
• BZ - 1351807 - ipa-nis-manage config.get_dn missing
• BZ - 1351918 - ipa-server-install fails with No usable IP address provided nor resolved.
• BZ - 1352883 - Traceback on adding default automember group and hostgroup set
• BZ - 1352912 - Cross-Frame Scripting (XFS) vulnerability
• BZ - 1353072 - ipa unknown command vault-add
• BZ - 1353452 - ipa-compat-manage command failed, exception: NotImplementedError: config.get_dn()
• BZ - 1353506 - ipa migrate-ds command fails for IPA in RHEL 7.3
• BZ - 1353829 - traceback message seen in ipaserver-uninstall.log file.
• BZ - 1353831 - ipa-server-install fails in container because of hostnamectl set-hostname
• BZ - 1353881 - ipa-replica-install suggests about non-existent --force-ntpd option
• BZ - 1353888 - Fix the help for ipa otp and other topics
• BZ - 1353899 - ipa-advise: object of type 'type' has no len()
• BZ - 1353936 - custodia.conf and server.keys file is world-readable.
• BZ - 1354348 - ipa trustconfig-show throws internal error.
• BZ - 1354381 - ipa trust-add with raw option gives internal error.
• BZ - 1354406 - host-del updatedns options complains about missing ptr record for host
• BZ - 1354441 - DNS forwarder check is too strict: unable to add sub-domain to already-broken domain
• BZ - 1354493 - Replica install fails with old IPA master
• BZ - 1354628 - ipa hostgroup-add-member does not return error message when adding itself as member
• BZ - 1355718 - ipa-replica-manage man page example output differs actual command output
• BZ - 1355753 - adding two way non transitive(external) trust displays internal error on the console
• BZ - 1355856 - ipa otptoken-add --type=totp gives internal error
• BZ - 1356063 - "ipa radiusproxy-add" command needs to prompt to enter secret key
• BZ - 1356091 - ipa-cacert-manage --help and man differ
• BZ - 1356099 - Bug in the ipapwd plugin
• BZ - 1356101 - Lightweight sub-CA certs are not tracked by certmonger after `ipa-replica-install`
• BZ - 1356102 - Server uninstall does not stop tracking lightweight sub-CA with certmonger
• BZ - 1356134 - 'kinit -E' does not work for IPA user
• BZ - 1356144 - host-find should not print SSH keys by default, only SSH fingerprints
• BZ - 1356146 - performance regression in CLI help
• BZ - 1356899 - com.redhat.idm.trust.fetch_domains need update after thin client changes
• BZ - 1356964 - Renaming a user removes all of his principal aliases
• BZ - 1357488 - ipa command stuck forever on higher versioned client with lower versioned server
• BZ - 1358229 - Traceback message should be fixed, seen while editing winsync migrated user information in Default trust view.
• BZ - 1358849 - CA replica install logs to wrong log file
• BZ - 1359130 - ipa-server-install command fails to install IPA server.
• BZ - 1359237 - AVC on dirsrv config caused by IPA installer
• BZ - 1359692 - ipa-client-install join fail with traceback against RHEL-6.8 ipa-server
• BZ - 1359738 - ipa-replica-install --domain=<IPA primary domain> option does not work
• BZ - 1360631 - ipa-backup is not keeping the /etc/tmpfiles.d/dirsrv-<instance>.conf
• BZ - 1360769 - ipa-server-certinstall couldnt unlock private key file
• BZ - 1360778 - Vault commands are available in CLI even when the server does not support them
• BZ - 1360792 - Migrating users doesn't update krbCanonicalName
• BZ - 1361047 - ipa-replica-install --help usage line suggests the replica file is needed
• BZ - 1361119 - UPN-based search for AD users does not match an entry in slapi-nis map cache
• BZ - 1361545 - ipa-client-install starts rhel-domainname.service but does not rpm-require it
• BZ - 1362012 - ipa hbactest produces error about cannot concatenate 'str' and 'bool' objects
• BZ - 1362260 - ipa vault-mod no longer allows defining salt
• BZ - 1362312 - ipa vault-retrieve internal error when using the wrong public key
• BZ - 1362333 - ipa vault container owner cannot add vault
• BZ - 1362537 - ipa-server-install fails to create symlink from /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/
• BZ - 1363756 - Increase length of passwords generated by installer
• BZ - 1363905 - man page for ipa-replica-manage has a typo in -c flag
• BZ - 1364113 - ipa-password: ipa: ERROR: RuntimeError: Unable to create cache directory: [Errno 13] Permission denied: '/home/test_user'
• BZ - 1364197 - caacl: error when instantiating rules with service principals
• BZ - 1364310 - ipa otptoken-add bytes object has no attribute confirm
• BZ - 1364464 - Topology graph: ca and domain adders shows question marks instead of plus icon
• BZ - 1365083 - Incomplete output returned for command ipa vault-add
• BZ - 1365526 - build fails during "make check"
• BZ - 1365546 - External trust with root domain is transitive
• BZ - 1365572 - IPA server broken after upgrade
• BZ - 1366604 - `cert-find` crashes on invalid certificate data
• BZ - 1366612 - Middle replica uninstallation in line topology works without '--ignore-topology-disconnect'
• BZ - 1366626 - caacl-add-service: incorrect error message when service does not exists
• BZ - 1367022 - The ipa-server-upgrade command failed when named-pkcs11 does not happen to run during dnf upgrade
• BZ - 1367759 - [RFE] [webui] warn admin if there is only one IPA server with CA
• BZ - 1367773 - thin client ignores locale change
• BZ - 1367864 - Server assumes latest version of command instead of version 1 for old / 3rd party clients
• BZ - 1367865 - webui: cert_revoke should use --cacn to set correct CA when revoking certificate
• BZ - 1368424 - Unable to view certificates issued by Sub CA in Web UI
• BZ - 1368557 - dnsrecord-add does not prompt for missing record parts internactively
• BZ - 1368754 - ipa server uninstall fails with Python "Global Name error"
• BZ - 1368981 - ipa otptoken-add --type=hotp --key creates wrong OTP
• BZ - 1369414 - ipa server-del fails with Python stack trace
• BZ - 1369761 - ipa-server must depend on a version of httpd that support mod_proxy with UDS
• BZ - 1370512 - Received ACIError instead of DuplicatedError in stageuser_tests
• BZ - 1370519 - Certificate revocation in service-del and host-del isn't aware of Sub CAs
• BZ - 1371901 - Use OAEP padding with custodia
• BZ - 1371915 - When establishing external two-way trust, forest root Administrator account is used to fetch domain info
• BZ - 1372597 - Incorrect CA ACL evaluation of SAN DNS names in certificate request
• BZ - 1373272 - CLI always sends default command version
• BZ - 1373359 - ipa-certupdate fails with "CA is not configured"
• BZ - 1373540 - client-install with IPv6 address fails on link-local address (always)
• BZ - 1373910 - IPA server upgrade fails with DNS timed out errors.
• BZ - 1375269 - ipa trust-fetch-domains throws internal error

CVEs

(none)

References

(none)