RHBA-2017:2304 - Bug Fix Advisory

Topic

An update for ipa is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 800545 - [RFE] Support SUDO command rename
• BZ - 828866 - [RFE] enhance --subject option for ipa-server-install
• BZ - 872671 - IPA WebUI login for AD Trusted User fails
• BZ - 1081561 - CA not start during ipa server install in pure IPv6 env
• BZ - 1125174 - [RFE] Support IdM running in FIPS-140 mode
• BZ - 1160555 - ipa-server-install: Cannot handle double hyphen "--" in hostname
• BZ - 1200767 - [RFE] Allow Kerberos authentication for users with certificates on smart cards (pkinit)
• BZ - 1264370 - RFE: disable last successful authentication by default in ipa.
• BZ - 1318186 - Misleading error message during external-ca IPA master install
• BZ - 1318616 - CA fails to start after doing ipa-ca-install --external-ca
• BZ - 1321652 - ipa-server-install fails when using external certificates that encapsulate RDN components in double quotes
• BZ - 1322963 - Errors from AD when trying to sign ipa.csr, conflicting template on
• BZ - 1327207 - ipa cert-revoke --help doesn't provide enough info on revocation reasons
• BZ - 1340880 - ipa-server-install: improve prompt on interactive installation
• BZ - 1353841 - ipa-replica-install fails to install when resolv.conf incomplete entries
• BZ - 1356104 - cert-show command does not display Subject Alternative Names
• BZ - 1357511 - Traceback message seen when ipa is provided with invalid configuration file name
• BZ - 1358752 - ipa-ca-install fails on replica when IPA server is converted from CA-less to CA-full
• BZ - 1360813 - ipa-server-certinstall does not update all certificate stores and doesn't set proper trust permissions
• BZ - 1365858 - ipa-ca-install fails on replica when IPA Master is installed without CA
• BZ - 1366572 - [RFE] Web UI: allow Smart Card authentication
• BZ - 1367572 - improve error message in ipa migrate-ds: mention ipa config-mod --enable-migration=TRUE
• BZ - 1367868 - Add options to retrieve lightweight CA certificate/chain
• BZ - 1371479 - cert-find --all does not show information about revocation
• BZ - 1371927 - Implement ca-enable/disable commands.
• BZ - 1372202 - Add Users into User Group editors fails to show Full names
• BZ - 1373091 - Adding an auth indicator from the CLI creates an extra check box in the UI
• BZ - 1375133 - WinSync users who have First.Last casing creates users who can have their password set
• BZ - 1375596 - Ipa-server WebUI - long user/group name show wrong error message
• BZ - 1375905 - "Normal" group type in the UI is confusing
• BZ - 1376040 - IPA client ipv6 - invalid --ip-address shows traceback
• BZ - 1376043 - certmap.conf file is not backedup during ipa-server-upgrade
• BZ - 1376630 - IDM admin password gets written to /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
• BZ - 1376729 - ipa-server-install script option --no_hbac_allow should match other options
• BZ - 1377973 - ipa-server-install fails when the provided or resolved IP address is not found on local interfaces
• BZ - 1378353 - Replica install fails with old IPA master sometimes during replication process
• BZ - 1378461 - IPA Allows Password Reuse with History value defined when admin resets the password.
• BZ - 1378797 - Web UI must check OCSP and CRL during smartcard login
• BZ - 1379029 - conncheck failing intermittently during single step replica installs
• BZ - 1379858 - [RFE] better debugging for ipa-replica-conncheck
• BZ - 1380393 - UnboundLocalError in yacc module in FIPS mode
• BZ - 1382053 - Need to have validation for idrange names
• BZ - 1384310 - ipa dnsrecord-add fails with Keyerror stack trace
• BZ - 1385816 - ipa-cacert-manage renew on replica fails
• BZ - 1387779 - Make httpd publish CA certificate on Domain Level 1
• BZ - 1387782 - WebUI: Services are not displayed correctly after upgrade
• BZ - 1389709 - Traceback seen in error_log when trustdomain-del is run
• BZ - 1392778 - Update man page for ipa-adtrust-install by removing --no-msdcs option
• BZ - 1392858 - Rebase to FreeIPA 4.5+
• BZ - 1393726 - Enumerate all available request type options in ipa cert-request help
• BZ - 1398600 - IPA replica install fails with dirsrv errors.
• BZ - 1398670 - Check IdM Topology for broken record caused by replication conflict before upgrading it
• BZ - 1399133 - Delete option shouldn't be available for hosts applied to view.
• BZ - 1399190 - [RFE] Certificates issued by externally signed IdM CA should contain full trust chain
• BZ - 1400416 - RFE: Advise to take backup of IPA server before uninstalling IPA server
• BZ - 1400529 - cert-request is not aware of Kerberos principal aliases
• BZ - 1401088 - IPA upgrade of replica without DNS fails during restart of named-pkcs11
• BZ - 1401526 - IPA WebUI certificates are grayed out on overview page but not on details page
• BZ - 1402959 - [RFE] Universal Smart Card to Identity mapping
• BZ - 1404750 - ipa-client-install fails to get CA cert via LDAP when non-FQDN name of IPA server is first in /etc/hosts
• BZ - 1409628 - [RFE] Semi-automatic integration with external DNS using nsupdate
• BZ - 1413742 - Backport request for bug/issue Change IP address validation errors to warnings
• BZ - 1415652 - IPA replica install log shows password in plain text
• BZ - 1416454 - replication race condition prevents IPA to install
• BZ - 1419735 - ipa-replica-install fails promotecustodia.create_replica with cert errors (untrusted)
• BZ - 1426258 - Document and test procedure for running IdM Server in TLS 1.2+ environment
• BZ - 1427897 - different behavior regarding system wide certs in master and replica.
• BZ - 1428472 - batch param compatibility is incorrect
• BZ - 1430314 - The ipa-managed-entries command failed, exception: AttributeError: ldap2
• BZ - 1430363 - [RFE] HBAC rule names command rename
• BZ - 1432630 - python2-jinja2 needed for python2-ipaclient
• BZ - 1432903 - Set GssProxy options to enable caching of ldap tickets
• BZ - 1433082 - systemctl daemon-reload needs to be called after httpd.service.d/ipa.conf is manipulated
• BZ - 1434032 - Run ipa-custodia with custom SELinux context
• BZ - 1434384 - RPC client should use HTTP persistent connection
• BZ - 1434729 - man ipa-cacert-manage install needs clarification
• BZ - 1434910 - replica install against IPA v3 master fails with ACIError
• BZ - 1435394 - Ipa-kra-install fails with weird output when backspace is used during typing Directory Manager password
• BZ - 1435397 - ipa-replica-install can't install replica file produced by ipa-replica-prepare on 4.5
• BZ - 1435599 - WebUI: in self-service Vault menu item is shown even if KRA is not installed
• BZ - 1435606 - Add pkinit_indicator option to KDC configuration
• BZ - 1435611 - Tracebacks seen from dogtag-ipa-ca-renew-agent-submit helper when installing replica
• BZ - 1435718 - As a ID user I cannot call a command with --rights option
• BZ - 1436319 - "Truncated search results" pop-up appears in user details in WebUI
• BZ - 1436333 - Uninstall fails with No such file or directory: '/var/run/ipa/services.list'
• BZ - 1436334 - WebUI: Adding certificate mapping data using certificate fails
• BZ - 1436338 - CLI doesn't work after ipa-restore
• BZ - 1436342 - Bump samba version, required for FIPS mode and privilege separation
• BZ - 1436642 - [ipalib/rpc.py] - "maximum recursion depth exceeded" with ipa vault commands
• BZ - 1436657 - Add workaround for pki_pin for FIPS
• BZ - 1436714 - [vault] cache KRA transport cert
• BZ - 1436723 - cert-find does not find all certificates without sizelimit=0
• BZ - 1436724 - Renewal of IPA RA fails on replica
• BZ - 1436753 - Master tree fails to install
• BZ - 1436987 - ipasam: gidNumber attribute is not created in the trusted domain entry
• BZ - 1437378 - ipa-adtrust-install produced an error and failed on starting smb when hostname is not FQDN
• BZ - 1437502 - ipa-replica-install fails with requirement to use --force-join that is a client install option.
• BZ - 1437555 - ipa-replica-install with DL0 fails to get annonymous keytab
• BZ - 1437879 - [copr] Replica install failing
• BZ - 1437946 - Upgrade to FreeIPA 4.5.0 does not configure anonymous principal for PKINIT
• BZ - 1437951 - Remove pkinit-related options from server/replica-install on DL0
• BZ - 1437953 - Server CA-less impossible option check
• BZ - 1438016 - gssapi errors after IPA server upgrade
• BZ - 1438348 - Console output message while adding trust should be mapped with texts changed in Samba.
• BZ - 1438366 - ipa trust-fetch-domains: ValidationError: invalid 'Credentials': Missing credentials for cross-forest communication
• BZ - 1438490 - CA-less installation fails on publishing CA certificate
• BZ - 1438679 - [ipa-replica-install] - IncorrectPasswordException: Incorrect client security database password
• BZ - 1438729 - Configure local PKINIT on DL0 or when '--no-pkinit' option is used
• BZ - 1438731 - Extend ipa-server-certinstall and ipa-certupdate to handle PKINIT certificates/anchors
• BZ - 1438833 - [ipa-replica-install] - 406 Client Error: Failed to validate message: Incorrect number of results (0) searching forpublic key for host
• BZ - 1438838 - Avoid arch-specific path in /etc/krb5.conf.d/ipa-certmap
• BZ - 1439038 - Allow erasing ipaDomainResolutionOrder attribute
• BZ - 1441160 - FreeIPA client <= 4.4 fail to parse 4.5 cookies
• BZ - 1441192 - Add the name of URL parameter which will be check for username during cert login
• BZ - 1441316 - WebUI cert auth fails after ipa-adtrust-install
• BZ - 1441493 - ipa cert-show raises stack traces when --certificate-out=/tmp
• BZ - 1441499 - ipa cert-show does not raise error if no file name specified
• BZ - 1441548 - ipa server install fails with --external-ca option
• BZ - 1441593 - error adding authenticator indicators to host
• BZ - 1441718 - Conversion of CA-less server to CA fails on CA instance spawn
• BZ - 1442133 - Do not link libkrad, liblber, libldap_r and libsss_nss_idmap to every binary in IPA
• BZ - 1442233 - IPA client commands fail when pointing to replica
• BZ - 1442427 - ipa.ipaserver.install.plugins.adtrust.update_tdo_gidnumber: ERROR Default SMB Group not found
• BZ - 1442815 - Replica install fails during migration from older IPA master
• BZ - 1442932 - ipa restore fails to restore IPA user
• BZ - 1443869 - Command "openssl pkcs12 ..." failed during IPA upgrade
• BZ - 1444432 - CA-less pkinit not installable with --pkinit-cert-file option
• BZ - 1444787 - Update warning message when KRA installation fails
• BZ - 1444791 - Update man page of ipa-kra-install
• BZ - 1444896 - ipa-server-install with external-ca fails in FIPS mode
• BZ - 1444947 - Deadlock between topology and schema-compat plugins
• BZ - 1445358 - ipa vault-add raises TypeError
• BZ - 1445382 - ipa vault-retrieve fails to retrieve data from vault
• BZ - 1445390 - ipa-[ca|kra]-install with invalid DM password break replica
• BZ - 1445397 - GET in KerberosSession.finalize_kerberos_acquisition() must use FreeIPA CA
• BZ - 1445432 - uninstall ipa client automount failed with RuntimeWarning
• BZ - 1446087 - services entries missing krbCanonicalName attribute.
• BZ - 1446137 - pki_client_database_password is shown in ipaserver-install.log
• BZ - 1447284 - Upgrade from ipa-4.1 fails when enabling KDC proxy
• BZ - 1447375 - ipa-client-install: extra space in pkinit_anchors definition
• BZ - 1447703 - Fix SELinux contex of http.keytab during upgrade
• BZ - 1449189 - ipa-kra-install timeouts on replica
• BZ - 1449522 - Deprecate `ipa pkinit-anonymous` command in FreeIPA 4.5+
• BZ - 1449523 - Provide an API command to retrieve PKINIT status in the FreeIPA topology
• BZ - 1449525 - Set directory ownership in spec file
• BZ - 1451228 - ipa-kra-install fails when primary KRA server has been decommissioned
• BZ - 1451279 - otptoken-add-yubikey KeyError: 'ipatokenotpdigits'
• BZ - 1451712 - KRA installation fails on server that was originally installed as CA-less
• BZ - 1451804 - "AttributeError: 'tuple' object has no attribute 'append'" error observed during ipa upgrade with latest package.
• BZ - 1452763 - ipa certmaprule change not reflected in krb5kdc workers
• BZ - 1454483 - rhel73 ipa ui - cannot del server - IPA Error 903 - server_del - TypeError: 'NoneType' object is not iterable
• BZ - 1455045 - Simple service uninstallers must be able to handle missing service files gracefully
• BZ - 1455541 - after upgrade login from web ui breaks
• BZ - 1455862 - "ipa: ERROR: an internal error has occurred" on executing command "ipa cert-request --add" after upgrade
• BZ - 1455945 - Enabling OCSP checks in mod_nss breaks certificate issuance when ipa-ca records are not resolvable
• BZ - 1455946 - Provide a tooling automating the configuration of Smart Card authentication on a FreeIPA master
• BZ - 1456769 - ipaAnchorUUID index incorrectly configured and then not indexed
• BZ - 1457942 - certauth: use canonical principal for lookups
• BZ - 1459153 - Do not send Max-Age in ipa_session cookie to avoid breaking older clients
• BZ - 1461053 - allow to modify list of UPNs of a trusted forest
• BZ - 1462112 - ipaserver installation fails in FIPS mode: OpenSSL internal error, assertion failed: Digest MD4 forbidden in FIPS mode!

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html