RHBA-2017:2935 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

• Previously, the race condition during the IdM (Identity Management) installation caused that the required entry was not present at the time it was requested from the database. Consequently, the IdM installation failed. The bug has been fixed, and the installation now continues only when the required entry is present. (BZ#1486794)
• Previously, the "ipa config-mod --ca-renewal-master-server hostname" command failed on a replica. Consequently, the administrator could not configure the replica as Certificate Authority renewal master. To fix this bug, the parameters were passed in the expected format. As a result, using the "ipa config-mod --ca-renewal-master-server hostname" command is now successful. (BZ#1489300)
• Previously, when switching from an externally signed Certificate Authority (CA) to self-signed CA, the "ipa-cacert-manage renew --self-signed" command failed. As a consequence, it was not possible to switch from the externally signed CA to the self-signed CA. To fix this bug, the CA helper has been fixed to properly handle certificate trust flags. As a result, it is now possible to switch from the externally signed CA to a self-signed CA. (BZ#1489815)
• Previously, when upgrading to Red Hat enterprise Linux 7.4, the upgrade of IdM server failed, if there was a duplicate entry containing the IdM CA certificate. Consequently, the upgrade script did not complete, and the IdM services did not restart. The upgrade script has been fixed to remove duplicate entries, and to use consistent names for IdM CA certificate. As a result, the upgrade is now successful.(BZ#1489817)
• Previously, when gradually upgrading from Red Hat Enterprise Linux 7.0 to 7.4 version with the IdM installed, the IdM web user interface (WebUI) failed. To fix this bug, the IdM updater has been changed to automatically add the Directory Server (DS) whoami plug-in in case it is missing. As a result, the WebUI now works as expected. (BZ#1490331)
• Previously, the IdM WebUI did not work after upgrading from version 4.4. to 4.5. Consequently, it was not possible to log in into WebUI. To fix this bug, the /etc/sssd/sssd.conf file has been configured to contain the right attributes. As a result, it is now possible to log in to WebUI. (BZ#1491545)
• When upgrading to Red Hat Enterprise Linux 7.4, the IdM upgrade script failed because it did not accept the HTTPD and LDAP server certificates nicknames different from 'Server-Cert'. Consequently, the upgrade script did not complete successfully, and IdM services were not restarted. The bug has been fixed, and the upgrade now succeeds with the server certificates nicknames different from 'Server-Cert'. (BZ#1493153)
• Previously, when using the "ipa help" command for the first time, the help message did not appear. The bug has been fixed to correctly display the help message even if no cache is present. As a result, the help message is displayed even when using the command for the first time. (BZ#1493411)
• Prior to this update, IdM did not operate with the IPv6 stack disabled on the machine due to the use of a unified Linux networking API to handle both IPv6 and IPv4 connections. Consequently, it was not possible to upgrade the Red Hat Enterprise Linux IdM. The bug has been fixed, and validation of the IPv6 stack now works as expected. (BZ#1493410)
• Previously, when trying to add new One-Time Password (OTP) token from the OATH-compliant PSKC XML file, the import failed. The bug has been fixed, and OTP token is now imported successfully. (BZ#1492616)

Users of ipa are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1486794 - [ipa-replica-install] - 406 Client Error: Failed to validate message: Incorrect number of results (0) searching forpublic key for host [rhel-7.4.z]
• BZ - 1489300 - Unable to set ca renewal master on replica [rhel-7.4.z]
• BZ - 1489815 - TypeError in renew_ca_cert prevents from swiching back to self-signed CA [rhel-7.4.z]
• BZ - 1489817 - ipa-server-upgrade failes with "This entry already exists" [rhel-7.4.z]
• BZ - 1490331 - FreeIPA/IdM installations which were upgraded from versions with 389 DS prior to 1.3.3.0 doesn't have whomai plugin enabled and thus startup of Web UI fails [rhel-7.4.z]
• BZ - 1493153 - Updating from RHEL 7.3 fails with Server-Cert not found (ipa-server-upgrade) [rhel-7.4.z]
• BZ - 1493410 - ipa-server-upgrade timeouts on wait_for_open ports expecting IPA services listening on IPv6 ports [rhel-7.4.z]
• BZ - 1493411 - ipa help command returns traceback when no cache is present [rhel-7.4.z]

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html