RHBA-2019:0190 - Bug Fix Advisory

Topic

An updated ipa package that fixes several bugs is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

• Previously, the source code internally looking for certificates in the LDAP server built a wrong search filter. As a consequence, the "ipa user-find --certificate=<cert>" command failed to find users who had the provided certificate. With this update, the source code that builds the LDAP search filter has been fixed. As a result, the "ipa user-find --certificate=<cert>" command now properly finds users with the provided certificate. (BZ#1659492)
• Previously, the automember commands assumed existence of a hostgroup with the same name as the automember rule. As a consequence, when an automember rule was using a deleted hostgroup, the "ipa automember-rebuild --type=hostgroup" command failed to execute and exited with the following error message:

"Automember rebuild task aborted"

With this update, Identity Management in Red Hat Enterprise Linux provides the new "ipa automember-find-orphans --type=hostgroup" command, which allows to find the automember rules that have a missing host group. The command provides a "--remove" option, which deletes such automember rules. As a result, if you run "ipa member-find-orphans --type=hostgroup --remove" before calling "ipa automember-rebuild", the "ipa automember-rebuild" command succeeds. (BZ#1659499)

• Previously, non-administrator users did not have permissions to find the key recovery authority (KRA) servers. As a consequence, when they tried to access data in a shared vault, the "ipa vault-retrieve" command failed with the following error message:

"ipa: ERROR: an internal error has occurred"

With this update permissions have been added to allow non-administrator users to find the KRA servers. As a result, non-admin users are able to access data stored in a shared vault. (BZ#1659500)

• Previously, the CA certificate was improperly encoded in the "cn=CACert,cn=ipa,cn=etc,$BASEDN" entry. As a consequence, running the "ipa-upgrade" command failed with the following error message:

"unable to convert the attribute u'cACertificate;binary'

With this update, "ipa-upgrade" fixes the value of the wrong encoding in the LDAP server instead of terminating. As a result, "ipa-upgrade" is successful and the wrongly-encoded certificate entry is repaired if necessary. (BZ#1659509)

• Previously, the PKINIT feature required a certificate signed by IPA CA. When enabling the feature, the step replacing the self-signed certificate with a certificate signed by IPA CA failed but was not detected because the certificate file was already present on the file system. As a consequence, the "ipa-pkinit-manage enable" command reported that it succeeded but PKINIT was not properly configured. With this update, "ipa-pkinit-manage enable" ensures that the certificate file is removed and that a new CA-signed certificate is issued. As a result, "ipa-pkinit-manage enable" now successfully configures PKINIT. (BZ#1659511)
• When installing a RHEL 7 replica from a RHEL 6 master, the installer did not check the version of the remote master and used attributes the RHEL 6 master did not understand. As a consequence, the installation of a replica terminated unexpectedly. With this update, the replica installation checks the master version and uses only the attributes supported by the master. As a result, installation of a RHEL 7 replica from a RHEL 6 master is now successful. (BZ#1660389)

Users of ipa are advised to upgrade to these updated packages that fix these bugs.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1659492 - searching for ipa users by certificate fails [rhel-7.6.z]
• BZ - 1659499 - automember-rebuild crashes [rhel-7.6.z]
• BZ - 1659511 - ipa-pkinit-manage reports a switch from local pkinit to full pkinit configuration was successful although it was not. [rhel-7.6.z]
• BZ - 1660389 - ipa-replica-install fails migrating RHEL 6 to 7 [rhel-7.6.z]

CVEs

(none)

References

(none)