The FreeIPA Project is proud to announce the latest release of the
FreeIPA. As always, the latest tarball can be found at http://freeipa.org/
FreeIPA 2.1 is available in Fedora 15. It is currently in the
updates-testing repository along with a number of its dependencies.
Fedora 16 and rawhide builds will be coming soon.
== Highlights ==
* General client and server installation improvements. Server
installation is significantly faster.
* Improved support for IPv6.
* General UI improvements related to navigation and work flow.
* Added UI for automount.
* A Host-based Access Control (HBAC) test tool
* Deprecation of HBAC deny rules
* A CA is no longer required on every replica and may be added
post-install to a replica (see ipa-ca-install).
* A new replication tool for dogtag has been added (ipa-cs-manage).
This allows you to control the replication topology of your CA.
== Upgrading ==
=== Server ===
To upgrade a 2.0.0 or 2.0.1 server do the following:
# yum update freeipa-server --enablerepo=updates-testing
This will pull in updated freeIPA, 389-ds, dogtag, libcurl and xmlrpc-c
packages (and perhaps some others). A script will be executed in the rpm
postinstall phase to update the IPA LDAP server with any required changes.
There is a bug reported against 389-ds,
https://bugzilla.redhat.com/show_bug.cgi?id=730387, related to
read-write locks. The NSPR RW lock implementation does not safely allow
re-entrant use of reader
locks. This is a timing issue so it is difficult to predict. During
testing one user experienced this and the upgrade hung. To break the
hang kill the ns-slapd process for your realm, wait for the yum
transaction to complete, then restart 389-ds and manually run the update
process:
# service dirsrv start
# ipa-ldap-updater
=== Client ===
The ipa-client-install tool in the ipa-client package is just a
configuration tool. There should be no need to re-run this on every
client already enrolled.
== Detailed Changelog ==
Adam Young (62):
* Fixed labels for sudo and hbac rules
* update metadata with label changes
* define entities using builder and more declarative syntax
* default all false no longer default to all: true for searches, only
specify it for user searches
* code review fixes
* make use of new user-find columns.
* fix JSL error
* Upgrade to jquery 1.5.2
* action panel to top tabs
* remove jquery-cookie library
* update ipa init a simple script to update the metatdate et alles
that come
s from the ipa_init batch call
* whitespace and -x removal
* create entities on demand. fixed changes from code review
* automount UI
* redirect on show error.
* redirect on error Code for redirecting on error has been moved to
IPA.face
t so it can be called from both details and assocaiton facets.
* automount delete key indirect automount maps
* scrollable content areas
* dialog scrolling table
* JSON marshalling list
* dns multiple records show multiple records that share the same dnsname
* no redirect on search
* test for dirty
* test dirty textarea runs the testdirty check before setting the undo
tag for a textarea
* test dirty multivalue test the multivalue widgets for changes before
showing the undo link.
* test dirty onchange
* entity select widget for manager
* hide automount tabs.
* service host entity select Use the entity select widget for add service
* entity select undo
* no redirect on unknown error If the error name is indicates a server
wide error, do not attempt to redirect.
* editable entity_select
* ipaddress for host add
* entity select for password policy
* tooltips for host add
* automountkey details
* identify target as section for permissions
* optional uid
* validate required fields
* Generate record type list from metadata
* shorten url cache state in a javascript variable, and leave on
information about the current entity in the URL hash params
* containing entity pkeys
* undefined pkeys
* config fields
* ipadefaultemaildomain
* config widgets entity select default group checkbox for migration
* entity link for password policy
* validate ints
* password expiration label
* HBAC deny warning
* check required on add
* clear errors on reset
* indirect admins
* entity_select naming
* remove HBAC warning from static UI
* dnsrecord-mod ui
* no dns
* remove hardcoded DNS label for record name.
* move dns to identity tab
* removing setters setup and init
* dns section header i18n.
* use other_entity for adder columns
Alexander Bokovoy (10):
* Convert Bool to TRUE/FALSE when working with LDAP backend
* Minor typos in the examples
* Convert nsaccountlock to always work as bool towards Python code
* Rearrange logging for NSCD daemon.
* Fix sssd.conf to always have IPA certificate for the domain.
* Add hbactest command.
* Modify /etc/sysconfig/network on a client when IPA manages hostname
* Make proper LDAP configuration reporting for ipa-client-install
* Ensure network configuration file has proper permissions
* Pass empty options as empty arrays for supported dns record types.
Endi S. Dewata (114):
* Fixed undefined label in permission adder dialog box.
* Initial Selenium test cases.
* Added functional test runner.
* Refactored action panel and client area.
* Refactored builder interface.
* Refactored search facet.
* Entitlements.
* Updated Selenium tests.
* Merged IPA.cmd() into IPA.command().
* Entitlement registration.
* Entitlement import.
* Entitlement download.
* Moved adder dialog box into entity.
* Standardized action panel buttons creation.
* Entitlement quantity validation.
* Refactored navigation.
* Use entity names for tab state.
* Moved entity contents outside navigation.
* Added facet container.
* Fixed self-service UI.
* Updated Selenium tests.
* Updated Selenium tests.
* Updated DNS interface.
* Added Selenium tests for DNS.
* Added UUID field for entitlement registration.
* Added Self-Service and Delegation tests.
* Customizable facet groups.
* Read-only association facet.
* jQuery ordered map.
* Fixed problem disabling HBAC and SUDO rules.
* Fixed Ajax error handling.
* Fixed details tests.
* Fixed adder dialog title.
* Fixed Add and Edit without primary key.
* Fixed Selenium tests.
* Fixed URL parameter parsing.
* Added Update and Reset buttons into Dirty dialog.
* Fixed problem deleting value in text field.
* Added pagination for associations.
* Fixed pagination problem.
* Temporary fix for indirect member tabs.
* Fixed blank dialog box on internal error.
* Fixed resizing issues.
* Added selectable option for table widget.
* Entitlement status.
* Fixed tab navigation.
* Fixed build break.
* Fixed paging for indirect members.
* Renamed associate.js to association.js.
* Fixed self-service links.
* Merged direct and indirect association facets
* Storing page number in URL.
* Removed FreeWay font files.
* Fixed problem with navigation tabs on reload.
* Converted entity header into facet header.
* Added navigation breadcrumb.
* Added record count into association facet tabs.
* Added singular entity labels.
* Fixed entity labels.
* Fixed DNS records page title.
* Fixed undo all problem.
* Removed unused images.
* Fixed hard-coded messages.
* Added confirmation dialog for user activation.
* Fixed button style in Entitlements
* Removed invalid associations.
* Added arrow icons for details sections.
* Fixed object_name usage.
* Fixed HBAC/Sudo rules associations.
* Fixed blank self-service page.
* Fixed dirty dialog problems in HBAC/Sudo rules.
* Fixed test fixture file name.
* Fixed missing entitlement import button label
* Added sudo options.
* Fixed collapsed table in Chrome.
* Fixed object_name and object_name_plural internationalization
* Fixed label capitalization
* Entity select widget improvements
* Removed reverse zones from host adder dialog.
* Fixed host details fields.
* Added checkbox to remove hosts from DNS.
* Creating reverse zones from IP address.
* Removed entitlement registration UUID field.
* Fixed problem loading data in HBAC/sudo details page.
* Removed HBAC access time code.
* Removed custom layouts using HTML templates.
* Refactored IPA.current_facet().
* Fixed problem with navigation state loading.
* Fixed navigation problems.
* Fixed navigation unit test.
* Fixed click handlers on certificate buttons.
* New icons for entitlement buttons
* Fixed problem bookmarking Policy/IPA Server tabs
* Fixed problem setting host OTP.
* Fixed hard-coded labels in sudo rules.
* Fixed hard-coded label in Find button.
* Fixed missing section header in sudo command group.
* Fixed problem unprovisioning service.
* Fixed missing memberof definition in HBAC service.
* Added association facets for HBAC and sudo.
* Fixed certificate buttons.
* Fixed missing icons.
* Fixed misaligned search icon.
* Resizable adder dialog box.
* Linked entries in HBAC/sudo details page.
* Fixed 3rd level tab style.
* Fixed facet group labels.
* Fixed error after login on IE
* Fixed host adder dialog.
* Fixed DNS zone adder dialog.
* Fixed broken links in ipa_error.css and ipa_migration.css.
* Fixed problem clicking 3rd level tabs.
* Fixed link style in dialog box.
* Fixed problem with buttons in enrollment dialog.
Jakub Hrozek (1):
* Remove wrong kpasswd sysconfig
Jan Cholasta (34):
* Fix wording of error message.
* Add note about ipa-dns-install to ipa-server-install man page.
* Fix typo in ipa-server-install.
* Fix uninitialized variables.
* Fix double definition of output_for_cli.
* Add lint script for static code analysis.
* Fix lint false positives.
* Remove unused classes.
* Fix some minor issues uncovered by pylint.
* Fix uninitialized attributes.
* Run lint during each build.
* Several improvements of the lint script.
* Fix issues found by Coverity.
* Fix regressions introduced by pylint false positive fixes.
* Assume ipa help for plugins.
* Parse netmasks in IP addresses passed to server install.
* Honor netmask in DNS reverse zone setup.
* Do stricter checking of IP addressed passed to server install.
* Fix directory manager password validation in ipa-nis-manage.
* Improve IP address handling in the host-add command.
* Verify that the hostname is fully-qualified before accessing the
service information in ipactl.
* Remove redundant configuration values from krb5.conf.
* Replace the 'private' option in netgroup-find with 'managed'.
* Configure SSSD to store user password if offline.
* Fix creation of reverse DNS zones.
* Add ability to specify DNS reverse zone name by IP network address.
* Fix exit status of ipa-nis-manage enable.
* Update minimum required version of python-netaddr.
* Clean up of IP address checks in install scripts.
* Don't delete NIS netgroup compat suffix on 'ipa-nis-manage disable'.
* Fix ipa-compat-manage not working after recent ipa-nis-manage change.
* Make sure that hostname specified by user is not an IP address.
* Fix external CA install.
* Ask for reverse DNS zone information in attended install right after
asking for DNS forwarders, so that DNS configuration is done in one place.
John Dennis (9):
* Module for DN objects plus unit test
* assert_deepequal supports callback for equality testing
* Add backslash escape support for cvs reader
* Use DN class in get_primary_key_from_dn to return decoded value
* Update test_role_plugin test to include a comma in a privilege
* Ticket 1485 - DN pairwise grouping
* Make AVA, RDN & DN comparison case insensitive. No need for
lowercase normalization.
* Clean up existing DN object usage
* transifex translation adjustment
Jr Aquino (15):
* Escape LDAP characters in member and memberof searches
* Add memberHost and memberUser to default indexes
* Optimize and dynamically verify group membership
* Delete the sudoers entry when disabling Schema Compat
* Return copy of config from ipa_get_config()
* Typo in host_nis_groups has been creating 2 CN's
* Add sudorule and hbacrule to memberof and indirectmemberof attributes
* Display remaining external hosts when removing from sudorule
* Raise DuplicateEntry Error when adding a duplicate sudo option
* Don't add empty tuple to entry_attrs['externalhost']
* oneliner correct typo in ipasudorunas_group
* Return correct "RunAs External Group" when removing members
* remove escapes from the cvs parser in ipaserver/install/ldapupdate
* Correct behavior for sudorunasgroup vs sudorunasuser
* Correct sudo runasuser and runasgroup attributes in schema
Martin Kosek (68):
* Inconsistent error message for duplicate user
* Replica installation fails for self-signed server
* Remove doc from API.txt
* Revert "Remove doc from API.txt"
* Password policy commands do not include cospriority
* Improve DNS PTR record validation
* Remove unwanted trimming in text fields
* Need force option in DNS zone adder dialog
* IPA replica is not started after the reboot
* Improve Directory Service open port checker
* Log temporary files in ipa-client-install
* Prevent uninstalling client on the IPA server
* pwpolicy-mod doesn't accept old attribute values
* Forbid reinstallation in ipa-client-install
* ipa-client-install uninstall does not work on IPA server
* LDAP Updater may crash IPA installer
* NS records not updated by replica
* Bad return values for ipa-rmkeytab command
* Update spec with missing BuildRequires for pylint check
* Let selinux-policy handle port 7390
* Limit passwd plugin to user container
* Consolidate man pages and IPA tools help
* Remove doc from API.txt
* Improve service manipulation in client install
* Running ipa-replica-manage as non-root cause errors
* KDC autodiscovery may fail when domain is not realm
* A new flag to disable creation of UPG
* Fix reverse zone creation in ipa-replica-prepare
* Improve interactive mode for DNS plugin
* Localization fails for MaxArgumentError
* Fix forward zone creation in ipa-replica-prepare
* Connection check program for replica installation
* Fix support for nss-pam-ldapd
* Skip know_host check for ipa-replica-conncheck
* IPA installation with --no-host-dns fails
* Handle LDAP search references
* Add ignore lists to migrate-ds command
* Improve DNS zone creation
* Add a list of managed hosts
* Missing krbprincipalname when uid is not set
* Add port 9443 to replica port checking
* Fix doc for sudorule runasuser commands
* Improve IP address handling in IPA option parser
* Multi-process build problems
* DNS installation fails when domain and host domain mismatch
* Fix IPA install for secure umask
* Allow recursion by default
* Add DNS record modification command
* Filter reverse zones in dnszone-find
* Remove sensitive information from logs
* Fix ipa-dns-install
* Fix self-signed replica installation
* Check IPA configuration in install tools
* Add new dnszone-find test
* Fix typo in ipa-replica-prepare
* Improve long integer type validation
* Fix sudorule-remove-user
* Add missing automount summaries
* Fix man page ipa-csreplica-manage
* Fix automountkey commands summary
* Fix invalid issuer in unit tests
* Hide continue option from automountkey-del
* Improve error message in ipactl
* Improve dnszone-add error message
* Fix idnsUpdatePolicy for reverse zone record
* Fix client enrollment
* Update 389-ds-base version
* Update pki-ca version
Nalin Dahyabhai (1):
* Select a server with a CA on it when submitting signing requests.
Pavel Zuna (1):
* Fix gidnumber option of user-add command.
Petr Vobornik (3):
* fixed empty dns record update
* Fixed adding host without DNS reverse zone
* Redirection after changing browser configuration
Rich Megginson (3):
* winsync enables disabled users in AD
* modify user deleted in AD crashes winsync
* memory leak in ipa_winsync_get_new_ds_user_dn_cb
Rob Crittenden (90):
* Allow a client to enroll using principal when the host has a OTP
* Make retrieval of the CA during DNS discovery non-fatal.
* Cache the value of get_ipa_config() in the request context.
* Change default gecos from uid to first and last name.
* Fix ORDERING in some attributetypes and remove other unnecessary
elements.
* postalCode should be a string not an integer.
* Fix traceback in ipa-nis-manage.
* Suppress --on-master from ipa-client-install command-line and man page.
* Sort entries returned by *-find by the primary key (if any).
* The default groups we create should have ipaUniqueId set
* Always ask members in LDAP*ReverseMember commands.
* Provide attributelevelrights for the aci components in permission_show.
* Wait for memberof task and DS to start before proceeding in
installation.
* Convert manager from userid to dn for storage and back for displaying.
* Modify the default attributes shown in user-find to match the UI design.
* Ensure that the zonemgr passed to the installer conforms to IA5String.
* Handle principal not found errors when converting replication a
greements
* Bump version to 2.0.90 to distinguish between 2.0.x
* Properly handle --no-reverse being passed on the CLI in interactive mode
* Update min nvr for selinux-policy and pki-ca for F-15+
* Test for forwarded Kerberos credentials cache in wsgi code.
* Properly configure nsswitch.conf when using the --no-sssd option.
* Enable 389-ds SSL host checking by defauilt
* Configure Managed Entries on replicas.
* Document that deleting and re-adding a replica requires a dirsrv
restart.
* Fix migration to work between v2 servers and remove search/size limits.
* Add option to limit the attributes allowed in an entry.
* Include the word 'member' with autogenerated optional member labels.
* Do a lazy retrieval of the LDAP schema rather than at module load.
* Add UID, GID and e-mail to the user default attributes.
* Fix external CA installation
* Remove root autobind search restriction, fix upgrade logging & error
handling
* Support initializing memberof during replication re-init using GSSAPI
* Do better detection on status of CA DS instance when installing.
* Fix indirect member calculation
* Remove automountinformation as part of the DN for automount.
* Don't let a JSON error get lost in cascading errors.
* Add message output summary to sudorule del, mod and find.
* Return an error message when revocation reason 7 is used
* Require an imported certificate's issuer to match our issuer.
* On a master configure sssd to only talk to the local master.
* The IP address provided to ipa-server-install must be local
* Do lazy LDAP schema retrieval in json handler.
* Make data type of certificates more obvious/predictable internally.
* Update translation files
* Let the framework be able to override the hostname.
* Make dogtag an optional (and default un-) installed component in a
replica.
* Slight performance improvement by not doing some checking in
production mode
* Set the client auth callback after creating the SSL connection.
* Add pwd expiration notif (ipapwdexpadvnotify) to config plugin def
attr list
* Enforce class rules when query=True, continue to not run validators.
* find_entry_by_attr() should fail if multiple entries are found
* Fix error in AttrValueNotFound exception example
* Fix test failure in updater when adding values to a single-value attr
* Reset failed login count to 0 when admin resets password.
* Disallow direct modifications to enrolledBy.
* Document registering to an entitlement server with a UUID as not
implemented.
* In sudo labels we should use RunAs and not Run As.
* Remove the ability to create new HBAC deny rules.
* Validate that the certificate subject base is in valid DN format.
* Use information from the certificate subject when setting the NSS
nickname.
* Create tool to manage dogtag replication agreements
* Fix failing tests due to object name changes
* Set nickname of the RA to 'IPA RA' to avoid confusion with dogtag RA
* Set the ipa-modrdn plugin precedence to 60 so it runs last
* Generate a database password by default in all cases.
* Specify the package name when the replication plugin is missing.
* Change client enrollment principal prompt to hopefully be clearer.
* Optionally wait for 389-ds postop plugins to complete
* A removed external host is shown in output when removing external hosts.
* Don't set krbLastPwdChange when setting a host OTP password.
* Fix regression when calculating external groups.
* With the external user/group management fixed, correct the unit tests.
* Set a default minimum value for class Int, handle long values better.
* Make ipa-client-install error messages more understandable and relevant.
* Add Alexander Bokovoy and Jan Cholasta to contributors file
* Only call entry_from_entry() after waiting for the new entry.
* Hide the HBAC access type attribute now that deny is deprecated.
* Autofill the default revocation reason
* Don't check for leading/trailing spaces in a File parameter
* Add an arch-specific Requires on cyrus-sasl-gssapi
* Revert use of 'can be at least' to 'must be at least' in minvalue
validator
* Don't leave dangling map if adding an indirect map fails
* Fix message in test case for checking minimum values
* When setting a host password don't set krbPasswordExpiration.
* Set minimum version of pki-ca to 9.0.10 to pick up new ipa cert profile
* Deprecated managing users and runas user/group in sudorule add/mod
* Fix date order in changelog.
* Re-arrange CA configuration code to reduce the number of restarts.
Simo Sorce (4):
* Fix resource leaks.
* ipautil: Preserve environment unless explicitly overridden by caller.
* install-scripts: avoid using --list with chkconfig
* Don't set the password expiration to the current time
Yuri Chornoivan (1):
* Typos in freeIPA messages and man page
Kyle Baker (5):
* Background images and tab hover
* Search bar style and positioning changes
* List page spacing changes
* Tab and spacing on list
* Facet icon swap and tab sizing
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
