diff --git a/src/index.rst b/src/index.rst index 58e61729..17c638fa 100644 --- a/src/index.rst +++ b/src/index.rst @@ -52,6 +52,7 @@ Releases .. toctree:: :titlesonly: + /release-notes/4-13-2.rst /release-notes/4-13-1.rst /release-notes/4-13-0.rst /release-notes/4-12-5.rst @@ -60,8 +61,6 @@ Releases /release-notes/4-12-2.rst /release-notes/4-12-1.rst /release-notes/4-11-2.rst - /release-notes/4-12-0.rst - Getting involved ---------------- diff --git a/src/release-notes/4-13-2.rst b/src/release-notes/4-13-2.rst new file mode 100644 index 00000000..a24ff809 --- /dev/null +++ b/src/release-notes/4-13-2.rst @@ -0,0 +1,702 @@ +FreeIPA 4.13.2 +============== + +.. raw:: mediawiki + + {{ReleaseDate|2026-07-15}} + +The FreeIPA team would like to announce FreeIPA 4.13.2 release! + +It can be downloaded from http://www.freeipa.org/page/Downloads. Builds +for Fedora distributions will be available from the official repository +soon. + +.. _highlights_in_4.13.2: + +Highlights in 4.13.2 +-------------------- + +* https://codeberg.org/freeipa/freeipa/issues/10009 +When using passwordless authentication methods (PKINIT, passkey, IDP, +RADIUS), the KDC was rejecting pre-auth requests if the user's password +was expired, even though these methods don't use passwords. +The fix ensures that: + + Passwordless methods are never blocked by an expired password. + Password expiration is still enforced when a password-based method + (password, OTP, hardened) is actually used, even if passwordless + methods are also configured. + +* https://pagure.io/freeipa/issue/9989 +Fix RHEL 8.10 to RHEL 9.8 migration in FIPS mode + +* WebUI hardening: httpd configuration has been updated with various configuration options that improve security. + +-------------- + +.. _known_issues: + +Known Issues +~~~~~~~~~~~~ + +* https://codeberg.org/freeipa/freeipa/issues/9920 Failure to sign DNS zone with softhsm 2.7.0 rc1 + +.. _bug_fixes: + +Bug fixes +~~~~~~~~~ + +FreeIPA 4.13.2 is a stabilization release for the features delivered as a +part of 4.13 version series. + +There are more than 60 bug-fixes since FreeIPA 4.13.1 release. Details +of the bug-fixes can be seen in the list of resolved tickets below. + +Upgrading +--------- + +Upgrade instructions are available on +`Upgrade `__ page. + +Feedback +-------- + +Please provide comments, bugs and other feedback via the freeipa-users +mailing list +(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) +or #freeipa channel on libera.chat. + +.. _resolved_tickets: + +Resolved tickets +---------------- + +- `#8092 `__ Nightly test + failure in + test_webui/test_loginscreen.py::TestLoginScreen::()::test_reset_password_and_login_view +- `#9529 `__ Nightly test + failure (rawhide) in + test_webui/test_hostgroup.py::test_hostgroup::test_names_and_button +- `#9572 `__ RPM should use + sysusers to create accounts +- `#9749 `__ add "SameSite" + flag to ipa_session cookies +- `#9786 `__ Rawhide: test + failure in test_integration/test_installation.py::TestInstallWithoutNamed +- `#9820 `__ ipalockout_postop + is incorrectly warning about locked users +- `#9828 `__ ipa-migrate tool + is renaming host records & host info in automount information +- `#9829 `__ Nightly test + failure (rawhide): multiple webui tests failures with firefox 141 +- `#9832 `__ IPA compatibility + with tomcat 10 +- `#9837 `__ Default parameter + removes certificates found via cert_find._cert_search +- `#9845 `__ ipatests: Port + downstream ipa-trust-functional test suite. +- `#9897 `__ Server version + information disclosure +- `#9898 `__ Header + X-Content-Type-Options is not set +- `#9900 `__ Refine multiple + CSP directives +- `#9901 `__ CSP: failure to + define form-action directive which has no fallback +- `#9904 `__ Test failure in + test_edns.py::TestDNSOverTLS_EnforcedPolicy_IPA_CA::test_dot_enforced_dns_policy_with_ipa_ca +- `#9906 `__ ipa-otpd crash on + passkey auth +- `#9911 `__ ipatests: Port + downstream bash-dns test suite. +- `#9916 `__ Azure WebUI tests + failing +- `#9917 `__ ipatests: Port + downstream bash ipa-trust-func-\*test suite. +- `#9919 `__ ipa cert-find + --certificate= throws +- `#9921 `__ ipa uninstallation + is failing with message "'NoneType' object has no attribute 'lower'" +- `#9922 `__ ipatests: add + OTP-based replica promotion coverage +- `#9923 `__ ipa-advise client + script requires keytab (should just require root access on client system) +- `#9924 `__ Names of domains + from a trusted forest should be compared case-insensitive +- `#9925 `__ Remove deprecated + license classifiers. +- `#9929 `__ IdM password + policy Min lifetime is not enforced when high minlife is set +- `#9930 `__ ipatests: Port + downstream bash-ipa-join test suite. +- `#9931 `__ Add + ipa-delegation-cli bash test to upstream xmlrpc test. +- `#9935 `__ When using xmlrpc, + ipa server failed with assert type(value) in (unicode, float, int, bool, + type(None)) +- `#9936 `__ Code analysis + issue in ipa-4.9 +- `#9938 `__ ipa-migrate + doesn't process users' sshpublickeys +- `#9939 `__ FreeIPA fails to + build on rawhide because of missing npm command +- `#9941 `__ PRCI fails on + AzurePipeline.freeipa (Docs) due to module absense +- `#9942 `__ Replica + installation: failure in replica conncheck +- `#9943 `__ Pruning is enabled + by default with RSN +- `#9944 `__ Test failure in + test_integration/test_dns.py::TestDNSMisc::test_allow_query_transfer_ipv6 +- `#9945 `__ ipatests: Port + bash ipa-self-service testsuite. +- `#9946 `__ Regression in + test_integration/test_pwpolicy.py::TestPWquality::test_graceperiod_not_replicated +- `#9947 `__ webui tests: + regression in + test_webui/test_pwpolicy.py::test_pwpolicy::test_negative_value +- `#9948 `__ Extend SELinux + policy to allow use of SSSD authentication helpers on non-enrolled hosts +- `#9949 `__ freeipa-client + %triggerin and %post can fail (rpm scriptlets should never fail, by policy) +- `#9950 `__ [ipatests] support + for pytest 9 +- `#9952 `__ ipatests: Port + downstream bash-netgroup-cli test suite. +- `#9953 `__ Adding a group + with 32Bit Idrange fails. +- `#9954 `__ ipa-migrate + doesn't properly handle replication conflicts +- `#9955 `__ ipa-migrate + doesn't migrate IPA locations +- `#9957 `__ ipatests: Add + downstream bash ipa-getkeytab/ipa-rmkeytab CLI test suite +- `#9958 `__ ipa-migrate + doesn't migrate custom kerberos password policies +- `#9959 `__ ipatests: Port + downstream bash-ipa-i18n test suite. +- `#9962 `__ race condition + with wrong error code during deployment +- `#9964 `__ ipatests: + Additional tests for ipa-ipa migration scenarios +- `#9965 `__ ipatests: Include + testscenario for ipa-migrate-ds +- `#9968 `__ ipatests: Port + downstream bash-ipa-getcert test suite to upstream +- `#9970 `__ Nightly test + failure (f45+) in + test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client +- `#9972 `__ Nightly failure in + test_replica_promotion.py::TestReplicaPromotionRandomPassword::test_replica_two_step_install +- `#9974 `__ ipa ca-show ipa + --all failing to list RSN version +- `#9979 `__ Schema + Compatibility plugin disabling failed while ipa-server-upgrade command +- `#9980 `__ Test failure in + test_trust_functional.py::TestTrustFunctionalUser::test_su_ad_user (f45+) +- `#9981 `__ Test failure for + test_ad_user_in_posix_group_fully_qualified +- `#9982 `__ Disable TRACE + method +- `#9983 `__ Nightly test + failure (f45+) because of CryptographyDeprecationWarning +- `#9989 `__ ipa-replica-install + fails in mixed RHEL 8.10 to RHEL 9.8 FIPS environment +- `#9992 `__ Move testing to + fedora 44 +- `#9995 `__ ipatests: + testReplicaInForwardZone fails on RHEL teardown: NetworkManager rewrites + /etc/resolv.conf after ipa-replica-install --setup-dns +- `#10007 `__ Selection of + authentication indicators on the host/computer object disappears in GUI after + a few minutes +- `#10008 `__ Nightly test + failure in + test_webui/test_translation.py::TestUnauthorizedPage::test_long_text_of_unauthorized_page +- `#10009 `__ Passwordless + pre-authentication is blocked when user has an expired password +- `#10010 `__ ipatests: + test_EPN_starttls and test_EPN_ssl fail in FIPS mode due to Postfix MD5 TLS + fingerprint digest +- `#10011 `__ Fix inverted + SSSD xfail in SELinux trust integration tests + +.. _detailed_changelog_since_4.13.1: + +Detailed changelog since 4.13.1 +------------------------------- + +.. _am_rico_monteiro_1: + +Américo Monteiro (1) +~~~~~~~~~~~~~~~~~~~~~ + +- Translated using Weblate (Portuguese) + `commit `__ + +.. _alexander_bokovoy_6: + +Alexander Bokovoy (6) +~~~~~~~~~~~~~~~~~~~~~ + +- ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized + `commit `__ + `#9962 `__ +- SELinux: expand policy coverage for sssd_mfa_t domain + `commit `__ +- SELinux: wrap bare gen_require blocks in optional_policy in dnskey section + `commit `__ + `#9948 `__ +- SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers + `commit `__ +- ipa-sam: use internal Samba method to populate in-memory keytab + `commit `__ +- SELinux: expand policy coverage for Kerberos usage + `commit `__ + `#9948 `__ + +.. _anuja_more_6: + +Anuja More (6) +~~~~~~~~~~~~~~ + +- ipatests: add Azure Entra IdP integration tests + `commit `__ + `#8803 `__ +- ipatests: xfail trust sudo/HBAC tests when SSSD is below 2.12 + `commit `__ +- ipatests: add SSH/GSSAPI AD trust integration tests. + `commit `__ + `#9845 `__ +- ipatests: increase timeout for PR-CI. + `commit `__ +- ipatests: add HTTP GSSAPI Kerberos authentication tests with AD trust + `commit `__ + `#9845 `__ +- ipatests: add Random Password based replica promotion coverage + `commit `__ + `#9922 `__ + +.. _antonio_torres_1: + +Antonio Torres (1) +~~~~~~~~~~~~~~~~~~ + +- Back to git snapshots + `commit `__ + +.. _aleksandr_sharov_4: + +Aleksandr Sharov (4) +~~~~~~~~~~~~~~~~~~~~ + +- ipa-migrate: migrate custom kerberos password policies + `commit `__ + `#9958 `__ +- ipa-migrate: ignore replication conflicts + `commit `__ + `#9954 `__ +- ipa-migrate: migrate DNS locations + `commit `__ + `#9955 `__ +- ipa-migrate: migrate ssh public keys for users and overrides + `commit `__ + `#9938 `__ + +.. _david_hanina_19: + +David Hanina (19) +~~~~~~~~~~~~~~~~~ + +- ipatests: Fix webui hostgroup + `commit `__ + `#9529 `__ +- ipatests: unauthorized page through httpd + `commit `__ + `#10008 `__ +- Add referrer-policy + `commit `__ +- Disable Trace method + `commit `__ + `#9982 `__ +- Fix unauthorized error page + `commit `__ +- Fix naive Referer check bypass in rpcserver + `commit `__ +- Enforce Same-Site cookie + `commit `__ + `#9749 `__ +- ipatests: Change the xfail version to sssd 2.12.0 + `commit `__ + `#9981 `__ +- Disallow retrieving software versions + `commit `__ + `#9897 `__ +- Fix flaky notification assert for webui + `commit `__ + `#8092 `__ +- Fix ipa ca-show ipa --all not listing RSN version + `commit `__ + `#9974 `__ +- Allow 32bit gid + `commit `__ + `#9953 `__ +- Return code 0 for all failing scriplets + `commit `__ + `#9949 `__ +- Wait until buttons are clickable + `commit `__ + `#9829 `__ +- Replace None with '' when uninstalling CA + `commit `__ + `#9921 `__ +- Fix cert-find retrieval + `commit `__ + `#9837 `__ +- Remove navigation tests + `commit `__ +- Fix QUnit import + `commit `__ + `#9916 `__ +- Return nothing if certificate is empty + `commit `__ + `#9919 `__ + +.. _erik_belko_2: + +Erik Belko (2) +~~~~~~~~~~~~~~ + +- ipatests: Add AD trust NFS automount integration tests + `commit `__ +- ipatests: Add ipa-getcert request tests for NSS storage + `commit `__ + `#9968 `__ + +.. _florence_blanc_renaud_33: + +Florence Blanc-Renaud (33) +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +- freeipa.spec: bump samba version + `commit `__ +- prci definitions: increase test_sudo timeout + `commit `__ +- ipatests: split test_commands into 2 jobs + `commit `__ +- ipatests: xfail TestInstallDNSSECFirst + `commit `__ +- CI: switch testing from fedora 43 to fedora 44 + `commit `__ + `#9992 `__ +- Spec file: move named-related files to server-dns package + `commit `__ + `#9786 `__ +- ipatests: use either cafile or capath for ssl connection + `commit `__ +- ipatests: adapt to psutil + `commit `__ +- Azure CI: Use Fedora 44 + `commit `__ + `#9992 `__ +- replica conncheck: use crypto-policies in temp krb5.conf + `commit `__ + `#9989 `__ +- prci definitions: extend test_commands timeout to 6000s + `commit `__ +- constants: Use 24-byte key to check id TripleDES is supported + `commit `__ + `#9983 `__ +- ipatests: adapt the expected output message + `commit `__ + `#9980 `__ +- ipatests: fix the method add_a_record + `commit `__ + `#9972 `__ +- ipatests: adapt expected output for test_smb + `commit `__ + `#9970 `__ +- CI definitions: split ipa_ipa_migrate into 2 jobs + `commit `__ +- ipatests: fix migration test + `commit `__ + `#9964 `__ +- Read The Docs: use ubuntu-24.04 instead of ubuntu-20.04 + `commit `__ +- ipatests: Add selfservice-find cli tests to xmlrpc Add a new Declarative test class test_selfservice_cli_find covering CLI-level behaviour of the selfservice-find command: + `commit `__ + `#9945 `__ +- ipatests: fix the topology for test_32bit_idranges + `commit `__ +- ipa-migrate: normalize objectClass before building the list + `commit `__ + `#9954 `__ +- Azure CI: remove test_sudo::TestSudo_Functional + `commit `__ +- azure CI: fix broken package installation + `commit `__ +- webui tests: update expected max value for krbminpwdlife + `commit `__ + `#9947 `__ +- ipatests: fix install method for BasePWpolicy + `commit `__ + `#9946 `__ +- Spec file: create the systemd-sysusers before oddjob and dbus restart + `commit `__ + `#9942 `__ +- Spec file: build requires /usr/bin/node, /usr/bin/npm + `commit `__ + `#9939 `__ +- ipatests: pruning is enabled when RSN is enabled + `commit `__ + `#9943 `__ +- Doc: remove the constraint on docutils version + `commit `__ + `#9941 `__ +- ipa-join: initialize pointer + `commit `__ + `#9936 `__ +- fetch_domains: Use case-insensitive comparison for domains names + `commit `__ + `#9924 `__ +- ipa-advise: smart card client script does not need krb ticket + `commit `__ + `#9923 `__ +- ipatests: Fix xfail assertion for sssd 2.12.0 + `commit `__ + +.. _olesya_gerasimenko_1: + +Olesya Gerasimenko (1) +~~~~~~~~~~~~~~~~~~~~~~ + +- Translated using Weblate (Russian) + `commit `__ + +.. _jay_gondaliya_5: + +Jay Gondaliya (5) +~~~~~~~~~~~~~~~~~ + +- ipatests: Ensure kdcproxy logs a timeout warning when AD KDC is unreachable + `commit `__ +- ipatests: Add ipa selfservice-show and selfservice-mod CLI tests to xmlrpc + `commit `__ + `#9945 `__ +- ipatests: Add user-principal ipa-getkeytab and ipa-rmkeytab cmdline tests + `commit `__ + `#9957 `__ +- ipatests: Add selfservice-add and selfservice-del cli tests + `commit `__ + `#9945 `__ +- ipatests: Add ipa-selfservice users tests to xmlrpc + `commit `__ + `#9945 `__ +- ipatests: Add ipa-selfservice BZ tests to xmlrpc + `commit `__ + `#9945 `__ + +.. _julien_rische_6: + +Julien Rische (6) +~~~~~~~~~~~~~~~~~ + +- ipatests: test password expiration with passwordless authentication + `commit `__ + `#10009 `__ +- kdb: skip password expiration for passwordless authentication + `commit `__ + `#10009 `__ +- kdb: do not encode string attr null terminator in LDAP + `commit `__ + `#10007 `__ +- kdb: prevent read overrun while loading tl_data + `commit `__ +- ipa-kdb: warn when tickets are issued without PAC + `commit `__ + `#9962 `__ +- ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized + `commit `__ + `#9962 `__ + +.. _mark_reynolds_1: + +Mark Reynolds (1) +~~~~~~~~~~~~~~~~~ + +- ipa-migrate - do not convert hostnames/realm for computers and automounts + `commit `__ + `#9828 `__ + +.. _andrew_novak_1: + +Andrew Novak (1) +~~~~~~~~~~~~~~~~ + +- upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off + `commit `__ + `#9979 `__ + +.. _pranav_thube_19: + +PRANAV THUBE (19) +~~~~~~~~~~~~~~~~~ + +- ipatests: Add AD trust SELinux user map tests (part 3) + `commit `__ + `#9845 `__ +- Fix inverted SSSD 2.12.0 xfail in SELinux trust tests + `commit `__ + `#10011 `__ +- ipatests: Fix EPN Postfix TLS setup for FIPS mode + `commit `__ + `#10010 `__ +- Document SELinux usermap verify expectations. + `commit `__ +- ipatests: Add AD trust SELinux user map tests (part 2) + `commit `__ + `#9845 `__ +- PRCI definations updated for trust_selinux_usermap. + `commit `__ +- ipatests: Add AD trust SELinux user map tests (part 1) + `commit `__ + `#9845 `__ +- ipatests: fix replica forward-zone test teardown resolv.conf restore + `commit `__ + `#9995 `__ +- ipatests: fix dnszone_add SOA MNAME expectation for numeric TLD + `commit `__ + `#9911 `__ +- ipatests: Add trust functional User testcases. + `commit `__ + `#9917 `__ +- ipatests: Extend netgroup test coverage. + `commit `__ + `#9952 `__ +- ipatests: Add XML-RPC tests for i18n user attributes + `commit `__ + `#9959 `__ +- ipatests: Fix test_allow_query_transfer_ipv6 when IPv6 is disabled + `commit `__ + `#9944 `__ +- ipatests: Add DNS integration tests. + `commit `__ + `#9911 `__ +- ipatests: Add DNS bugzilla integration tests. + `commit `__ + `#9911 `__ +- ipatests: Add integration tests for ipa-join command + `commit `__ + `#9930 `__ +- ipatests: Fix resolver state tracking in enforced DNS policy tests. + `commit `__ + `#9904 `__ +- ipatests: Add DNS functional integration tests. + `commit `__ + `#9911 `__ +- ipatests: Move expire_password fixture into TestIPACommand class + `commit `__ + +.. _rob_crittenden_4: + +Rob Crittenden (4) +~~~~~~~~~~~~~~~~~~ + +- Skip the lockout alert on no failure count or not max fail + `commit `__ + `#9820 `__ +- Add path to identify the tomcat version for Tomcat 10 + `commit `__ + `#9832 `__ +- Avoid int overflow with pwpolicy minlife + `commit `__ + `#9929 `__ +- Handle IPACertificate types in xmlrpc + `commit `__ + `#9935 `__ + +.. _rafael_guterres_jeffman_2: + +Rafael Guterres Jeffman (2) +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +- freeipa.spec.in: Use systemd-sysusers to setup users and groups + `commit `__ + `#9572 `__ +- Remove deprecated license classifier from ipasetup.py.in + `commit `__ + `#9925 `__ + +.. _sumit_bose_1: + +Sumit Bose (1) +~~~~~~~~~~~~~~ + +- ipa-otpd: do not pass reference of data_out->jdata + `commit `__ + `#9906 `__ + +.. _stanislav_levin_1: + +Stanislav Levin (1) +~~~~~~~~~~~~~~~~~~~ + +- ipatest: make tests compatible with Pytest 9 + `commit `__ + `#9950 `__ + +.. _sudhir_menon_11: + +Sudhir Menon (11) +~~~~~~~~~~~~~~~~~ + +- ipatests: add negative and option-validation tests for migrate-ds + `commit `__ + `#9965 `__ +- ipatests: add migrate-ds integration tests for bugs. + `commit `__ + `#9965 `__ +- ipatests: Add hashed password migration scenario to ds-migrate testsuite + `commit `__ + `#9965 `__ +- ipatests: ipa mixed mode and ipa plugins migration. + `commit `__ + `#9964 `__ +- ipatests: Bugzillas for ipa-migrate ds testsuite + `commit `__ +- ipatests: Add nigthly definitions for ds-migrate + `commit `__ +- ipatests: ipa-migrate-ds test scenarios + `commit `__ +- ipatests: Updated nightly definitions for ipa-ipa-migration testsuite + `commit `__ +- ipatests: Additional tests for ipa-ipa migration testsuite + `commit `__ + `#9964 `__ +- ipatests: Additional tests for 32BitIdranges + `commit `__ +- ipatests: Add xmlrpc tests for ipa-delegation-cli + `commit `__ + `#9931 `__ + +.. _veronika_miticka_2: + +Veronika Miticka (2) +~~~~~~~~~~~~~~~~~~~~ + +- Add CSP headers to webui + `commit `__ + `#9900 `__ + `#9901 `__ +- Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files + `commit `__ + `#9898 `__ + +.. _yuri_chornoivan_1: + +Yuri Chornoivan (1) +~~~~~~~~~~~~~~~~~~~ + +- Translated using Weblate (Ukrainian) + `commit `__ +