From 1fe3e2ff29dd23c9fc8324bc25937e0e3e07ae59 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 7 Jul 2026 09:51:56 +0200 Subject: [PATCH] Add release notes for FreeIPA 4.13.2 Signed-off-by: Antonio Torres --- src/index.rst | 3 +- src/release-notes/4-13-2.rst | 247 +++++++++++++++++++++++++++++++++++ 2 files changed, 248 insertions(+), 2 deletions(-) create mode 100644 src/release-notes/4-13-2.rst diff --git a/src/index.rst b/src/index.rst index 58e61729..17c638fa 100644 --- a/src/index.rst +++ b/src/index.rst @@ -52,6 +52,7 @@ Releases .. toctree:: :titlesonly: + /release-notes/4-13-2.rst /release-notes/4-13-1.rst /release-notes/4-13-0.rst /release-notes/4-12-5.rst @@ -60,8 +61,6 @@ Releases /release-notes/4-12-2.rst /release-notes/4-12-1.rst /release-notes/4-11-2.rst - /release-notes/4-12-0.rst - Getting involved ---------------- diff --git a/src/release-notes/4-13-2.rst b/src/release-notes/4-13-2.rst new file mode 100644 index 00000000..c2c82e8a --- /dev/null +++ b/src/release-notes/4-13-2.rst @@ -0,0 +1,247 @@ +FreeIPA 4.13.2 +============== + +.. raw:: mediawiki + +{{ReleaseDate|2026-07-14}} +The FreeIPA team would like to announce FreeIPA 4.13.2 release! + +It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for +Fedora distributions will be available from the official repository soon. + +== Highlights in 4.13.2 == + +* https://codeberg.org/freeipa/freeipa/issues/10009 +When using passwordless authentication methods (PKINIT, passkey, IDP, +RADIUS), the KDC was rejecting pre-auth requests if the user's password +was expired, even though these methods don't use passwords. +The fix ensures that: + + Passwordless methods are never blocked by an expired password. + Password expiration is still enforced when a password-based method + (password, OTP, hardened) is actually used, even if passwordless + methods are also configured. + +* https://pagure.io/freeipa/issue/9989 +Fix RHEL 8.10 to RHEL 9.8 migration in FIPS mode + +* WebUI hardening: httpd configuration has been updated with various configuration options that improve security. + +=== Known Issues === + +* https://codeberg.org/freeipa/freeipa/issues/9920 Failure to sign DNS zone with softhsm 2.7.0 rc1 + +=== Bug fixes === +FreeIPA 4.13.2 is a stabilization release for the features delivered as a +part of 4.13 version series. + +There are more than 10 bug-fixes since FreeIPA 4.13.1 release. +Details of the bug-fixes can be seen in the list of resolved tickets below. + +== Upgrading == +Upgrade instructions are available on [https://www.freeipa.org/page/Upgrade Upgrade] page. + +== Feedback == +Please provide comments, bugs and other feedback via the freeipa-users mailing +list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) +or #freeipa channel on libera.chat. + +== Resolved tickets == + +- `#8803 `__ Add support for + managing IdP references +- `#9820 `__ ipalockout_postop + is incorrectly warning about locked users +- `#9845 `__ ipatests: Port + downstream ipa-trust-functional test suite. +- `#9900 `__ Refine multiple + CSP directives +- `#9901 `__ CSP: failure to + define form-action directive which has no fallback +- `#9920 `__ Failure to sign + DNS zone with softhsm 2.7.0 rc1 +- `#9982 `__ Disable TRACE + method +- `#10007 `__ Selection of + authentication indicators on the host/computer object disappears in GUI after + a few minutes +- `#10008 `__ Nightly test + failure in test_webui/test_translation.py::TestUnauthorizedPage::test_long_text_of_unauthorized_page +- `#10009 `__ Passwordless + pre-authentication is blocked when user has an expired password +- `#10010 `__ ipatests: + test_EPN_starttls and test_EPN_ssl fail in FIPS mode due to Postfix MD5 TLS + fingerprint digest +- `#10011 `__ Fix inverted + SSSD xfail in SELinux trust integration tests + +== Detailed changelog since 4.13.1 == + +=== Américo Monteiro (1) === +* Translated using Weblate (Portuguese) [https://codeberg.org/freeipa/freeipa/commit/4d7164fecd4dc71c305ebb41c0d3a72f7d0975ea commit] + +=== Alexander Bokovoy (6) === +* ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized [https://codeberg.org/freeipa/freeipa/commit/fdf089768322b77e4b21dfa845564de1187ddaa8 commit] +* SELinux: expand policy coverage for sssd_mfa_t domain [https://codeberg.org/freeipa/freeipa/commit/509b93d7a1bc316a6919c4d5c36ab30433c2d27a commit] +* SELinux: wrap bare gen_require blocks in optional_policy in dnskey section [https://codeberg.org/freeipa/freeipa/commit/8932b7894027dc2c7927f15d801c69e1bb9b14d6 commit] +* SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA helpers [https://codeberg.org/freeipa/freeipa/commit/3bef9cbdbe154c06b9b253d7d7bd005c28df3f39 commit] +* ipa-sam: use internal Samba method to populate in-memory keytab [https://codeberg.org/freeipa/freeipa/commit/b06460bddd16dea69fe941bf1e2656de0c7e0c27 commit] +* SELinux: expand policy coverage for Kerberos usage [https://codeberg.org/freeipa/freeipa/commit/fd2ca1c099d4c95868c740e1957252300b9d4019 commit] + +=== Anuja More (6) === +* ipatests: add Azure Entra IdP integration tests [https://codeberg.org/freeipa/freeipa/commit/e933a40eb7d8ba9309874a2022ae51b5737ad905 commit] [https://codeberg.org/freeipa/freeipa/issues/8803 #8803] +* ipatests: xfail trust sudo/HBAC tests when SSSD is below 2.12 [https://codeberg.org/freeipa/freeipa/commit/9dc0d76176c31322ba5d76e761f0a6fa5e3dc010 commit] +* ipatests: add SSH/GSSAPI AD trust integration tests. [https://codeberg.org/freeipa/freeipa/commit/60b466e819b8bfff59547923b5b8932a2009f4dc commit] +* ipatests: increase timeout for PR-CI. [https://codeberg.org/freeipa/freeipa/commit/3485b21f2dca74b2bd9e4dee704bfddbe41b6f8d commit] +* ipatests: add HTTP GSSAPI Kerberos authentication tests with AD trust [https://codeberg.org/freeipa/freeipa/commit/3acf55ed7fcf9a3b38deb0efb98d222d57bafbbc commit] +* ipatests: add Random Password based replica promotion coverage [https://codeberg.org/freeipa/freeipa/commit/a55f9185c96457bdffe9099ddde39ec696f1f998 commit] + +=== Antonio Torres (1) === +* Back to git snapshots [https://codeberg.org/freeipa/freeipa/commit/420401c0d9dd3e13037dfcdca3a3135e086b3aa6 commit] + +=== Aleksandr Sharov (4) === +* ipa-migrate: migrate custom kerberos password policies [https://codeberg.org/freeipa/freeipa/commit/89d2405972534e38d812563f5f93e04d55f19963 commit] +* ipa-migrate: ignore replication conflicts [https://codeberg.org/freeipa/freeipa/commit/5b9c650c56a44a30e97ccbbbfa4003e40dbed2a4 commit] +* ipa-migrate: migrate DNS locations [https://codeberg.org/freeipa/freeipa/commit/3ff6acb00f1c7251465aae5a169e2fc1e54c0a48 commit] +* ipa-migrate: migrate ssh public keys for users and overrides [https://codeberg.org/freeipa/freeipa/commit/f236684691f0ce764aca4887d790f31906ea2044 commit] + +=== David Hanina (18) === +* ipatests: unauthorized page through httpd [https://codeberg.org/freeipa/freeipa/commit/93ee811a362f195fa3eb9e26792a022cf1d72889 commit] [https://codeberg.org/freeipa/freeipa/issues/10008 #10008] +* Add referrer-policy [https://codeberg.org/freeipa/freeipa/commit/d975deafe95064a104e183444740ef4bf32f16a6 commit] +* Disable Trace method [https://codeberg.org/freeipa/freeipa/commit/a63f6f015df55c44129f720a8b35d8b592d44e3a commit] [https://codeberg.org/freeipa/freeipa/issues/9982 #9982] +* Fix unauthorized error page [https://codeberg.org/freeipa/freeipa/commit/27ed26cb6c5202432ef61658161fea01d9af46b2 commit] +* Fix naive Referer check bypass in rpcserver [https://codeberg.org/freeipa/freeipa/commit/7f3f631e5493e78890dcb622bb0fd11ef2e3548e commit] +* Enforce Same-Site cookie [https://codeberg.org/freeipa/freeipa/commit/3682f0a51f9af4ade3e52da255954f09dbe402a8 commit] +* ipatests: Change the xfail version to sssd 2.12.0 [https://codeberg.org/freeipa/freeipa/commit/33c2fe638435247989f1b691b18c5df723eaba12 commit] +* Disallow retrieving software versions [https://codeberg.org/freeipa/freeipa/commit/a0fce96da3c11a8ad1e7d7bb8cef087a74a56252 commit] +* Fix flaky notification assert for webui [https://codeberg.org/freeipa/freeipa/commit/e269c7159e06d8d86f75de3025ad6c3457d9b42e commit] +* Fix ipa ca-show ipa --all not listing RSN version [https://codeberg.org/freeipa/freeipa/commit/35dc8246e07bb18b634b76532d04a59ed29d46b0 commit] +* Allow 32bit gid [https://codeberg.org/freeipa/freeipa/commit/58239f9fbe33408b5cb5c52ba5132f6deb6b8f40 commit] +* Return code 0 for all failing scriplets [https://codeberg.org/freeipa/freeipa/commit/7f36a5d3297de02f23bcad2aafdc41e2715745d5 commit] +* Wait until buttons are clickable [https://codeberg.org/freeipa/freeipa/commit/2e24bfc03a5ea039868769aaf05208d37fb34ce2 commit] +* Replace None with '' when uninstalling CA [https://codeberg.org/freeipa/freeipa/commit/a583b0dc08536a50e10b76e27861864b61906355 commit] +* Fix cert-find retrieval [https://codeberg.org/freeipa/freeipa/commit/36948421d7fedef0975ab8358b9a24941e72ecee commit] +* Remove navigation tests [https://codeberg.org/freeipa/freeipa/commit/e5c217878bd011546c24ca210a0a96248c782d60 commit] +* Fix QUnit import [https://codeberg.org/freeipa/freeipa/commit/39ad4285d938df786f8d902b9e895c691b0b059d commit] +* Return nothing if certificate is empty [https://codeberg.org/freeipa/freeipa/commit/5ce13edb9c34ae2a1151d27aeffc25a7c6d34b5f commit] + +=== Erik Belko (2) === +* ipatests: Add AD trust NFS automount integration tests [https://codeberg.org/freeipa/freeipa/commit/7129041a547873805272f27f310cc49ec6ffba86 commit] +* ipatests: Add ipa-getcert request tests for NSS storage [https://codeberg.org/freeipa/freeipa/commit/73b22ff8edc219e8ff0c10e6906835cc860b4723 commit] + +=== Florence Blanc-Renaud (33) === +* freeipa.spec: bump samba version [https://codeberg.org/freeipa/freeipa/commit/4a1c3d149595da0aa0d86f95c84426f102b291b0 commit] +* prci definitions: increase test_sudo timeout [https://codeberg.org/freeipa/freeipa/commit/a8538ab3f7bc04cfe61b64faea34b639d60dff2c commit] +* ipatests: split test_commands into 2 jobs [https://codeberg.org/freeipa/freeipa/commit/028aaed8e1d4ba77f5641c6c5248e8ee70be750d commit] +* ipatests: xfail TestInstallDNSSECFirst [https://codeberg.org/freeipa/freeipa/commit/0cfbb103884ccadf6b6e9d06d19e463b466634d2 commit] +* CI: switch testing from fedora 43 to fedora 44 [https://codeberg.org/freeipa/freeipa/commit/18166e57fd2f8d4698e9d4aa60e7d3ea45d807a5 commit] +* Spec file: move named-related files to server-dns package [https://codeberg.org/freeipa/freeipa/commit/d4ee256c47300f8a6b93b4c87e49a1ec785147b3 commit] +* ipatests: use either cafile or capath for ssl connection [https://codeberg.org/freeipa/freeipa/commit/d954eb244bd6f4ad79b80a7dcbbaebaa150b4db8 commit] +* ipatests: adapt to psutil [https://codeberg.org/freeipa/freeipa/commit/0622f426f6ff2c9b96c246f38fd4a9ce6770c569 commit] +* Azure CI: Use Fedora 44 [https://codeberg.org/freeipa/freeipa/commit/695ba5d298308260ea2302740adcf2ac87107d47 commit] +* replica conncheck: use crypto-policies in temp krb5.conf [https://codeberg.org/freeipa/freeipa/commit/3030751ed8c0e782ad58eeac136c0991833a2017 commit] +* prci definitions: extend test_commands timeout to 6000s [https://codeberg.org/freeipa/freeipa/commit/0135a9e551faa674423b919d7ab8c58c5942685c commit] +* constants: Use 24-byte key to check id TripleDES is supported [https://codeberg.org/freeipa/freeipa/commit/0c9b1e2324bd1e9795c6878bc6456f9abf3aa3c9 commit] +* ipatests: adapt the expected output message [https://codeberg.org/freeipa/freeipa/commit/2b455469337f8be2dc2a6ca887b3933684bdbee3 commit] +* ipatests: fix the method add_a_record [https://codeberg.org/freeipa/freeipa/commit/922a24a9ba2f626077ccdb699069775cc01a6bce commit] +* ipatests: adapt expected output for test_smb [https://codeberg.org/freeipa/freeipa/commit/49b4eb90bacaebeffb2b15cb6609af6b21ac5e3e commit] +* CI definitions: split ipa_ipa_migrate into 2 jobs [https://codeberg.org/freeipa/freeipa/commit/3317bf53ff1a519e0b0d528d119c95638196009c commit] +* ipatests: fix migration test [https://codeberg.org/freeipa/freeipa/commit/3d5fe37d41332cdca486c9ca42089934e5ed7f89 commit] +* Read The Docs: use ubuntu-24.04 instead of ubuntu-20.04 [https://codeberg.org/freeipa/freeipa/commit/65bb08f15ff72b4f412cdcdf1f0c54541e8ede5c commit] +* ipatests: Add selfservice-find cli tests to xmlrpc Add a new Declarative test class test_selfservice_cli_find covering CLI-level behaviour of the selfservice-find command: [https://codeberg.org/freeipa/freeipa/commit/c294159878de52fa5762025ee4be893f280c5320 commit] +* ipatests: fix the topology for test_32bit_idranges [https://codeberg.org/freeipa/freeipa/commit/215cc6f47e613d8a58fc77cd3e0cbaa8ec9eb4bd commit] +* ipa-migrate: normalize objectClass before building the list [https://codeberg.org/freeipa/freeipa/commit/5965b3ce6e3414a5b30cb1a3750c26909eddea60 commit] +* Azure CI: remove test_sudo::TestSudo_Functional [https://codeberg.org/freeipa/freeipa/commit/6d3122cdfafe22fe8a252ef057c3447359b8c7ff commit] +* azure CI: fix broken package installation [https://codeberg.org/freeipa/freeipa/commit/f33f632bec75f4b15f6534c69ac84e447dd6be9f commit] +* webui tests: update expected max value for krbminpwdlife [https://codeberg.org/freeipa/freeipa/commit/8a7486bc980b7f9b19e6b15dee6642679198c40f commit] +* ipatests: fix install method for BasePWpolicy [https://codeberg.org/freeipa/freeipa/commit/5cd2639f539ce220c291b00afafa72fd35e1d07e commit] +* Spec file: create the systemd-sysusers before oddjob and dbus restart [https://codeberg.org/freeipa/freeipa/commit/df379acfeec6322276d93e5843c79c2a6fad8663 commit] +* Spec file: build requires /usr/bin/node, /usr/bin/npm [https://codeberg.org/freeipa/freeipa/commit/262aeca51b473b3797fe15aea3732d77f308ab99 commit] +* ipatests: pruning is enabled when RSN is enabled [https://codeberg.org/freeipa/freeipa/commit/dd7e9ed2a2f30ce42c07123b8b55b76a3e427cf0 commit] +* Doc: remove the constraint on docutils version [https://codeberg.org/freeipa/freeipa/commit/bad124add6fb0fe3f8708291aedea43d318cf75b commit] +* ipa-join: initialize pointer [https://codeberg.org/freeipa/freeipa/commit/7cc96e42683a6d3ec9f2dc2a19e99330b6f3ce58 commit] +* fetch_domains: Use case-insensitive comparison for domains names [https://codeberg.org/freeipa/freeipa/commit/7f6a2835f0972af5e94b58daf47fa60bfade4279 commit] +* ipa-advise: smart card client script does not need krb ticket [https://codeberg.org/freeipa/freeipa/commit/5756ed2af940378c16d9d52e083b8c4005d41a13 commit] +* ipatests: Fix xfail assertion for sssd 2.12.0 [https://codeberg.org/freeipa/freeipa/commit/ecc0efa96e3c446586425d470657de7f2d5376bf commit] + +=== Olesya Gerasimenko (1) === +* Translated using Weblate (Russian) [https://codeberg.org/freeipa/freeipa/commit/37f2a683e67953ae07e652562f0ca013c57633d3 commit] + +=== Jay Gondaliya (6) === +* ipatests: Ensure kdcproxy logs a timeout warning when AD KDC is unreachable [https://codeberg.org/freeipa/freeipa/commit/4b7ec004265753ce7036feaccf2d60215c414b06 commit] +* ipatests: Add ipa selfservice-show and selfservice-mod CLI tests to xmlrpc [https://codeberg.org/freeipa/freeipa/commit/51e669d46f912d39841bc40560682f9f414f68fe commit] +* ipatests: Add user-principal ipa-getkeytab and ipa-rmkeytab cmdline tests [https://codeberg.org/freeipa/freeipa/commit/9a8553fc297987b006b28ade2098d613f9b5360f commit] +* ipatests: Add selfservice-add and selfservice-del cli tests [https://codeberg.org/freeipa/freeipa/commit/3056bf8fb27732213591f4c86044ce6980054ec9 commit] +* ipatests: Add ipa-selfservice users tests to xmlrpc [https://codeberg.org/freeipa/freeipa/commit/ffae7d109b9cc968bb9942da78ea4238eee5497b commit] +* ipatests: Add ipa-selfservice BZ tests to xmlrpc [https://codeberg.org/freeipa/freeipa/commit/f60df430602db1e3949fa67f3744d40bd9b1d971 commit] + +=== Julien Rische (6) === +* ipatests: test password expiration with passwordless authentication [https://codeberg.org/freeipa/freeipa/commit/29478fc01dda26b1f36f839b64b4601f213cb565 commit] [https://codeberg.org/freeipa/freeipa/issues/10009 #10009] +* kdb: skip password expiration for passwordless authentication [https://codeberg.org/freeipa/freeipa/commit/fffb93a83f60eeb914e26383a93fc67d40bbdd4f commit] [https://codeberg.org/freeipa/freeipa/issues/10009 #10009] +* kdb: do not encode string attr null terminator in LDAP [https://codeberg.org/freeipa/freeipa/commit/f0be7decb5675c89a1d5db2c437cfdf7279cc290 commit] [https://codeberg.org/freeipa/freeipa/issues/10007 #10007] +* kdb: prevent read overrun while loading tl_data [https://codeberg.org/freeipa/freeipa/commit/ca954e168fe6139dbdac935987ca011e156e668a commit] +* ipa-kdb: warn when tickets are issued without PAC [https://codeberg.org/freeipa/freeipa/commit/84a4ed22da400297b08dcc429cf63beea89e2aa4 commit] +* ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not initialized [https://codeberg.org/freeipa/freeipa/commit/541eb4e49748d832fcd0c11578200af5d8262ddb commit] + +=== Mark Reynolds (1) === +* ipa-migrate - do not convert hostnames/realm for computers and automounts [https://codeberg.org/freeipa/freeipa/commit/6e18d622a3dd259dda37dee8cc40a96f7934e785 commit] + +=== Andrew Novak (1) === +* upgrade: change ModifyLDIF modification processing logic for proper Schema Compat turn off [https://codeberg.org/freeipa/freeipa/commit/0421666a050810983239bf0672393e7354dfcd36 commit] + +=== PRANAV THUBE (19) === +* ipatests: Add AD trust SELinux user map tests (part 3) [https://codeberg.org/freeipa/freeipa/commit/415c70fb36b8823744e85950af2e3aa808dfe7cb commit] [https://codeberg.org/freeipa/freeipa/issues/9845 #9845] +* Fix inverted SSSD 2.12.0 xfail in SELinux trust tests [https://codeberg.org/freeipa/freeipa/commit/1051c982531607733f74d28bdfd652ce1e7a6c7f commit] [https://codeberg.org/freeipa/freeipa/issues/10011 #10011] +* ipatests: Fix EPN Postfix TLS setup for FIPS mode [https://codeberg.org/freeipa/freeipa/commit/3bedd1c21d6e3b54ec31d99b5272f491e8820eff commit] [https://codeberg.org/freeipa/freeipa/issues/10010 #10010] +* Document SELinux usermap verify expectations. [https://codeberg.org/freeipa/freeipa/commit/45b60200145dfc12c7f813ffd8f93ae7430dcea1 commit] +* ipatests: Add AD trust SELinux user map tests (part 2) [https://codeberg.org/freeipa/freeipa/commit/9664438b478e17cc47a9c7a1163f593f8bf187da commit] [https://codeberg.org/freeipa/freeipa/issues/9845 #9845] +* PRCI definations updated for trust_selinux_usermap. [https://codeberg.org/freeipa/freeipa/commit/5d0b576a4c2aa0049c47e842763e4a44c6177373 commit] +* ipatests: Add AD trust SELinux user map tests (part 1) [https://codeberg.org/freeipa/freeipa/commit/1b0e117bc951a776c6c8114c2147e58166b7ecb8 commit] +* ipatests: fix replica forward-zone test teardown resolv.conf restore [https://codeberg.org/freeipa/freeipa/commit/4e727421dc4e9772d78e3e1351bc1ab5ccf99e72 commit] +* ipatests: fix dnszone_add SOA MNAME expectation for numeric TLD [https://codeberg.org/freeipa/freeipa/commit/1388a92e8b73b22b5cd85a8a20c40343d1067cd5 commit] +* ipatests: Add trust functional User testcases. [https://codeberg.org/freeipa/freeipa/commit/642f1941772b23450eec9aa6a12d45ede47b4497 commit] +* ipatests: Extend netgroup test coverage. [https://codeberg.org/freeipa/freeipa/commit/0390076bfdeb122b33437a55a08ade9880127deb commit] +* ipatests: Add XML-RPC tests for i18n user attributes [https://codeberg.org/freeipa/freeipa/commit/c8a832e19699a7bb6ff486055015f033a3137e5f commit] +* ipatests: Fix test_allow_query_transfer_ipv6 when IPv6 is disabled [https://codeberg.org/freeipa/freeipa/commit/313bd8ff118a79dca5aad0b19ec8f69519258f89 commit] +* ipatests: Add DNS integration tests. [https://codeberg.org/freeipa/freeipa/commit/69f9978dc8bfe33b0f02cfb62a7d9d6a6051657c commit] +* ipatests: Add DNS bugzilla integration tests. [https://codeberg.org/freeipa/freeipa/commit/ee33a646ac9ad4c2d028e7633c2091239a3c0d6b commit] +* ipatests: Add integration tests for ipa-join command [https://codeberg.org/freeipa/freeipa/commit/7cb2c5d38a84eb31aa9ddd20cf9dc0b6d90fa242 commit] +* ipatests: Fix resolver state tracking in enforced DNS policy tests. [https://codeberg.org/freeipa/freeipa/commit/fd84cec77d18e0e608285ab712f8211b0b49a7fe commit] +* ipatests: Add DNS functional integration tests. [https://codeberg.org/freeipa/freeipa/commit/aa90ce09c3f6d496ee2cf63123c619f1008140b4 commit] +* ipatests: Move expire_password fixture into TestIPACommand class [https://codeberg.org/freeipa/freeipa/commit/1c86c973c8dc778a71c8e2abf54ff37ececdd696 commit] + +=== Rob Crittenden (4) === +* Skip the lockout alert on no failure count or not max fail [https://codeberg.org/freeipa/freeipa/commit/052880630c66b002213916169d24fd0e4da34e26 commit] [https://codeberg.org/freeipa/freeipa/issues/9820 #9820] +* Add path to identify the tomcat version for Tomcat 10 [https://codeberg.org/freeipa/freeipa/commit/b4a0c3cb44adb1c0ae694fdfd32fd63565dabaa4 commit] +* Avoid int overflow with pwpolicy minlife [https://codeberg.org/freeipa/freeipa/commit/7b0ac4f3dd8febf0c22a11bf2db9b780a242e302 commit] +* Handle IPACertificate types in xmlrpc [https://codeberg.org/freeipa/freeipa/commit/8deb4be0962b25dfd43e1245307a8bb9d58cfc48 commit] + +=== Rafael Guterres Jeffman (2) === +* freeipa.spec.in: Use systemd-sysusers to setup users and groups [https://codeberg.org/freeipa/freeipa/commit/0800065ac5555dba102f05c947ca47b5dc9a81af commit] +* Remove deprecated license classifier from ipasetup.py.in [https://codeberg.org/freeipa/freeipa/commit/737ec203b03dfbeedcf693945d1c3b90c31b05bf commit] + +=== Sumit Bose (1) === +* ipa-otpd: do not pass reference of data_out->jdata [https://codeberg.org/freeipa/freeipa/commit/5f7bd9612edd5ab6b8cd45148be75b3fd7c86cf8 commit] + +=== Stanislav Levin (1) === +* ipatest: make tests compatible with Pytest 9 [https://codeberg.org/freeipa/freeipa/commit/0bf2a549a8a858c393ef59487bc1d395e5535c07 commit] + +=== Sudhir Menon (11) === +* ipatests: add negative and option-validation tests for migrate-ds [https://codeberg.org/freeipa/freeipa/commit/c35edac6c2e53ea72378c4779bcfbae99c4838c7 commit] +* ipatests: add migrate-ds integration tests for bugs. [https://codeberg.org/freeipa/freeipa/commit/279eff56fd303dd155e145c91c95ff4de6352af5 commit] +* ipatests: Add hashed password migration scenario to ds-migrate testsuite [https://codeberg.org/freeipa/freeipa/commit/d250920fb6c0511eedc0e8fcaf71052e964d8210 commit] +* ipatests: ipa mixed mode and ipa plugins migration. [https://codeberg.org/freeipa/freeipa/commit/356db1d85454bbc560e32321cc7a8f02bef9f686 commit] +* ipatests: Bugzillas for ipa-migrate ds testsuite [https://codeberg.org/freeipa/freeipa/commit/39d7a4970c2b2bfe9a9321c4a5fce6a611f8bf0b commit] +* ipatests: Add nigthly definitions for ds-migrate [https://codeberg.org/freeipa/freeipa/commit/451365232a41e58615d3e3bd93ab992c00f508de commit] +* ipatests: ipa-migrate-ds test scenarios [https://codeberg.org/freeipa/freeipa/commit/8f2bbb02ae64f322fb34f073d7a7cdb00a69aea0 commit] +* ipatests: Updated nightly definitions for ipa-ipa-migration testsuite [https://codeberg.org/freeipa/freeipa/commit/514432267004375d9b8c529c7f791435daaeced1 commit] +* ipatests: Additional tests for ipa-ipa migration testsuite [https://codeberg.org/freeipa/freeipa/commit/b6d50197882dd62b5416948cb232c77c0349c0d3 commit] +* ipatests: Additional tests for 32BitIdranges [https://codeberg.org/freeipa/freeipa/commit/b05586c2a6a81c7121dd40f8d627cd8a2c5908d8 commit] +* ipatests: Add xmlrpc tests for ipa-delegation-cli [https://codeberg.org/freeipa/freeipa/commit/91a6618e51b0e767c5cc5e4b1719531dbbd7268d commit] + +=== Veronika Miticka (2) === +* Add CSP headers to webui [https://codeberg.org/freeipa/freeipa/commit/0d5ae4794197cb33336b73a01a06dd3868c265ec commit] [https://codeberg.org/freeipa/freeipa/issues/9900 #9900] [https://codeberg.org/freeipa/freeipa/issues/9901 #9901] +* Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files [https://codeberg.org/freeipa/freeipa/commit/7db5506a5e95fc2328d5b4dca65f8a54c0c59f38 commit] + +=== Yuri Chornoivan (1) === +* Translated using Weblate (Ukrainian) [https://codeberg.org/freeipa/freeipa/commit/3ea6895491aca54c5c3856dedaba463c4e0090c8 commit]