summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ipatests: check that ipa-client-automount restores nsswitch.conf at ↵François Cami2019-08-284-0/+108
| | | | | | | | | | | | uninstall time Check that using ipa-client-install, ipa-client-automount --no-ssd, then uninstalling both properly restores nsswitch.conf sequentially. Related-to:: https://pagure.io/freeipa/issue/8038 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: Test for ipa-backup with ipa not configuredMichal Polovka2019-08-274-0/+60
| | | | | | | | | | | | | | | Added test class for executing tests without ipa server being configured. This is achieved by not providing topology attribute in the test class. Subsequently implemented test for PG6843 - ipa-backup does not create log file at /var/log/ - by invoking ipa-backup command with ipa server not configured and checking for expected error code presence of /var/log in the error message. https://pagure.io/freeipa/issue/6843 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Tibor Dudlák <tdudlak@redhat.com> Reviewed-By: François Cami <fcami@redhat.com>
* Mark failing test as xfail for use of python-dns make_ds methodAlexander Bokovoy2019-08-221-0/+3
| | | | | | | | | | https://github.com/rthalley/dnspython/issues/343 documents broken use of hashes in dns.dnssec.make_ds() and other python-dns methods. This is a regression introduced with python-dns 1.16. Mark the test as expecting to fail until python-dns is fixed in Fedora. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* prci: update test definitionsArmando Neto2019-08-228-1478/+1690
| | | | | | | | | Update boxes used in nightlies runs and add new ones. Based on the changes made in freeipa/freeipa-pr-ci#304. Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ca_initialize_hsm_stateChristian Heimes2019-08-211-1/+1
| | | | | | | | | | | Fixup for commit eb2313920e20bb4a74fc0abc52c496ccf2822dab. configparser's set() method does not convert boolean to string automatically. Use string '"False"', which is then interpreted as boolean 'False' by getboolean(). Related: https://pagure.io/freeipa/issue/5608 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* travis-ci: make dnf invocations more resilientFrançois Cami2019-08-211-0/+7
| | | | | | | | | | | | Travis-CI sometimes fails to download repository metadata or packages. Change dnf configuration and invocation: * activate dnf fastestmirror * add more dnf retries * invoke "dnf makecache" twice Fixes: https://pagure.io/freeipa/issue/8048 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Scott Poore <spoore@redhat.com>
* ipa-extdom-extop: test timed out getgrgid_rAlexander Bokovoy2019-08-191-0/+29
| | | | | | | | Simulate getgrgid_r() timeout when packing list of groups user is a member of in pack_ber_user(). Related: https://pagure.io/freeipa/issue/8044 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* extdom: unify error code handling especially LDAP_NO_SUCH_OBJECTSumit Bose2019-08-193-22/+61
| | | | | | | | | | | | | | | | | | A return code LDAP_NO_SUCH_OBJECT will tell SSSD on the IPA client to remove the searched object from the cache. As a consequence LDAP_NO_SUCH_OBJECT should only be returned if the object really does not exists otherwise the data of existing objects might be removed form the cache of the clients causing unexpected behaviour like authentication errors. Currently some code-paths use LDAP_NO_SUCH_OBJECT as default error code. With this patch LDAP_NO_SUCH_OBJECT is only returned if the related lookup functions return ENOENT. Timeout related error code will lead to LDAP_TIMELIMIT_EXCEEDED and LDAP_OPERATIONS_ERROR is used as default error code. Fixes: https://pagure.io/freeipa/issue/8044 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Store HSM token and stateChristian Heimes2019-08-193-10/+54
| | | | | | | | | | | The HSM state is stored in fstore, so that CA and KRA installer use the correct token names for internal certificates. The default token is "internal", meaning the keys are stored in a NSSDB as usual. Related: https://pagure.io/freeipa/issue/5608 Co-authored-by: Magnus K Karlsson <magnus-ka.karlsson@polisen.se> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Nightly test definition: add missing testsFlorence Blanc-Renaud2019-08-144-0/+72
| | | | | | | | | | | | | | | | The following test was missing from all nightlies: - test_integration/test_crlgen_manage.py The following tests was missing from nightly_f29: - test_integration/test_smb.py The following test was missing from nightly_rawhide: - test_integration/test_smb.py Note: nightly_f28 not updated as we stopped testing on f28. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update contributorsAlexander Bokovoy2019-08-141-1/+16
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update translationsAlexander Bokovoy2019-08-1423-121/+793
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add Theodor van Nahl to the Contributors.txtAlexander Bokovoy2019-08-131-0/+1
| | | | Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Allow insecure binds for migrationChristian Heimes2019-08-132-8/+9
| | | | | | | | | | | | | | Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind over an insecure connection. Password logins were only allowed over LDAPS or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases. This commit lifts the restriction and permits insecure binds over plain LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA certificate is configured with a plain LDAP connection. Fixes: https://pagure.io/freeipa/issue/8040 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Don't move keys when key backup is disabledChristian Heimes2019-08-132-4/+7
| | | | | | | | | The CA_BACKUP_KEYS_P12 file is not enabled when pki_backup_keys is set to False. It's the case when FreeIPA is configured with HSM support. Related: https://pagure.io/freeipa/issue/7677 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* install: Add missing scripts to app_DATA.Timo Aaltonen2019-08-111-0/+2
| | | | | Signed-off-by: Timo Aaltonen <tjaalton@debian.org> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Restore SELinux context for p11-kit config overridesAlexander Bokovoy2019-08-091-0/+1
| | | | | | | | | | | | | | When 74e09087 started disabling softshm2 module in p11-kit-proxy, we missed to restore SELinux context on the configuration override creation. We don't need an explicit restore_context() when removing the override because restore_file() already calls restore_context(). Related: https://pagure.io/freeipa/issue/7810 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update comments to explain caSubsystemCert switchChristian Heimes2019-08-082-1/+4
| | | | | | | Related: https://bugzilla.redhat.com/1670239 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Change RA agent certificate profile to caSubsystemCertAlexander Bokovoy2019-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | Currently, RA agent certificate is issued using caServerCert profile. This has unfortunate side effect of asserting id-pk-serverAuth EKU which is not really needed for RA agent. If IPA CA certificate adds SAN DNS constraints into issued certificates, presence of id-pk-serverAuth EKU forces NSS (and other crypto libraries) to validate CN value with regards to SAN DNS constraints, due to historical use of CN bearing DNS name. Since RA agent certificate has 'CN=IPA RA', it is guaranteed to fail the check. Default IPA CA configuration does *not* add SAN DNS constraints into RA agent certificate. However, it is better to be prepared to such behavior. Related: https://bugzilla.redhat.com/1670239 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Don't return SSH keys with ipa host-find --pkey-onlyRob Crittenden2019-08-071-1/+2
| | | | | | | | This was introduced in 14ee02dcbd6cbb6c221ac7526e471a9fc58fcc82 https://pagure.io/freeipa/issue/8029 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* configure.ac: don't rely on bashismsChristian Hermann2019-08-071-4/+4
| | | | | | | | | | 93fb037d8409d9d46606c31d8a240e3963b72651 introduced unportable shell syntax, which led to erros like ./configure: 3179: ./configure: CFLAGS+= -D__STDC_WANT_LIB_EXT1__=1: not found in case a posix shell is used. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Test external CA with DNS name constraintsChristian Heimes2019-08-068-8/+44
| | | | | | | | | Verify that FreeIPA can be installed with an external CA that has a name constraints extension. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix UnboundLocalError in ipa-replica-manage on errorsTheodor van Nahl2019-08-061-0/+1
| | | | | | | | If ipa-replica-manage is unable to retrieve e.g. due to certificate validity problem. An UnboundLocalError is thrown for `type1`. This fixes the issue with a clean exit. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* azure-pipelines.yml: switch to Python 3.7François Cami2019-08-021-4/+4
| | | | | | | | | * switch to Python 3.7 (UsePythonVersion@0 task) * use "pip install --user" Fixes: https://pagure.io/freeipa/issue/8030 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Increase ntp_options test timeoutTibor Dudlák2019-07-314-4/+4
| | | | | Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: refactor TestNTPoptionsTibor Dudlák2019-07-311-41/+39
| | | | | | | Move common and error messages to class scope to be reused again. Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: Add tests for interactive chronyd configTibor Dudlák2019-07-312-2/+161
| | | | | | | | | | | | Add interactive configuration tests for ipa-server-install and ipa-client-install FreeIPA server as it is now is unable to configure NTP interactively for replica installations. Resolves: https://pagure.io/freeipa/issue/7908 Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: Update test tasks for client to be interactiveTibor Dudlák2019-07-311-6/+11
| | | | | | Related: https://pagure.io/freeipa/issue/7908 Reviewed-By: Michal Polovka <mpolovka@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* xmlrpc test: add test for preserved > stage userFlorence Blanc-Renaud2019-07-312-2/+67
| | | | | | | | | | | | | | | | When moving a preserved user to the stage area, check that the custom attributes are not lost ( = the attr for which there is no specific user_stage option). Test scenario: - add a stage user with --setattr "businesscategory=value" - activate the user, check that businesscategory is still present - delete (preserve) the user, check that attr is still present - stage the user, check that attr is still present Related: https://pagure.io/freeipa/issue/7597 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* user-stage: transfer all attributes from preserved to stage userFlorence Blanc-Renaud2019-07-311-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The user-stage command is internally implemented as: - user_show(all=True) in order to read the user attributes - loop on the attributes defined as possible to add using stageuser-add and transform them into new options for stageuser_add (for instance stageuser-add provides the option --shell for the attribute loginshell, but there is no option for the attribute businesscategory). - call stageuser_add in order to create a new entry in the active users subtree - user-del to remove the previous entry in the staged users subtree The issue is in the 2nd step. Only the attributes with a stageuser-add option are processed. The logic of the code should be slightly modified, so that all the attributes read in the first step are processed: - if they correspond to an option of stageuser-add, process them like it's currently done. For instance if the entry contains displayname, then it should be processed as --displayName=value in the stageuser-add cmd - if they do not correspond to an option of stageuser-add, add them with --setattr=<attrname>=<attrvalue> Note that some attributes may need to be filtered, for instance user-show returns has_password or has_keytab, which do not correspond to attributes in the LDAP entry. Fixes: https://pagure.io/freeipa/issue/7597 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* test_nfs.py: switch to master_3replFrançois Cami2019-07-304-27/+9
| | | | | | | | | | | test_nfs.py historically used master_2repl_1client. Now that master_3client exists, switch to that as it allows removal of custom install/cleanup steps. Fixes: https://pagure.io/freeipa/issue/8027 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: rename config_replica_resolvconf_with_master_data()François Cami2019-07-303-10/+10
| | | | | | | | | | config_replica_resolvconf_with_master_data() is not replica specific. Rename to config_host_resolvconf_with_master_data() as it is not tied to any role (master, replica, client). Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* test_nfs.py: switch to tasks.config_replica_resolvconf_with_master_data()François Cami2019-07-301-34/+9
| | | | | | | | | | | | Previously test_nfs.py would implement its own method to configure resolv.conf leading to cleanup failures in some cases. Use tasks.config_replica_resolvconf_with_master_data() instead. Also simplify and fix client uninstall. Fixes: https://pagure.io/freeipa/issue/7949 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* prci_definitions: add master_3client topologyFrançois Cami2019-07-304-0/+16
| | | | | | | | | Some tests would benefit from using a multi-client topology. As PR-CI now supports master_3client, use it. Fixes: https://pagure.io/freeipa/issue/8026 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* ipapython/admintool.py: use SERVER_NOT_CONFIGUREDFrançois Cami2019-07-301-3/+1
| | | | | | | | | | | | Commit 9182917280a5c2590fa677729db54b38a9ac4d1f introduced SUCCESS, SERVER_INSTALL_ERROR and SERVER_NOT_CONFIGURED to deal with cases when server is not configured. Actually use SERVER_NOT_CONFIGURED in log_failure instead of 2. Related-to: https://pagure.io/freeipa/issue/6843 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* test_xmlrpc: fix TestAutomemberFindOrphans.test_find_orphan_automember_rulesFlorence Blanc-Renaud2019-07-301-3/+21
| | | | | | | | | | | | | | | | | | | | | | Test scenario: - create a hostgroup - create a host - create an automember rule for the hostgroup with a condition fulfilled by the host - delete the hostgroup - call automember-rebuild (1) - call automember-find-orphans to remove the orphan automember group - call automember-rebuild(2) The test was expecting the first rebuild command to fail but this assumption is not true if the DS version is >= 1.4.0.22 because of the fix for https://pagure.io/389-ds-base/issue/50077 Modify the test so that it expects failure only when DS is older. Fixes: https://pagure.io/freeipa/issue/7902 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* WebUI tests: Fix request timeout for test_trustSerhii Tsymbaliuk2019-07-291-1/+2
| | | | | | | | | | Because of intergration with AD server response can take time more then 1 minute. So request_timeout is increased to 120s. Ticket: https://pagure.io/freeipa/issue/8024 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* WebUI: Add PKINIT status field to 'Configuration' pageSerhii Tsymbaliuk2019-07-262-7/+19
| | | | | | | | | | - Add 'Server Options' section to the page - Add 'IPA master capable of PKINIT' field to the 'Server Options' Ticket: https://pagure.io/freeipa/issue/7305 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Test: Test to check whether ssh from ipa client to ipa master is successful ↵Sumedh Sidhaye2019-07-261-0/+66
| | | | | | | | | | | | | | | | after adding ldap_deref_threshold=0 in sssd.conf Problem: After adding ldap_deref_threshold=0 setting for sssd on master for performance enhancement ssh from ipa client was failing Test Procedure: 1. setup a master 2. add ldap_deref_threshold=0 to sssd.conf on master 3. add an ipa user 4. ssh from controller to master using the user created in step 3 Signed-off-by: Sumedh Sidhaye <ssidhaye@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipa-client-samba: remove state on uninstallFrançois Cami2019-07-261-5/+19
| | | | | | | | | | | | | The "domain_member" state was not removed at uninstall time. Remove it so that future invocations of ipa-client-samba work. Fixes: https://pagure.io/freeipa/issue/8021 Signed-off-by: François Cami <fcami@redhat.com> https://pagure.io/freeipa/issue/8021 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipatests: test ipa-client-samba after --uninstallFrançois Cami2019-07-261-0/+5
| | | | | | | Related-to: https://pagure.io/freeipa/issue/8021 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipa-client-samba: remove and restore smb.conf only on first uninstallFrançois Cami2019-07-261-3/+4
| | | | | | | Fixes: https://pagure.io/freeipa/issue/8019 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* ipatests: test multiple invocations of ipa-client-samba --uninstallFrançois Cami2019-07-261-0/+3
| | | | | | | Related-to: https://pagure.io/freeipa/issue/8019 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Sergey Orlov <sorlov@redhat.com>
* Azure pipeline: report failure in prepare-build stepFlorence Blanc-Renaud2019-07-261-2/+2
| | | | | | | | | | | | | | | | The azure pipeline defines a "prepare build" step that installs the FreeIPA development dependencies but the step does not report failures of the dnf builddep command. As a consequence, subsequent steps may fail (for instance because of components not installed such as tox) but are hard to diagnose. The fix reports the command failure. Fixes: https://pagure.io/freeipa/issue/8022 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Test: To check ipa replica-manage del <FQDN> does not failSumedh Sidhaye2019-07-254-4/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: If a replica installation fails before all the services have been enabled then it could leave things in a bad state. ipa-replica-manage del <replica> --cleanup --force invalid 'PKINIT enabled server': all masters must have IPA master role enabled Test Steps: 1. Setup server 2. Setup replica 3. modify the replica entry on Master: dn: cn=KDC,cn=<replica hostname>,cn=masters,cn=ipa,cn=etc,dc=<test>,dc=<realm> changetype: modify delete: ipaconfigstring ipaconfigstring: enabledService dn: cn=KDC,cn=<replica hostname>,cn=masters,cn=ipa,cn=etc,dc=<test>,dc=<realm> add: ipaconfigstring ipaconfigstring: configuredService 4. On master, run ipa-replica-manage del <replicaFQDN> --cleanup --force Related Ticket: https://pagure.io/freeipa/issue/7929 Signed-off-by: Sumedh Sidhaye <ssidhaye@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add PKCS#11 module name to p11helper errorsChristian Heimes2019-07-251-3/+5
| | | | | | | | | | The p11helper module now includes the name of the PKCS#11 shared library in error messages. Fixes: https://pagure.io/freeipa/issue/8015 Co-Authored-By: Mikhail Novosyolov <m.novosyolov@rosalinux.ru> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* WebUI tests: Fix timeout issues for reset password testsSerhii Tsymbaliuk2019-07-221-1/+2
| | | | | | | | | | - Increase wait timeout after password reset - Wait for server response after login in TestLoginScreen.test_reset_password_and_login_view Ticket: https://pagure.io/freeipa/issue/8012 Signed-off-by: Serhii Tsymbaliuk <stsymbal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* dsinstance: add proflie when tracking certificateFraser Tweedale2019-07-222-5/+10
| | | | | | | | | | | | When the DS certificate gets untracked then tracked again (via dsinstance.start_tracking_certificate()), it loses its profile configuration. Although it is the default profile, we want to retain the explicit reference. Ensure we add the profile when re-tracking the DS certificate. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* httpinstance: add pinfile when tracking certificateRob Crittenden2019-07-221-1/+4
| | | | | | | | | | When the HTTP certificate gets untracked then tracked again, it loses its pin file. Ensure we add the pin file when (re-)tracking the HTTP certificate. Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipatests: test ipa-server-upgrade in CA-less deploymentFraser Tweedale2019-07-222-0/+11
| | | | | | Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 05:50:01 +0000