summaryrefslogtreecommitdiffstats
path: root/ipaserver
Commit message (Collapse)AuthorAgeFilesLines
...
* Hide PKI Client database password in log fileAbhijeet Kasurde2017-03-302-4/+10
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Allow erasing ipaDomainResolutionOrder attributeFabiano Fidêncio2017-03-301-0/+5
| | | | | | | | | | | | | | Currently when trying to erase the ipaDomainResolutionOrder attribute we hit an internal error as the split() method is called on a None object. By returning early in case of empty string we now allow removing the ipaDomainResolutionOrder attribute by both calling delattr or setting its value to an empty string. https://pagure.io/freeipa/issue/6825 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* adtrust: make sure that runtime hostname result is consistent with the ↵Alexander Bokovoy2017-03-301-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configuration FreeIPA's `ipasam` module to Samba uses gethostname() call to identify own server's host name. This value is then used in multiple places, including construction of cifs/host.name principal. `ipasam` module always uses GSSAPI authentication when talking to LDAP, so Kerberos keys must be available in the /etc/samba/samba.keytab. However, if the principal was created using non-FQDN name but system reports FQDN name, `ipasam` will fail to acquire Kerberos credentials. Same with FQDN principal and non-FQDN hostname. Also host name and principal name must have the same case. Report an error when configuring ADTrust instance with inconsistent runtime hostname and configuration. This prevents errors like this: [20/21]: starting CIFS services ipa : CRITICAL CIFS services failed to start where samba logs have this: [2017/03/20 06:34:27.385307, 0] ipa_sam.c:4193(bind_callback_cleanup) kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/ipatrust@EXAMPLE.COM [2017/03/20 06:34:27.385476, 1] ../source3/lib/smbldap.c:1206(get_cached_ldap_connect) Connection to LDAP server failed for the 16 try! Fixes https://pagure.io/freeipa/issue/6786 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Ensure KDC is propery configured after upgradeMartin Babinsky2017-03-301-5/+5
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Split out anonymous PKINIT test to a separate methodMartin Babinsky2017-03-301-0/+2
| | | | | | | | This allows for more flexibility in the whole PKINIT setup process. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variable from failed anonymous PKINIT handlingMartin Babinsky2017-03-301-1/+1
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Upgrade: configure PKINIT after adding anonymous principalMartin Babinsky2017-03-301-1/+1
| | | | | | | | | | In order to set up PKINIT, the anonymous principal must already be created, otherwise the upgrade with fail when trying out anonymous PKINIT. Switch the order of steps so that this issue does not occur. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not ↵David Kupka2017-03-281-3/+11
| | | | | | | | | | | | | | available Server installation failed when attmpting to disable module 'Root Certs' and the module was not available in HTTP_ALIAS_DIR. When the module is not available there's no need to disable it and the error may be treated as success. https://pagure.io/freeipa/issue/6803 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate PIN for PKI to help Dogtag in FIPSStanislav Laznicka2017-03-282-2/+10
| | | | | | | | | | Dogtag is currently unable to generate a PIN it could use for an NSS database creation in FIPS. Generate it for them so that we don't fail. https://pagure.io/freeipa/issue/6824 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Use Custodia 0.3.1 featuresChristian Heimes2017-03-282-0/+31
| | | | | | | | | | | | | | | | | | | | | * Use sd-notify in ipa-custodia.service * Introduce libexec/ipa/ipa-custodia script. It comes with correct default setting for IPA's config file. The new file also makes it simpler to run IPA's custodia instance with its own SELinux context. * ipapython no longer depends on custodia The patch addresses three issues: * https://bugzilla.redhat.com/show_bug.cgi?id=1430247 Forward compatibility with Custodia 0.3 in Fedora rawhide * https://pagure.io/freeipa/issue/5825 Use sd-notify * https://pagure.io/freeipa/issue/6788 Prepare for separate SELinux context Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Backup CA cert from kerberos folderStanislav Laznicka2017-03-281-0/+1
| | | | | | https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* rpcserver.login_x509: Actually return reply from __call__ methodDavid Kupka2017-03-281-1/+1
| | | | | | | | | | __call__ didn't return causing internal error in wsgi application. Previously this bug was hidden by some other error and the code worked even though it shouldn't. https://pagure.io/freeipa/issue/6819 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Create temporaty directories at the begining of uninstallDavid Kupka2017-03-281-0/+4
| | | | | | | | | | | | Since commit 38c6689 temporary directories are no longer created at package install time. Instead they're created at server install time. Some steps in uninstall also assume that temporary direcories exist. Creating the directories in the begining of server uninstall ensure that the uninstall will go through. https://pagure.io/freeipa/issue/6715 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the sudorule objectsStanislav Laznicka2017-03-271-0/+1
| | | | | | | | | | The recent changes allow the sudorule objects to be renamed. https://pagure.io/freeipa/issue/2466 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Allow renaming of the HBAC rule objectsStanislav Laznicka2017-03-271-0/+1
| | | | | | | | | | The recent changes allow HBAC rule objects to be renamed. https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Reworked the renaming mechanismStanislav Laznicka2017-03-2713-26/+34
| | | | | | | | | | | | | | | | | | | The rename operation on *_mod commands was only allowed when the primary key of an entry was also its RDN. With these changes, it should be possible to rename the rest of the entries as well. An attribute to the base LDAPObject was added to whitelist the objects we want to allow to be renamed. It replaced an old attribute rdn_is_primary_key which was used for the very same purpose but the name was confusing because it was not set correctly for certain objects. https://pagure.io/freeipa/issue/2466 https://pagure.io/freeipa/issue/6784 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: do not limit internal searches in cert-findJan Cholasta2017-03-271-18/+10
| | | | | | | | | | | | Instead, apply the limits on the combined result. This fixes (absence of) `--sizelimit` leading to strange behavior, such as `cert-find --users user` returning a non-empty result only with `--sizelimit 0`. https://pagure.io/freeipa/issue/6716 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* WebUI: Add support for login for AD usersPavel Vomacka2017-03-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | After login, method user-find --whoami was called which cannot be called for AD users. That method was replaced by ipa whoami command and sequential command according to result of ipa whoami. AD user can now be logged in. AD users have new menu definition which contains only list of IPA users and profile page of AD user - "User ID Override". This commit also fixes several places where IPA.whoami object was used, because its structure was also changed. It now contains two objects. First one is stored in 'metadata' property and stores result from ipa whoami (type of object, command which should be called for showing detailed data about currently logged entity, etc). The second one is stored in 'data' property which stores result of _show command for currently logged entity. https://pagure.io/freeipa/issue/3242 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Backup ipa-specific httpd unit-fileStanislav Laznicka2017-03-232-0/+3
| | | | | | | | | | | | On backup-restore, the ipa unit file for httpd was not backed up. This file however contains setting for httpd to communicate with gssproxy so not backing it up will result in httpd not knowing how to get credentials. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ldap2: use LDAP whoami operation to retrieve bind DN for current connectionAlexander Bokovoy2017-03-221-4/+3
| | | | | | | | | | | | | For external users which are mapped to some DN in LDAP server, we wouldn't neccesary be able to find a kerberos data in their LDAP entry. Instead of searching for Kerberos principal use actual DN we are bound to because for get_effective_rights LDAP control we only need the DN itself. Fixes https://pagure.io/freeipa/issue/6797 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* replica prepare: fix wrong IPA CA nickname in replica fileHEADmasterJan Cholasta2017-03-221-3/+4
| | | | | | | | | | | | | Lookup IPA CA subject and pass it to CertDB when creating dscert.p12 and httpcert.p12, otherwise a generic nickname will be used for the IPA CA certificate instead of "$REALM IPA CA". This fixes replica install on domain level 0 from a replica file created using ipa-replica-install on IPA 4.5. https://pagure.io/freeipa/issue/6777 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fixing replica install: fix ldap connection in domlvl 0felipe2017-03-221-1/+10
| | | | | | | | | | | | Now, at the domain level 0, the replica install always uses Directory Manager credentials to create the LDAP connection. Since ACIs permitting hosts to manage their own services were added in 4.2 release, the old master denies this operations. https://pagure.io/freeipa/issue/6549 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* httpinstance: clean up /etc/httpd/alias on uninstallJan Cholasta2017-03-222-0/+6
| | | | | | | | | | | Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias from backup on uninstall. Files modified by IPA are kept with .ipasave suffix. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certs: do not implicitly create DS pin.txtJan Cholasta2017-03-222-2/+2
| | | | | | | | | | | | Do not implicitly create DS pin.txt in `CertDB.init_from_pkcs12()`, create it explicitly in `DSInstance.__enable_ssl()`. This stops the file from being created in /etc/httpd/alias during classic replica install. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix Python 3 pylint errorsChristian Heimes2017-03-151-1/+1
| | | | | | | | | | | | | | | | ************* Module ipaserver.install.ipa_kra_install ipaserver/install/ipa_kra_install.py:25: [W0402(deprecated-module), ] Uses of a deprecated module 'optparse') ************* Module ipapython.install.core ipapython/install/core.py:163: [E1101(no-member), _knob] Module 'types' has no 'TypeType' member) ************* Module ipatests.test_ipapython.test_dn ipatests/test_ipapython/test_dn.py:1205: [W1505(deprecated-method), TestDN.test_x500_text] Using deprecated method assertEquals()) ************* Module ipa-ca-install install/tools/ipa-ca-install:228: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) install/tools/ipa-ca-install:232: [E1101(no-member), install_master] Instance of 'ValueError' has no 'message' member) Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Try out anonymous PKINIT after it is configuredMartin Babinsky2017-03-151-0/+6
| | | | | | | | | | | After PKINIT certificate is requested and everything is set up, we should attempt to perform anonymous PKINIT and fail hard if it does not work for some reason. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* check for replica's KDC entry on master before requesting PKINIT certMartin Babinsky2017-03-152-3/+18
| | | | | | | | | | This prevents replication-based race conditions to break PKINIT certificate requests on replica installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* check that the master requesting PKINIT cert has KDC enabledMartin Babinsky2017-03-151-5/+17
| | | | | | | https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make wait_for_entry raise exceptionsMartin Babinsky2017-03-151-6/+3
| | | | | | | | | | | | Instead of only logging errors when timeout is reached or query for the entry fails for other reasons, `wait_for_entry` should raise exceptions so that we can handle them in caller or let them propagate and fail early. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move PKINIT configuration to a later stage of server/replica installMartin Babinsky2017-03-153-7/+23
| | | | | | | | | | | | | | This is to ensure that we can request PKINIT certs once all the following requirements are in place: * CA is configured or PKCS#12 file is provided * LDAP, KDC and Apache are configured and the master role is thus completed and enabled https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Request PKINIT cert directly from Dogtag API on first masterMartin Babinsky2017-03-151-0/+16
| | | | | | | | | | | On the first master the framework may not be fully functional to server certificate requests. It is safer to configure helper that contacts Dogtag REST API directly. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Make PKINIT certificate request logic consistent with other installersMartin Babinsky2017-03-151-8/+8
| | | | | | | | | | | | | | | | | The certmonger request handling code during pkinit setup actually never correctly handled situations when certificate request was rejected by the CA or CA was unreachable. This led to subtle errors caused by broken anonymous pkinit (e.g. failing WebUI logins) which are hard to debug. The code should behave as other service installers, e. g. use `request_and_wait_for_cert` method which raises hard error when request times out or is not granted by CA. On master contact Dogtag CA endpoint directly as is done in DS installation. https://pagure.io/freeipa/issue/6739 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove pkinit from ipa-replica-prepareStanislav Laznicka2017-03-151-76/+7
| | | | | | | | | | | The PKINIT feature is not available on domain level 0 so any options about pkinit are false. https://pagure.io/freeipa/issue/6759 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* rpcserver: x509_login: Handle unsuccessful certificate login gracefullyDavid Kupka2017-03-151-0/+10
| | | | | | | | | | | | When mod_lookup_identity is unable to match user by certificate (and username) it unsets http request's user. mod_auth_gssapi is then unable to get Kerberos ticket and doesn't set KRB5CCNAME environment variable. x509_login.__call__ now returns 401 in such case to indicate that request was not authenticated. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* idviews: correctly handle modification of non-existent viewMartin Babinsky2017-03-151-3/+6
| | | | | | | | | | the pre-callback in `idview-mod` did not correctly handle non-existent object during objectclass check. It will now correctly report that the object was not found instead on generic 'no such entry'. https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Re-use trust domain retrieval code in certmap validatorsMartin Babinsky2017-03-141-8/+3
| | | | | | | | https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* idview: add domain_resolution_order attributeMartin Babinsky2017-03-141-2/+31
| | | | | | | | | | | `idview-add` and `idview-mod` can now set and validate the attribute. The required objectclass is added on-demand after modification https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaconfig: add the ability to manipulate domain resolution orderMartin Babinsky2017-03-141-2/+113
| | | | | | | | | | | | | | | optional attribute was added to config object along with validator that check for valid domain names and also checks whether the specified domains exist in FreeIPA or in trusted forests and, in case of trusted domains, are not disabled. Part of http://www.freeipa.org/page/V4/AD_User_Short_Names https://pagure.io/freeipa/issue/6372 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* httpinstance: disable system trust module in /etc/httpd/aliasJan Cholasta2017-03-142-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the NSS database in /etc/httpd/alias is installed with the system trust module enabled. This is problematic for a number of reasons: * IPA has its own trust store, which is effectively bypassed when the system trust module is enabled in the database. This may cause IPA unrelated CAs to be trusted by httpd, or even IPA related CAs not to be trusted by httpd. * On client install, the IPA trust configuration is copied to the system trust store for third parties. When this configuration is removed, it may cause loss of trust information in /etc/httpd/alias (https://bugzilla.redhat.com/show_bug.cgi?id=1427897). * When a CA certificate provided by the user in CA-less install conflicts with a CA certificate in the system trust store, the latter may be used by httpd, leading to broken https (https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html). Disable the system trust module on install and upgrade to prevent the system trust store to be used in /etc/httpd/alias and fix all of the above issues. https://pagure.io/freeipa/issue/6132 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Backup KDC certificate pairStanislav Laznicka2017-03-141-0/+2
| | | | | | | | | KDC certificate pair was added but is not included in backup which might cause issues when restoring the IPA service. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove copy-schema-to-ca.py from master branchMartin Basti2017-03-141-4/+2
| | | | | | | | | This script is used only for IPA <3.1, so it must be compatible with ipa-3-0 branch, so it should be placed there https://pagure.io/freeipa/issue/6540 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Support certificate login after installation and upgradePavel Vomacka2017-03-142-0/+6
| | | | | | | | | | | | Add necessary steps which set SSSD and set SELinux boolean during installation or upgrade. Also create new endpoint in apache for login using certificates. https://pagure.io/freeipa/issue/6225 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Don't fail more if cert req/cert creation failedStanislav Laznicka2017-03-141-2/+5
| | | | | | | | | This should help debugging issues that could happen during server certificate creation. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix ipa-replica-prepare server-cert creationStanislav Laznicka2017-03-141-1/+2
| | | | | | | | | | Fixes an issue introduced in 0a54fac0, we need to specify the current master's hostname so that we know to which CA we need to connect to create the other's server Server-Cert. https://pagure.io/freeipa/issue/6755 Reviewed-By: Martin Basti <mbasti@redhat.com>
* cert: include certificate chain in cert command outputJan Cholasta2017-03-141-7/+46
| | | | | | | | | | | | Include the full certificate chain in the output of cert-request, cert-show and cert-find if --chain or --all is specified. If output file is specified in the CLI together with --chain, the full certificate chain is written to the file. https://pagure.io/freeipa/issue/6547 Reviewed-By: David Kupka <dkupka@redhat.com>
* WebUI: add vault managementPavel Vomacka2017-03-141-0/+38
| | | | | | | | | | | | | | | | | | | | Add vault management into WebUI, there are some constraints: - There is no crypto library so Symmetric and Assymetric vaults are not supported in WebUI. Also retrieving or archiving data is not supported. - There aren't any container support right now Supported is: - Browsing vaults - Adding Standard vaults (users, service, shared) - Removing vaults - Adding and removing owners - Adding and removing members https://fedorahosted.org/freeipa/ticket/5426 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* permissions: add permissions for read and mod of external group membersPetr Vobornik2017-03-131-0/+17
| | | | | | | | Issue: "User Administrator" role cannot add users to an External Group. https://fedorahosted.org/freeipa/ticket/5504 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Installation must publish CA cert in /usr/share/ipa/html/ca.crtFlorence Blanc-Renaud2017-03-131-0/+6
| | | | | | | | | | | | Regression introduced with commit d124e30. ipa-server-install and ipa-replica-install must publish the CA cert in /usr/share/ipa/html/ca.crt, otherwise the web page http://ipaserver.ipadomain.com/ipa/config/ssbrowser.html has a link to http://ipaserver.ipadomain.com/ipa/config/ca.crt but this file is missing. https://pagure.io/freeipa/issue/6750 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaserver/dcerpc.py: use arcfour_encrypt from sambaAlexander Bokovoy2017-03-131-9/+1
| | | | | | | | | | | Samba Python bindings provide samba.arcfour_encrypt(key, data). Instead of implementing own wrapper, use Samba's. In future Samba versions this wrapper will be FIPS 140-2 compatible. Fixes https://pagure.io/freeipa/issue/6697 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Don't allow standalone KRA uninstallsStanislav Laznicka2017-03-133-40/+11
| | | | | | | | | | KRA uninstallation is very likely to break the user's setup. Don't allow it at least till we can be safely sure we are able to remove it in a standalone manner without breaking anything. https://pagure.io/freeipa/issue/6538 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 09:49:55 +0000