Issued:

2018-05-14

Updated:

2018-05-14

RHBA-2018:1395 - ipa bug fix update

Synopsis

ipa bug fix update

Type/Severity

Bug Fix Advisory None

Topic

An updated ipa package that fixes several bugs is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

• Previously, the one-time password (OTP) logins required APIs that were not available in the FIPS mode. As a consequence, authentication of OTP and RADIUS failed when the user installed Identity Management (IdM) on a machine with FIPS enabled. This update overcomes the described failure by using a different set of APIs for loading the OTP secret. As a result, IdM now supports the OTP and RADIUS authentication on machines with FIPS enabled. (BZ#1564390)

• Previously, a replication conflict could happen when running the ipa-replica-install utility in specific timing conditions. Due to the conflict, two service principals were created for the http/replica service. As a consequence, ipa-replica-install failed with the "KDC has no support for encryption type." error message. With this update, ipa-replica-install consistently communicates with a single master to create the service principal and the service keytab, which prevents potential replication conflicts. As a result, ipa-replica-install succeeds. (BZ#1565520)

• Previously, the ipa-replica-install utility internally called the ipa-client-utility without forwarding the --ip-address option. As a consequence, ipa-replica-install did not use the specific IP addresses provided through --ip-address and created the DNS records for all services on the machine. With this update, ipa-replica-install now forwards --ip-address to ipa-client-install. As a result, ipa-replica-install with the --ip-address option now creates the DNS records only for the provided IP addresses. (BZ#1565605)

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• ipa-4.5.4-10.el7_5.1.src.rpm
• ipa-debuginfo-4.5.4-10.el7_5.1.ppc64.rpm
• ipa-server-4.5.4-10.el7_5.1.x86_64.rpm
• ipa-client-4.5.4-10.el7_5.1.ppc64le.rpm
• ipa-debuginfo-4.5.4-10.el7_5.1.ppc64le.rpm
• ipa-client-4.5.4-10.el7_5.1.aarch64.rpm
• ipa-client-4.5.4-10.el7_5.1.s390x.rpm
• ipa-debuginfo-4.5.4-10.el7_5.1.x86_64.rpm
• python2-ipaclient-4.5.4-10.el7_5.1.noarch.rpm
• python2-ipaserver-4.5.4-10.el7_5.1.noarch.rpm
• ipa-server-common-4.5.4-10.el7_5.1.noarch.rpm
• ipa-server-trust-ad-4.5.4-10.el7_5.1.x86_64.rpm
• ipa-common-4.5.4-10.el7_5.1.noarch.rpm
• ipa-debuginfo-4.5.4-10.el7_5.1.s390x.rpm
• ipa-client-4.5.4-10.el7_5.1.ppc64.rpm
• ipa-server-dns-4.5.4-10.el7_5.1.noarch.rpm
• ipa-client-4.5.4-10.el7_5.1.x86_64.rpm
• ipa-debuginfo-4.5.4-10.el7_5.1.aarch64.rpm
• ipa-client-common-4.5.4-10.el7_5.1.noarch.rpm
• python2-ipalib-4.5.4-10.el7_5.1.noarch.rpm
• ipa-python-compat-4.5.4-10.el7_5.1.noarch.rpm

Fixes

• This content is not included.BZ - 1564390
• This content is not included.BZ - 1565519
• This content is not included.BZ - 1565520

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.