Issued:

2018-06-26

Updated:

2018-06-26

RHBA-2018:1985 - ipa bug fix update

Synopsis

ipa bug fix update

Type/Severity

Bug Fix Advisory None

Topic

An updated ipa package that fixes several bugs is now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

This update fixes the following bugs:

• During the installation of Identity Management replicas, setting up the Custodia component sometimes failed because of missing objects in the Directory Server database. Consequently, the whole "ipa-replica-install" command failed. With this update, the "nsds5ReplicaReleaseTimeout" setting can be added to the LDAP servers on the replication masters to avoid the Custodia setup failure. The setting defines how long a replication master should send updates to the new replica before it terminates its replication session. The termination then allows other replication masters to update the new replica. As a result, "ipa-replica-install" proceeds correctly. (#1579189)

• When an Identity Management (IdM) host is promoted to a replica, IdM uses Custodia to transport secrets, for example Certificate Authority keys. Previously, Custodia uploaded the newly created public keys of the IdM host to the local LDAP server and then connected to one or two remote Custodia instances to check if the keys had been replicated there. Consequently, on a busy LDAP cluster the replica installation sometimes timed out. With this update, Custodia directly uploads its key to a remote IdM master and uses this remote IdM master to request all secrets. As a result, retrieval of secrets no longer depends on timely replication between local and remote LDAP servers. (#1579190)

• Previously, the ipa-server-upgrade utility did not check if a Certificate Authority (CA) instance was configured on the IdM host and tried to back up configuration files that exist only on IdM masters with a CA instance. Consequently, ipa-server-upgrade failed because of the missing files. With this update, ipa-server-upgrade checks if a CA instance is configured on the IdM host before trying to back up CA configuration files. As a result, ipa-server-upgrade works as expected. (#1579203)

Users of ipa are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• ipa-client-4.5.4-10.el7_5.3.x86_64.rpm
• ipa-debuginfo-4.5.4-10.el7_5.3.aarch64.rpm
• python2-ipalib-4.5.4-10.el7_5.3.noarch.rpm
• python2-ipaclient-4.5.4-10.el7_5.3.noarch.rpm
• ipa-server-trust-ad-4.5.4-10.el7_5.3.x86_64.rpm
• ipa-4.5.4-10.el7_5.3.src.rpm
• ipa-client-4.5.4-10.el7_5.3.aarch64.rpm
• ipa-server-common-4.5.4-10.el7_5.3.noarch.rpm
• python2-ipaserver-4.5.4-10.el7_5.3.noarch.rpm
• ipa-client-4.5.4-10.el7_5.3.ppc64le.rpm
• ipa-python-compat-4.5.4-10.el7_5.3.noarch.rpm
• ipa-client-4.5.4-10.el7_5.3.ppc64.rpm
• ipa-common-4.5.4-10.el7_5.3.noarch.rpm
• ipa-server-dns-4.5.4-10.el7_5.3.noarch.rpm
• ipa-debuginfo-4.5.4-10.el7_5.3.ppc64le.rpm
• ipa-debuginfo-4.5.4-10.el7_5.3.s390x.rpm
• ipa-server-4.5.4-10.el7_5.3.x86_64.rpm
• ipa-debuginfo-4.5.4-10.el7_5.3.x86_64.rpm
• ipa-client-4.5.4-10.el7_5.3.s390x.rpm
• ipa-client-common-4.5.4-10.el7_5.3.noarch.rpm
• ipa-debuginfo-4.5.4-10.el7_5.3.ppc64.rpm

Fixes

• This content is not included.BZ - 1579189
• This content is not included.BZ - 1579190
• This content is not included.BZ - 1579203

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.