The FreeIPA team would like to announce FreeIPA 4.8.9 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.8.9

Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication ( https://pagure.io/freeipa/issue/8431 ).
Re-enable test_sss_ssh_authorizedkeys ; add -v to ssh in order to get debug information if this test fails or stalls again. The test was run 16 times without a failure before re-enabling it.
Previously, ipa-client-installation saved the pre-install state using "authselect current" command and the uninstallation reverted to the same authselect state. In cases where the system was installed using authconfig instead of authselect, the uninstallation was unable to revert to the same state and picked "sssd"'s authselect profile instead. Now, the client installation relies on the backup functionality of authselect and is able to revert to the exact pre-install state
ipa-client-installation now writes the sshd configuration to the drop-in directory /etc/ssh/sshd_config.d/, in the 04-ipa.conf snippet, thus ensuring that the setting "ChallengeResponseAuthentication yes" take precedence.
When users from trusted Active Directory domains have permissions to manage IPA resources, they can do so through a Web UI management console.
EPN did not ship any configuration file. This was an oversight, but the tool itself would work fine as it had sane defaults ; moreover, the man page for the configuration file was present.
The new PR-CI images are cleaner and do not need the *epn* packages to be uninstalled/reinstalled.
ipaplatform now provides container platform flavors for freeipa/freeipa-container
Sometimes test_login_wrong_password fails because the log window the string message is searched in is too narrow. Broaden the window by looking at the past 10 seconds.
Various input validation checks were added to EPN.
EPN now displays a proper message if the configured SMTP server cannot be contacted.
EPN: enhance existing tests for --dry-run, --from-nbdays and --to-nbdays.

Enhancements

Known Issues

Bug fixes

FreeIPA 4.8.9 is a stabilization release for the features delivered as a part of 4.8 version series.

There are more than 50 bug-fixes details of which can be seen in the list of resolved tickets below.

Upgrading

Upgrade instructions are available on Upgrade page.

Feedback

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on Freenode.

Resolved tickets

Detailed changelog since 4.8.8

Armando Neto (4)

Alexander Bokovoy (6)

Anuja More (5)

Alexander Scheel (3)

Peter Keresztes Schmidt (7)

Christian Heimes (17)

François Cami (28)

Florence Blanc-Renaud (20)

Fraser Tweedale (5)

Jeremy Frasier (2)

Kaleemullah Siddiqui (1)

Michal Polovka (2)

Mark Reynolds (3)

Mohammad Rizwan (3)

Petr Voborník (2)

Rob Crittenden (23)

Stanislav Levin (9)

Sergey Orlov (1)

Serhii Tsymbaliuk (5)

sumenon (9)

Zdenek Pytela (1)