FreeIPA 4.9.8 release notes draft

The FreeIPA team would like to announce FreeIPA 4.9.8 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.9.8

TODO RELEASE NOTES - put release notes (if any) to proper categories

The KRA role search was too narrow resulting in false positives when trying to delete a server with a KRA, resulting in an error that the last KRA was being removed when this was not the case.
IPA clients store a copy of the server command schema, with a TTL of 1 hour by default. During plugin development command options, labels, etc may change and because some values are cached, new values will not display until the cache expires. This change adds a new configuration option, schema_ttl, so that a user can control how long the data is cached. A setting of 0 disables the cache. Tuning this is not recommended on production servers.
Set the server-side search size limit to 10,000 entries. By default the client side will still be 100. Consider carefully when increasing the client side value as it adds additional load on the server to retrieve more entries.
FreeIPA DNS integration now provides URI records for a dynamic discovery of Kerberos KDCs. This allows automatic discover and use of MS-KKDCP proxies. URI records are also Kubernetes-friendly as Kubernetes does not support SRV records with the same name and different protocols.
When creating a new replica against an older existing server that lacks the sanToCNDefaultImpl capability, the ACME certificate profile cannot be added. Running ipa-server-upgrade manually after ipa-replica-install has completed will correctly add in the missing profile.
Make Dogtag return XML for ipa cert-find
By default IPA caches LDAP entries within a given request. Entries with a userCertificate value are not cached because the attribute may be represented with or without a ;binary tag and this confuses the cache. This will be revisted in the future but for now we are favoring correctness over speed.
New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part of the ipa-adtrust-install command.
FreeIPA now implements PAC structure hardening as coordinated with Samba Team and Microsoft in CVE-2020-25719 and CVE-2021-42287 correspondingly.
ipa pwpolicy-mod --minlife $min --maxlife $max accepts $max >= $min, yet the error message says: "Maximum password life must be greater than minimum." Change the error message so that it conveys the actual logic.

END TODO

Enhancements

IPA clients store a copy of the server command schema, with a TTL of 1 hour by default. During plugin development command options, labels, etc may change and because some values are cached, new values will not display until the cache expires. This change adds a new configuration option, schema_ttl, so that a user can control how long the data is cached. A setting of 0 disables the cache. Tuning this is not recommended on production servers.
FreeIPA DNS integration now provides URI records for a dynamic discovery of Kerberos KDCs. This allows automatic discover and use of MS-KKDCP proxies. URI records are also Kubernetes-friendly as Kubernetes does not support SRV records with the same name and different protocols.
New installations of IPA now configure the server to generate SIDs by default. Previously, this setup was executed as part of the ipa-adtrust-install command.
FreeIPA now implements PAC structure hardening as coordinated with Samba Team and Microsoft in CVE-2020-25719 and CVE-2021-42287 correspondingly.

Known Issues

Previously, systemd-resolved presented reverse record for host's IP address which made ipa-server-install skip creation of reverse zone. The issue was fixed in systemd on Fedora 35 and is not a problem anymore.

Bug fixes

FreeIPA 4.9.8 is a stabilization release for the features delivered as a part of 4.9.0 version series.

There are more than 30 bug-fixes since FreeIPA 4.9.7 release. Details of the bug-fixes can be seen in the list of resolved tickets below.

Upgrading

Upgrade instructions are available on Upgrade page.

Feedback

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat.

Resolved tickets

Detailed changelog since 4.9.7

Armando Neto (2)

Alexander Bokovoy (12)

Christian Heimes (1)

Chris Kelley (1)

Endi Sukma Dewata (1)

François Cami (5)

Florence Blanc-Renaud (27)

Jochen Kellner (1)

Michal Polovka (1)

Mohammad Rizwan (4)

Pavel Březina (1)

Petr Voborník (2)

Rob Crittenden (7)

Sumit Bose (1)

Stanislav Levin (15)

Sergey Orlov (2)

Sumedh Sidhaye (1)

Vit Mojzis (1)