diff --git a/src/index.rst b/src/index.rst index 58e61729..17c638fa 100644 --- a/src/index.rst +++ b/src/index.rst @@ -52,6 +52,7 @@ Releases .. toctree:: :titlesonly: + /release-notes/4-13-2.rst /release-notes/4-13-1.rst /release-notes/4-13-0.rst /release-notes/4-12-5.rst @@ -60,8 +61,6 @@ Releases /release-notes/4-12-2.rst /release-notes/4-12-1.rst /release-notes/4-11-2.rst - /release-notes/4-12-0.rst - Getting involved ---------------- diff --git a/src/release-notes/4-13-2.rst b/src/release-notes/4-13-2.rst new file mode 100644 index 00000000..1932e53e --- /dev/null +++ b/src/release-notes/4-13-2.rst @@ -0,0 +1,441 @@ +FreeIPA 4.13.2 +============== + +.. raw:: mediawiki + + {{ReleaseDate|2026-07-07}} + +The FreeIPA team would like to announce FreeIPA 4.13.2 release! + +It can be downloaded from http://www.freeipa.org/page/Downloads. Builds +for Fedora distributions will be available from the official repository +soon. + +.. _highlights_in_4.13.2: + +Highlights in 4.13.2 +-------------------- + +Enhancements +~~~~~~~~~~~~ + +.. _known_issues: + +Known Issues +~~~~~~~~~~~~ + +.. _bug_fixes: + +Bug fixes +~~~~~~~~~ + +FreeIPA 4.13.2 is a stabilization release for the features delivered as +a part of 4.13 version series. + +There are no bug-fixes since FreeIPA 4.13.1 release. Details of the +bug-fixes can be seen in the list of resolved tickets below. + +Upgrading +--------- + +Upgrade instructions are available on +`Upgrade `__ page. + +Feedback +-------- + +Please provide comments, bugs and other feedback via the freeipa-users +mailing list +(https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) +or #freeipa channel on libera.chat. + +.. _resolved_tickets: + +Resolved tickets +---------------- + +.. _detailed_changelog_since_4.13.1: + +Detailed changelog since 4.13.1 +------------------------------- + +.. _jay_gondaliya_1: + +Jay Gondaliya (1) +~~~~~~~~~~~~~~~~~ + +- ipatests: Ensure kdcproxy logs a timeout warning when AD KDC is + unreachable + `commit `__ + +.. _alexander_bokovoy_6: + +Alexander Bokovoy (6) +~~~~~~~~~~~~~~~~~~~~~ + +- ipa-kdb: fix S4U2Proxy failure when MS-PAC not yet initialized + `commit `__ +- SELinux: expand policy coverage for sssd_mfa_t domain + `commit `__ +- SELinux: wrap bare gen_require blocks in optional_policy in dnskey + section + `commit `__ +- SELinux: transition ipa_otpd_t to sssd_mfa_t when executing MFA + helpers + `commit `__ +- ipa-sam: use internal Samba method to populate in-memory keytab + `commit `__ +- SELinux: expand policy coverage for Kerberos usage + `commit `__ + +.. _anuja_more_6: + +Anuja More (6) +~~~~~~~~~~~~~~ + +- ipatests: add Azure Entra IdP integration tests + `commit `__ + `#8803 `__ +- ipatests: xfail trust sudo/HBAC tests when SSSD is below 2.12 + `commit `__ +- ipatests: add SSH/GSSAPI AD trust integration tests. + `commit `__ +- ipatests: increase timeout for PR-CI. + `commit `__ +- ipatests: add HTTP GSSAPI Kerberos authentication tests with AD trust + `commit `__ +- ipatests: add Random Password based replica promotion coverage + `commit `__ + +.. _antonio_torres_1: + +Antonio Torres (1) +~~~~~~~~~~~~~~~~~~ + +- Back to git snapshots + `commit `__ + +.. _aleksandr_sharov_4: + +Aleksandr Sharov (4) +~~~~~~~~~~~~~~~~~~~~ + +- ipa-migrate: migrate custom kerberos password policies + `commit `__ +- ipa-migrate: ignore replication conflicts + `commit `__ +- ipa-migrate: migrate DNS locations + `commit `__ +- ipa-migrate: migrate ssh public keys for users and overrides + `commit `__ + +.. _david_hanina_18: + +David Hanina (18) +~~~~~~~~~~~~~~~~~ + +- ipatests: unauthorized page through httpd + `commit `__ + `#10008 `__ +- Add referrer-policy + `commit `__ +- Disable Trace method + `commit `__ + `#9982 `__ +- Fix unauthorized error page + `commit `__ +- Fix naive Referer check bypass in rpcserver + `commit `__ +- Enforce Same-Site cookie + `commit `__ +- ipatests: Change the xfail version to sssd 2.12.0 + `commit `__ +- Disallow retrieving software versions + `commit `__ +- Fix flaky notification assert for webui + `commit `__ +- Fix ipa ca-show ipa --all not listing RSN version + `commit `__ +- Allow 32bit gid + `commit `__ +- Return code 0 for all failing scriplets + `commit `__ +- Wait until buttons are clickable + `commit `__ +- Replace None with '' when uninstalling CA + `commit `__ +- Fix cert-find retrieval + `commit `__ +- Remove navigation tests + `commit `__ +- Fix QUnit import + `commit `__ +- Return nothing if certificate is empty + `commit `__ + +.. _erik_belko_2: + +Erik Belko (2) +~~~~~~~~~~~~~~ + +- ipatests: Add AD trust NFS automount integration tests + `commit `__ +- ipatests: Add ipa-getcert request tests for NSS storage + `commit `__ + +.. _florence_blanc_renaud_33: + +Florence Blanc-Renaud (33) +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +- freeipa.spec: bump samba version + `commit `__ +- prci definitions: increase test_sudo timeout + `commit `__ +- ipatests: split test_commands into 2 jobs + `commit `__ +- ipatests: xfail TestInstallDNSSECFirst + `commit `__ +- CI: switch testing from fedora 43 to fedora 44 + `commit `__ +- Spec file: move named-related files to server-dns package + `commit `__ +- ipatests: use either cafile or capath for ssl connection + `commit `__ +- ipatests: adapt to psutil + `commit `__ +- Azure CI: Use Fedora 44 + `commit `__ +- replica conncheck: use crypto-policies in temp krb5.conf + `commit `__ +- prci definitions: extend test_commands timeout to 6000s + `commit `__ +- constants: Use 24-byte key to check id TripleDES is supported + `commit `__ +- ipatests: adapt the expected output message + `commit `__ +- ipatests: fix the method add_a_record + `commit `__ +- ipatests: adapt expected output for test_smb + `commit `__ +- CI definitions: split ipa_ipa_migrate into 2 jobs + `commit `__ +- ipatests: fix migration test + `commit `__ +- Read The Docs: use ubuntu-24.04 instead of ubuntu-20.04 + `commit `__ +- ipatests: Add selfservice-find cli tests to xmlrpc Add a new + Declarative test class test_selfservice_cli_find covering CLI-level + behaviour of the selfservice-find command: + `commit `__ +- ipatests: fix the topology for test_32bit_idranges + `commit `__ +- ipa-migrate: normalize objectClass before building the list + `commit `__ +- Azure CI: remove test_sudo::TestSudo_Functional + `commit `__ +- azure CI: fix broken package installation + `commit `__ +- webui tests: update expected max value for krbminpwdlife + `commit `__ +- ipatests: fix install method for BasePWpolicy + `commit `__ +- Spec file: create the systemd-sysusers before oddjob and dbus restart + `commit `__ +- Spec file: build requires /usr/bin/node, /usr/bin/npm + `commit `__ +- ipatests: pruning is enabled when RSN is enabled + `commit `__ +- Doc: remove the constraint on docutils version + `commit `__ +- ipa-join: initialize pointer + `commit `__ +- fetch_domains: Use case-insensitive comparison for domains names + `commit `__ +- ipa-advise: smart card client script does not need krb ticket + `commit `__ +- ipatests: Fix xfail assertion for sssd 2.12.0 + `commit `__ + +.. _jay_gondaliya_5: + +Jay Gondaliya (5) +~~~~~~~~~~~~~~~~~ + +- ipatests: Add ipa selfservice-show and selfservice-mod CLI tests to + xmlrpc + `commit `__ +- ipatests: Add user-principal ipa-getkeytab and ipa-rmkeytab cmdline + tests + `commit `__ +- ipatests: Add selfservice-add and selfservice-del cli tests + `commit `__ +- ipatests: Add ipa-selfservice users tests to xmlrpc + `commit `__ +- ipatests: Add ipa-selfservice BZ tests to xmlrpc + `commit `__ + +.. _julien_rische_6: + +Julien Rische (6) +~~~~~~~~~~~~~~~~~ + +- ipatests: test password expiration with passwordless authentication + `commit `__ + `#10009 `__ +- kdb: skip password expiration for passwordless authentication + `commit `__ + `#10009 `__ +- kdb: do not encode string attr null terminator in LDAP + `commit `__ + `#10007 `__ +- kdb: prevent read overrun while loading tl_data + `commit `__ +- ipa-kdb: warn when tickets are issued without PAC + `commit `__ +- ipa-kdb: fix PAC creation failure in DAL v9 when PAC generator not + initialized + `commit `__ + +.. _mark_reynolds_1: + +Mark Reynolds (1) +~~~~~~~~~~~~~~~~~ + +- ipa-migrate - do not convert hostnames/realm for computers and + automounts + `commit `__ + +.. _andrew_novak_1: + +Andrew Novak (1) +~~~~~~~~~~~~~~~~ + +- upgrade: change ModifyLDIF modification processing logic for proper + Schema Compat turn off + `commit `__ + +.. _pranav_thube_17: + +PRANAV THUBE (17) +~~~~~~~~~~~~~~~~~ + +- ipatests: Fix EPN Postfix TLS setup for FIPS mode + `commit `__ + `#10010 `__ +- Document SELinux usermap verify expectations. + `commit `__ +- ipatests: Add AD trust SELinux user map tests (part 2) + `commit `__ + `#9845 `__ +- PRCI definations updated for trust_selinux_usermap. + `commit `__ +- ipatests: Add AD trust SELinux user map tests (part 1) + `commit `__ +- ipatests: fix replica forward-zone test teardown resolv.conf restore + `commit `__ +- ipatests: fix dnszone_add SOA MNAME expectation for numeric TLD + `commit `__ +- ipatests: Add trust functional User testcases. + `commit `__ +- ipatests: Extend netgroup test coverage. + `commit `__ +- ipatests: Add XML-RPC tests for i18n user attributes + `commit `__ +- ipatests: Fix test_allow_query_transfer_ipv6 when IPv6 is disabled + `commit `__ +- ipatests: Add DNS integration tests. + `commit `__ +- ipatests: Add DNS bugzilla integration tests. + `commit `__ +- ipatests: Add integration tests for ipa-join command + `commit `__ +- ipatests: Fix resolver state tracking in enforced DNS policy tests. + `commit `__ +- ipatests: Add DNS functional integration tests. + `commit `__ +- ipatests: Move expire_password fixture into TestIPACommand class + `commit `__ + +.. _rob_crittenden_4: + +Rob Crittenden (4) +~~~~~~~~~~~~~~~~~~ + +- Skip the lockout alert on no failure count or not max fail + `commit `__ + `#9820 `__ +- Add path to identify the tomcat version for Tomcat 10 + `commit `__ +- Avoid int overflow with pwpolicy minlife + `commit `__ +- Handle IPACertificate types in xmlrpc + `commit `__ + +.. _rafael_guterres_jeffman_2: + +Rafael Guterres Jeffman (2) +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +- freeipa.spec.in: Use systemd-sysusers to setup users and groups + `commit `__ +- Remove deprecated license classifier from ipasetup.py.in + `commit `__ + +.. _sumit_bose_1: + +Sumit Bose (1) +~~~~~~~~~~~~~~ + +- ipa-otpd: do not pass reference of data_out->jdata + `commit `__ + +.. _stanislav_levin_1: + +Stanislav Levin (1) +~~~~~~~~~~~~~~~~~~~ + +- ipatest: make tests compatible with Pytest 9 + `commit `__ + +.. _sudhir_menon_11: + +Sudhir Menon (11) +~~~~~~~~~~~~~~~~~ + +- ipatests: add negative and option-validation tests for migrate-ds + `commit `__ +- ipatests: add migrate-ds integration tests for bugs. + `commit `__ +- ipatests: Add hashed password migration scenario to ds-migrate + testsuite + `commit `__ +- ipatests: ipa mixed mode and ipa plugins migration. + `commit `__ +- ipatests: Bugzillas for ipa-migrate ds testsuite + `commit `__ +- ipatests: Add nigthly definitions for ds-migrate + `commit `__ +- ipatests: ipa-migrate-ds test scenarios + `commit `__ +- ipatests: Updated nightly definitions for ipa-ipa-migration testsuite + `commit `__ +- ipatests: Additional tests for ipa-ipa migration testsuite + `commit `__ +- ipatests: Additional tests for 32BitIdranges + `commit `__ +- ipatests: Add xmlrpc tests for ipa-delegation-cli + `commit `__ + +.. _veronika_miticka_2: + +Veronika Miticka (2) +~~~~~~~~~~~~~~~~~~~~ + +- Add CSP headers to webui + `commit `__ + `#9900 `__ + `#9901 `__ +- Add X-Content-Type-Options header in IdM WebUI. I checked the content + type of static files + `commit `__