First release candidate for FreeIPA 4.8.0.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2019-4b1fc0c4b9Please login to add feedback.
This update has been submitted for testing by abbra.
Fails openQA testing - see links on Automated Tests tab. I haven't investigated the cause yet.
The server claims to be running fine, but the client claims not to be able to register with it. Someone's lying! Client logs show this:
Server logs show more or less a successful server deployment, but also these errors...
which I guess may be related here? It does seem like some kind of DNS problem.
This update has been pushed to testing.
Bodhi is disabling automatic push to stable due to negative karma. The maintainer may push manually if they determine that the issue is not severe.
I think this failure is due to the test running with DNSSEC validation but named-pkcs11 failing to validate the path to root nameservers and disabling it:
It doesn't allow external clients to resolve through itself then. You need to add --no-dnssec-validation to ipa-server-install to disable DNSSEC validation.
In order to get more insights what happens, we need /var/named/data/named.run log. It is not included into artifacts, unfortunately.
because why put log files into
/var/log, that would be so boring and conventional...sighAdding
--no-dnssec-validationdoes not seem to help. Exact command tested wasipa-server-install -U --realm=DOMAIN.LOCAL --domain=domain.local --ds-password=monkeys123 --admin-password=monkeys123 --setup-dns --reverse-zone=2.0.10.in-addr.arpa --allow-zone-overlap --forwarder=10.5.126.21 --forwarder=10.5.126.22 --no-dnssec-validation. Client tests still failed. Will get that log file.https://openqa.stg.fedoraproject.org/tests/533861/file/role_deploy_domain_controller_check-named.run is a
named.runfrom a run of this test, not sure if it contains what you need. Note that the server logs are being uploaded sort of while the client tests are running; for boring openQA implementation reasons it is difficult to get the logs after the client tests fail. The logs may be from just after one of the clients tries to enrol, or just before; I'll check timestamps and figure out which this was in a bit.abbra edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update has been submitted for testing by abbra.
I backed off the change that set default for minimum SSF value to 56. With it, realmd was unable to validate IPA server discovery as it uses only anonymous LDAP connection.
adamwill edited this update.
New build(s):
Removed build(s):
Karma has been reset.
With my web font fix in -3, the openQA tests now pass. Still, is it really appropriate to send a 4.8 pre-release as an update to F30, now F30 is a stable release?
This update has been pushed to testing.
This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes
FreeIPA 4.8 pre-release went through extensive testing in past three months in upstream PR-CI. The tests we saw failing here were the only ones we didn't test. We had intention to add FreeIPA 4.8 to Fedora 30 since the very beginning.
This update has been submitted for batched by abbra.
This update has been submitted for stable by abbra.
This update has been pushed to stable.