freeipa

#7932 FreeIPA queries rely on missing attribute altsecurityidentities
Closed: fixed by abbra. Opened by firstyear.

Closed: fixed
Reopen Issue

Issue

During analysis of a 389ds issue, it was discovered that altsecurityidentities as an attribute is not present in the FreeIPA schema. This means the attribute can never match in a query, and is not possible to index.

The attribute should be removed from all queries related, or should be added to the schema and indexed.

References:

https://pagure.io/389-ds-base/pull-request/50252#comment-85208

Metadata Update from @pcech:
- Issue tagged with: Raven

Metadata Update from @pcech:
- Issue untagged with: Raven
- Issue tagged with: Falcon

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3110

master:

  • 5a83eea20bdd0c1c6302eada774ef3d8cfa04e36 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 725899595f42b607989db96d849e1b4f01de7faa Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 41ca4d484e7492bf469d73c6e627cc6df46eebf8 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 95c2b34c4b468a9b766b24172e34ff2d8b6c9530 certmaprule: add negative test for altSecurityIdentities

ipa-4-8:

  • f9551453de251a46cf2e867334f5f4b435a60747 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 0841d8b4329feec312b22c0440dae9749061eae7 Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 14ddf7b8ed541e8d3343509acfde181b70c04295 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 2e37205393e106d7ddd9de0c151d6c3a2c695243 certmaprule: add negative test for altSecurityIdentities

ipa-4-7:

  • 9de1287af88380a296850ee557fd784fc955265f Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 0c57ce7eab559aac232c19edb4c295f8592b3a5a Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • bbed1adc0bb61a51cfd7c017bac6dbb855460eae certmap rules: altSecurityIdentities should only be used for trusted domains
  • 9f59b3cfd8c97374edd365e1aa39bc4edbac5a74 certmaprule: add negative test for altSecurityIdentities

ipa-4-6:

  • f8fccd5a3381f44ad8058d611a37a72ea9327040 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • dc816890398a681b2a5de4a75b932140ffd98627 Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 219fb1f5f98f72ff34010935000cc4072630ecc6 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 0cc8ce2d23c46108088a0e2de6bb95bb7add8e92 certmaprule: add negative test for altSecurityIdentities

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

Falcon

None
None
None
https://github.com/freeipa/freeipa/pull/3110
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.