freeipa

#9632 Unconditionally add MS-PAC to global config
Closed: fixed by rcritten. Opened by jrische.

Closed: fixed
Reopen Issue

To enable PAC generation, the "MS-PAC" value has to be set for "ipaKrbAuthzData" in "cn=ipaConfig,cn=etc,$SUFFIX".

However, the LDIF file is using the "addifnew" instruction, which is skipped in case the attribute already exists. This is not the behaviour we want. "MS-PAC" should be added unconditionally, especially now on RHEL 8 where the PAC is required by the Bronze-Bit attack detection mechanism. Not supporting the PAC breaks the IPA API on this RHEL version.

Metadata Update from @jrische:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-49437

master:

  • 0c79ecb163dac9b7a07c2ab48982eb4823cfde0d Unconditionally add MS-PAC to global config on update

ipa-4-12:

  • d1a485a435ea9dba7587d1998451a09d3aa4077b Unconditionally add MS-PAC to global config on update
  • 9f88188204e443dd5d1d22ebe65b947452558f66 Remove RC4 and 3DES default encryption types on update

ipa-4-11:

  • 96e1c9726454cdb04b8c7cc1e06885135244c387 Unconditionally add MS-PAC to global config on update
  • e51db4ac7c4bc5a67064b6ebae1b538385347757 Remove RC4 and 3DES default encryption types on update

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-10:

  • 2925336ea406a2f70d5690fd89dee637308adab2 Unconditionally add MS-PAC to global config on update
  • 5313dae84b8c6014561f31f28a7455c84e9a509e Remove RC4 and 3DES default encryption types on update

ipa-4-9:

  • 4ef0d6c013169e0ad9c8766c9cc7460f38e8c362 Unconditionally add MS-PAC to global config on update
  • 4d682a224495701613a1f0d64da970418b7ee2b9 Remove RC4 and 3DES default encryption types on update

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-49437, https://issues.redhat.com/browse/RHEL-52305, https://issues.redhat.com/browse/RHEL-52306 (was: https://issues.redhat.com/browse/RHEL-49437)

master:

  • b07f1d970b2ca4877daa6232acd6786bcebeb5a7 ipatests: Check Default PAC type is added to config

ipa-4-12:

  • ad4b7f6cedaed54acf279033b650010c65face10 ipatests: Check Default PAC type is added to config

ipa-4-11:

  • d22bdac0eb9ea6676c755a086bd2c0941287505d ipatests: Check Default PAC type is added to config

ipa-4-10:

  • bdc35a02f5038610136c329eab9e3b79788bbb9a ipatests: Check Default PAC type is added to config

ipa-4-9:

  • 7ef941104cb8f862bcd5f6efa766c90a0680c287 ipatests: Check Default PAC type is added to config
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.