ipaserver: Move /etc/httpd/ipa to /etc/ipa/httpd

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Stanislav Levin <slev@altlinux.org>

.gitignore

@@ -155,6 +155,7 @@ install/custodia/ipa-custodia-dmldap
 install/custodia/ipa-custodia-pki-tomcat
 install/custodia/ipa-custodia-pki-tomcat-wrapped
 install/custodia/ipa-custodia-ra-agent
+install/oddjob/org.freeipa.server.config-enable-sid
 install/oddjob/org.freeipa.server.trust-enable-agent
 install/oddjob/com.redhat.idm.trust-fetch-domains
 install/oddjob/etc/oddjobd.conf.d/ipa-server.conf

Makefile.am

@@ -23,6 +23,8 @@ PYTHON_SCRIPT_SUBDIRS = \
         $(top_builddir)/install/tools \
         $(NULL)
 
+PRCI_DEFINITIONS_DIR = $(top_srcdir)/ipatests/prci_definitions
+
 AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure
 
 IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests
@@ -336,6 +338,8 @@ endif  # WITH_RPMLINT
 # There are Jinja yaml templates, which differ from reqular ones. These
 # files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise
 # safe_load fails.
+# Also check PRCI definitions yaml files jobs format and content with
+# prci_checker script
 .PHONY: yamllint
 yamllint:
 	YAML_TEMPLATE_FILES="\
@@ -357,7 +361,10 @@ yamllint:
 		echo $${YAML}; \
 		$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \
 	done; \
-	echo "-----------"
+	echo -e "\nCheck PRCI definitions";
+	@echo "-----------"
+	$(PYTHON) $(PRCI_DEFINITIONS_DIR)/prci_checker.py -d $(PRCI_DEFINITIONS_DIR) -s $(PRCI_DEFINITIONS_DIR)/prci_jobs_spec.yaml;
+	@echo "-----------"
 
 # Build & lint documentation.
 #
@@ -389,7 +396,7 @@ pylint: $(GENERATED_PYTHON_FILES) ipasetup.py python_scripts
 		-name '*~' -o \
 		-name '*.py' -print -o \
 		-type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
-	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)"`; \
+	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)\n$(PRCI_DEFINITIONS_DIR)"`; \
 	echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \
 	$(PYTHON) -m pylint --version; \
 	PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \

VERSION.m4

@@ -21,7 +21,7 @@
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
 define(IPA_VERSION_MINOR, 10)
-define(IPA_VERSION_RELEASE, 0)
+define(IPA_VERSION_RELEASE, 1)
 
 ########################################################
 # For 'pre' releases the version will be               #

daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c

@@ -359,7 +359,8 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     Slapi_ValueSet *values = NULL;
     long grace_limit = 0;
     int grace_user_time;
-    char *pwd_expiration = NULL;
+    char *tmpstr = NULL;
+    time_t pwd_expiration;
     int pwresponse_requested = 0;
     Slapi_PBlock *pbtm = NULL;
     Slapi_Mods *smods = NULL;
@@ -414,12 +415,17 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     }
     slapi_value_free(&objectclass);
 
-    pwd_expiration = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
-    if (pwd_expiration == NULL) {
+    tmpstr = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
+    if (tmpstr == NULL) {
         /* No expiration means nothing to do */
         LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn);
         goto done;
     }
+    pwd_expiration = ipapwd_gentime_to_time_t(tmpstr);
+    if (pwd_expiration > time(NULL)) {
+        /* Not expired, nothing to see here */
+        goto done;
+    }
 
     ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry,
                                     &values, &actual_type_name,
@@ -473,7 +479,7 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
         if (pwresponse_requested) {
             slapi_pwpolicy_make_response_control(pb, -1, grace_limit - grace_user_time , -1);
         }
-    } else if ((grace_limit > 0) && (grace_user_time >= grace_limit)) {
+    } else if (grace_user_time >= grace_limit) {
         LOG_TRACE("%s password is expired and out of grace limit\n", dn);
         errstr = "Password is expired.\n";
         ret = LDAP_INVALID_CREDENTIALS;

doc/Makefile

@@ -35,4 +35,5 @@ distclean: clean
 venv:
 	$(PYTHON) -m venv $(VENVDIR)
 	$(VENVDIR)/bin/python3 -m pip install -U pip setuptools
-	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt
+	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt \
+		-c constraints.txt

doc/constraints.txt

@@ -0,0 +1 @@
+docutils < 0.19

freeipa.spec.in

@@ -1525,10 +1525,11 @@ fi
 %dir %{_sysconfdir}/ipa/html
 %config(noreplace) %{_sysconfdir}/ipa/html/ssbrowser.html
 %config(noreplace) %{_sysconfdir}/ipa/html/unauthorized.html
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf
-%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-kdc-proxy.conf
-%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf
+%dir %{_sysconfdir}/ipa/http
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-rewrite.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa.conf
+%ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-kdc-proxy.conf
+%ghost %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ipa/httpd/ipa-pki-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipa/kdcproxy/ipa-kdc-proxy.conf
 %ghost %attr(0644,root,root) %config(noreplace) %{_usr}/share/ipa/html/ca.crt
 %ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/named/ipa-ext.conf

install/share/Makefile.am

@@ -101,6 +101,7 @@ dist_app_DATA =				\
 	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf.template	\
 	ipa-rewrite.conf.template	\
+	ipa-vhost.conf.template		\
 	ipaca_default.ini		\
 	ipaca_customize.ini		\
 	ipaca_softhsm2.ini		\

install/share/ipa-vhost.conf.template

@@ -0,0 +1,50 @@
+#
+# VERSION 32 - DO NOT REMOVE THIS LINE
+#
+# This file may be overwritten on upgrades.
+#
+
+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
+# Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
+
+<VirtualHost *:80>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
+
+# the below section is only need if you have above 3 lines and want SSL
+<VirtualHost *:443>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    # SSL
+    SSLEngine on
+    SSLCertificateFile $HTTPD_CERT_FILE
+    SSLCertificateKeyFile $HTTPD_KEY_FILE
+    SSLCACertificateFile $IPA_CA_CRT
+    SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH
+
+    # FreeIPA
+    IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>

install/share/ipa.conf.template

@@ -35,19 +35,11 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml \
  application/javascript application/json text/css \
  application/x-font-ttf
 
-# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
-# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
-WSGISocketPrefix $WSGI_PREFIX_DIR
-
 # Configure mod_wsgi handler for /ipa
-WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
-  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
-  lang=C.UTF-8 locale=C.UTF-8
 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \
   application-group=%{GLOBAL}
 WSGIScriptReloading Off
 
-
 # Turn off mod_msgi handler for errors, config, crl:
 <Location "/ipa/errors">
   SetHandler None

install/tools/man/ipa-replica-install.1

@@ -98,6 +98,9 @@ Configure SSSD as data source for subid.
 \fB\-\-skip\-conncheck\fR
 Skip connection check to remote master
 .TP
+\fB\-\-skip\-mem\-check\fR
+Skip checking for minimum required memory
+.TP
 \fB\-d\fR, \fB\-\-debug
 Enable debug logging when more verbose output is needed
 .TP

install/tools/man/ipa-server-install.1

@@ -83,6 +83,9 @@ Do not configure OpenSSH server.
 \fB\-\-subid\fR
 Configure SSSD as data source for subid.
 .TP
+\fB\-\-skip\-mem\-check\fR
+Skip checking for minimum required memory
+.TP
 \fB\-d\fR, \fB\-\-debug\fR
 Enable debug logging when more verbose output is needed.
 .TP

install/ui/src/freeipa/Application_controller.js

@@ -318,6 +318,7 @@ define([
                         $type: 'text',
                         name: 'pagination_size',
                         label: '@i18n:customization.table_pagination',
+                        required: true,
                         validators: ['positive_integer']
                     }
                 ]

install/ui/src/freeipa/policy.js

@@ -72,6 +72,9 @@ return {
                         {
                             name: 'cospriority',
                             required: true
+                        },
+                        {
+                            name: 'passwordgracelimit'
                         }
                     ]
                 }]

install/ui/src/freeipa/user.js

@@ -318,6 +318,11 @@ return {
                             label: '@mo-param:pwpolicy:krbpwdlockoutduration:label',
                             read_only: true,
                             measurement_unit: 'seconds'
+                        },
+                        {
+                            name: 'passwordgracelimit',
+                            label: '@mo-param:pwpolicy:passwordgracelimit:label',
+                            read_only: true
                         }
                     ]
                 },

ipalib/messages.py

@@ -18,7 +18,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 """
-Custom message (debug, info, wraning) classes passed through RPC.
+Custom message (debug, info, warning) classes passed through RPC.
 
 These are added to the "messages" entry in a RPC response, and printed to the
 user as log messages.
@@ -27,7 +27,7 @@ Each message class has a unique numeric "errno" attribute from the 10000-10999
 range, so that it does not clash with PublicError numbers.
 
 Messages also have the 'type' argument, set to one of 'debug', 'info',
-'warning', 'error'. This determines the severity of themessage.
+'warning', 'error'. This determines the severity of the message.
 """
 from __future__ import print_function
 
@@ -496,6 +496,16 @@ class LightweightCACertificateNotAvailable(PublicMessage):
     format = _("The certificate for %(ca)s is not available on this server.")
 
 
+class MissingTargetAttributesinPermission(PublicMessage):
+    """
+    **13032** A permission was added with no target attributes
+    """
+    errno = 13032
+    type = "warning"
+    format = _("The permission has %(right)s rights but no attributes "
+               "are set.")
+
+
 def iter_messages(variables, base):
     """Return a tuple with all subclasses
     """

ipaplatform/base/paths.py

@@ -45,11 +45,13 @@ class BasePathNamespace:
     GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
     OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
     HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd"
     HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"

ipaplatform/debian/paths.py

@@ -20,10 +20,12 @@ class DebianPathNamespace(BasePathNamespace):
     ETC_HTTPD_DIR = "/etc/apache2"
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
     HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"

ipaplatform/suse/paths.py

@@ -17,10 +17,12 @@ class SusePathNamespace(BasePathNamespace):
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
+    HTTPD_IPA_DIR = "/etc/ipa/httpd/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/ipa/httpd/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/ipa/httpd/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/ipa/httpd/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/ipa/httpd/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"

ipapython/dnsutil.py

@@ -144,6 +144,47 @@ class DNSResolver(dns.resolver.Resolver):
             nameservers.remove(ipv4_loopback)
         self.nameservers = nameservers
 
+    @dns.resolver.Resolver.nameservers.setter
+    def nameservers(self, nameservers):
+        """
+        *nameservers*, a ``list`` of nameservers with optional ports:
+            "SERVER_IP port PORT_NUMBER".
+
+        Overloads dns.resolver.Resolver.nameservers setter to split off ports
+        into nameserver_ports after setting nameservers successfully with the
+        setter in dns.resolver.Resolver.
+        """
+        # Get nameserver_ports if it is already set
+        if hasattr(self, "nameserver_ports"):
+            nameserver_ports = self.nameserver_ports
+        else:
+            nameserver_ports = {}
+
+        # Check nameserver items in list and split out converted port number
+        # into nameserver_ports: { nameserver: port }
+        if isinstance(nameservers, list):
+            _nameservers = []
+            for nameserver in nameservers:
+                splits = nameserver.split()
+                if len(splits) == 3 and splits[1] == "port":
+                    nameserver = splits[0]
+                    try:
+                        port = int(splits[2])
+                        if port < 0 or port > 65535:
+                            raise ValueError()
+                    except ValueError:
+                        raise ValueError(
+                            "invalid nameserver: %s is not a valid port" %
+                            splits[2])
+                    nameserver_ports[nameserver] = port
+                _nameservers.append(nameserver)
+            nameservers = _nameservers
+
+        # Call dns.resolver.Resolver.nameservers setter
+        dns.resolver.Resolver.nameservers.__set__(self, nameservers)
+        # Set nameserver_ports after successfull call to setter
+        self.nameserver_ports = nameserver_ports
+
 
 class DNSZoneAlreadyExists(dns.exception.DNSException):
     supp_kwargs = {'zone', 'ns'}

ipaserver/install/httpinstance.py

@@ -112,6 +112,14 @@ class HTTPInstance(service.Service):
             IPA_CCACHES=paths.IPA_CCACHES,
             WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
             WSGI_PROCESSES=constants.WSGI_PROCESSES,
+            HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+            HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+            HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+            HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+            HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+            IPA_CA_CRT=paths.IPA_CA_CRT,
+            MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
         )
         self.ca_file = ca_file
         if ca_is_configured is not None:
@@ -129,7 +137,6 @@ class HTTPInstance(service.Service):
         self.step("configuring mod_ssl log directory",
                   self.set_mod_ssl_logdir)
         self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp)
-        self.step("adding URL rewriting rules", self.__add_include)
         self.step("configuring httpd", self.__configure_http)
         self.step("setting up httpd keytab", self.request_service_keytab)
         self.step("configuring Gssproxy", self.configure_gssproxy)
@@ -198,6 +205,14 @@ class HTTPInstance(service.Service):
         # https://pagure.io/freeipa/issue/7662
         tasks.restore_context(session_dir)
 
+        # create /etc/httpd/ipa
+        if not os.path.isdir(paths.HTTPD_IPA_DIR):
+            os.makedirs(paths.HTTPD_IPA_DIR)
+        # Must be world-readable / executable
+        os.chmod(paths.HTTPD_IPA_DIR, 0o755)
+        # Restore SELinux context of /etc/httpd/ipa
+        tasks.restore_context(paths.HTTPD_IPA_DIR)
+
         target_fname = paths.HTTPD_IPA_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -209,6 +224,17 @@ class HTTPInstance(service.Service):
         http_fd.close()
         os.chmod(target_fname, 0o644)
 
+        target_fname = paths.HTTPD_IPA_SITE_CONF
+        http_txt = ipautil.template_file(
+            os.path.join(paths.USR_SHARE_IPA_DIR,
+                         "ipa-vhost.conf.template"),
+            self.sub_dict)
+        self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
+        http_fd = open(target_fname, "w")
+        http_fd.write(http_txt)
+        http_fd.close()
+        os.chmod(target_fname, 0o644)
+
         target_fname = paths.HTTPD_IPA_REWRITE_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -286,17 +312,6 @@ class HTTPInstance(service.Service):
             aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
             aug.save()
 
-    def __add_include(self):
-        """This should run after __set_mod_nss_port so is already backed up"""
-        if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
-                                    '</VirtualHost>',
-                                    'Include {path}\n'
-                                    '</VirtualHost>'.format(
-                                        path=paths.HTTPD_IPA_REWRITE_CONF)
-                                    ) != 0:
-            self.print_msg("Adding Include conf.d/ipa-rewrite to "
-                           "%s failed." % paths.HTTPD_SSL_SITE_CONF)
-
     def configure_certmonger_renewal_guard(self):
         certmonger = services.knownservices.certmonger
         certmonger_stopped = not certmonger.is_running()
@@ -554,13 +569,14 @@ class HTTPInstance(service.Service):
             paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host),
             paths.HTTPD_IPA_REWRITE_CONF,
             paths.HTTPD_IPA_CONF,
+            paths.HTTPD_IPA_SITE_CONF,
             paths.HTTPD_IPA_PKI_PROXY_CONF,
             paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
             paths.HTTPD_IPA_KDCPROXY_CONF,
             paths.GSSPROXY_CONF,
             paths.GSSAPI_SESSION_KEY,
             paths.HTTPD_PASSWORD_CONF,
-            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
+            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF
         ]
         # NSS DB backups
         remove_files.extend(
@@ -672,7 +688,6 @@ class HTTPInstance(service.Service):
         self.configure_mod_ssl_certs()
         self.set_mod_ssl_protocol()
         self.set_mod_ssl_logdir()
-        self.__add_include()
 
         self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE)
 

ipaserver/install/installutils.py

@@ -1132,7 +1132,8 @@ def check_available_memory(ca=False):
     if available < minimum_suggested:
         raise ScriptError(
             "Less than the minimum 1.2GB of RAM is available, "
-            "%.2fGB available" % (available / (1024 * 1024 * 1024))
+            "%.2fGB available.  Use --skip-mem-check to suppress this check."
+            % (available / (1024 * 1024 * 1024))
         )
 
 def load_external_cert(files, ca_subject):

ipaserver/install/ipa_backup.py

@@ -154,6 +154,7 @@ class Backup(admintool.AdminTool):
         paths.HTTPD_CERT_FILE,
         paths.HTTPD_KEY_FILE,
         paths.HTTPD_IPA_CONF,
+        paths.HTTPD_IPA_SITE_CONF,
         paths.SSHD_CONFIG,
         paths.SSHD_IPA_CONFIG,
         paths.SSH_CONFIG,

ipaserver/install/replication.py

@@ -1152,7 +1152,7 @@ class ReplicationManager:
             except (ValueError, TypeError, KeyError):
                 end = 0
             # incremental update is done if inprogress is false and end >= start
-            done = inprogress and inprogress.lower() == 'false' and start <= end
+            done = inprogress is not None and not inprogress and start <= end
             logger.info("Replication Update in progress: %s: status: %s: "
                         "start: %d: end: %d",
                         inprogress, status, start, end)

ipaserver/install/server/upgrade.py

@@ -20,7 +20,7 @@ from contextlib import contextmanager
 from augeas import Augeas
 
 from ipalib import api, x509
-from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD
+from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH
 from ipalib.install import certmonger
 from ipalib import sysrestore
 from ipalib.facts import is_ipa_configured
@@ -1697,6 +1697,14 @@ def upgrade_configuration():
         IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
         KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
         DOMAIN=api.env.domain,
+        HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+        HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+        HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF,
+        HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE,
+        HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE,
+        IPA_CA_CRT=paths.IPA_CA_CRT,
+        MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH,
     )
 
     subject_base = find_subject_base()
@@ -1733,6 +1741,9 @@ def upgrade_configuration():
         upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa.conf.template"))
+        upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
+                     os.path.join(paths.USR_SHARE_IPA_DIR,
+                                  "ipa-vhost.conf.template"))
         upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa-rewrite.conf.template"))
@@ -1888,9 +1899,12 @@ def upgrade_configuration():
     custodia = custodiainstance.CustodiaInstance(api.env.host, api.env.realm)
     custodia.upgrade_instance()
 
+    # Don't include schema upgrades in restart consideration, see
+    # https://pagure.io/freeipa/issue/9204
+    ca_upgrade_schema(ca)
+
     ca_restart = any([
         ca_restart,
-        ca_upgrade_schema(ca),
         certificate_renewal_update(ca, kra, ds, http),
         ca_enable_pkix(ca),
         ca_configure_profiles_acl(ca),

ipaserver/plugins/permission.py

@@ -28,6 +28,7 @@ from .privilege import validate_permission_to_privilege
 from ipalib import errors
 from ipalib.parameters import Str, StrEnum, DNParam, Flag
 from ipalib import api, _, ngettext
+from ipalib import messages
 from ipalib.plugable import Registry
 from ipalib.capabilities import client_has_capability
 from ipalib.aci import ACI
@@ -553,6 +554,7 @@ class permission(baseldap.LDAPObject):
     def make_aci(self, entry):
         """Make an ACI string from the given permission entry"""
 
+        msg = None
         aci_parts = []
         name = entry.single_value['cn']
 
@@ -560,6 +562,18 @@ class permission(baseldap.LDAPObject):
         attrs = self.get_effective_attrs(entry)
         if attrs:
             aci_parts.append("(targetattr = \"%s\")" % ' || '.join(attrs))
+        else:
+            # If we are re-parsing an entry for validation then
+            # the effective attrs may be empty.
+            if entry.get('attrs') is None:
+                rights = set(['read', 'write', 'search', 'compare'])
+                permrights = set(entry['ipapermright'])
+                for right in ('add', 'delete'):
+                    permrights.discard(right)
+                if permrights and permrights.issubset(rights):
+                    msg = messages.MissingTargetAttributesinPermission(
+                        right=', '.join(sorted(entry['ipapermright']))
+                    )
 
         # target
         ipapermtarget = entry.single_value.get('ipapermtarget')
@@ -608,12 +622,12 @@ class permission(baseldap.LDAPObject):
         aci_parts.append('(version 3.0;acl "permission:%s";allow (%s) %s;)' % (
             name, ','.join(sorted(entry['ipapermright'])), bindrule))
 
-        return ''.join(aci_parts)
+        return ''.join(aci_parts), msg
 
     def add_aci(self, permission_entry):
         """Add the ACI coresponding to the given permission entry"""
         ldap = self.api.Backend.ldap2
-        acistring = self.make_aci(permission_entry)
+        acistring, _msg = self.make_aci(permission_entry)
         location = permission_entry.single_value.get('ipapermlocation',
                                                      self.api.env.basedn)
 
@@ -641,7 +655,7 @@ class permission(baseldap.LDAPObject):
             - entry
             - removed ACI string, or None if none existed previously
         """
-        new_acistring = self.make_aci(permission_entry)
+        new_acistring, _msg = self.make_aci(permission_entry)
         return self._replace_aci(permission_entry, old_name, new_acistring)
 
     def _replace_aci(self, permission_entry, old_name=None, new_acistring=None):
@@ -672,6 +686,25 @@ class permission(baseldap.LDAPObject):
             logger.debug('No changes to ACI')
         return acientry, acistring
 
+    def check_attrs(self, result, *keys, **options):
+        """Re-build the ACI to determine if there are rights that
+           only work when there are attributes defined."""
+        ldap = self.backend
+
+        dn = self.get_dn(*keys, **options)
+        entry = ldap.make_entry(dn, result['result'])
+        for old_name, new_name in _DEPRECATED_OPTION_ALIASES.items():
+            if old_name in entry:
+                entry[new_name] = entry[old_name]
+                del entry[old_name]
+        _acistring, msg = self.make_aci(entry)
+        if msg:
+            messages.add_message(
+                options['version'],
+                result,
+                msg,
+            )
+
     def _get_aci_entry_and_string(self, permission_entry, name=None,
                                   notfound_ok=False, cached_acientry=None):
         """Get the entry and ACI corresponding to the permission entry
@@ -776,7 +809,7 @@ class permission(baseldap.LDAPObject):
         target_entry['ipapermlocation'] = [self.api.env.basedn]
 
         # Make sure we're not losing *any info* by the upgrade
-        new_acistring = self.make_aci(target_entry)
+        new_acistring, _msg = self.make_aci(target_entry)
         if not ACI(new_acistring).isequal(aci):
             raise ValueError('Cannot convert ACI, %r != %r' % (new_acistring,
                                                                acistring))
@@ -992,7 +1025,9 @@ class permission_add(baseldap.LDAPCreate):
     # the whole command, not just the callbacks
     def execute(self, *keys, **options):
         self.obj.preprocess_options(options, merge_targetfilter=True)
-        return super(permission_add, self).execute(*keys, **options)
+        result = super(permission_add, self).execute(*keys, **options)
+        self.obj.check_attrs(result, *keys, **options)
+        return result
 
     def get_args(self):
         for arg in super(permission_add, self).get_args():
@@ -1094,7 +1129,9 @@ class permission_mod(baseldap.LDAPUpdate):
     def execute(self, *keys, **options):
         context.filter_ops = self.obj.preprocess_options(
             options, return_filter_ops=True)
-        return super(permission_mod, self).execute(*keys, **options)
+        result = super(permission_mod, self).execute(*keys, **options)
+        self.obj.check_attrs(result, *keys, **options)
+        return result
 
     def get_options(self):
         for opt in super(permission_mod, self).get_options():

ipatests/azure/azure_definitions/gating-fedora.yml

@@ -45,15 +45,16 @@ vms:
     - test_integration/test_external_ca.py::TestExternalCAInstall
 
 - vm_jobs:
-  - container_job: InstallDNSSECFirst
-    containers:
-      replicas: 1
-      resources:
-        replica:
-          mem_limit: "2400m"
-          memswap_limit: "3500m"
-    tests:
-    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
+# Temporary disable - see https://pagure.io/freeipa/issue/9216
+#  - container_job: InstallDNSSECFirst
+#    containers:
+#      replicas: 1
+#      resources:
+#        replica:
+#          mem_limit: "2400m"
+#          memswap_limit: "3500m"
+#    tests:
+#    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
 
   - container_job: simple_replication
     containers:
@@ -69,14 +70,6 @@ vms:
     tests:
     - test_integration/test_service_permissions.py
 
-  - container_job: netgroup
-    tests:
-    - test_integration/test_netgroup.py
-
-  - container_job: external_ca_ExternalCAProfileScenarios
-    tests:
-    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-
 - vm_jobs:
   - container_job: sudo
     containers:
@@ -137,6 +130,15 @@ vms:
     tests:
     - test_integration/test_membermanager.py
 
+  - container_job: netgroup
+    tests:
+    - test_integration/test_netgroup.py
+
+  - container_job: external_ca_ExternalCAProfileScenarios
+    tests:
+    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
+
+
 - vm_jobs:
   - container_job: ServerReplicaCALessToCAFull
     tests:

ipatests/azure/scripts/setup_containers.py

@@ -12,7 +12,7 @@ from jinja2 import Template
 from typing import NamedTuple, TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from typing import List, Tuple, Union
+    from typing import List, Tuple, Union, Dict
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
 
@@ -77,14 +77,19 @@ class Container:
         return self._ipv6
 
     def execute(
-        self, args: Union[str, List[str]], raiseonerr: bool = True
+        self,
+        args: Union[str, List[str]],
+        raiseonerr: bool = True,
+        env: Union[Dict[str, str], List[str], None] = None,
     ) -> ExecRunReturn:
         """
         Exec an arbitrary command within container
         """
         dcont = self.dclient.containers.get(self.name)
         logging.info("%s: run: %s", dcont.name, args)
-        result: ExecRunReturn = dcont.exec_run(args, demux=True)
+        result: ExecRunReturn = dcont.exec_run(
+            args, demux=True, environment=env
+        )
         if result.output[0] is not None:
             logging.info("%s: %s", dcont.name, result.output[0])
         logging.info("%s: result: %s", dcont.name, result.exit_code)
@@ -127,13 +132,13 @@ class ContainersGroup:
             for c in range(1, self.scale + 1)
         ]
 
-    def execute_all(self, args):
+    def execute_all(self, args, env=None):
         """
         Sequentially exec an arbitrary command within every container of group
         """
         results = []
         for cont in self.containers:
-            results.append(cont.execute(args))
+            results.append(cont.execute(args, env=env))
         return results
 
     def ips(self):
@@ -199,7 +204,8 @@ class ContainersGroup:
             cont.execute(cmd)
 
             cmd = ["hostnamectl", "set-hostname", cont.hostname]
-            cont.execute(cmd)
+            # default timeout (25s) maybe not enough
+            cont.execute(cmd, env={"SYSTEMD_BUS_TIMEOUT": "50"})
 
     def setup_resolvconf(self):
         """
@@ -331,7 +337,7 @@ class Controller(Container):
 
         return self._master_container
 
-    def execute(self, args):
+    def execute(self, args, env=None):
         """
         Execute a command on controller (either master or local machine)
         """
@@ -339,7 +345,7 @@ class Controller(Container):
             proc = subprocess.run(args, check=True, capture_output=True)
             return [proc.stdout.decode().rstrip().strip("'")]
 
-        return self.master_container.execute(args)
+        return self.master_container.execute(args, env=env)
 
     def setup_hosts(self):
         """

ipatests/azure/templates/test-jobs.yml

@@ -4,6 +4,11 @@ steps:
     env | sort
   displayName: Print Host Enviroment
 
+- script: |
+    set -e
+    sudo apt list --installed
+  displayName: Show Host's installed packages
+
 - script: |
     set -e
     sudo apt-get update
@@ -16,6 +21,21 @@ steps:
         python3-docker
   displayName: Install Host's tests requirements
 
+- script: |
+    set -e
+    sudo systemctl
+  displayName: Show Host's systemd status
+
+- script: |
+    set -e
+    # most of the time systemd killed hostnamed with SIGKILL on timeout
+    # kill without waiting for graceful termination
+    sudo systemctl kill -s SIGKILL azsecd ||:
+    sudo systemctl disable --now azsecmond ||:
+    sudo systemctl disable --now azsecd ||:
+    sudo systemctl disable --now clamav-freshclam ||:
+  displayName: Disable azsec services (clamav)
+
 - script: |
     set -e
     printf "AppArmor status\n"
@@ -52,6 +72,16 @@ steps:
 
 - template: setup-test-environment.yml
 
+- script: |
+    set -eu
+    sudo top -b -o +%MEM n 1
+  displayName: Show Host's top
+
+- script: |
+    set -eu
+    sudo ps -auxf
+  displayName: Show Host's processes
+
 - template: run-test.yml
 
 - script: |

ipatests/prci_definitions/gating.yaml

@@ -21,7 +21,7 @@ topologies:
     memory: 2400
 
 jobs:
-  fedora-latest/build:
+  fedora-latest-ipa-4-10/build:
     requires: []
     priority: 150
     job:
@@ -29,284 +29,284 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
+        template: &ci-ipa-4-10-latest
+          name: freeipa/ci-ipa-4-10-f36
+          version: 0.0.1
         timeout: 1800
         topology: *build
 
-  fedora-latest/test_installation_TestInstallMaster:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_installation_TestInstallMaster:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_installation.py::TestInstallMaster
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 7200
         topology: *master_1repl
 
-  fedora-latest/simple_replication:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/simple_replication:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_simple_replication.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_caless_TestServerReplicaCALessToCAFull:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_caless_TestServerReplicaCALessToCAFull:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_caless.py::TestServerReplicaCALessToCAFull
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_external_ca_TestExternalCA:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_external_ca_TestExternalCA:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_external_ca_TestSelfExternalSelf:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_external_ca_TestSelfExternalSelf:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_external_ca.py::TestSelfExternalSelf test_integration/test_external_ca.py::TestExternalCAInstall
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/external_ca_templates:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/external_ca_templates:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_topologies:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_topologies:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_topologies.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_sudo:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_sudo:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_sudo.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_commands:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_commands:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_commands.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest/test_kerberos_flags:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_kerberos_flags:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_kerberos_flags.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest/test_forced_client_enrolment:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_forced_client_enrolment:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_forced_client_reenrollment.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_advise:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_advise:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_advise.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest/test_testconfig:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_testconfig:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_testconfig.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_service_permissions:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_service_permissions:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_service_permissions.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_netgroup:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_netgroup:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_netgroup.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_authconfig:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_authconfig:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_authselect.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest/test_replica_promotion_TestSubCAkeyReplication:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_replica_promotion_TestSubCAkeyReplication:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_replica_promotion.py::TestSubCAkeyReplication
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_dnssec_TestInstallDNSSECFirst:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_dnssec_TestInstallDNSSECFirst:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_membermanager:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_membermanager:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_membermanager.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 1800
         topology: *master_1repl
 
-  fedora-latest/test_adtrust_install:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_adtrust_install:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_adtrust_install.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_cert:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_cert:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_cert.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest/test_upgrade:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_upgrade:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_upgrade.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest/test_subids:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/test_subids:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_subids.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
-        topology: *master_1repl
+        topology: *master_1repl_1client

ipatests/prci_definitions/nightly_latest_389ds.yaml

@@ -1,658 +0,0 @@
-topologies:
-  build: &build
-    name: build
-    cpu: 2
-    memory: 3800
-  master_1repl: &master_1repl
-    name: master_1repl
-    cpu: 4
-    memory: 6450
-  master_1repl_1client: &master_1repl_1client
-    name: master_1repl_1client
-    cpu: 4
-    memory: 7400
-  ipaserver: &ipaserver
-    name: ipaserver
-    cpu: 2
-    memory: 2400
-  master_2repl_1client: &master_2repl_1client
-    name: master_2repl_1client
-    cpu: 5
-    memory: 10150
-  master_3repl_1client: &master_3repl_1client
-    name: master_3repl_1client
-    cpu: 6
-    memory: 12900
-
-jobs:
-  389ds-fedora/build:
-    requires: []
-    priority: 100
-    job:
-      class: Build
-      args:
-        copr: '@389ds/389-ds-base-nightly'
-        git_repo: '{git_repo}'
-        git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
-        timeout: 1800
-        topology: *build
-
-  389ds-fedora/simple_replication:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_simple_replication.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_commands:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_commands.py
-        template: *ci-master-latest
-        timeout: 5400
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_server_del:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_server_del.py
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_installation_TestInstallWithCA1:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_installation.py::TestInstallWithCA1
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_caless_TestServerInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestServerInstall
-        template: *ci-master-latest
-        timeout: 12000
-        topology: *master_1repl
-
-  389ds-fedora/test_caless_TestReplicaInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestReplicaInstall
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_caless_TestClientInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestClientInstall
-        template: *ci-master-latest
-        timeout: 5400
-        # actually master_1client
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_caless_TestCertInstall:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_caless.py::TestCertInstall
-        template: *ci-master-latest
-        timeout: 5400
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestUserRootFilesOwnershipPermission:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestUserRootFilesOwnershipPermission
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestore:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestore
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNSSEC:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNSSEC
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNSSEC:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNSSEC
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNS:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNS
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNS:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNS
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithReplica:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithReplica
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreDMPassword:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreDMPassword
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_backup_and_restore_TestReplicaInstallAfterRestore:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_backup_and_restore.py::TestReplicaInstallAfterRestore
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_dnssec:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_dnssec.py
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_replica_promotion_TestReplicaPromotionLevel1:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_replica_promotion_TestProhibitReplicaUninstallation:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestProhibitReplicaUninstallation
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_replica_promotion_TestHiddenReplicaPromotion:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_2repl_1client
-
-  389ds-fedora/test_upgrade:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_upgrade.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl
-
-  389ds-fedora/test_topology_TestCASpecificRUVs:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_topology.py::TestCASpecificRUVs
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_topology_TestTopologyOptions:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_topology.py::TestTopologyOptions
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestLineTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts.py_TestStarTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestStarTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestStarTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 10800
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithoutCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithoutCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCAKRA:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCAKRA
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_3repl_1client
-
-  389ds-fedora/test_client_uninstallation:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_uninstallation.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl_1client
-
-  389ds-fedora/customized_ds_config_install:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_customized_ds_config_install.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/dns_locations:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_dns_locations.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_2repl_1client
-
-  389ds-fedora/external_ca_TestExternalCAdirsrvStop:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_external_ca.py::TestExternalCAdirsrvStop
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/mask:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_installation.py::TestMaskInstall
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/automember:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_automember.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_fips:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_fips.py
-        template: *ci-master-latest
-        timeout: 7200
-        topology: *master_1repl_1client
-
-  389ds-fedora/test_pwpolicy:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_pwpolicy.py
-        template: *ci-master-latest
-        timeout: 3600
-        topology: *master_1repl
-
-  389ds-fedora/test_external_idp:
-    requires: [389ds-fedora/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{389ds-fedora/build_url}'
-        update_packages: True
-        copr: '@389ds/389-ds-base-nightly'
-        test_suite: test_integration/test_idp.py
-        template: *ci-master-latest
-        timeout: 5000
-        topology: *master_2repl_1client

ipatests/prci_definitions/prci_checker.py

@@ -0,0 +1,433 @@
+#! /usr/bin/python3
+import os
+import glob
+import sys
+import argparse
+from argparse import RawTextHelpFormatter
+import yaml
+
+# Get default DIR from script location
+DEFAULT_DIR = os.path.dirname(os.path.abspath(__file__))
+# Default jobs specification file name and path
+JOBS_SPEC_YAML = "prci_jobs_spec.yaml"
+JOBS_SPEC_PATH = os.path.join(DEFAULT_DIR, JOBS_SPEC_YAML)
+# Files to ignore on check
+IGNORE_FILES = {JOBS_SPEC_YAML, "temp_commit.yaml"}
+
+
+def load_yaml(path):
+    """Load YAML file into Python object."""
+    with open(path, "r") as file_data:
+        data = yaml.safe_load(file_data)
+
+    return data
+
+
+def print_error(msg):
+    """Helper function to print error messages"""
+    print("ERROR: " + msg)
+
+
+def print_warning(msg):
+    """Helper function to print warning messages"""
+    print("WARNING: " + msg)
+
+
+def print_hint(msg):
+    """Helper function to print hint messages"""
+    print("HINT: " + msg)
+
+
+def print_field_error(
+    jobname, fieldname=None, expected_value=None, custom_msg=None
+):
+    """Helper function to print field errors"""
+    msg = f"In job '{jobname}':\n"
+    if custom_msg:
+        msg += f"  {custom_msg}"
+    elif fieldname and expected_value:
+        msg += (
+            f'  Job field "{fieldname}" should be defined as: '
+            f'"{fieldname}: {expected_value}"'
+        )
+    else:
+        msg = f"In job '{jobname}'."
+    print_error(msg)
+
+
+def check_jobs(filename, jobs_def, topologies, current_spec, supported_classes):
+    """
+    Check if given job definition file has all jobs correctly defined according
+    to specification file.
+
+    :param filename: file name of the definition file to be checked
+    :param jobs_def: definition file jobs as a dict object
+    :param topologies: list of dicts of predefined topologies
+    :param jobs_spec: PRCI specification file containing correct definitions
+    :param supported_classes: List of supported test-run classes
+
+    :returns: Boolean with the checks result
+    """
+    correct_fields = True
+
+    try:
+        job_prefix = current_spec["job_prefix"]
+    except KeyError as e:
+        print_error(
+            "Specification file has bad format "
+            f"and '{filename}' could not be analyzed.\n"
+            f"  KeyError: {e} in '{filename}'"
+        )
+        return False
+
+    requires = [f"{job_prefix}build"]
+    build_url = f"{{{job_prefix}build_url}}"
+
+    # Get template from build job
+    build_job_name = job_prefix + "build"
+    build_job = jobs_def.get(build_job_name)
+    if not build_job:
+        print_error(
+            " Build job is not defined or has incorrect name.\n"
+            f"  Name should be: '{build_job_name}'"
+        )
+        return False
+    build_args = build_job["job"]["args"]
+    template = build_args["template"]
+
+    copr = build_args.get("copr")
+    copr_defined = current_spec.get("copr_defined", False)
+
+    update_packages = current_spec.get("update_packages", False)
+    selinux = current_spec.get("selinux_enforcing", False)
+    enable_testing_repo = current_spec.get("enable_testing_repo", False)
+
+    for job_name, params in jobs_def.items():
+        # Checks for all kind of jobs
+        args = params.get("job").get("args")
+        if not job_name.startswith(job_prefix):
+            msg = f"Job name should start with prefix '{job_prefix}'"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("template") != template:
+            print_field_error(job_name, "template", template)
+            correct_fields = False
+        if "timeout" not in args:
+            msg = "'timeout' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+        if args.get("topology") not in topologies:
+            msg = (
+                "'topology' field should be defined with one of the "
+                "pre-defined topologies"
+            )
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("enable_testing_repo", False) != enable_testing_repo:
+            if enable_testing_repo:
+                print_field_error(
+                    job_name, "enable_testing_repo", enable_testing_repo
+                )
+            else:
+                msg = (
+                    "'enable_testing_repo' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+
+        # Checks for build job
+        if job_name == build_job_name:
+            if copr_defined and not copr:
+                msg = "'copr' field should be defined for the build job"
+                print_field_error(job_name, custom_msg=msg)
+                correct_fields = False
+            elif not copr_defined and copr:
+                msg = "'copr' field should NOT be defined for the build job"
+                print_field_error(job_name, custom_msg=msg)
+                correct_fields = False
+            if params.get("job").get("class") != "Build":
+                print_field_error(job_name, "class", "Build")
+                correct_fields = False
+            continue
+
+        # Checks only for non-build jobs
+        if params.get("requires") != requires:
+            print_field_error(job_name, "requires", requires)
+            correct_fields = False
+        if params.get("job").get("class") not in supported_classes:
+            msg = (
+                "'class' field should be defined with one of the "
+                f"supported: {supported_classes}"
+            )
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("build_url") != build_url:
+            print_field_error(job_name, "build_url", f"'{build_url}'")
+            correct_fields = False
+        if "test_suite" not in args:
+            msg = "'test_suite' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        # Check template field against build target
+        if args.get("template") != template:
+            print_field_error(job_name, "template", template)
+            correct_fields = False
+        if "timeout" not in args:
+            msg = "'timeout' field should be defined in args section"
+            print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        # If build target has a copr repo, check that the job also defines it
+        if args.get("copr") != copr:
+            if copr and copr_defined:
+                print_field_error(job_name, "copr", copr)
+            elif not copr and not copr_defined:
+                msg = "'copr' field should not be defined"
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("update_packages", False) != update_packages:
+            if update_packages:
+                print_field_error(job_name, "update_packages", update_packages)
+            else:
+                msg = (
+                    "'update_packages' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+        if args.get("selinux_enforcing", False) != selinux:
+            if selinux:
+                print_field_error(job_name, "selinux_enforcing", selinux)
+            else:
+                msg = (
+                    "'selinux_enforcing' field should be set to false or not"
+                    " defined"
+                )
+                print_field_error(job_name, custom_msg=msg)
+            correct_fields = False
+
+    return correct_fields
+
+
+def process_def_file(file, jobs_spec, supported_classes):
+    """Function to process PRCI definition file
+
+    :param file: name of the definition file to be
+                 processed (extension included)
+    :param jobs_spec: PRCI specification file containing correct definitions
+    :param supported_classes: List of supported test-run classes
+
+    :returns: Boolean with the checks result, filename,
+              and number of jobs in the definition
+              file (-1 when error / warning)
+    """
+    # File base name without extension
+    filename = os.path.splitext(os.path.basename(file))[0]
+    try:
+        def_suite = load_yaml(file)
+    except FileNotFoundError as e:
+        print(e)
+        print_error(f"File '{file}' was not found.")
+        sys.exit(1)
+    except yaml.composer.ComposerError as e:
+        print_error(str(e))
+        print_hint(
+            "You probably defined a wrong alias "
+            "in the newly added or modified job."
+        )
+        sys.exit(1)
+    except yaml.YAMLError as e:
+        print(e)
+        print_error(f"Error loading YAML definition file {file}")
+        sys.exit(1)
+
+    # Get spec for file to be analyzed
+    current_spec = jobs_spec.get(filename)
+    if current_spec is None:
+        print_warning(
+            f"'{filename}' file is not defined in the PRCI "
+            "specification file and "
+            "could not be analyzed."
+        )
+        return True, "", -1
+
+    jobs_def = def_suite.get("jobs")
+    if jobs_def is None:
+        print_error(
+            f"'{filename}' file doesn't have a jobs section following "
+            "the format."
+        )
+        return False, "", -1
+
+    # Get list of pre-defined topologies
+    topologies_def = def_suite.get("topologies")
+    if topologies_def is None:
+        print_error(
+            f"'{filename}' file doesn't have a topologies section following "
+            "the format."
+        )
+        return False, "", -1
+    topologies = list(topologies_def.values())
+
+    # Print file to be analyzed and its number of jobs
+    n_jobs = len(jobs_def)
+    print("[File] " + filename + " [Jobs] " + str(n_jobs))
+
+    result = check_jobs(
+        filename, jobs_def, topologies, current_spec, supported_classes
+    )
+    return result, filename, n_jobs
+
+
+def process_spec_file(filepath):
+    """Function to process jobs specification file
+
+    :param filepath: Filepath for spec file
+
+    :returns: Definition specification dict, supported classes and
+              list of files that should contain the same number of jobs
+    """
+    try:
+        spec_root = load_yaml(filepath)
+    except FileNotFoundError as e:
+        print(e)
+        print_error(f"Jobs specification file '{filepath}' not found.")
+        sys.exit(1)
+    except yaml.YAMLError as e:
+        print(e)
+        print_error(f"Error loading YAML specification file '{filepath}'")
+        sys.exit(1)
+
+    jobs_spec = spec_root.get("prci_job_spec")
+    if not jobs_spec:
+        print_error(
+            f"Specification definition not found in spec file '{filepath}'\n"
+            "  Key 'prci_job_spec' is not present."
+        )
+        sys.exit(1)
+
+    supported_classes = spec_root.get("classes")
+    if not supported_classes:
+        print_error(
+            f"Supported classes not defined in spec file '{filepath}'\n"
+            "  Key 'classes' is not present."
+        )
+        sys.exit(1)
+
+    f_fixed_jobs = spec_root.get("fixed_n_jobs")
+
+    return jobs_spec, supported_classes, f_fixed_jobs
+
+
+def check_n_jobs(defs_n_jobs):
+    """
+    Function to check if definition files have the same number of jobs
+
+    :param defs_n_jobs: Dict of definition filenames as keys and number
+                        of jobs as values
+
+    :returns: Boolean, if definitions have the same number of jobs
+    """
+    if not defs_n_jobs:  # Spec not defined to check num of jobs
+        return True
+    elif len(set(defs_n_jobs.values())) == 1:
+        return True
+    else:
+        print_error(
+            "Following PRCI definitions should have the same number of jobs:"
+            f" {list(defs_n_jobs.keys())}"
+        )
+        return False
+
+
+def parse_arguments(description):
+    """Parse and return arguments if specified"""
+    parser = argparse.ArgumentParser(
+        description=description, formatter_class=RawTextHelpFormatter
+    )
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument(
+        "-f", "--file", help="Specify YAML definition file to be analyzed"
+    )
+    group.add_argument(
+        "-d",
+        "--defs",
+        default=DEFAULT_DIR,
+        help="Specify directory for definition files to be analyzed",
+    )
+    parser.add_argument(
+        "-s",
+        "--spec",
+        default=JOBS_SPEC_PATH,
+        help="Specify path for specification file",
+    )
+    return parser.parse_args()
+
+
+def main():
+    """
+    Checker script for prci definition files.\n
+    This script checks whether jobs in a prci definition file have the correct
+    naming format, requirements, and arguments, which are defined in the
+    specification file.
+
+    If no defition file, definition directory or spec file is specified,
+    script will look for them in its own dir location.
+
+    Examples of the usage for the tool:\n
+    # Check all yaml definition files in default dir\n
+    python3 prci_checker.py\n
+    # Check only specified file\n
+    python3 prci_checker.py -f gating.yaml\n
+    # Check with custom path for spec file\n
+    python3 prci_checker.py -s ../../alternative_spec.yaml
+    # Check with custom path for spec file\n
+    python3 prci_checker.py -d ./definitions
+    """
+    args = parse_arguments(main.__doc__)
+
+    print("BEGINNING PRCI JOB DEFINITIONS CHECKS")
+
+    # Get data from jobs specification file
+    jobs_spec, supported_classes, f_fixed_jobs = process_spec_file(args.spec)
+
+    if args.file:
+        result = process_def_file(args.file, jobs_spec, supported_classes)
+    else:
+        # Get all yaml files in default dir, except those in IGNORE_FILES
+        def_files_dir = os.path.join(args.defs, "*.y*ml")
+        defs_files = glob.glob(def_files_dir)
+        ignore_files_paths = {
+            os.path.join(args.defs, ignore_file) for ignore_file in IGNORE_FILES
+        }
+        defs_files = set(defs_files) - ignore_files_paths
+        if not defs_files:
+            print_warning(
+                "No yaml job definition files found to analyze "
+                "in specified directory."
+            )
+            return
+
+        result = True
+        defs_n_jobs = {}
+
+        for def_file in defs_files:
+            result_file, filename, n_jobs = process_def_file(
+                def_file, jobs_spec, supported_classes
+            )
+            if not result_file:
+                result = False
+                continue
+            if n_jobs > -1 and f_fixed_jobs and filename in f_fixed_jobs:
+                defs_n_jobs[filename] = n_jobs
+
+        result = result and check_n_jobs(defs_n_jobs)
+
+    if not result:
+        print("CHECKS FINISHED WITH ERRORS")
+        sys.exit(1)
+
+    print("CHECKS FINISHED SUCCESSFULLY")
+
+
+if __name__ == "__main__":
+    main()

ipatests/prci_definitions/prci_jobs_spec.yaml

@@ -0,0 +1,32 @@
+# Specification file for PRCI definitions used by prci_checker script
+
+# List of supported test-run classes for non-build jobs
+classes:
+  - "RunPytest"
+  - "RunPytest2"
+  - "RunPytest3"
+  - "RunWebuiTests"
+  - "RunADTests"
+
+# (Optional) Definition files that should contain the same number of jobs
+fixed_n_jobs:
+  - nightly_ipa-4-10_latest
+  - nightly_ipa-4-10_latest_selinux
+  - nightly_ipa-4-10_previous
+
+# Info specific to prci definition files
+# 'job_prefix' field is mandatory
+# 'update_packages', 'selinux_enforcing', 'enable_testing_repo' and
+# 'copr_defined' are optional boolean fields (if not specified,
+# false value is assumed).
+# New definitions specifications may be added anytime
+prci_job_spec:
+  gating:
+    job_prefix: 'fedora-latest-ipa-4-10/'
+  nightly_ipa-4-10_latest:
+    job_prefix: 'fedora-latest-ipa-4-10/'
+  nightly_ipa-4-10_latest_selinux:
+    job_prefix: 'fedora-latest-ipa-4-10/'
+    selinux_enforcing: True
+  nightly_ipa-4-10_previous:
+    job_prefix: 'fedora-previous-ipa-4-10/'

ipatests/prci_definitions/temp_commit.yaml

@@ -47,7 +47,7 @@ topologies:
     memory: 14500
 
 jobs:
-  fedora-latest/build:
+  fedora-latest-ipa-4-10/build:
     requires: []
     priority: 100
     job:
@@ -55,20 +55,20 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-master-latest
-          name: freeipa/ci-master-f36
-          version: 0.0.7
+        template: &ci-ipa-4-10-latest
+          name: freeipa/ci-ipa-4-10-f36
+          version: 0.0.1
         timeout: 1800
         topology: *build
 
-  fedora-latest/temp_commit:
-    requires: [fedora-latest/build]
+  fedora-latest-ipa-4-10/temp_commit:
+    requires: [fedora-latest-ipa-4-10/build]
     priority: 50
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest/build_url}'
+        build_url: '{fedora-latest-ipa-4-10/build_url}'
         test_suite: test_integration/test_REPLACEME.py
-        template: *ci-master-latest
+        template: *ci-ipa-4-10-latest
         timeout: 3600
         topology: *master_1repl_1client

ipatests/test_integration/test_caless.py

@@ -122,6 +122,15 @@ def replica_install_teardown(func):
 
 
 class CALessBase(IntegrationTest):
+    # The teardown method is called even if all the tests are skipped
+    # since the required PKI version is not present.
+    # The teardown is trying to remove a non-existent directory.
+    # Currently the cert_dir attribute is only present if IPA installation was
+    # done. If IPA was not installed the attribute does not exist.
+    # In order that the uninstall code finds the attribute a class attribute
+    # is added.
+    cert_dir = None
+
     @classmethod
     def install(cls, mh):
         cls.cert_dir = tempfile.mkdtemp(prefix="ipatest-")
@@ -164,7 +173,8 @@ class CALessBase(IntegrationTest):
     @classmethod
     def uninstall(cls, mh):
         # Remove the NSS database
-        shutil.rmtree(cls.cert_dir)
+        if cls.cert_dir:
+            shutil.rmtree(cls.cert_dir)
         super(CALessBase, cls).uninstall(mh)
 
     @classmethod

ipatests/test_integration/test_ipahealthcheck.py

@@ -340,6 +340,31 @@ class TestIpaHealthCheck(IntegrationTest):
         assert returncode == 0
         assert output == "No issues found."
 
+    def test_ipa_healthcheck_fips_enabled(self):
+        """
+        Test if FIPS is enabled and the check exists.
+
+        https://pagure.io/freeipa/issue/8951
+        """
+        returncode, check = run_healthcheck(self.master,
+                                            source="ipahealthcheck.meta.core",
+                                            check="MetaCheck",
+                                            output_type="json",
+                                            failures_only=False)
+        assert returncode == 0
+
+        cmd = self.master.run_command(['fips-mode-setup', '--is-enabled'],
+                                      raiseonerr=False)
+        returncode = cmd.returncode
+
+        # If this produces IndexError, the check does not exist
+        if check[0]["kw"]["fips"] == "disabled":
+            assert returncode == 2
+        elif check[0]["kw"]["fips"] == "enabled":
+            assert returncode == 0
+        else:
+            assert returncode == 1
+
     def test_ipa_healthcheck_after_certupdate(self):
         """
         Verify that ipa-certupdate hasn't messed up tracking

ipatests/test_integration/test_pwpolicy.py

@@ -36,7 +36,7 @@ class TestPWPolicy(IntegrationTest):
         cls.master.run_command(['ipa', 'group-add-member', POLICY,
                                 '--users', USER])
         cls.master.run_command(['ipa', 'pwpolicy-add', POLICY,
-                                '--priority', '1'])
+                                '--priority', '1', '--gracelimit', '-1'])
         cls.master.run_command(['ipa', 'passwd', USER],
                                stdin_text='{password}\n{password}\n'.format(
                                password=PASSWORD
@@ -265,7 +265,6 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_expired(self):
         """Test the LDAP bind grace period"""
-        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -308,7 +307,6 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_not_replicated(self):
         """Test that the grace period is reset on password reset"""
-        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -341,3 +339,54 @@ class TestPWPolicy(IntegrationTest):
         )
         assert 'passwordgraceusertime: 0' in result.stdout_text.lower()
         self.reset_password(self.master)
+
+    def test_graceperiod_zero(self):
+        """Test the LDAP bind with zero grace period"""
+        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
+             user=USER, base_dn=str(self.master.domain.basedn))
+
+        self.master.run_command(
+            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "0", ],
+        )
+
+        # Resetting the password will mark it as expired
+        self.reset_password(self.master)
+
+        # Now grace is done and binds should fail.
+        result = self.master.run_command(
+            ["ldapsearch", "-e", "ppolicy", "-D", dn,
+             "-w", PASSWORD, "-b", dn], raiseonerr=False
+        )
+        assert result.returncode == 49
+
+        assert 'Password is expired' in result.stderr_text
+        assert 'Password expired, 0 grace logins remain' in result.stderr_text
+
+    def test_graceperiod_disabled(self):
+        """Test the LDAP bind with grace period disabled (-1)"""
+        str(self.master.domain.basedn)
+        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
+             user=USER, base_dn=str(self.master.domain.basedn))
+
+        # This can fail if gracelimit is already -1 so ignore it
+        self.master.run_command(
+            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "-1",],
+            raiseonerr=False,
+        )
+
+        # Ensure the password is expired
+        self.reset_password(self.master)
+
+        result = self.kinit_as_user(self.master, PASSWORD, PASSWORD)
+
+        for _i in range(0, 10):
+            result = self.master.run_command(
+                ["ldapsearch", "-e", "ppolicy", "-D", dn,
+                 "-w", PASSWORD, "-b", dn]
+            )
+
+        # With graceperiod disabled it should not increment
+        result = tasks.ldapsearch_dm(
+            self.master, dn, ['passwordgraceusertime',],
+        )
+        assert 'passwordgraceusertime: 0' in result.stdout_text.lower()

ipatests/test_integration/test_random_serial_numbers.py

@@ -4,12 +4,15 @@
 
 import pytest
 
+from ipaplatform.paths import paths
+
+from ipatests.pytest_ipa.integration import tasks
 from ipatests.test_integration.test_installation import (
     TestInstallWithCA_DNS1,
     TestInstallWithCA_KRA1,
 )
 from ipatests.test_integration.test_caless import TestServerCALessToExternalCA
-
+from ipatests.test_integration.test_vault import TestInstallKRA
 from ipatests.test_integration.test_commands import TestIPACommand
 
 
@@ -26,6 +29,18 @@ def pki_supports_RSNv3(host):
     return False
 
 
+def check_pki_config_params(host):
+    # Check CS.cfg
+    try:
+        cs_cfg = host.get_file_contents(paths.CA_CS_CFG_PATH)
+        kra_cfg = host.get_file_contents(paths.KRA_CS_CFG_PATH)
+        assert "dbs.cert.id.generator=random".encode() in cs_cfg
+        assert "dbs.request.id.generator=random".encode() in cs_cfg
+        assert "dbs.key.id.generator=random".encode() in kra_cfg
+    except IOError:
+        pytest.skip("PKI config not present.Skipping test")
+
+
 class TestInstallWithCA_DNS1_RSN(TestInstallWithCA_DNS1):
     random_serial = True
 
@@ -64,3 +79,43 @@ class TestServerCALessToExternalCA_RSN(TestServerCALessToExternalCA):
         if not pki_supports_RSNv3(mh.master):
             raise pytest.skip("RNSv3 not supported")
         super(TestServerCALessToExternalCA_RSN, cls).install(mh)
+
+    @classmethod
+    def uninstall(cls, mh):
+        if not pki_supports_RSNv3(mh.master):
+            raise pytest.skip("RSNv3 not supported")
+        super(TestServerCALessToExternalCA_RSN, cls).uninstall(mh)
+
+
+class TestRSNPKIConfig(TestInstallWithCA_KRA1):
+    random_serial = True
+    num_replicas = 3
+
+    @classmethod
+    def install(cls, mh):
+        if not pki_supports_RSNv3(mh.master):
+            raise pytest.skip("RSNv3 not supported")
+        super(TestRSNPKIConfig, cls).install(mh)
+
+    def test_check_pki_config(self):
+        check_pki_config_params(self.master)
+        check_pki_config_params(self.replicas[0])
+        check_pki_config_params(self.replicas[1])
+
+    def test_check_rsn_version(self):
+        tasks.kinit_admin(self.master)
+        res = self.master.run_command(['ipa', 'ca-find'])
+        assert 'RSN Version: 3' in res.stdout_text
+        tasks.kinit_admin(self.replicas[0])
+        res = self.replicas[0].run_command(['ipa', 'ca-find'])
+        assert 'RSN Version: 3' in res.stdout_text
+
+
+class TestRSNVault(TestInstallKRA):
+    random_serial = True
+
+    @classmethod
+    def install(cls, mh):
+        if not pki_supports_RSNv3(mh.master):
+            raise pytest.skip("RSNv3 not supported")
+        super(TestRSNVault, cls).install(mh)

ipatests/test_integration/test_subids.py

@@ -17,6 +17,7 @@ from ipatests.test_integration.base import IntegrationTest
 
 class TestSubordinateId(IntegrationTest):
     num_replicas = 0
+    num_clients = 1
     topology = "star"
 
     def _parse_result(self, result):
@@ -268,3 +269,40 @@ class TestSubordinateId(IntegrationTest):
                                           f"--subuid={subuid}"])
         owner = self._parse_result(result)["owner"]
         assert owner == uid
+
+    def test_nsswitch_doesnot_contain_subid_entry(self):
+        """
+        This testcase checks that when ipa-client-install
+        is installed without subid option, the nsswitch.conf
+        does not contain subid entry or does not use sss as
+        source for subid
+        """
+        cmd = self.clients[0].run_command(
+            ["grep", "^subid", "/etc/nsswitch.conf"],
+            raiseonerr=False
+        )
+        # a source is defined for the subid database.
+        # Ensure it is not "sss"
+        if cmd.returncode == 0:
+            assert 'sss' not in cmd.stdout_text
+        else:
+            # grep command returncode 1 means no matching line
+            # was found = no source is defined for the subid database,
+            # which is valid other return codes would
+            # mean an error occurred
+            assert cmd.returncode == 1
+
+    def test_nsswitch_is_updated_with_subid_entry(self):
+        """
+        This test case checks that when ipa-client-install
+        is installed with --subid option, the nsswitch.conf
+        file is modified with the entry 'subid: sss'
+        """
+        tasks.uninstall_client(self.clients[0])
+        tasks.install_client(self.master, self.clients[0],
+                             extra_args=['--subid'])
+        cmd = self.clients[0].run_command(
+            ["grep", "^subid", "/etc/nsswitch.conf"]
+        )
+        subid = cmd.stdout_text.split()
+        assert ['subid:', 'sss'] == subid

ipatests/test_integration/test_vault.py

@@ -33,7 +33,9 @@ class TestInstallKRA(IntegrationTest):
 
     @classmethod
     def install(cls, mh):
-        tasks.install_master(cls.master, setup_kra=True)
+        tasks.install_master(cls.master,
+                             setup_kra=True,
+                             random_serial=cls.random_serial)
         # do not install KRA on replica, it is part of test
         tasks.install_replica(cls.master, cls.replicas[0], setup_kra=False)
 

ipatests/test_ipapython/test_dnsutil.py

@@ -101,3 +101,43 @@ class TestSortURI:
         assert dnsutil.sort_prio_weight([h3, h2, h1]) == [h1, h2, h3]
         assert dnsutil.sort_prio_weight([h3, h3, h3]) == [h3]
         assert dnsutil.sort_prio_weight([h2, h2, h1, h1]) == [h1, h2]
+
+
+class TestDNSResolver:
+    def test_nameservers(self):
+        res = dnsutil.DNSResolver()
+        res.nameservers = ["4.4.4.4", "8.8.8.8"]
+        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
+
+    def test_nameservers_with_ports(self):
+        res = dnsutil.DNSResolver()
+        res.nameservers = ["4.4.4.4 port 53", "8.8.8.8 port 8053"]
+        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
+        assert res.nameserver_ports == {"4.4.4.4": 53, "8.8.8.8": 8053}
+
+        res.nameservers = ["4.4.4.4 port 53", "8.8.8.8  port  8053"]
+        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
+        assert res.nameserver_ports == {"4.4.4.4": 53, "8.8.8.8": 8053}
+
+    def test_nameservers_with_bad_ports(self):
+        res = dnsutil.DNSResolver()
+        try:
+            res.nameservers = ["4.4.4.4 port a"]
+        except ValueError:
+            pass
+        else:
+            pytest.fail("No fail on bad port a")
+
+        try:
+            res.nameservers = ["4.4.4.4 port -1"]
+        except ValueError:
+            pass
+        else:
+            pytest.fail("No fail on bad port -1")
+
+        try:
+            res.nameservers = ["4.4.4.4 port 65536"]
+        except ValueError:
+            pass
+        else:
+            pytest.fail("No fail on bad port 65536")

ipatests/test_webui/test_misc_cases.py

@@ -11,6 +11,11 @@ from ipatests.test_webui.ui_driver import screenshot
 import pytest
 import re
 
+try:
+    from selenium.webdriver.common.by import By
+except ImportError:
+    pass
+
 
 @pytest.mark.tier1
 class TestMiscCases(UI_driver):
@@ -26,3 +31,17 @@ class TestMiscCases(UI_driver):
         ver_re = re.compile('version: .*')
         assert re.search(ver_re, about_text), 'Version not found'
         self.dialog_button_click('ok')
+
+    @screenshot
+    def test_customization_pagination_input_required(self):
+        """Test if 'pagination size' is required when submitting the form."""
+        self.init_app()
+
+        self.profile_menu_action('configuration')
+        self.fill_input('pagination_size', '')
+        self.dialog_button_click('save')
+
+        pagination_size_elem = self.find(
+            ".widget[name='pagination_size']", By.CSS_SELECTOR)
+
+        self.assert_field_validation_required(parent=pagination_size_elem)

ipatests/test_webui/test_subid.py

@@ -7,7 +7,15 @@ from ipatests.test_webui.ui_driver import UI_driver
 import ipatests.test_webui.data_config as config_data
 import ipatests.test_webui.data_user as user_data
 from ipatests.test_webui.ui_driver import screenshot
+
 import re
+import pytest
+
+try:
+    from selenium.common.exceptions import NoSuchElementException
+    from selenium.webdriver.common.by import By
+except ImportError:
+    pass
 
 
 class test_subid(UI_driver):
@@ -125,3 +133,26 @@ class test_subid(UI_driver):
         self.assert_no_error_dialog()
         after_count = self.get_rows()
         assert len(before_count) < len(after_count)
+
+    @screenshot
+    def test_subid_range_deletion_not_allowed(self):
+        """
+        Test to check that subid range delete is not
+        allowed from WebUI i.e Delete button is not available.
+        """
+        self.init_app()
+        self.navigate_to_entity('subid', facet='search')
+        self.facet_button_click('add')
+        self.select_combobox('ipaowner', 'admin')
+        self.dialog_button_click('add')
+        self.wait(0.3)
+        self.assert_no_error_dialog()
+        self.get_field_checked('ipauniqueid')
+        with pytest.raises(NoSuchElementException):
+            self.facet_button_click('remove')
+        buttons_s = 'div.control-buttons button'
+        facet_buttons = self.find(buttons_s, By.CSS_SELECTOR,
+                                  many=True, strict=True)
+        assert len(facet_buttons) == 2
+        assert facet_buttons[0].get_attribute('name') in ['add', 'refresh']
+        assert facet_buttons[1].get_attribute('name') in ['add', 'refresh']

ipatests/test_xmlrpc/test_old_permission_plugin.py

@@ -152,6 +152,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -493,6 +505,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission2_dn,
                     cn=[permission2],
@@ -801,6 +825,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has read rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'read',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -921,6 +957,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result={
                     'dn': permission1_renamed_ucase_dn,
                     'cn': [permission1_renamed_ucase],
@@ -947,6 +995,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1_renamed_ucase,
                 summary=u'Modified permission "%s"' % permission1_renamed_ucase,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_renamed_ucase_dn,
                     cn=[permission1_renamed_ucase],
@@ -1175,6 +1235,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -1206,6 +1278,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -1229,6 +1313,18 @@ class test_old_permission(Declarative):
             ),
             expected=dict(
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 value=permission1,
                 result=dict(
                     dn=permission1_dn,
@@ -1266,6 +1362,18 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],

ipatests/test_xmlrpc/test_permission_plugin.py

@@ -3167,6 +3167,18 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -3228,6 +3240,18 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -3319,6 +3343,18 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_renamed_dn,
                     cn=[permission1_renamed],
@@ -3350,6 +3386,18 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_renamed_dn,
                     cn=[permission1_renamed],
@@ -3379,6 +3427,18 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4010,6 +4070,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4054,6 +4126,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4093,6 +4177,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4132,6 +4228,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4172,6 +4280,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4205,6 +4325,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4254,6 +4386,18 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],

ipatests/test_xmlrpc/test_privilege_plugin.py

@@ -255,6 +255,18 @@ class test_privilege(Declarative):
             expected=dict(
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
+                messages=(
+                    {
+                        'message': ('The permission has write rights but no '
+                                    'attributes are set.'),
+                        'code': 13032,
+                        'type': 'warning',
+                        'name': 'MissingTargetAttributesinPermission',
+                        'data': {
+                            'right': 'write',
+                        }
+                    },
+                ),
                 result=dict(
                     dn=permission2_dn,
                     cn=[permission2],

ipatests/test_xmlrpc/test_user_plugin.py

@@ -125,7 +125,9 @@ def user_npg(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         description=[], memberof_group=[group.cn],
-        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
+        objectclass=fuzzy_set_optional_oc(
+            objectclasses.user_base, 'ipantuserattrs'
+        ),
     )
     return tracker.make_fixture(request)
 
@@ -139,7 +141,9 @@ def user_npg2(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         gidnumber=[u'1000'], description=[], memberof_group=[group.cn],
-        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
+        objectclass=fuzzy_set_optional_oc(
+            objectclasses.user_base, 'ipantuserattrs'
+        ),
     )
     return tracker.make_fixture(request)
 
@@ -151,8 +155,9 @@ def user_radius(request, xmlrpc_setup):
                           sn=u'radiususer1',
                           ipatokenradiususername=u'radiususer')
     tracker.track_create()
-    tracker.attrs.update(
-        objectclass=objectclasses.user + [u'ipatokenradiusproxyuser']
+    tracker.attrs.update(objectclass=fuzzy_set_optional_oc(
+        objectclasses.user + [u'ipatokenradiusproxyuser'],
+        'ipantuserattrs'),
     )
     return tracker.make_fixture(request)
 
@@ -647,7 +652,8 @@ class TestCreate(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=objectclasses.user_base + [u'ipantuserattrs']
+            objectclass=fuzzy_set_optional_oc(
+                objectclasses.user_base, 'ipantuserattrs'),
         )
         command = testuser.make_create_command()
         result = command()
@@ -865,7 +871,9 @@ class TestUserWithUPGDisabled(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=objectclasses.user_base + [u'ipantuserattrs'],
+            objectclass=fuzzy_set_optional_oc(
+                objectclasses.user_base, 'ipantuserattrs'
+            ),
         )
         command = testuser.make_create_command()
         result = command()

makeaci.in

@@ -61,7 +61,7 @@ def generate_aci_lines(api):
             anonymous_read_aci=None,
             is_new=True,
         )
-        aci = perm_plugin.make_aci(entry)
+        aci, _msg = perm_plugin.make_aci(entry)
         yield 'dn: %s\n' % entry.single_value['ipapermlocation']
         yield f'aci: {aci}\n'
 

tox.ini

@@ -62,4 +62,4 @@ exclude=.git,.venv,build,_build,rpmbuild,2_49,2_114,2_156,2_164
 filename=*.py,*.in
 
 [pytest]
-addopts = -ra -v
+addopts = -ra -v --ignore=prci_definitions/prci_checker.py