#The forest mod api 0.54 install
#The forest mod api 0.54 upgrade
#The forest mod api 0.54 windows

Sudo -u ods SOFTHSM2_CONF=/etc/ipa/dnssec/nf ods-ksmutil key ds-seen -zone. This confirmation has to be done on FreeIPA server with key master role using following command:

User has to manually confirm that DS record in parent zone was published otherwise Key Signing Key (KSK) will not be rotated.

User has to manually upload Delegation Signer (DS) record to parent DNS zone to establish chain of trust.

Please keep in mind that it can take few minutes before all servers sign the zone. This command will generate new zone keys, distribute keys to all FreeIPA DNS servers and configure all servers to independently sign the zone. It allows you to enable DNSSEC for particular DNS zone using command:

#The forest mod api 0.54 install

Before you start signing you DNS zones you have to install DNSSEC key master role to an existing FreeIPA DNS server using command: SSLv3.0 ( CVE-2014-3566) ciphers are now disabled on new installationsДЇreeIPA now automates basic key management for Domain Name System Security Extensions (DNSSEC).

#The forest mod api 0.54 upgrade

ipa-ldap-upgrade restores Directory Server settings when upgrade fails.

DNS zone interface no longer accepts -class option as it had no effect as FreeIPA DNS only supports IN class.

Server installers can now handle hosts with multiple IPv4 or IPv6 addresses.

Port 8443 is now checked before server installation to prevent failures in configuring PKI which uses the port.

ipa-replica-prepare now waits for the replica DNS record to be available to fix race conditions in automated test environments.

Packages can be now built and installed on RHEL/CentOS 7.0.

in groups, sudo command groups or others) given that it is also not required in schema.

Description attribute is no longer required (e.g.

ipa command run with -vv option now prints JSON request and reply exchanged with the FreeIPA server.

Services can now be assigned as members of RBAC roles.

CLI and Web UI for retrive keytab and create keytab authorization ( design page).

New option -request-cert to optionally request host certificates on FreeIPA clients (to /etc/ipa/nssdb/).

#The forest mod api 0.54 windows

Seamless signing of FreeIPA CA us a subCA in Windows Certificate Services ( ticket).The list of authoritative name servers are read from LDAP DNS zone adding interface was simplified - name server and it's IP address is no longer required.DNS interface now supports adding DNS root zone ('.') allowing admin to for example centrally override DNS root hints.OTP authentication plugin now prevents multiple usage of token codes on a single FreeIPA server.New tool ipa-cacert-manage to manually renew or change FreeIPA PKI CA certificate ( design page).Per-host overrides should be used with extreme care! ( design page) It also allows to assign particular view to selected hosts or hostgroups, thus allowing having a user / group with different POSIX attributes on different hosts.

Such users then do not need to have POSIX attributes defined in the Active Directory to authenticate to FreeIPA clients.

New concept of ID Views allowing FreeIPA administrator to define or override POSIX attributes for users/groups coming from trusted domains.