#openssl is a library and aligns closely with its allies. Slides from Tim and Anton talk at the OpenSSL conference.

#yesterdayatwork Past week was busy. We released #freeipa 4.12.5 with the fix for CVE-2025-7493. I think we ended up doing 13 downstream releases (RHEL+Fedora) and anticipate several weeks of busy freeipa-users@ traffic. New FreeIPA Web UI support was merged upstream but building it on the […]

Finally implemented automatic FAST channel acquisition in MIT Kerberos using Anonymous PKINIT. This means you don't need to do `kinit -c fast.ccache @realm && -Tfast.ccache user@REALM` anymore to get passwordless pre-authentication working in console. All apps should be able to work […]

#yesterdayatwork: - #freeipa and #samba 4.23 interop fixes pushed to #fedora 43 updates stable. Not sure they are part of the Fedora 43 beta iso image, though. - We started looking into how to automatically test Samba and FreeIPA trust interop in Fedora QA infra […]

- PCP 7.0 support is merged upstream and backported to Samba 4.23 series, so should be good now. - Also helped with some patch reviews. More to come...

#yesterdayatwork: - the new #samba 4.23 release candidates found a bug I had in #freeipa for a decade. MS-DRSR spec forces version of ForestTrustInfo structure to be set to 1 (the only supported type) and Samba started enforcing it. FreeIPA saved the structure with a default (0) version number […]

#yesterdayatwork: This week was intense in fixing regressions. At SambaXP we improved Samba support for Kerberos but it broke FreeIPA use of GSSProxy which we only noticed in Fedora Rawhide with 4.23 release candidates. Fixed that and during Rawhide update discovered that new PCP 7.0.0 broke […]

#yesterdayatwork Back from vacation. Spent some time crawling through the emails, recovering my audio setup after two weeks out of home. - started to look into automating FAST channel use when doing kinit with https://github.com/krb5/krb5/pull/1447. Greg suggested to move the logic to libkrb5 […]

#yesterdayatwork: - helped @zlopez investigating why IPA replica couldn't be provisioned in the new Fedora datacenter. We had similar report upstream as well. This looks like a PKI/DS configuration issue but also PKI problem with VLV searches. - filed an issue for freeipa-healthcheck to […]

#yesterdayatwork - back from the Flock+meetings+Devconf trip that took 12 days. Flights got delayed in Prague due to thunderstorms, came back around midnight. - Tuesday we released #freeipa 4.12.4 with a fix to CVE-2025-4404. Spent some time getting Fedora builds done. RHEL builds were released […]

#yesterdayatwork: It is a Red Hat Summit's week and I'm in Boston. - ran a talk about post-quantum crypto in RHEL together with @simo5 and Amy. - gave 4 lightning talks about different #freeipa features that we either have implemented recently or are working upstream: - `ipa-migrate` - […]

#yesterdayatwork: - together with @cryptomilk we've got #localkdc to handle IP addresses associated with the host as aliases for Kerberos authentication. You'd be able to do SMB3 with Kerberos using IP address and still use Kerberos auth. This is work in progress. - keep discussing with […]

If you're attending the Red Hat Summit this year, I'll be there as well and will be talking about post-quantum cryptography together with @simo5. I also will be showing some upstream demos around FreeIPA projects. Never been at the Summit before, so it would be an opportunity to meet and talk […]

MIT Kerberos 1.22 beta1 is out: https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html This release includes our work to enable local KDC activities: - use UNIX domain socket on KDC side for Kerberos protocol exchanges and for kadmin/kpasswd protocols - updated IAKERB proxy. To use it, just […]

#yesterdayatwork, or rather for couple weeks: - in #freeipa completed DNSSEC support recovery after OpenSSL provider API migration - in orther to merge that upstream, we had to migrate to Fedora 42 builds in CI. This wasn't easy for our Azure CI - python-dnspython removal in Fedora caused […]

#yesterdayatwork: Finished backporting FreeIPA Encrypted DNS support to Fedora. It took several steps, as @pemensik had to do DoT and OpenSSL provider API support backport to Bind 9.18 first, then I had to fix upgrade code that switched our Bind setup from OpenSSL engine use to OpenSSL provider […]

Past week's #yesterdayatwork: - Discussed with Greg and Nico IAKERB changes we need to make sure local KDC-issued tickets can work in cross-realm environments. We need IAKERB spec update to clarify the error handling to allow exchanges to proceed properly and not to drop the connection. Todo […]

#yesterdayatwork: - IAKERB realm discovery changes merged to MIT Kerberos development branch, as well as fixes to shortcut crashes. They'll appear in the next MIT Kerberos release. So we are good here. - continue working on sysaccounts support API for #freeipa - helped @cryptomilk with reviews […]

#yesterdayatwork: Thursday/Friday were spent in iakerb land. We mostly fixed realm discovery, found a bug in iakerb state machine shortcuts that existed for ~10 years if not more. There is an issue in mixed use of Kerberos and IAKerb mechs which we cannot currently solve, so this will be […]

#yesterdayatwork: - When adjusting full 32-bit IDs pull request to review comments, found a bug in a separate upgrade plugin in #freeipa. The issue shouldn't happen in normal situation, uncovered by my new changes only. The PR is acked now, so should land in release branches soon. - Got […]

#yesterdayatwork: (more of end of past week + today) - worked with @cryptomilk on IAKerb discovery in MIT Kerberos. Submitted https://github.com/krb5/krb5/pull/1415 which implements client side of the default server realm discovery. It needs target service realm propagation as well but we need […]

#yesterdayatwork: - meetings, meetings - first cut of 32-bit ID ranges support in #freeipa. Next step is to actually test a switch over procedure and write docs - talked to @SteveSyfuhs on how we can get early interop with Windows version of localkdc/iakerb. Hopefully, something will come […]