Loading...

XML

Word

Printable

Type: Story
Resolution: Unresolved
Priority: Normal
Fix Version/s: rhel-9.5
Affects Version/s: rhel-8.5.0, rhel-9.3.0
Component/s: samba
Labels:

Fixed in Build:
samba-4.20.0-103.el9

Pool Team:

sst_idm_sssd
Sub-System Group:

ssg_idm

Story Points:
0
ACKs Check:

QE ack, Dev ack
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Product Documentation Required:
Yes
Sprint:
None

Preliminary Testing:
Pass
Errata Link:
https://errata.engineering.redhat.com/advisory/131667
Test Coverage:

RegressionOnly

Release Note Type:
Enhancement
Release Note Text:

Hide
.Samba supports certificate auto enrollment from Active Directory Certificate Services

With this enhancement, Samba on RHEL clients joined to an Active Directory (AD) can enroll for certificates from AD Certificate Services. The `certmonger` service keeps track of the certificates and renews them before they expire. As a result, administrators can use the private key and the certificate issued from the AD certificate authority in other services running on the same Samba host.

Show
.Samba supports certificate auto enrollment from Active Directory Certificate Services With this enhancement, Samba on RHEL clients joined to an Active Directory (AD) can enroll for certificates from AD Certificate Services. The `certmonger` service keeps track of the certificates and renews them before they expire. As a result, administrators can use the private key and the certificate issued from the AD certificate authority in other services running on the same Samba host.
Release Note Status:
Done

Experience:
Architecture:

All
Bugzilla Bug:
RHBZ: 2070411

PX Impact Score:
PX Priority Data:
PX Review Complete:
SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Planning:
None

The next stable release of Samba (4.16) introduces a new feature, Certificate auto enrolment: https://wiki.samba.org/index.php/Certificate_Auto_Enrollment

To achieve this functionality, Samba leverages a number of third party components, most of which are not available as RPM packages.

The components for which RPMs are not available are:

Oddjob-gpupdate - https://github.com/openSUSE/oddjob-gpupdate
cepces - https://github.com/openSUSE/cepces

I would like to request that Red Hat create RPMs for these components and include them when Samba 4.16 is released to the official RHEL repositories.

is blocked by

RHEL-25724 Add support for samba-gpupdate [SELinux]

Release Pending

RHEL-26337 gpupdate: Implement site_dn_for_machine() correctly

Release Pending

RHEL-22302 Add its own return code for EEXISTS for getcert tool

Closed

RHEL-13739 [RHEL9][RFE] - Add new cepces package

Closed

RHEL-13740 [RHEL9][RFE] - Add new oddjob-gpudate package

Closed

external trackers

Red Hat Customer Portal 03186117

Red Hat Issue Tracker RHELPLAN-117434

Red Hat Issue Tracker SSSD-4763

Red Hat Issue Tracker SSSD-6368

links to

RHBA-2024:131667 samba update

(4 external trackers, 1 links to)

Assignee:: Andreas Schneider

Reporter:: Sunny Wu

Developer:: Andreas Schneider

QA Contact:: Denis Karpelevich

Doc Contact:: Marc Muehlfeld

Votes:: 0 Vote for this issue

Watchers:: 9 Start watching this issue

Created:: 2023/09/04 9:21 AM

Updated:: 2024/11/07 2:58 PM

Details

Description

Attachments

Issue Links

Activity

People

Dates