git: 4c8bd7aad901 - main - net/freeipa-server: Fix client enrollment paths

The branch main has been updated by joneum:

URL: https://cgit.FreeBSD.org/ports/commit/?id=4c8bd7aad9017e3f62f2f87c6b104fddf3f129f2

commit 4c8bd7aad9017e3f62f2f87c6b104fddf3f129f2
Author:     Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-09-06 09:50:24 +0000
Commit:     Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-09-06 09:51:08 +0000

    net/freeipa-server: Fix client enrollment paths
    
    ipa-join used the upstream default /etc/ipa/ca.crt, so it could not
    build a
    TLS context and enrollment stopped at "Unable to determine root DN". The
    client port already patches this constant; the server port ships the
    same
    ipaclient tree and needs it too.
    
    configure_krb5_snippet() copied its snippet into a krb5.conf.d that
    nothing
    creates, which aborted the install with FileNotFoundError. It now
    creates
    the directory, which is where FreeIPA points krb5.conf's includedir
    anyway.
    
    Reported by:    usenix17
    https://github.com/joneum/FreeBSD-freeipa-server/issues/3
    Sponsored by:   Netzkommune GmbH
---
 net/freeipa-server/Makefile                                |  5 +++--
 net/freeipa-server/files/patch-ipaclient_install_client.py | 11 +++++++++++
 net/freeipa-server/files/patch-util_ipa__ldap.h            | 11 +++++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/net/freeipa-server/Makefile b/net/freeipa-server/Makefile
index e86badffca7e..cf096bddf907 100644
--- a/net/freeipa-server/Makefile
+++ b/net/freeipa-server/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	freeipa-server
 DISTVERSION=	4.13.2
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	net
 MASTER_SITES=	https://codeberg.org/freeipa/freeipa/releases/download/release-${DISTVERSION:S/./-/g}/
 DISTNAME=	freeipa-${DISTVERSION}
@@ -120,7 +120,8 @@ post-patch:
 		${WRKSRC}/ipaplatform/freebsd/services.py \
 		${WRKSRC}/ipapython/ipautil.py \
 		${WRKSRC}/ipaserver/install/cainstance.py \
-		${WRKSRC}/ipaserver/install/server/upgrade.py
+		${WRKSRC}/ipaserver/install/server/upgrade.py \
+		${WRKSRC}/util/ipa_ldap.h
 
 post-build:
 	${MAKE_CMD} -C ${WRKSRC}/client \
diff --git a/net/freeipa-server/files/patch-ipaclient_install_client.py b/net/freeipa-server/files/patch-ipaclient_install_client.py
new file mode 100644
index 000000000000..e58eff24f858
--- /dev/null
+++ b/net/freeipa-server/files/patch-ipaclient_install_client.py
@@ -0,0 +1,11 @@
+--- ipaclient/install/client.py.orig	2026-09-05 20:54:40 UTC
++++ ipaclient/install/client.py
+@@ -728,6 +728,8 @@ def configure_krb5_snippet():
+         paths.USR_SHARE_IPA_CLIENT_DIR,
+         os.path.basename(paths.KRB5_FREEIPA_DEFAULTS) + ".template"
+     )
++    os.makedirs(os.path.dirname(paths.KRB5_FREEIPA_DEFAULTS),
++                mode=0o755, exist_ok=True)
+     shutil.copy(template, paths.KRB5_FREEIPA_DEFAULTS)
+     os.chmod(paths.KRB5_FREEIPA_DEFAULTS, 0o644)
+     tasks.restore_context(paths.KRB5_FREEIPA_DEFAULTS)
diff --git a/net/freeipa-server/files/patch-util_ipa__ldap.h b/net/freeipa-server/files/patch-util_ipa__ldap.h
new file mode 100644
index 000000000000..b5db315e6214
--- /dev/null
+++ b/net/freeipa-server/files/patch-util_ipa__ldap.h
@@ -0,0 +1,11 @@
+--- util/ipa_ldap.h.orig	2026-09-05 20:54:40 UTC
++++ util/ipa_ldap.h
+@@ -20,7 +20,7 @@
+ 
+ #include <ldap.h>
+ 
+-#define DEFAULT_CA_CERT_FILE "/etc/ipa/ca.crt"
++#define DEFAULT_CA_CERT_FILE "%%PREFIX%%/etc/ipa/ca.crt"
+ 
+ #define LDAP_SASL_EXTERNAL "EXTERNAL"
+ #define LDAP_SASL_GSSAPI "GSSAPI"