IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

krainstance: set correct issuer DN in uid=ipakra entry

Browse Source 
If IPA CA has custom subject DN (not "CN=Certificate
Authority,{subject_base}"), the uid=ipakra people entry gets an
incorrect 'description' attribute.  The issuer DN in the
'description' attribute is based on the aforementioned pattern,
instead of the actual IPA CA subject DN.

Update KRAInstance.configure_instance() to require the CA subject DN
argument.  Update ipaserver.install.kra.install() to pass the CA
subject DN.

Fixes: https://pagure.io/freeipa/issue/8084
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
This commit is contained in:
Fraser Tweedale 2019-10-04 13:30:37 +10:00 committed by Florence Blanc-Renaud
parent 0fc8562b24
commit 326d417d98
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ipaserver/install/kra.py
View File

@ -16,7 +16,7 @@ from ipaplatform import services
from ipaplatform.paths import paths from ipaplatform.paths import paths
from ipapython import ipautil from ipapython import ipautil
from ipapython.install.core import group from ipapython.install.core import group
from ipaserver.install import cainstance from ipaserver.install import ca, cainstance
from ipaserver.install import krainstance from ipaserver.install import krainstance
from ipaserver.install import dsinstance from ipaserver.install import dsinstance
from ipaserver.install import service as _service from ipaserver.install import service as _service
@ -86,10 +86,13 @@ def install(api, replica_config, options, custodia):
master_host = replica_config.kra_host_name master_host = replica_config.kra_host_name
promote = True promote = True
ca_subject = ca.lookup_ca_subject(api, subject_base)
kra = krainstance.KRAInstance(realm_name) kra = krainstance.KRAInstance(realm_name)
kra.configure_instance( kra.configure_instance(
realm_name, host_name, dm_password, dm_password, realm_name, host_name, dm_password, dm_password,
subject_base=subject_base, subject_base=subject_base,
ca_subject=ca_subject,
pkcs12_info=pkcs12_info, pkcs12_info=pkcs12_info,
master_host=master_host, master_host=master_host,
promote=promote, promote=promote,

9
ipaserver/install/krainstance.py
View File

@ -81,7 +81,7 @@ class KRAInstance(DogtagInstance):
def configure_instance(self, realm_name, host_name, dm_password, def configure_instance(self, realm_name, host_name, dm_password,
admin_password, pkcs12_info=None, master_host=None, admin_password, pkcs12_info=None, master_host=None,
subject_base=None, subject=None, subject_base=None, ca_subject=None,
promote=False, pki_config_override=None): promote=False, pki_config_override=None):
"""Create a KRA instance. """Create a KRA instance.
@ -99,8 +99,9 @@ class KRAInstance(DogtagInstance):
self.subject_base = \ self.subject_base = \
subject_base or installutils.default_subject_base(realm_name) subject_base or installutils.default_subject_base(realm_name)
self.subject = \
subject or installutils.default_ca_subject_dn(self.subject_base) # eagerly convert to DN to ensure validity
self.ca_subject = DN(ca_subject)
self.realm = realm_name self.realm = realm_name
self.suffix = ipautil.realm_to_suffix(realm_name) self.suffix = ipautil.realm_to_suffix(realm_name)
@ -258,7 +259,7 @@ class KRAInstance(DogtagInstance):
userCertificate=[cert], userCertificate=[cert],
description=['2;%s;%s;%s' % ( description=['2;%s;%s;%s' % (
cert.serial_number, cert.serial_number,
DN(self.subject), self.ca_subject,
DN(('CN', 'IPA RA'), self.subject_base))]) DN(('CN', 'IPA RA'), self.subject_base))])
conn.add_entry(entry) conn.add_entry(entry)