IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow SAN extension for cert-request self-service

Browse Source 
Users cannot self-issue a certificate with a subjectAltName
extension (e.g. with rfc822Name altNames).  Suppress the
cert-request "request certificate with subjectaltname" permission
check when the bind principal is the target principal (i.e.
cert-request self-service).

Fixes: https://fedorahosted.org/freeipa/ticket/5190
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This commit is contained in:
Fraser Tweedale 2015-08-09 03:25:58 -04:00 committed by Jan Cholasta
parent 6f8b0ed4fa
commit aafc0e980b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ipalib/plugins/cert.py
View File

@ -369,7 +369,7 @@ class cert_request(VirtualCommand):
error=_("Failure decoding Certificate Signing Request: %s") % e)
# host principals may bypass allowed ext check
if bind_principal_type != HOST:
if bind_principal != principal and bind_principal_type != HOST:
for ext in extensions:
operation = self._allowed_extensions.get(ext)
if operation: