IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-08-14 06:54:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

server install: fix KDC PKINIT configuration

Browse Source 
Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known
to IPA.

Make sure `cacert.pem` is exported in all installation code paths.

Use the KDC certificate itself as a PKINIT anchor in `login_password`.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This commit is contained in:
Jan Cholasta
2017-05-19 12:31:24 +02:00
committed by Martin Basti
parent 4d36cbf6ad
commit f769045f0a
8 changed files with 103 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipalib/install/kinit.py
+4 -3
View File
@@ -96,7 +96,7 @@ def kinit_password(principal, password, ccache_name, config=None,
raise RuntimeError(result.error_output)
def kinit_armor(ccache_name, pkinit_anchor=None):
def kinit_armor(ccache_name, pkinit_anchors=None):
"""
perform anonymous pkinit to obtain anonymous ticket to be used as armor
for FAST.
@@ -113,8 +113,9 @@ def kinit_armor(ccache_name, pkinit_anchor=None):
env = {'LC_ALL': 'C'}
args = [paths.KINIT, '-n', '-c', ccache_name]
if pkinit_anchor is not None:
args.extend(['-X', 'X509_anchors=FILE:{}'.format(pkinit_anchor)])
if pkinit_anchors is not None:
for pkinit_anchor in pkinit_anchors:
args.extend(['-X', 'X509_anchors=FILE:{}'.format(pkinit_anchor)])
# this workaround enables us to capture stderr and put it
# into the raised exception in case of unsuccessful authentication