IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-28 01:41:14 -06:00
Code Issues Packages Projects Releases Wiki Activity
14,777 Commits 11 Branches 59 Tags 60 MiB
379d5da0ae
Commit Graph

4 Commits

Author SHA1 Message Date
Christian Heimes
24a5d4d06b Ensure that KDC cert has SAN DNS entry 
The dns parameter of request_and_wait_for_cert() must be a string of
hostnames.

* Enforce list/tuple type so that API misuse no longer passes silently.
* Add commonNameToSANDefaultImpl to KDCs_PKINIT_Certs profile
* Explicitly pass hostname for service certs

Fixes: https://pagure.io/freeipa/issue/8685
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2021-01-29 13:36:41 -05:00
Florence Blanc-Renaud
a25de958e4 test: add non-reg test checking pkinit after server install 
Add a test with the following scenario:
ipa-server-install (with ca and pkinit enabled)
check that pkinit is properly enabled:
ipa-pkinit-manage status must return "enabled"
the KDC cert must be signed by IPA CA

Related to: https://pagure.io/freeipa/issue/7795

Reviewed-By: François Cami <fcami@redhat.com>
 2019-02-20 09:18:38 +01:00
Florence Blanc-Renaud
64be3141da ipatests: add integration test for pkinit enable on replica 
ipa-pkinit-manage enable was failing when run on a replica
without a CA instance.
Add a test with the following scenario:
- install a replica with --no-pkinit
- check that the KDC cert is self signed
- call ipa-pkinit-manage enable
- check that the KDC cert is signed by IPA CA

Related to https://pagure.io/freeipa/issue/7795

Reviewed-By: Francois Cami <fcami@redhat.com>
 2019-01-09 09:51:31 +01:00
Florence Blanc-Renaud
52c3c90875 ipatest: add test for ipa-pkinit-manage enable|disable 
Add a test for ipa-pkinit-manage with the following scenario:
- install master with option --no-pkinit
- call ipa-pkinit-manage enable
- call ipa-pkinit-manage disable
- call ipa-pkinit-manage enable

At each step, check that the PKINIT cert is consistent with the
expectations: when pkinit is enabled, the cert is signed by IPA
CA and tracked by 'IPA' ca helper, but when pkinit is disabled,
the cert is self-signed and tracked by 'SelfSign' CA helper.

The new test is added in the nightly definitons.

Related to https://pagure.io/freeipa/issue/7200

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2018-12-05 11:06:21 +01:00