freeipa/ipatests/pytest_ipa/integration
Christian Heimes dbebed2e3a Add PKINIT support to ipa-client-install
The ``ipa-client-install`` command now supports PKINIT for client
enrollment. Existing X.509 client certificates can be used to
authenticate a host.

Also restart KRB5 KDC during ``ipa-certupdate`` so KDC picks up new CA
certificates for PKINIT.

*Requirements*

- The KDC must trust the CA chain of the client certificate.
- The client must be able to verify the KDC's PKINIT cert.
- The host entry must exist. This limitation may be removed in the
  future.
- A certmap rule must match the host certificate and map it to a single
  host entry.

*Example*

```
ipa-client-install \
    --pkinit-identity=FILE:/path/to/cert.pem,/path/to/key.pem \
    --pkinit-anchor=/path/to/kdc-ca-bundle.pem
```

Fixes: https://pagure.io/freeipa/issue/9271
Fixes: https://pagure.io/freeipa/issue/9269
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2022-11-16 14:32:05 +02:00
..
__init__.py ipatests: collect samba logs when setting up trust to AD 2022-04-13 18:37:12 +02:00
config.py ipatests: Collect all logs on all Unix hosts 2020-04-28 17:50:10 +02:00
create_bridge.py ipatests: add keycloak user login to ipa test 2022-10-20 08:48:53 -04:00
create_caless_pki.py ipatests: use non-ascii chars in CA-less install 2021-06-16 11:25:08 -04:00
create_keycloak.py ipatests: add Keycloak Bridge test 2022-09-20 14:54:04 -04:00
env_config.py Test installation with (fake) userspace FIPS 2019-11-14 16:01:15 +01:00
expect.py ipatests: log command spawned by pexpect 2021-03-29 14:55:23 +03:00
fips.py tests: ensure AD-SUPPORT subpolicy is active in more cases 2022-03-25 10:23:38 +01:00
firewall.py ipatests: Mark firewalld commands as no-op on non-firewalld distros 2020-04-08 16:33:35 +02:00
host.py ipatests: allocate pseudo-terminal only for specific command 2021-03-29 14:55:23 +03:00
resolver.py pylint: Fix deprecated-decorator 2022-03-11 13:37:08 -05:00
tasks.py Add PKINIT support to ipa-client-install 2022-11-16 14:32:05 +02:00
transport.py ipatests: allocate pseudo-terminal only for specific command 2021-03-29 14:55:23 +03:00