Lets Encrypt scripts for multiple principals and Web/LDAP
by Antonia Stevens
Hi,
Thought I should introduce myself and post a link to some recent work which
might be relevant for some of you.
My name is Antonia Stevens and I'm a DevOps Engineer and long time FreeIPA
user.
We recently had a need to get proper certs for IPA servers in AWS which
means they have multiple IPs/DNS Names/Principals, since I could not find
anything I hacked together a couple of bash scripts to make it a bit easier.
https://github.com/antevens/letsencrypt-freeipa
Thanks for all the great work and depending on my schedule I might try to
contribute a bit more going forward.
Antonia Stevens
@antevens
a(a)antevens.com
https://github.com/antevens/
5 years, 6 months
[freeipa PR#837][opened] ca-add: fix permission issue
by frasertweedale
URL: https://github.com/freeipa/freeipa/pull/837
Author: frasertweedale
Title: #837: ca-add: fix permission issue
Action: opened
PR body:
"""
The ca-add command pre_callback uses ldap.can_add() to check whether
the user has permission to add CAs. Alas, the GetEffectiveRights
control used by ldap.can_add() doesn't correctly interpret ACIs with
'targetfilter' constraints, and returns a false-negative for
non-admin users, even when they have the 'System: Add CA'
permission.
To work around this, add the CA object to FreeIPA before attempting
to create the CA in Dogtag. If the CA creation in Dogtag succeds,
the user then updates the FreeIPA object with the Authority ID and
other authoritative data returned by Dogtag. If the CA creation in
Dogtag fails, the user cleans up by deleting the newly-created CA
object from FreeIPA.
This modified procedure ensures that the user certainly has the
'System: Add CA' permission before the CA creation in Dogtag is
attempted. But it also means that the user must have 'write' and
'delete' permission on 'ipaca' objects in FreeIPA, so that it can
complete the object after CA creation in Dogtag, or clean up if that
step fails. Therefore, update the 'System: Add CA' permission to
confer 'write' and 'delete' access on 'ipaca' objects, as well as
'add' access.
Fixes: https://pagure.io/freeipa/issue/6609
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/837/head:pr837
git checkout pr837
5 years, 7 months