[freeipa PR#798][opened] [4.5] install: fix CA-less PKINIT
by HonzaCholasta
URL: https://github.com/freeipa/freeipa/pull/798
Author: HonzaCholasta
Title: #798: [4.5] install: fix CA-less PKINIT
Action: opened
PR body:
"""
**certdb: add named trust flag constants**
Add named constants for common trust flag combinations.
Use the named constants instead of trust flags strings in the code.
**certdb, certs: make trust flags argument mandatory**
Make the trust flags argument mandatory in all functions in `certdb` and
`certs`.
**certdb: use custom object for trust flags**
Replace trust flag strings with `TrustFlags` objects. The `TrustFlags`
class encapsulates `certstore` key policy and has an additional flag
indicating the presence of a private key.
**install: trust IPA CA for PKINIT**
Trust IPA CA to issue PKINIT KDC and client authentication certificates in
the IPA certificate store.
**client install: fix client PKINIT configuration**
Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs
trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`.
Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs
known to IPA.
Make sure both bundles are exported in all installation code paths.
**server install: fix KDC PKINIT configuration**
Make sure `cacert.pem` contains only certificates of CAs trusted to issue
PKINIT client certificates and is exported in all installation code paths.
Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known
to IPA.
Use the KDC certificate itself as a PKINIT anchor in `login_password`.
**certs: do not export CA certs in install_pem_from_p12**
This fixes `kdc.crt` containing the full chain rather than just the KDC
certificate in CA-less server install.
**server install: fix KDC certificate validation in CA-less**
Verify that the provided certificate has the extended key usage and subject
alternative name required for KDC.
**cacert manage: support PKINIT**
Allow installing 3rd party CA certificates trusted to issue PKINIT KDC
and/or client certificates.
**server certinstall: support PKINIT**
Allow replacing the KDC certificate.
https://pagure.io/freeipa/issue/6831
https://pagure.io/freeipa/issue/6869
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/798/head:pr798
git checkout pr798
7 years
[freeipa PR#758][comment] install: fix CA-less PKINIT
by MartinBasti
URL: https://github.com/freeipa/freeipa/pull/758
Title: #758: install: fix CA-less PKINIT
MartinBasti commented:
"""
master:
* 235265a5f5436148dd8d7e63b7e3928689796560 certdb: add named trust flag constants
* f0442a2d0ed54abe6567fce6d99fd31f7c6c7883 certdb, certs: make trust flags argument mandatory
* 52730c786f6bb11aa7992b11fa0f5c94c90f9eb8 certdb: use custom object for trust flags
* 01a7416d305ddb11d5b83c99afbacf8ba854c148 install: trust IPA CA for PKINIT
* 11b8a3434655932fa73f05d4bd864bed0194035c client install: fix client PKINIT configuration
* 4d36cbf6ad412822b8fb029f517f9228e2c8d4ee install: introduce generic Kerberos Augeas lens
* f769045f0ae9c5fdc651e03c0c96af9cdec8f298 server install: fix KDC PKINIT configuration
* b9fd123d61fa7adda090c05216906ba0cf4779a9 ipapython.ipautil.run: Add option to set umask before executing command
* 0c5b2c42bf52dc75ecf9d95036ca8517670877d6 certs: do not export keys world-readable in install_key_from_p12
* cc572378a69a7e4d18b7297b7fa54e2fe8e33b2f certs: do not export CA certs in install_pem_from_p12
* 3b5dbf7cdb4c03260057c8f7a2abd5c5712eca41 server install: fix KDC certificate validation in CA-less
* b3855704f479eaf122139189b762b943b2dcc0fc replica install: respect --pkinit-cert-file
* 9ea764ecf5c3118df0917d94c4940b4ee38b3a31 cacert manage: support PKINIT
* 96ca62f81d3505b050eb9b9d71d4fc4c18e1535e server certinstall: support PKINIT
"""
See the full comment at https://github.com/freeipa/freeipa/pull/758#issuecomment-302669009
7 years