URL: https://github.com/freeipa/freeipa/pull/813
Author: frasertweedale
Title: #813: Add Subject Key Identifier to CA cert validity check
Action: opened
PR body:
"""
CA certificates MUST have the Subject Key Identifier extension to
facilitiate certification path construction. Not having this
extension on the IPA CA certificate will cause failures in Dogtag
during signing; it tries to copy the CA's Subject Key Identifier to
the new certificate's Authority Key Identifier extension, which
fails.
When installing an externally-signed CA, check that the Subject Key
Identifier extension is present in the CA certificate.
Fixes: https://pagure.io/freeipa/issue/6976
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/813/head:pr813
git checkout pr813
URL: https://github.com/freeipa/freeipa/pull/810
Author: Tiboris
Title: #810: user.py: replace user_mod with ldap.update_entry()
Action: opened
PR body:
"""
Refactoring user_add class to use 'ldap.update_entry()' call
instead of api call 'user_mod' when --noprivate option is used.
https://pagure.io/freeipa/issue/5788
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/810/head:pr810
git checkout pr810
URL: https://github.com/freeipa/freeipa/pull/797
Author: flo-renaud
Title: #797: ipa-replica-conncheck: handle ssh not installed
Action: opened
PR body:
"""
When ipa-replica-conncheck is run but ssh is not installed, the tool exits
with a stack trace. Properly handle the error by raising an Exception.
https://pagure.io/freeipa/issue/6935
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/797/head:pr797
git checkout pr797
Hi List,
Me, Alexander, and Pavel discussed the current issues and hurdles related to
various configurational aspects of SmartCard Authentication against FreeIPA
masters.
Based on the inputs gathered during the discussion we have put together a short
Design page draft[1] describing the proposed approach used for configuring:
* PKINIT for server and clients
* OCSP responder in mod_nss
* WebUI smart card login
As always feel free to comment and voice your concerns regarding the design and
implementation of the feature.
[1] https://www.freeipa.org/page/V4/Smartcard_authentication_ipa-advise_recipes
--
Martin Babinsky