[freeipa PR#2554][opened] certdb: validate certificate signatures
by frasertweedale
URL: https://github.com/freeipa/freeipa/pull/2554
Author: frasertweedale
Title: #2554: certdb: validate certificate signatures
Action: opened
PR body:
"""
When verifying a CA certificate, validate its signature. This causes
FreeIPA to reject certificate chains with bad signatures, signatures using
unacceptable algorithms, or certificates with unacceptable key sizes. The
'-e' option to 'certutil -V' was the missing ingredient.
An an example of a problem prevented by this change, a certifiate signed by
a 1024-bit intermediate CA, would previously have been imported by
ipa-cacert-manage, but would cause Dogtag startup failure due to failing
self-test. With this change, ipa-cacert-manage will reject the
certificate:
\# ipa-cacert-manage renew --external-cert-file /tmp/ipa.p7
Importing the renewed CA certificate, please wait
CA certificate CN=Certificate Authority,O=IPA.LOCAL 201809261455
in /tmp/ipa.p7 is not valid: certutil: certificate is invalid: The
certificate was signed using a signature algorithm that is
disabled because it is not secure.
Fixes: https://pagure.io/freeipa/issue/7761
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2554/head:pr2554
git checkout pr2554
5 years, 5 months
[freeipa PR#2545][opened] ipatests: update tests for ipa-server-certinstall
by flo-renaud
URL: https://github.com/freeipa/freeipa/pull/2545
Author: flo-renaud
Title: #2545: ipatests: update tests for ipa-server-certinstall
Action: opened
PR body:
"""
1. The test test_http_intermediate_ca was expecting success when it should expect a failure. Scenario:
- install IPA ca-less with certs signed by rootCA
- call ipa-server-certinstall with a cert signed by a subCA to replace http cert.
In this case, the command should refuse changing the cert (otherwise the clients won't be able any more to use ipa * commands as the subca is not installed in /etc/ipa/nssdb or in /etc/ipa/ca.crt).
The commit fixes the test expectation and marks the test as xfail (see ticket 7759).
2. The test test_ds_intermediate_ca was expecting success when it should expect a failure. Same scenario as above, but for the ldap server cert.
The commit fixes the test expectation and removes the xfail (ticket 6959 was closed as invalid).
Note:
The behavior differs for ldap and http cert because LDAP server is using a NSSDB and http server is using openssl, hence ipa-server-certinstall follows 2 different code paths when changing the server cert.
Related to https://pagure.io/freeipa/issue/7759
Related to https://pagure.io/freeipa/issue/6959
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2545/head:pr2545
git checkout pr2545
5 years, 5 months
[freeipa PR#2530][opened] Fix ipa user-add --radius=radiusserver
by flo-renaud
URL: https://github.com/freeipa/freeipa/pull/2530
Author: flo-renaud
Title: #2530: Fix ipa user-add --radius=radiusserver
Action: opened
PR body:
"""
## ipa user-add: add optional objectclass for radius-username
The command `ipa user-add --radius-username` fails with `ipa: ERROR: attribute "ipatokenRadiusUserName" not allowed` because it does not add the objectclass ipatokenradiusproxyuser that is required by the attribute ipatokenradiususername.
The issue happens with `ipa user-add / stageuser-add / user-mod / stageuser-mod`.
The fix adds the objectclass when needed in the pre_common_callback method of baseuser_add and baseuser_mod (ensuring that user and stageuser commands are fixed).
Also add a xmlrpc unit test for `ipa user-add|mod --radius-username`
Fixes https://pagure.io/freeipa/issue/7569
## radiusproxy: add permission for reading radius proxy servers
A non-admin user which has the `User Administrator` role cannot add a user with `ipa user-add --radius=<proxy>` because the call needs to read the radius proxy server entries.
The fix adds a System permission for reading radius proxy server entries (all attributes except the ipatokenradiussecret). This permission is added to the already existing privileges `User Administrators` and `Stage User Administrators`, so that the role `User Administrator` can call `ipa [stage]user-add|mod --radius=<proxy>`
Also add an integration test for the following scenario:
- create a user with the "User Administrator" role
- as this user, create a user with a --radius=<radius_proxy_server>
Fixes: https://pagure.io/freeipa/issue/7570
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2530/head:pr2530
git checkout pr2530
5 years, 5 months