On Tue, Oct 01, 2019 at 10:51:37AM +0300, Alexander Bokovoy via FreeIPA-users wrote:
On ti, 01 loka 2019, Dmitry Perets via FreeIPA-users wrote:
> Hi,
>
> Posting back here, in case someone gets this issue in the future...
>
> The problem turned out to be that IPA put wrong CA cert subject in the LDAP entry
under "uid=ipakra,ou=people,o=kra,o=ipaca".
> It looked like this:
>
> dn: uid=ipakra,ou=people,o=kra,o=ipaca
> description: 2;7;CN=Certificate Authority,O=<my_realm>;CN=IPA
RA,O=<my_realm>
> uid: ipakra
> sn: IPA KRA User
> usertype: undefined
> userCertificate:: <here cert comes>
> objectClass: top
> objectClass: person
> objectClass: organizationalPerson
> objectClass: inetOrgPerson
> objectClass: cmsuser
> cn: IPA KRA User
>
> So there are a couple of requirements that this entry must satisfy, such as:
> - `userCertificate` must contain the cert from /var/lib/ipa/ra-agent.pem
> - `description` must contain cert serial number (it's the second integer,
usually 7)
> - `description` must further contain the issuer of that the cert and its subject
(CN=IPA RA...)
>
> So in our case, the problem was with the wrong issuer.
> `CN=Certificate Authority` is the default issuer subject, but in my environment I
actually use a custom one:
>
> $ openssl x509 -noout -issuer -subject -in /var/lib/ipa/ra-agent.pem
> issuer= /CN=My CA/O=<my_realm>
> subject= /O=<my_realm>/CN=IPA RA
This looks like actual IPA RA subject is fixed in the code in
ipaserver/install/krainstance.py:
class KRAInstance(DogtagInstance):
.....
def __create_kra_agent(self):
.....
# create ipakra user with RA agent certificate
user_dn = DN(('uid', "ipakra"), ('ou',
'people'), self.basedn)
entry = conn.make_entry(
user_dn,
objectClass=['top', 'person', 'organizationalPerson',
'inetOrgPerson', 'cmsuser'],
uid=["ipakra"],
sn=["IPA KRA User"],
cn=["IPA KRA User"],
usertype=["undefined"],
userCertificate=[cert],
description=['2;%s;%s;%s' % (
cert.serial_number,
DN(self.subject),
DN(('CN', 'IPA RA'), self.subject_base))])
conn.add_entry(entry)
I think it should be picked up from the cert. Time for a ticket?
Time for a ticket, yes. But the above code looks ok. The problem
is 'self.subject' (the issuer DN) contains the wrong value. I'll
follow the reproducer steps to see what's going on. I suspect
KRAInstance instance is not initialised properly for some operation.
Cheers,
Fraser
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...