On ti, 30 heinä 2019, Dmitry Perets via FreeIPA-users wrote:
Hi Alexander,
Thanks again for your help on this...
Just one question regarding your fix here:
https://github.com/abbra/freeipa/pull/9/files
When you say "host aliases", what exactly do you mean? DNS CNAME records?
Any other host names this host is known about so that IPA CLI requests
could come with the HTTP referrer for it.
Because then, I am afraid, this would not solve my problem. I
can't
create CNAME record
name2.example.com for my IPA server, because the
whole problem was that name2 and name1 must resolve to different IPs.
Which CNAME cannot do for me.
You can add A/AAAA records.
I was thinking that HTTP Referers check should accept any of the
configured _principal aliases_ (added to the service
HTTP/name1.example.com). This would be a true "IPA-way", I would say...
But at least from a manual test of your code fix - this doesn't seem to
be the case (or maybe I did it wrong).
We cannot -- at the point of this check we
aren't talking to LDAP to see
a list of aliases. We only rely on what is set in the config files, so
you should set this in /etc/ipa/server.conf
[global]
host_aliases =
name2.example.com name3.example.com ...
Well... the (kinda) good news is that when I commented out the
referers
check I could finally enroll without further errors.
You know that you are basically
opening your environment for CSRF and
phishing attack?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland