On ti, 01 loka 2019, Dmitry Perets via FreeIPA-users wrote:
Hi,
Posting back here, in case someone gets this issue in the future...
The problem turned out to be that IPA put wrong CA cert subject in the LDAP entry under
"uid=ipakra,ou=people,o=kra,o=ipaca".
It looked like this:
dn: uid=ipakra,ou=people,o=kra,o=ipaca
description: 2;7;CN=Certificate Authority,O=<my_realm>;CN=IPA RA,O=<my_realm>
uid: ipakra
sn: IPA KRA User
usertype: undefined
userCertificate:: <here cert comes>
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: cmsuser
cn: IPA KRA User
So there are a couple of requirements that this entry must satisfy, such as:
- `userCertificate` must contain the cert from /var/lib/ipa/ra-agent.pem
- `description` must contain cert serial number (it's the second integer, usually 7)
- `description` must further contain the issuer of that the cert and its subject (CN=IPA
RA...)
So in our case, the problem was with the wrong issuer.
`CN=Certificate Authority` is the default issuer subject, but in my environment I actually
use a custom one:
$ openssl x509 -noout -issuer -subject -in /var/lib/ipa/ra-agent.pem
issuer= /CN=My CA/O=<my_realm>
subject= /O=<my_realm>/CN=IPA RA
This looks like actual IPA RA subject is fixed in the code in
ipaserver/install/krainstance.py:
class KRAInstance(DogtagInstance):
.....
def __create_kra_agent(self):
.....
# create ipakra user with RA agent certificate
user_dn = DN(('uid', "ipakra"), ('ou',
'people'), self.basedn)
entry = conn.make_entry(
user_dn,
objectClass=['top', 'person', 'organizationalPerson',
'inetOrgPerson', 'cmsuser'],
uid=["ipakra"],
sn=["IPA KRA User"],
cn=["IPA KRA User"],
usertype=["undefined"],
userCertificate=[cert],
description=['2;%s;%s;%s' % (
cert.serial_number,
DN(self.subject),
DN(('CN', 'IPA RA'), self.subject_base))])
conn.add_entry(entry)
I think it should be picked up from the cert. Time for a ticket?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland