On Tue, Nov 17, 2015 at 10:43:10AM +0100, Jakub Hrozek wrote:
On Tue, Nov 10, 2015 at 11:23:38AM +0100, Sumit Bose wrote:
> Hi,
>
> currently the p11_child does not continue to search for more
> certificates if the first suitable certificate cannot be verified. With
> this patch p11_child will continue until a valid certificate is found
> (or all are checked).
The code looks good to me.
>
> As said before I'm working on improving the handling of the certificates
> for the unit-test and would prefer to not spend time to add a test for
> this case with the old scheme. If you agree I would open a ticket to
> remind me to add tests for this case with the new scheme.
Is there an easy way to test manually? If not, I'll trust your testing
for now and ack based on code inspection.
I might work if you follow the steps in
https://fedorahosted.org/sssd/wiki/DesignDocs/SmartcardAuthenticationStep...
and add a second invalid certificate to the sql:/home/use/my_cert with
certutil. But I'm not sure if it is worth the effort.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org