URL: https://github.com/SSSD/sssd/pull/5376 Author: peptekmail Title: #5376: Update cert.c Action: opened
PR body: """ Sometimes generating a sshkey from a certificate fails. Looking at other implementations gives a hint about 0x80 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5376/head:pr5376 git checkout pr5376
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
sumit-bose commented: """ Hi,
can you give a bit more details about the purpose of this pull request? Currently the `0` is added unconditionally, do you have a case where this does not work as expected?
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192
I will come back with an example certificate that fails. This seems to be more complicated than I first anticipated. The same certificate is working on older code based on the mozilla-nss libray. You could reject the patch.
Den ons 28 okt. 2020 10:24sumit-bose < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
sumit-bose commented: """ Hi,
can you give a bit more details about the purpose of this pull request? Currently the `0` is added unconditionally, do you have a case where this does not work as expected?
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
On Wed, Oct 28, 2020 at 07:44:31PM +0100, Per-Erik Persson wrote:
I will come back with an example certificate that fails. This seems to be more complicated than I first anticipated. The same certificate is working on older code based on the mozilla-nss libray. You could reject the patch.
Hi,
thanks for the explanation. We can use https://github.com/SSSD/sssd/pull/5376 for further communication for the time being.
It would be very helpful if you can share a certificate where the conversion does not produce the same key as sshd would expect. Adding it to the unit test would help to avoid similar issues in future.
bye, Sumit
Den ons 28 okt. 2020 10:24sumit-bose < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
sumit-bose commented: """ Hi,
can you give a bit more details about the purpose of this pull request? Currently the `0` is added unconditionally, do you have a case where this does not work as expected?
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
Hello
I can't find any unittests that actually download a certificate from LDAP via the userCertificate attribute, extract the public key and convert it to a ssh-rsa key. The ssh-test only tests for public keys already in ssh format.
Are there any other ways than LDAP to "publish" a certificate to be used for ssh public key extraction?
If I missed the obvious, please point me in the right direction otherwise I will start by writing the test.
Den tors 29 okt. 2020 07:03Sumit Bose sbose@redhat.com skrev:
On Wed, Oct 28, 2020 at 07:44:31PM +0100, Per-Erik Persson wrote:
I will come back with an example certificate that fails. This seems to be more complicated than I first anticipated. The same certificate is working on older code based on the mozilla-nss libray. You could reject the patch.
Hi,
thanks for the explanation. We can use https://github.com/SSSD/sssd/pull/5376 for further communication for the time being.
It would be very helpful if you can share a certificate where the conversion does not produce the same key as sshd would expect. Adding it to the unit test would help to avoid similar issues in future.
bye, Sumit
Den ons 28 okt. 2020 10:24sumit-bose < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
sumit-bose commented: """ Hi,
can you give a bit more details about the purpose of this pull request? Currently the `0` is added unconditionally, do you have a case where
this
does not work as expected?
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o... _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
On Sun, Nov 01, 2020 at 09:38:57PM +0100, Per-Erik Persson wrote:
Hello
I can't find any unittests that actually download a certificate from LDAP via the userCertificate attribute, extract the public key and convert it to a ssh-rsa key. The ssh-test only tests for public keys already in ssh format.
Are there any other ways than LDAP to "publish" a certificate to be used for ssh public key extraction?
If I missed the obvious, please point me in the right direction otherwise I will start by writing the test.
Hi,
you can find tests which extract ssh keys from certificates e.g. in test_ssh_user_pubkey_cert(), test_ssh_user_pubkey_cert_with_rule() and the following tests in src/tests/cmocka/test_ssh_srv.c.
HTH
bye, Sumit
Den tors 29 okt. 2020 07:03Sumit Bose sbose@redhat.com skrev:
On Wed, Oct 28, 2020 at 07:44:31PM +0100, Per-Erik Persson wrote:
I will come back with an example certificate that fails. This seems to be more complicated than I first anticipated. The same certificate is working on older code based on the mozilla-nss libray. You could reject the patch.
Hi,
thanks for the explanation. We can use https://github.com/SSSD/sssd/pull/5376 for further communication for the time being.
It would be very helpful if you can share a certificate where the conversion does not produce the same key as sshd would expect. Adding it to the unit test would help to avoid similar issues in future.
bye, Sumit
Den ons 28 okt. 2020 10:24sumit-bose < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
sumit-bose commented: """ Hi,
can you give a bit more details about the purpose of this pull request? Currently the `0` is added unconditionally, do you have a case where
this
does not work as expected?
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-717807192 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o... _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
alexey-tikhonov commented: """ Hi @peptekmail,
what's your plan with this PR? Is it related to #5463? """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-764945346
It is related. But could be closed, should I close it? The problem seems to be much more complicated than I anticipated. My mistake to start a second PR.
Den tors 21 jan. 2021 22:13alexey-tikhonov < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
alexey-tikhonov commented: """ Hi @peptekmail,
what's your plan with this PR? Is it related to #5463? """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-764945346 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
Hi,
On Thu, Jan 21, 2021 at 10:25 PM Per-Erik Persson peptekmail@gmail.com wrote:
It is related. But could be closed, should I close it?
If you don't plan working on this PR then please close it.
The problem seems to be much more complicated than I anticipated. My mistake to start a second PR.
Den tors 21 jan. 2021 22:13alexey-tikhonov < sssd-github-notification@fedorahosted.org> skrev:
URL: https://github.com/SSSD/sssd/pull/5376 Title: #5376: Update cert.c
alexey-tikhonov commented: """ Hi @peptekmail,
what's your plan with this PR? Is it related to #5463? """
See the full comment at https://github.com/SSSD/sssd/pull/5376#issuecomment-764945346 _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o...
sssd-devel@lists.fedorahosted.org