From c19196a0d3fc0a38c4c83cb8a7fde56e6bc310af Mon Sep 17 00:00:00 2001 From: Petr Vobornik Date: May 02 2017 11:42:52 +0000 Subject: kerberos session: use CA cert with full cert chain for obtaining cookie Http request performed in finalize_kerberos_acquisition doesn't use CA certificate/certificate store with full certificate chain of IPA server. So it might happen that in case that IPA is installed with externally signed CA certificate, the call can fail because of certificate validation and e.g. prevent session acquisition. If it will fail for sure is not known - the use case was not discovered, but it is faster and safer to fix preemptively. https://pagure.io/freeipa/issue/6876 Reviewed-By: Martin Basti --- diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py index 1618724..996a3d2 100644 --- a/ipaserver/rpcserver.py +++ b/ipaserver/rpcserver.py @@ -602,7 +602,8 @@ class KerberosSession(HTTP_Status): try: target = self.api.env.host r = requests.get('http://{0}/ipa/session/cookie'.format(target), - auth=NegotiateAuth(target, ccache_name)) + auth=NegotiateAuth(target, ccache_name), + verify=paths.IPA_CA_CRT) session_cookie = r.cookies.get("ipa_session") if not session_cookie: raise ValueError('No session cookie found')