freeipa

Clone
Source Code
GIT

#5191 cert-request rejects request with correct krb5PrincipalName SAN
Closed: Fixed None Opened 8 years ago by ftweedal.

Closed: Fixed
Reopen Issue

cert-request checks krb5PrincipalName SAN OtherName for match
against the target principal to whom the certificate is being
issued, however, it fails when it should not.

For example, for principal alice in domain IPA.LOCAL, if the
principal is specified on the command line as `alice', the
command fails with message:

ftweedal% ipa cert-request alice-k5pn.req --principal alice
ipa: ERROR: Insufficient access: Principal 'alice@IPA.LOCAL' in subject alt name does not match requested principal

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1252517

master:

  • ba7e5df Fix KRB5PrincipalName / UPN SAN comparison

ipa-4-2:

  • 58cf1cd Fix KRB5PrincipalName / UPN SAN comparison

Metadata Update from @ftweedal:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.2.1
7 years ago

Login to comment on this ticket.

Metadata
None
None
None
normal
None
None
None
None
defect
None
None
Certificate management
None
1
None
None
mbabinsk
None
https://bugzilla.redhat.com/show_bug.cgi?id=1252517
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.