Issue #6937: Provide an API command to retrieve PKINIT status in the FreeIPA topology - freeipa

freeipa

#6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology

Closed: fixed 7 years ago Opened 7 years ago by mbabinsk.

In mixed FreeIPA topologies (pre 4.5 and 4.5 masters) it may be useful to have a tool reporting masters which have PKINIT enabled. This could greatly simplify troubleshooting in cases when some of the clients attempt to request TGT via PKINIT and fail (maybe due to resolving a old KDC that does not understand PKINIT yet).

Since PKINIT is an attribute of KDC shared by multiple masters, we may reuse the Server-Roles API (after slight modifications) to report PKINIT status based on pkinitEnabled value set on KDC entry's ipaConfigString. This can be reported in ipaconfig and we can also provide a dedicated ipa pkinit-status command to retrieve this info.

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue set to the milestone: FreeIPA 4.5.1

7 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523

7 years ago

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1449523

7 years ago

pvoborni commented 7 years ago

Issue linked to bug 1449523

Metadata Update from @pvoborni:
- Issue assigned to mbabinsk

7 years ago

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.2 (was: FreeIPA 4.5.1)

7 years ago

mbasti commented 7 years ago

FreeIPA 4.5.2

mbabinsk commented 7 years ago

ipa-4-5:

c4aa3a1 Allow for multivalued server attributes
753f8cf Refactor the role/attribute member reporting code
fbccb74 Add an attribute reporting client PKINIT-capable servers
733cef9 Add the list of PKINIT servers as a virtual attribute to global config
6b815aa Add pkinit-status command
4fa29a3 test_serverroles: Get rid of MockLDAP and use ldap2 instead

master:

bddb90f Allow for multivalued server attributes
cac7e49 Refactor the role/attribute member reporting code
d8bb23a Add an attribute reporting client PKINIT-capable servers
f805532 Add the list of PKINIT servers as a virtual attribute to global config
9935273 Add pkinit-status command
58fd229 test_serverroles: Get rid of MockLDAP and use ldap2 instead

Metadata Update from @mbabinsk:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

7 years ago

Metadata

Assignee

mbabinsk

Tags

None

Blocking

None

Depending on

None

Priority

critical

Milestone

FreeIPA 4.5.2

None

affects_doc

None

source

None

knownissue

None

type

None

blockedby

None

test_case

None

component

None

blocking

None

on_review

None

keywords

None

test_coverage

None

reviewer

None

external_tracker

None

tester

None

changelog

None

design

None

rhbz

https://bugzilla.redhat.com/show_bug.cgi?id=1449523

freeipa

Source Code

#6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology Closed: fixed 7 years ago Opened 7 years ago by mbabinsk.

Metadata

#6937 Provide an API command to retrieve PKINIT status in the FreeIPA topology

Closed: fixed 7 years ago Opened 7 years ago by mbabinsk.